CVE,CVSS Score,CVSS_Vector,EPSS,CWE,Description,Published,Source,CPE,Vendor,Affected Products
CVE-1999-0016,0.0,,0.95739,NVD-CWE-Other,Land IP denial of service.,1997-12-01,EPSS,cpe:2.3:a:gnu:inet:5.01:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:winsock:2.0:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:7000:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:10.00:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:10.01:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:10.10:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:10.16:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:10.20:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:10.24:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:10.30:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:11.00:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:9.00:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:9.01:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:9.03:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:9.04:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:9.05:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:9.07:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_95:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:1.0:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:1.1:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:4.1.3u1:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:4.1.4:*:*:*:*:*:*:*,Cisco,Ios
CVE-1999-0103,0.0,,0.1463,NVD-CWE-Other,"Echo and chargen, or other combinations of UDP services, can be used in tandem to flood the server, a.k.a. UDP bomb or UDP packet storm.",1996-02-08,Metasploit,,,
CVE-1999-0170,0.0,,0.18745,NVD-CWE-Other,"Remote attackers can mount an NFS file system in Ultrix or OSF, even if it is denied on the access list.",1997-01-01,Metasploit,cpe:2.3:o:digital:ultrix:*:*:*:*:*:*:*:*,Digital,Ultrix
CVE-1999-0209,0.0,,0.4853,NVD-CWE-Other,The SunView (SunTools) selection_svc facility allows remote users to read files.,1990-08-14,Metasploit,cpe:2.3:o:sun:sunos:3.5:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:4.0.1:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:4.0.2:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:4.0.3:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:4.0:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:4.1.1:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:4.1:*:*:*:*:*:*:*,Sun,Sunos
CVE-1999-0256,0.0,,0.7242,NVD-CWE-Other,Buffer overflow in War FTP allows remote execution of commands.,1998-02-01,Metasploit,cpe:2.3:a:jgaa:warftpd:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_95:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:*:*:*:*:*:*:*:*,Microsoft,Windows 95
CVE-1999-0497,0.0,,0.07085,NVD-CWE-Other,Anonymous FTP is enabled.,1999-01-01,Metasploit,,,
CVE-1999-0502,0.0,,0.53618,NVD-CWE-Other,"A Unix account has a default, null, blank, or missing password.",1998-03-01,Metasploit,cpe:2.3:o:hp:hp-ux:10.20:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:11:*:*:*:*:*:*:*;cpe:2.3:o:redhat:linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:sun:solaris:2.6:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.5.1:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.7:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.8:*:*:*:*:*:*:*,Hp,Hp-Ux
CVE-1999-0504,0.0,,0.63703,NVD-CWE-Other,"A Windows NT local user or administrator account has a default, null, blank, or missing password.",1997-01-01,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:*:*:*:*:*:*:*:*,Microsoft,Windows 2000
CVE-1999-0506,0.0,,0.17166,NVD-CWE-Other,"A Windows NT domain user or administrator account has a default, null, blank, or missing password.",1998-10-01,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:*:*:*:*:*:*:*:*,Microsoft,Windows 2000
CVE-1999-0508,0.0,,0.0356,NVD-CWE-Other,"An account on a router, firewall, or other network device has a default, null, blank, or missing password.",1998-06-01,Metasploit,,,
CVE-1999-0512,0.0,,0.12035,NVD-CWE-Other,"A mail server is explicitly configured to allow SMTP mail relay, which allows abuse by spammers.",1999-01-01,Metasploit,,,
CVE-1999-0516,0.0,,0.10463,NVD-CWE-Other,An SNMP community name is guessable.,1998-08-01,Metasploit,,,
CVE-1999-0517,5.9,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.27166,NVD-CWE-Other,"An SNMP community name is the default (e.g. public), null, or missing.",1997-01-01,Metasploit,cpe:2.3:o:hp:hp-ux:10:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:11.00:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.0:*:*:*:*:*:*:*,Hp,Hp-Ux
CVE-1999-0526,0.0,,0.20978,NVD-CWE-Other,"An X server's access control is disabled (e.g. through an ""xhost +"" command) and allows anyone to connect to the server.",1997-07-01,Metasploit,cpe:2.3:a:x.org:x11:7.1_1.1.0:*:*:*:*:*:*:*,X.Org,X11
CVE-1999-0532,0.0,,0.68535,NVD-CWE-Other,A DNS server allows zone transfers.,1997-07-01,Metasploit,,,
CVE-1999-0554,0.0,,0.11134,NVD-CWE-Other,"NFS exports system-critical data to the world, e.g. / or a password file.",1999-01-01,Metasploit,,,
CVE-1999-0651,0.0,,0.11902,NVD-CWE-Other,The rsh/rlogin service is running.,1999-01-01,Metasploit,,,
CVE-1999-0667,0.0,,0.14703,NVD-CWE-Other,The ARP protocol allows any host to spoof ARP replies and poison the ARP cache to conduct IP address spoofing or a denial of service.,1997-09-19,Metasploit,cpe:2.3:h:arp_protocol:arp_protocol:*:*:*:*:*:*:*:*,Arp Protocol,Arp Protocol
CVE-1999-0874,0.0,,0.74651,CWE-119,"Buffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR, .IDC, or .STM extensions.",1999-06-16,Metasploit,cpe:2.3:a:microsoft:internet_information_server:4.0:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:*:*:*:*:*:*:*,Microsoft,Windows 2000
CVE-1999-0920,0.0,,0.32367,NVD-CWE-Other,Buffer overflow in the pop-2d POP daemon in the IMAP package allows remote attackers to gain privileges via the FOLD command.,1999-05-26,Metasploit,cpe:2.3:a:university_of_washington:imap:4.4:*:*:*:*:*:*:*;cpe:2.3:a:university_of_washington:pop2d:*:*:*:*:*:*:*:*,University Of Washington,Imap
CVE-1999-1011,0.0,,0.7714,CWE-264,"The Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC) in IIS 3.x and 4.x exposes unsafe methods, which allows remote attackers to execute arbitrary commands.",1999-07-19,Metasploit,cpe:2.3:a:microsoft:data_access_components:1.5:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:data_access_components:2.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:data_access_components:2.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:index_server:2.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_information_server:3.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_information_server:4.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:site_server:3.0:*:*:*:*:*:*:*,Microsoft,Data Access Components
CVE-1999-1053,0.0,,0.85205,NVD-CWE-Other,"guestbook.pl cleanses user-inserted SSI commands by removing text between ""<!--"" and ""-->"" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides ""-->"".",1999-09-13,Metasploit,cpe:2.3:a:apache:http_server:1.3.9:*:*:*:*:*:*:*;cpe:2.3:a:matt_wright:matt_wright_guestbook:2.3:*:*:*:*:*:*:*,Apache,Http Server
CVE-1999-1510,0.0,,0.67091,NVD-CWE-Other,"Buffer overflows in Bisonware FTP server prior to 4.1 allow remote attackers to cause a denial of service, and possibly execute arbitrary commands, via long (1) USER, (2) LIST, or (3) CWD commands.",1999-05-17,Metasploit,cpe:2.3:a:bisonware:bisonware_ftp_server:*:*:*:*:*:*:*:*,Bisonware,Bisonware Ftp Server
CVE-2000-0114,0.0,,0.47595,NVD-CWE-Other,Frontpage Server Extensions allows remote attackers to determine the name of the anonymous account via an RPC POST request to shtml.dll in the /_vti_bin/ virtual directory.,2000-02-02,Nuclei,cpe:2.3:a:microsoft:internet_information_server:3.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_information_server:4.0:*:*:*:*:*:*:*,Microsoft,Internet Information Server
CVE-2000-0248,0.0,,0.73662,NVD-CWE-Other,The web GUI for the Linux Virtual Server (LVS) software in the Red Hat Linux Piranha package has a backdoor password that allows remote attackers to execute arbitrary commands.,2000-04-24,Metasploit,cpe:2.3:o:redhat:linux:6.2:*:alpha:*:*:*:*:*;cpe:2.3:o:redhat:linux:6.2:*:i386:*:*:*:*:*;cpe:2.3:o:redhat:linux:6.2:*:sparc:*:*:*:*:*,Redhat,Linux
CVE-2000-0284,0.0,,0.69476,NVD-CWE-Other,Buffer overflow in University of Washington imapd version 4.7 allows users with a valid account to execute commands via LIST or other commands.,2000-04-16,Metasploit,cpe:2.3:a:university_of_washington:imap:12.264:*:*:*:*:*:*:*,University Of Washington,Imap
CVE-2000-0322,0.0,,0.41632,NVD-CWE-Other,The passwd.php3 CGI script in the Red Hat Piranha Virtual Server Package allows local users to execute arbitrary commands via shell metacharacters.,2000-04-24,Metasploit,cpe:2.3:o:redhat:linux:6.2:*:alpha:*:*:*:*:*;cpe:2.3:o:redhat:linux:6.2:*:i386:*:*:*:*:*;cpe:2.3:o:redhat:linux:6.2:*:sparc:*:*:*:*:*,Redhat,Linux
CVE-2000-0380,0.0,,0.35005,CWE-20,The IOS HTTP service in Cisco routers and switches running IOS 11.1 through 12.1 allows remote attackers to cause a denial of service by requesting a URL that contains a %% string.,2000-04-26,Metasploit,cpe:2.3:o:cisco:ios:11.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:11.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:11.2\(10\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:11.2\(10\)bc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:11.2\(17\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:11.2\(4\)f1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:11.2\(8\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:11.2\(8\)p:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:11.2\(9\)p:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:11.2\(9\)xa:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:11.2p:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:11.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:11.3\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:11.3\(1\)ed:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:11.3\(1\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:11.3t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0\(1\)w:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0\(1\)xa3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0\(1\)xb:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0\(1\)xe:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0\(2\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0\(2\)xc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0\(2\)xd:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0\(2\)xf:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0\(2\)xg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0\(3\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0\(4\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0\(4\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0\(4\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0\(5\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0\(5\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0\(6\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0\(7\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0\(8\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0\(9\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0db:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0t:*:*:*:*:*:*:*,Cisco,Ios
CVE-2000-0402,0.0,,0.90609,NVD-CWE-Other,"The Mixed Mode authentication capability in Microsoft SQL Server 7.0 stores the System Administrator (sa) account in plaintext in a log file which is readable by any user, aka the ""SQL Server 7.0 Service Pack Password"" vulnerability.",2000-05-30,Metasploit,cpe:2.3:a:microsoft:sql_server:7.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server:7.0:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server:7.0:sp2:*:*:*:*:*:*,Microsoft,Sql Server
CVE-2000-0573,0.0,,0.96292,NVD-CWE-Other,"The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format string, which allows remote attackers to execute arbitrary commands via the SITE EXEC command.",2000-07-07,EPSS/Metasploit,cpe:2.3:o:hp:hp-ux:11.00:*:*:*:*:*:*:*,Hp,Hp-Ux
CVE-2000-0649,0.0,,0.76558,CWE-200,IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined.,2000-07-13,Metasploit,cpe:2.3:a:microsoft:internet_information_server:3.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_information_server:4.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_information_services:2.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_information_services:5.0:*:*:*:*:*:*:*,Microsoft,Internet Information Server
CVE-2000-0665,0.0,,0.50337,NVD-CWE-Other,GAMSoft TelSrv telnet server 1.5 and earlier allows remote attackers to cause a denial of service via a long username.,2000-07-17,Metasploit,cpe:2.3:a:gamsoft:telsrv:1.4:*:*:*:*:*:*:*;cpe:2.3:a:gamsoft:telsrv:1.5:*:*:*:*:*:*:*,Gamsoft,Telsrv
CVE-2000-0760,0.0,,0.62496,NVD-CWE-Other,The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.,2000-10-20,Nuclei,cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:3.1:*:*:*:*:*:*:*,Apache,Tomcat
CVE-2000-0917,0.0,,0.78658,NVD-CWE-Other,Format string vulnerability in use_syslog() function in LPRng 3.6.24 allows remote attackers to execute arbitrary commands.,2000-12-19,Metasploit,cpe:2.3:a:caldera:openlinux_ebuilder:3.0:*:*:*:*:*:*:*;cpe:2.3:o:caldera:openlinux:*:*:*:*:*:*:*:*;cpe:2.3:o:caldera:openlinux_edesktop:2.4:*:*:*:*:*:*:*;cpe:2.3:o:caldera:openlinux_eserver:2.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:trustix:secure_linux:1.0:*:*:*:*:*:*:*;cpe:2.3:o:trustix:secure_linux:1.1:*:*:*:*:*:*:*,Caldera,Openlinux
CVE-2000-0945,0.0,,0.72575,NVD-CWE-Other,"The web configuration interface for Catalyst 3500 XL switches allows remote attackers to execute arbitrary commands without authentication when the enable password is not set, via a URL containing the /exec/ directory.",2000-12-19,Metasploit,cpe:2.3:h:cisco:catalyst_3500_xl:*:*:*:*:*:*:*:*,Cisco,Catalyst 3500 Xl
CVE-2000-1089,0.0,,0.74639,NVD-CWE-Other,"Buffer overflow in Microsoft Phone Book Service allows local users to execute arbitrary commands, aka the ""Phone Book Service Buffer Overflow"" vulnerability.",2001-01-09,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:*:*:*:*:*:*:*,Microsoft,Windows 2000
CVE-2000-1209,0.0,,0.87307,NVD-CWE-Other,"The ""sa"" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE) 1.0, including third party packages that use these products such as (4) Tumbleweed Secure Mail (MMS) (5) Compaq Insight Manager, and (6) Visio 2000, which allows remote attackers to gain privileges, as exploited by worms such as Voyager Alpha Force and Spida.",2002-08-12,Metasploit,cpe:2.3:a:compaq:insight_manager:7.0:*:*:*:*:*:*:*;cpe:2.3:a:compaq:insight_manager:7.0:sp1:*:*:*:*:*:*;cpe:2.3:a:compaq:insight_manager_xe:1.1:*:*:*:*:*:*:*;cpe:2.3:a:compaq:insight_manager_xe:1.21:*:*:*:*:*:*:*;cpe:2.3:a:compaq:insight_manager_xe:2.1:*:*:*:*:*:*:*;cpe:2.3:a:compaq:insight_manager_xe:2.1b:*:*:*:*:*:*:*;cpe:2.3:a:compaq:insight_manager_xe:2.1c:*:*:*:*:*:*:*;cpe:2.3:a:compaq:insight_manager_xe:2.2:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:data_engine:1.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:msde:2000:*:*:*:*:*:*:*,Compaq,Insight Manager
CVE-2001-0152,0.0,,0.08862,NVD-CWE-Other,"The password protection option for the Compressed Folders feature in Plus! for Windows 98 and Windows Me writes password information to a file, which allows local users to recover the passwords and read the compressed folders.",2001-05-03,Metasploit,cpe:2.3:a:microsoft:plus:*:*:*:*:*:*:*:*,Microsoft,Plus
CVE-2001-0167,0.0,,0.50813,NVD-CWE-Other,Buffer overflow in AT&T WinVNC (Virtual Network Computing) client 3.3.3r7 and earlier allows remote attackers to execute arbitrary commands via a long rfbConnFailed packet with a long reason string.,2001-05-03,Metasploit,cpe:2.3:a:att:winvnc:*:*:*:*:*:*:*:*,Att,Winvnc
CVE-2001-0168,0.0,,0.7073,NVD-CWE-Other,Buffer overflow in AT&T WinVNC (Virtual Network Computing) server 3.3.3r7 and earlier allows remote attackers to execute arbitrary commands via a long HTTP GET request when the DebugLevel registry key is greater than 0.,2001-05-03,Metasploit,cpe:2.3:a:att:winvnc:*:*:*:*:*:*:*:*,Att,Winvnc
CVE-2001-0241,0.0,,0.85698,NVD-CWE-Other,Buffer overflow in Internet Printing ISAPI extension in Windows 2000 allows remote attackers to gain root privileges via a long print request that is passed to the extension through IIS 5.0.,2001-06-27,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*,Microsoft,Windows 2000
CVE-2001-0311,0.0,,0.11643,NVD-CWE-Other,Vulnerability in OmniBackII A.03.50 in HP 11.x and earlier allows attackers to gain unauthorized access to an OmniBack client.,2001-06-02,Metasploit,cpe:2.3:a:hp:omniback_ii:a.03.50:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:*:*:*:*:*:*:*:*,Hp,Hp-Ux
CVE-2001-0333,0.0,,0.9077,NVD-CWE-Other,"Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and ""\"" characters twice.",2001-06-27,Metasploit,cpe:2.3:a:microsoft:internet_information_server:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_information_server:4.0:*:*:*:*:*:*:*,Microsoft,Internet Information Server
CVE-2001-0414,0.0,,0.91679,NVD-CWE-Other,Buffer overflow in ntpd ntp daemon 4.0.99k and earlier (aka xntpd and xntp3) allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long readvar argument.,2001-06-18,Metasploit,cpe:2.3:a:dave_mills:ntpd:*:*:*:*:*:*:*:*;cpe:2.3:a:dave_mills:ntpd:4.0.99:*:*:*:*:*:*:*;cpe:2.3:a:dave_mills:ntpd:4.0.99a:*:*:*:*:*:*:*;cpe:2.3:a:dave_mills:ntpd:4.0.99b:*:*:*:*:*:*:*;cpe:2.3:a:dave_mills:ntpd:4.0.99c:*:*:*:*:*:*:*;cpe:2.3:a:dave_mills:ntpd:4.0.99d:*:*:*:*:*:*:*;cpe:2.3:a:dave_mills:ntpd:4.0.99e:*:*:*:*:*:*:*;cpe:2.3:a:dave_mills:ntpd:4.0.99f:*:*:*:*:*:*:*;cpe:2.3:a:dave_mills:ntpd:4.0.99g:*:*:*:*:*:*:*;cpe:2.3:a:dave_mills:ntpd:4.0.99h:*:*:*:*:*:*:*;cpe:2.3:a:dave_mills:ntpd:4.0.99i:*:*:*:*:*:*:*;cpe:2.3:a:dave_mills:ntpd:4.0.99j:*:*:*:*:*:*:*;cpe:2.3:a:dave_mills:xntp3:5.93:*:*:*:*:*:*:*;cpe:2.3:a:dave_mills:xntp3:5.93a:*:*:*:*:*:*:*;cpe:2.3:a:dave_mills:xntp3:5.93b:*:*:*:*:*:*:*;cpe:2.3:a:dave_mills:xntp3:5.93c:*:*:*:*:*:*:*;cpe:2.3:a:dave_mills:xntp3:5.93d:*:*:*:*:*:*:*;cpe:2.3:a:dave_mills:xntp3:5.93e:*:*:*:*:*:*:*,Dave Mills,Ntpd
CVE-2001-0499,0.0,,0.85201,NVD-CWE-Other,"Buffer overflow in Transparent Network Substrate (TNS) Listener in Oracle 8i 8.1.7 and earlier allows remote attackers to gain privileges via a long argument to the commands (1) STATUS, (2) PING, (3) SERVICES, (4) TRC_FILE, (5) SAVE_CONFIG, or (6) RELOAD.",2001-07-21,Metasploit,cpe:2.3:a:oracle:oracle8i:*:*:*:*:*:*:*:*,Oracle,Oracle8I
CVE-2001-0500,0.0,,0.96731,NVD-CWE-Other,"Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files such as default.ida, as commonly exploited by Code Red.",2001-07-21,EPSS/Metasploit,cpe:2.3:a:microsoft:index_server:2.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:indexing_service:*:*:windows_2000:*:*:*:*:*;cpe:2.3:a:microsoft:internet_information_server:*:beta:*:*:*:*:*:*,Microsoft,Index Server
CVE-2001-0537,0.0,,0.6845,CWE-287,"HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL.",2001-07-21,Metasploit/Nuclei,cpe:2.3:o:cisco:ios:11.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:11.3aa:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:11.3da:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:11.3db:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:11.3ha:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:11.3ma:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:11.3na:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:11.3t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:11.3xa:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0\(10\)w5\(18g\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0\(14\)w5\(20\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0\(5\)xk:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0\(7\)xk:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0da:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0db:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0dc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0sc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0sl:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0st:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0wc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0wt:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0xa:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0xb:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0xc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0xd:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0xe:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0xf:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0xg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0xh:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0xi:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0xj:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0xl:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0xm:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0xn:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0xp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0xq:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0xr:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0xs:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0xu:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0xv:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1aa:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1cx:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1da:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1db:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1dc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1ec:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1ex:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1ey:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1ez:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1xa:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1xb:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1xc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1xd:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1xe:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1xf:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1xg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1xh:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1xi:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1xj:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1xk:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1xl:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1xm:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1xp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1xq:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1xr:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1xs:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1xt:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1xu:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1xv:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1xw:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1xx:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1xy:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1xz:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1ya:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1yb:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1yc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1yd:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1yf:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2xa:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2xd:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2xe:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2xh:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2xq:*:*:*:*:*:*:*,Cisco,Ios
CVE-2001-0797,0.0,,0.88836,NVD-CWE-Other,Buffer overflow in login in various System V based operating systems allows remote attackers to execute arbitrary commands via a large number of arguments through services such as telnet and rlogin.,2001-12-12,Metasploit,cpe:2.3:o:hp:hp-ux:10.00:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:10.01:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:10.10:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:10.20:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:10.24:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:11.0.4:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:11.00:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:11.11:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:4.3.1:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:4.3.2:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:4.3.3:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:4.3:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.1:*:*:*:*:*:*:*;cpe:2.3:o:sco:openserver:5.0.1:*:*:*:*:*:*:*;cpe:2.3:o:sco:openserver:5.0.2:*:*:*:*:*:*:*;cpe:2.3:o:sco:openserver:5.0.3:*:*:*:*:*:*:*;cpe:2.3:o:sco:openserver:5.0.4:*:*:*:*:*:*:*;cpe:2.3:o:sco:openserver:5.0.5:*:*:*:*:*:*:*;cpe:2.3:o:sco:openserver:5.0.6:*:*:*:*:*:*:*;cpe:2.3:o:sco:openserver:5.0.6a:*:*:*:*:*:*:*;cpe:2.3:o:sco:openserver:5.0:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:3.2:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:3.3.1:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:3.3.2:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:3.3.3:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:3.3:*:*:*:*:*:*:*;cpe:2.3:o:sun:solaris:2.4:*:x86:*:*:*:*:*;cpe:2.3:o:sun:solaris:2.5.1:*:ppc:*:*:*:*:*;cpe:2.3:o:sun:solaris:2.5.1:*:x86:*:*:*:*:*;cpe:2.3:o:sun:solaris:2.5:*:x86:*:*:*:*:*;cpe:2.3:o:sun:solaris:2.6:*:*:*:*:*:*:*;cpe:2.3:o:sun:solaris:7.0:*:x86:*:*:*:*:*;cpe:2.3:o:sun:solaris:8.0:*:x86:*:*:*:*:*;cpe:2.3:o:sun:sunos:-:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.0:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.1:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.2:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.3:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.4:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.5.1:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.5:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.7:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.8:*:*:*:*:*:*:*,Sgi,Irix
CVE-2001-0800,0.0,,0.54115,NVD-CWE-Other,lpsched in IRIX 6.5.13f and earlier allows remote attackers to execute arbitrary commands via shell metacharacters.,2001-12-06,Metasploit,cpe:2.3:o:sgi:irix:*:*:*:*:*:*:*:*,Sgi,Irix
CVE-2001-0803,0.0,,0.85564,CWE-119,Buffer overflow in the client connection routine of libDtSvc.so.1 in CDE Subprocess Control Service (dtspcd) allows remote attackers to execute arbitrary commands.,2001-12-06,Metasploit,cpe:2.3:a:open_group:cde_common_desktop_environment:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:open_group:cde_common_desktop_environment:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:open_group:cde_common_desktop_environment:1.1:*:*:*:*:*:*:*;cpe:2.3:a:open_group:cde_common_desktop_environment:1.2:*:*:*:*:*:*:*;cpe:2.3:a:open_group:cde_common_desktop_environment:2.0:*:*:*:*:*:*:*;cpe:2.3:a:open_group:cde_common_desktop_environment:2.1:*:*:*:*:*:*:*,Open Group,Cde Common Desktop Environment
CVE-2001-1013,0.0,,0.65563,NVD-CWE-Other,"Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a username exists and there is no public_html directory and when the username does not exist, which could allow remote attackers to determine valid usernames on the server.",2001-09-12,Metasploit,cpe:2.3:o:redhat:linux:7.0:*:*:*:*:*:*:*,Redhat,Linux
CVE-2001-1320,0.0,,0.68324,NVD-CWE-Other,"Network Associates PGP Keyserver 7.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via exceptional BER encodings (possibly buffer overflows), as demonstrated by the PROTOS LDAPv3 test suite.",2001-07-16,Metasploit,cpe:2.3:a:pgp:keyserver:7.0:*:*:*:*:*:*:*,Pgp,Keyserver
CVE-2001-1473,0.0,,0.06268,CWE-310,"The SSH-1 protocol allows remote servers to conduct man-in-the-middle attacks and replay a client challenge response to a target server by creating a Session ID that matches the Session ID of the target, but which uses a public key pair that is weaker than the target's public key, which allows the attacker to compute the corresponding private key and use the target's Session ID with the compromised key pair to masquerade as the target.",2001-01-18,Nuclei,cpe:2.3:a:ssh:ssh:1.2.24:*:*:*:*:*:*:*;cpe:2.3:a:ssh:ssh:1.2.25:*:*:*:*:*:*:*;cpe:2.3:a:ssh:ssh:1.2.26:*:*:*:*:*:*:*;cpe:2.3:a:ssh:ssh:1.2.27:*:*:*:*:*:*:*;cpe:2.3:a:ssh:ssh:1.2.28:*:*:*:*:*:*:*;cpe:2.3:a:ssh:ssh:1.2.29:*:*:*:*:*:*:*;cpe:2.3:a:ssh:ssh:1.2.30:*:*:*:*:*:*:*;cpe:2.3:a:ssh:ssh:1.2.31:*:*:*:*:*:*:*,Ssh,Ssh
CVE-2001-1583,0.0,,0.834,CWE-78,lpd daemon (in.lpd) in Solaris 8 and earlier allows remote attackers to execute arbitrary commands via a job request with a crafted control file that is not properly handled when lpd invokes a mail program. NOTE: this might be the same vulnerability as CVE-2000-1220.,2001-12-31,Metasploit,cpe:2.3:o:sun:sunos:*:*:*:*:*:*:*:*,Sun,Sunos
CVE-2002-0367,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.04879,CWE-269,"smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit.",2002-06-25,CISA,cpe:2.3:o:microsoft:windows_2000:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:-:*:*:terminal_server:*:*:*,Microsoft,Windows 2000
CVE-2002-0392,0.0,,0.95027,NVD-CWE-noinfo,"Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.",2002-07-03,EPSS/Metasploit,cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:2.2:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2002-0422,0.0,,0.42253,CWE-200,"IIS 5 and 5.1 supporting WebDAV methods allows remote attackers to determine the internal IP address of the system (which may be obscured by NAT) via (1) a PROPFIND HTTP request with a blank Host header, which leaks the address in an HREF property in a 207 Multi-Status response, or (2) via the WRITE or MKCOL method, which leaks the IP in the Location server header.",2002-08-12,Metasploit,cpe:2.3:a:microsoft:internet_information_services:5.0:*:*:*:*:*:*:*,Microsoft,Internet Information Services
CVE-2002-0649,0.0,,0.8475,CWE-119,"Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434 in which (1) a 0x04 byte that causes the SQL Monitor thread to generate a long registry key name, or (2) a 0x08 byte with a long string causes heap corruption, as exploited by the Slammer/Sapphire worm.",2002-08-12,Metasploit,cpe:2.3:a:microsoft:data_engine:2000:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server:2000:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server:2000:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server:2000:sp2:*:*:*:*:*:*,Microsoft,Data Engine
CVE-2002-0965,0.0,,0.6981,NVD-CWE-Other,"Buffer overflow in TNS Listener for Oracle 9i Database Server on Windows systems, and Oracle 8 on VM, allows local users to execute arbitrary code via a long SERVICE_NAME parameter, which is not properly handled when writing an error message to a log file.",2002-10-04,Metasploit,cpe:2.3:a:oracle:oracle9i:9.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle9i:9.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle9i:9.0:*:*:*:*:*:*:*,Oracle,Oracle9I
CVE-2002-1059,0.0,,0.60305,NVD-CWE-Other,"Buffer overflow in Van Dyke SecureCRT SSH client before 3.4.6, and 4.x before 4.0 beta 3, allows an SSH server to execute arbitrary code via a long SSH1 protocol version string.",2002-10-04,Metasploit,cpe:2.3:a:van_dyke_technologies:securecrt:2.4:*:*:*:*:*:*:*;cpe:2.3:a:van_dyke_technologies:securecrt:3.0:*:*:*:*:*:*:*;cpe:2.3:a:van_dyke_technologies:securecrt:3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:van_dyke_technologies:securecrt:3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:van_dyke_technologies:securecrt:3.1:*:*:*:*:*:*:*;cpe:2.3:a:van_dyke_technologies:securecrt:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:van_dyke_technologies:securecrt:3.2:*:*:*:*:*:*:*;cpe:2.3:a:van_dyke_technologies:securecrt:3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:van_dyke_technologies:securecrt:3.3.2:*:*:*:*:*:*:*;cpe:2.3:a:van_dyke_technologies:securecrt:3.3.3:*:*:*:*:*:*:*;cpe:2.3:a:van_dyke_technologies:securecrt:3.3:*:*:*:*:*:*:*;cpe:2.3:a:van_dyke_technologies:securecrt:3.4.1:*:*:*:*:*:*:*;cpe:2.3:a:van_dyke_technologies:securecrt:3.4.2:*:*:*:*:*:*:*;cpe:2.3:a:van_dyke_technologies:securecrt:3.4.3:*:*:*:*:*:*:*;cpe:2.3:a:van_dyke_technologies:securecrt:3.4.4:*:*:*:*:*:*:*;cpe:2.3:a:van_dyke_technologies:securecrt:3.4.5:*:*:*:*:*:*:*;cpe:2.3:a:van_dyke_technologies:securecrt:3.4:*:*:*:*:*:*:*;cpe:2.3:a:van_dyke_technologies:securecrt:4.0_beta_1:*:*:*:*:*:*:*;cpe:2.3:a:van_dyke_technologies:securecrt:4.0_beta_2:*:*:*:*:*:*:*,Van Dyke Technologies,Securecrt
CVE-2002-1120,0.0,,0.67356,NVD-CWE-Other,Buffer overflow in Savant Web Server 3.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.,2002-09-24,Metasploit,cpe:2.3:a:savant:savant_web_server:*:*:*:*:*:*:*:*,Savant,Savant Web Server
CVE-2002-1123,0.0,,0.77712,NVD-CWE-Other,"Buffer overflow in the authentication function for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows remote attackers to execute arbitrary code via a long request to TCP port 1433, aka the ""Hello"" overflow.",2002-09-24,Metasploit,cpe:2.3:a:microsoft:data_engine:2000:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server:2000:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server:2000:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server:2000:sp2:*:*:*:*:*:*,Microsoft,Data Engine
CVE-2002-1131,0.0,,0.25754,NVD-CWE-Other,"Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via (1) addressbook.php, (2) options.php, (3) search.php, or (4) help.php.",2002-10-04,Nuclei,cpe:2.3:a:squirrelmail:squirrelmail:*:*:*:*:*:*:*:*,Squirrelmail,Squirrelmail
CVE-2002-1142,0.0,,0.76004,NVD-CWE-Other,"Heap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6, and Internet Explorer 5.01 through 6.0, allows remote attackers to execute code via a malformed HTTP request to the Data Stub.",2002-11-29,Metasploit,cpe:2.3:a:microsoft:data_access_components:2.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:data_access_components:2.5:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:data_access_components:2.6:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:ie:6.0:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:5.5:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:5.5:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:5.5:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*,Microsoft,Data Access Components
CVE-2002-1214,0.0,,0.50832,NVD-CWE-Other,Buffer overflow in Microsoft PPTP Service on Windows XP and Windows 2000 allows remote attackers to cause a denial of service (hang) and possibly execute arbitrary code via a certain PPTP packet with malformed control data.,2002-10-28,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000_terminal_services:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000_terminal_services:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000_terminal_services:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000_terminal_services:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:*:home:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:gold:professional:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp1:home:*:*:*:*:*,Microsoft,Windows 2000
CVE-2002-1318,0.0,,0.51914,NVD-CWE-Other,Buffer overflow in samba 2.2.2 through 2.2.6 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an encrypted password that causes the overflow during decryption in which a DOS codepage string is converted to a little-endian UCS2 unicode string.,2002-12-11,Metasploit,cpe:2.3:a:hp:cifs-9000_server:a.01.08.01:*:*:*:*:*:*:*;cpe:2.3:a:hp:cifs-9000_server:a.01.08:*:*:*:*:*:*:*;cpe:2.3:a:hp:cifs-9000_server:a.01.09:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.2.2:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.2.3:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.2.4:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.2.5:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.2.6:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.10:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.11:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.12:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.13:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.14:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.15:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.16:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.17:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.18:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.1:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.2:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.3:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.4:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.5:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.6:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.7:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.8:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.9:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5:*:*:*:*:*:*:*,Sgi,Irix
CVE-2002-1359,0.0,,0.80233,CWE-20,"Multiple SSH2 servers and clients do not properly handle large packets or large fields, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code via buffer overflow attacks, as demonstrated by the SSHredder SSH protocol test suite.",2002-12-23,Metasploit,cpe:2.3:a:fissh:ssh_client:1.0a_for_windows:*:*:*:*:*:*:*;cpe:2.3:a:intersoft:securenetterm:5.4.1:*:*:*:*:*:*:*;cpe:2.3:a:netcomposite:shellguard_ssh:3.4.6:*:*:*:*:*:*:*;cpe:2.3:a:pragma_systems:secureshell:2.0:*:*:*:*:*:*:*;cpe:2.3:a:putty:putty:0.48:*:*:*:*:*:*:*;cpe:2.3:a:putty:putty:0.49:*:*:*:*:*:*:*;cpe:2.3:a:putty:putty:0.53:*:*:*:*:*:*:*;cpe:2.3:a:winscp:winscp:2.0.0:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.0st:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1ea:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.1t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2t:*:*:*:*:*:*:*,Cisco,Ios
CVE-2002-1473,0.0,,0.04429,NVD-CWE-Other,Multiple buffer overflows in lp subsystem for HP-UX 10.20 through 11.11 (11i) allow local users to cause a denial of service and possibly execute arbitrary code.,2003-04-22,Metasploit,cpe:2.3:o:hp:hp-ux:10.20:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:11.00:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:11.11:*:*:*:*:*:*:*,Hp,Hp-Ux
CVE-2002-1643,0.0,,0.7432,NVD-CWE-Other,"Multiple buffer overflows in RealNetworks Helix Universal Server 9.0 (9.0.2.768) allow remote attackers to execute arbitrary code via (1) a long Transport field in a SETUP RTSP request, (2) a DESCRIBE RTSP request with a long URL argument, or (3) two simultaneous HTTP GET requests with long arguments.",2002-12-19,Metasploit,cpe:2.3:a:realnetworks:helix_universal_server:9.0.2.768:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:helix_universal_server:9.0:*:*:*:*:*:*:*,Realnetworks,Helix Universal Server
CVE-2002-1864,0.0,,0.17772,NVD-CWE-Other,"Directory traversal vulnerability in Simple Web Server (SWS) 0.0.4 through 0.1.0 allows remote attackers to read arbitrary files via a "".."" (dot dot) in an HTTP request.",2002-12-31,Metasploit,cpe:2.3:a:sws:sws_simple_web_server:0.0.3:*:*:*:*:*:*:*;cpe:2.3:a:sws:sws_simple_web_server:0.0.4:*:*:*:*:*:*:*;cpe:2.3:a:sws:sws_simple_web_server:0.1.0:*:*:*:*:*:*:*;cpe:2.3:a:sws:sws_simple_web_server:0.1.1:*:*:*:*:*:*:*,Sws,Sws Simple Web Server
CVE-2002-2226,0.0,,0.63478,CWE-119,Buffer overflow in tftpd of TFTP32 2.21 and earlier allows remote attackers to execute arbitrary code via a long filename argument.,2002-12-31,Metasploit,cpe:2.3:a:tftpd32:tftpd32:*:*:*:*:*:*:*:*,Tftpd32,Tftpd32
CVE-2002-2268,0.0,,0.51749,CWE-119,Buffer overflow in Webster HTTP Server allows remote attackers to execute arbitrary code via a long URL.,2002-12-31,Metasploit,cpe:2.3:a:netdave:webster_http_server:*:*:*:*:*:*:*:*,Netdave,Webster Http Server
CVE-2003-0027,0.0,,0.25724,NVD-CWE-Other,Directory traversal vulnerability in Sun Kodak Color Management System (KCMS) library service daemon (kcms_server) allows remote attackers to read arbitrary files via the KCS_OPEN_PROFILE procedure.,2003-02-07,Metasploit,cpe:2.3:o:sun:solaris:2.5.1:*:x86:*:*:*:*:*;cpe:2.3:o:sun:solaris:2.6:*:*:*:*:*:*:*;cpe:2.3:o:sun:solaris:7.0:*:x86:*:*:*:*:*;cpe:2.3:o:sun:solaris:8.0:*:x86:*:*:*:*:*;cpe:2.3:o:sun:solaris:9.0:*:sparc:*:*:*:*:*;cpe:2.3:o:sun:solaris:9.0:x86_update_2:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:-:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.5.1:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.7:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.8:*:*:*:*:*:*:*,Sun,Solaris
CVE-2003-0050,0.0,,0.68858,NVD-CWE-Other,parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute arbitrary code via shell metacharacters.,2003-03-07,Metasploit,cpe:2.3:a:apple:darwin_streaming_server:4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime_streaming_server:4.1.1:*:*:*:*:*:*:*,Apple,Darwin Streaming Server
CVE-2003-0109,0.0,,0.85681,NVD-CWE-Other,"Buffer overflow in ntdll.dll on Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute arbitrary code, as demonstrated via a WebDAV request to IIS 5.0.",2003-03-31,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000_terminal_services:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000_terminal_services:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000_terminal_services:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000_terminal_services:*:sp3:*:*:*:*:*:*,Microsoft,Windows 2000
CVE-2003-0190,0.0,,0.76751,CWE-203,"OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.",2003-05-12,Metasploit,cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*;cpe:2.3:a:openbsd:openssh:3.6.1:p1:*:*:*:*:*:*;cpe:2.3:a:openpkg:openpkg:1.2:*:*:*:*:*:*:*;cpe:2.3:a:openpkg:openpkg:1.3:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_x204rna:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_x204rna_ecc:-:*:*:*:*:*:*:*;cpe:2.3:o:siemens:scalance_x204rna_ecc_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:scalance_x204rna_firmware:*:*:*:*:*:*:*:*,Siemens,Scalance X204Rna Ecc Firmware
CVE-2003-0201,0.0,,0.84502,NVD-CWE-Other,"Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG before 0.3.2, allows remote attackers to execute arbitrary code.",2003-05-05,Metasploit,cpe:2.3:a:hp:cifs-9000_server:a.01.05:*:*:*:*:*:*:*;cpe:2.3:a:hp:cifs-9000_server:a.01.06:*:*:*:*:*:*:*;cpe:2.3:a:hp:cifs-9000_server:a.01.07:*:*:*:*:*:*:*;cpe:2.3:a:hp:cifs-9000_server:a.01.08.01:*:*:*:*:*:*:*;cpe:2.3:a:hp:cifs-9000_server:a.01.08:*:*:*:*:*:*:*;cpe:2.3:a:hp:cifs-9000_server:a.01.09.01:*:*:*:*:*:*:*;cpe:2.3:a:hp:cifs-9000_server:a.01.09.02:*:*:*:*:*:*:*;cpe:2.3:a:hp:cifs-9000_server:a.01.09:*:*:*:*:*:*:*;cpe:2.3:a:samba-tng:samba-tng:0.3.1:*:*:*:*:*:*:*;cpe:2.3:a:samba-tng:samba-tng:0.3:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.0.10:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.0.6:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.0.7:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.0.8:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.0.9:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.2.0a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.2.1a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.2.3a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.2.4:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.2.5:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.2.6:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.2.7:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.2.7a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:2.2.8:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.2.1:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.2.2:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.2.3:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.2.4:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.2:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:4.0b:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:4.0d:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:4.0d_pk9_bl17:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:4.0f:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:4.0f_pk6_bl17:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:4.0f_pk7_bl18:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:4.0g:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:4.0g_pk3_bl17:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.0:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.0_pk4_bl17:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.0_pk4_bl18:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.0a:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.0a_pk3_bl17:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.0f:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1_pk3_bl17:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1_pk4_bl18:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1_pk5_bl19:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1_pk6_bl20:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1a:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1a_pk1_bl1:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1a_pk2_bl2:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1a_pk3_bl3:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1b:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1b_pk1_bl1:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:10.01:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:10.20:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:10.24:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:11.00:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:11.04:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:11.11:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:11.20:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:11.22:*:*:*:*:*:*:*;cpe:2.3:o:sun:solaris:2.5.1:*:ppc:*:*:*:*:*;cpe:2.3:o:sun:solaris:2.5.1:*:x86:*:*:*:*:*;cpe:2.3:o:sun:solaris:2.6:*:*:*:*:*:*:*;cpe:2.3:o:sun:solaris:7.0:*:x86:*:*:*:*:*;cpe:2.3:o:sun:solaris:8.0:*:x86:*:*:*:*:*;cpe:2.3:o:sun:solaris:9.0:*:sparc:*:*:*:*:*;cpe:2.3:o:sun:solaris:9.0:*:x86:*:*:*:*:*;cpe:2.3:o:sun:solaris:9.0:x86_update_2:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:-:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.5.1:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.7:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.8:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2003-0213,0.0,,0.70935,NVD-CWE-Other,"ctrlpacket.c in PoPToP PPTP server before 1.1.4-b3 allows remote attackers to cause a denial of service via a length field of 0 or 1, which causes a negative value to be fed into a read operation, leading to a buffer overflow.",2003-05-12,Metasploit,cpe:2.3:a:poptop:pptp_server:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:poptop:pptp_server:1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:poptop:pptp_server:1.1.3:*:*:*:*:*:*:*;cpe:2.3:a:poptop:pptp_server:1.1.3_2002-10-09:*:*:*:*:*:*:*;cpe:2.3:a:poptop:pptp_server:1.1.4b1:*:*:*:*:*:*:*;cpe:2.3:a:poptop:pptp_server:1.1.4b2:*:*:*:*:*:*:*,Poptop,Pptp Server
CVE-2003-0220,0.0,,0.6909,NVD-CWE-Other,Buffer overflow in the administrator authentication process for Kerio Personal Firewall (KPF) 2.1.4 and earlier allows remote attackers to execute arbitrary code via a handshake packet.,2003-05-12,Metasploit,cpe:2.3:a:kerio:personal_firewall_2:2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:kerio:personal_firewall_2:2.1.2:*:*:*:*:*:*:*;cpe:2.3:a:kerio:personal_firewall_2:2.1.3:*:*:*:*:*:*:*;cpe:2.3:a:kerio:personal_firewall_2:2.1.4:*:*:*:*:*:*:*;cpe:2.3:a:kerio:personal_firewall_2:2.1:*:*:*:*:*:*:*,Kerio,Personal Firewall 2
CVE-2003-0264,0.0,,0.71483,NVD-CWE-Other,"Multiple buffer overflows in SLMail 5.1.0.4420 allows remote attackers to execute arbitrary code via (1) a long EHLO argument to slmail.exe, (2) a long XTRN argument to slmail.exe, (3) a long string to POPPASSWD, or (4) a long password to the POP3 server.",2003-05-27,Metasploit,cpe:2.3:a:seattle_lab_software:slmail:5.1.0.4420:*:*:*:*:*:*:*,Seattle Lab Software,Slmail
CVE-2003-0270,0.0,,0.10998,NVD-CWE-Other,"The administration capability for Apple AirPort 802.11 wireless access point devices uses weak encryption (XOR with a fixed key) for protecting authentication credentials, which could allow remote attackers to obtain administrative access via sniffing when the capability is available via Ethernet or non-WEP connections.",2003-06-16,Metasploit,cpe:2.3:h:apple:802.11n:7.3.1:*:*:*:*:*:*:*,Apple,802.11N
CVE-2003-0344,0.0,,0.81307,NVD-CWE-Other,"Buffer overflow in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to execute arbitrary code via / (slash) characters in the Type property of an Object tag in a web page.",2003-06-16,Metasploit,cpe:2.3:a:microsoft:ie:6.0:*:windows_server_2003:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:5.01:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:5.5:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*,Microsoft,Ie
CVE-2003-0349,0.0,,0.80271,NVD-CWE-Other,"Buffer overflow in the streaming media component for logging multicast requests in the ISAPI for the logging capability of Microsoft Windows Media Services (nsiislog.dll), as installed in IIS 5.0, allows remote attackers to execute arbitrary code via a large POST request to nsiislog.dll.",2003-07-24,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*,Microsoft,Windows 2000
CVE-2003-0352,0.0,,0.98484,NVD-CWE-Other,"Buffer overflow in a certain DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a malformed message, as exploited by the Blaster/MSblast/LovSAN and Nachi/Welchia worms.",2003-08-18,EPSS/Metasploit,cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:enterprise:*:64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:enterprise_64-bit:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:r2:*:64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:r2:*:datacenter_64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:standard:*:64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:web:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:*:enterprise_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:*:server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:*:terminal_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:*:workstation:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp1:enterprise_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp1:server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp1:terminal_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp1:workstation:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp2:enterprise_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp2:server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp2:terminal_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp2:workstation:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp3:enterprise_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp3:server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp3:terminal_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp3:workstation:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp4:enterprise_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp4:server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp4:terminal_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp4:workstation:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp5:enterprise_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp5:server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp5:terminal_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp5:workstation:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp6:enterprise_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp6:server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp6:terminal_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp6:workstation:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp6a:enterprise_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp6a:server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp6a:terminal_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp6a:workstation:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:*:64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:*:home:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:gold:professional:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp1:64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp1:home:*:*:*:*:*,Microsoft,Windows 2000
CVE-2003-0471,0.0,,0.60953,NVD-CWE-Other,Buffer overflow in WebAdmin.exe for WebAdmin allows remote attackers to execute arbitrary code via an HTTP request to WebAdmin.dll with a long USER argument.,2003-08-07,Metasploit,cpe:2.3:a:alt-n:webadmin:*:*:*:*:*:*:*:*,Alt-N,Webadmin
CVE-2003-0533,0.0,,0.85653,NVD-CWE-Other,"Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via a packet that causes the DsRolerUpgradeDownlevelServer function to create long debug entries for the DCPROMO.LOG log file, as exploited by the Sasser worm.",2004-06-01,Metasploit,cpe:2.3:a:microsoft:netmeeting:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp4:*:fr:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_98:*:gold:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_me:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp6a:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp1:tablet_pc:*:*:*:*:*,Microsoft,Windows 2000
CVE-2003-0558,0.0,,0.56464,NVD-CWE-Other,Buffer overflow in LeapFTP 2.7.3.600 allows remote FTP servers to execute arbitrary code via a long IP address response to a PASV request.,2003-08-18,Metasploit,cpe:2.3:a:leapware:leapftp:2.7.3.600:*:*:*:*:*:*:*,Leapware,Leapftp
CVE-2003-0694,0.0,,0.60185,NVD-CWE-Other,"The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c.",2003-10-06,Metasploit,cpe:2.3:a:sendmail:advanced_message_server:1.2:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:advanced_message_server:1.3:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:2.6.1:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:2.6.2:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:2.6:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:3.0:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.10.1:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.10.2:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.10:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.11.0:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.11.1:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.11.2:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.11.3:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.11.4:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.11.5:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.11.6:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.12.0:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.12.1:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.12.2:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.12.3:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.12.4:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.12.5:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.12.6:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.12.7:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.12.8:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.12.9:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.12:beta10:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.12:beta12:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.12:beta16:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.12:beta5:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.12:beta7:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.8.8:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.9.0:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.9.1:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.9.2:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail:8.9.3:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail_pro:8.9.2:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail_pro:8.9.3:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail_switch:2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail_switch:2.1.2:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail_switch:2.1.3:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail_switch:2.1.4:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail_switch:2.1.5:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail_switch:2.1:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail_switch:2.2.1:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail_switch:2.2.2:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail_switch:2.2.3:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail_switch:2.2.4:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail_switch:2.2.5:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail_switch:2.2:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail_switch:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail_switch:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail_switch:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:sendmail:sendmail_switch:3.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.2.1:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.2.2:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.2.3:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.2.4:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.2.5:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.2.6:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.2:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x_server:10.2.1:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x_server:10.2.2:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x_server:10.2.3:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x_server:10.2.4:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x_server:10.2.5:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x_server:10.2.6:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x_server:10.2:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:4.0f:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:4.0f_pk6_bl17:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:4.0f_pk7_bl18:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:4.0f_pk8_bl22:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:4.0g:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:4.0g_pk3_bl17:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:4.0g_pk4_bl22:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1_pk3_bl17:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1_pk4_bl18:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1_pk5_bl19:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1_pk6_bl20:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1a:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1a_pk1_bl1:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1a_pk2_bl2:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1a_pk3_bl3:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1a_pk4_bl21:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1a_pk5_bl23:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1b:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1b_pk1_bl1:*:*:*:*:*:*:*;cpe:2.3:o:compaq:tru64:5.1b_pk2_bl22:*:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:3.0:releng:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:4.0:releng:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:4.3:release_p38:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:4.3:releng:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:4.4:release_p42:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:4.4:releng:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:4.5:release_p32:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:4.5:releng:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:4.6:release_p20:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:4.6:releng:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:4.7:release_p17:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:4.7:releng:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:4.8:release_p6:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:4.8:releng:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:4.9:pre-release:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:5.0:release_p14:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:5.0:releng:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:5.1:release_p5:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:5.1:releng:*:*:*:*:*:*;cpe:2.3:o:gentoo:linux:0.5:*:*:*:*:*:*:*;cpe:2.3:o:gentoo:linux:0.7:*:*:*:*:*:*:*;cpe:2.3:o:gentoo:linux:1.1a:*:*:*:*:*:*:*;cpe:2.3:o:gentoo:linux:1.2:*:*:*:*:*:*:*;cpe:2.3:o:gentoo:linux:1.4:rc1:*:*:*:*:*:*;cpe:2.3:o:gentoo:linux:1.4:rc2:*:*:*:*:*:*;cpe:2.3:o:gentoo:linux:1.4:rc3:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:11.0.4:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:11.00:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:11.11:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:11.22:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:4.3.3:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.1:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.2:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:1.4.3:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:1.5.1:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:1.5.2:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:1.5.3:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:1.5:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:1.5:*:sh3:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:1.5:*:x86:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:1.6.1:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:1.6:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:1.6:beta:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.15:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.16:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.17f:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.17m:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.18f:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.18m:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.19f:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.19m:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.20f:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.20m:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.21f:*:*:*:*:*:*:*;cpe:2.3:o:sgi:irix:6.5.21m:*:*:*:*:*:*:*;cpe:2.3:o:sun:solaris:2.6:*:*:*:*:*:*:*;cpe:2.3:o:sun:solaris:7.0:*:x86:*:*:*:*:*;cpe:2.3:o:sun:solaris:8.0:*:x86:*:*:*:*:*;cpe:2.3:o:sun:solaris:9.0:*:sparc:*:*:*:*:*;cpe:2.3:o:sun:solaris:9.0:*:x86:*:*:*:*:*;cpe:2.3:o:sun:sunos:-:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.7:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.8:*:*:*:*:*:*:*;cpe:2.3:o:turbolinux:turbolinux_advanced_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:turbolinux:turbolinux_server:6.1:*:*:*:*:*:*:*;cpe:2.3:o:turbolinux:turbolinux_server:6.5:*:*:*:*:*:*:*;cpe:2.3:o:turbolinux:turbolinux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:turbolinux:turbolinux_server:8.0:*:*:*:*:*:*:*;cpe:2.3:o:turbolinux:turbolinux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:turbolinux:turbolinux_workstation:7.0:*:*:*:*:*:*:*;cpe:2.3:o:turbolinux:turbolinux_workstation:8.0:*:*:*:*:*:*:*,Sgi,Irix
CVE-2003-0714,0.0,,0.76388,CWE-400,"The Internet Mail Service in Exchange Server 5.5 and Exchange 2000 allows remote attackers to cause a denial of service (memory exhaustion) by directly connecting to the SMTP service and sending a certain extended verb request, possibly triggering a buffer overflow in Exchange 2000.",2003-11-17,Metasploit,cpe:2.3:a:microsoft:exchange_server:2000:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2000:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2000:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2000:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:5.5:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:5.5:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:5.5:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:5.5:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:5.5:sp4:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2003-0719,0.0,,0.81203,NVD-CWE-Other,"Buffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, as used in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via PCT 1.0 handshake packets.",2004-06-01,Metasploit,cpe:2.3:a:microsoft:netmeeting:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp4:*:fr:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_98:*:gold:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_me:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp6a:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp1:tablet_pc:*:*:*:*:*,Microsoft,Windows 2000
CVE-2003-0722,0.0,,0.85678,NVD-CWE-Other,"The default installation of sadmind on Solaris uses weak authentication (AUTH_SYS), which allows local and remote attackers to spoof Solstice AdminSuite clients and gain root privileges via a certain sequence of RPC packets.",2003-09-22,Metasploit,cpe:2.3:o:sun:solaris:*:*:*:*:*:*:*:*,Sun,Solaris
CVE-2003-0727,0.0,,0.68395,NVD-CWE-Other,Multiple buffer overflows in the XML Database (XDB) functionality for Oracle 9i Database Release 2 allow local users to cause a denial of service or hijack user sessions.,2003-10-20,Metasploit,cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*,Oracle,Database Server
CVE-2003-0812,0.0,,0.81046,NVD-CWE-Other,"Stack-based buffer overflow in a logging function for Windows Workstation Service (WKSSVC.DLL) allows remote attackers to execute arbitrary code via RPC calls that cause long entries to be written to a debug log file (""NetSetup.LOG""), as demonstrated using the NetAddAlternateComputerName API.",2003-12-15,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:*:64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:*:home:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:*:media_center:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:gold:professional:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp1:64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp1:home:*:*:*:*:*,Microsoft,Windows 2000
CVE-2003-0818,0.0,,0.82241,NVD-CWE-Other,"Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with (1) very large length fields that cause arbitrary heap data to be overwritten, or (2) modified bit strings.",2004-03-03,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:enterprise:*:64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:enterprise_64-bit:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:r2:*:64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:r2:*:datacenter_64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:standard:*:64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:web:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:*:server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:*:terminal_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:*:workstation:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp1:server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp1:terminal_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp1:workstation:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp2:server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp2:terminal_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp2:workstation:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp3:server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp3:terminal_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp3:workstation:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp4:server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp4:terminal_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp4:workstation:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp5:server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp5:terminal_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp5:workstation:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp6:server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp6:terminal_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp6:workstation:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp6a:server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp6a:workstation:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:*:64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:*:home:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:gold:professional:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp1:64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp1:home:*:*:*:*:*,Microsoft,Windows 2000
CVE-2003-0822,0.0,,0.81262,NVD-CWE-Other,Buffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to execute arbitrary code via a crafted chunked encoded request.,2003-12-15,Metasploit,cpe:2.3:a:microsoft:frontpage_server_extensions:2000:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:frontpage_server_extensions:2002:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_team_services:2002:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:gold:professional:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp1:64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp1:home:*:*:*:*:*,Microsoft,Windows 2000
CVE-2003-0990,0.0,,0.28792,NVD-CWE-Other,"The parseAddress code in (1) SquirrelMail 1.4.0 and (2) GPG Plugin 1.1 allows remote attackers to execute commands via shell metacharacters in the ""To:"" field.",2004-01-20,Metasploit,cpe:2.3:a:squirrelmail:gpg_plugin:1.1:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:*:*:*:*:*:*:*,Squirrelmail,Gpg Plugin
CVE-2003-1141,0.0,,0.68318,NVD-CWE-Other,Buffer overflow in NIPrint 4.10 allows remote attackers to execute arbitrary code via a long string to TCP port 515.,2003-11-04,Metasploit,cpe:2.3:h:network_instruments:niprint_lpd-lpr_print_server:4.10:*:*:*:*:*:*:*,Network Instruments,Niprint Lpd-Lpr Print Server
CVE-2003-1192,0.0,,0.69174,NVD-CWE-Other,Stack-based buffer overflow in IA WebMail Server 3.1.0 allows remote attackers to execute arbitrary code via a long GET request.,2003-11-03,Metasploit,cpe:2.3:a:truenorth_software:ia_webmail_server:3.0:*:*:*:*:*:*:*;cpe:2.3:a:truenorth_software:ia_webmail_server:3.1:*:*:*:*:*:*:*,Truenorth Software,Ia Webmail Server
CVE-2003-1200,0.0,,0.65097,NVD-CWE-Other,Stack-based buffer overflow in FORM2RAW.exe in Alt-N MDaemon 6.5.2 through 6.8.5 allows remote attackers to execute arbitrary code via a long From parameter to Form2Raw.cgi.,2003-12-29,Metasploit,cpe:2.3:a:alt-n:mdaemon:6.5.2:*:*:*:*:*:*:*;cpe:2.3:a:alt-n:mdaemon:6.7.5:*:*:*:*:*:*:*;cpe:2.3:a:alt-n:mdaemon:6.7.9:*:*:*:*:*:*:*;cpe:2.3:a:alt-n:mdaemon:6.8.0:*:*:*:*:*:*:*;cpe:2.3:a:alt-n:mdaemon:6.8.1:*:*:*:*:*:*:*;cpe:2.3:a:alt-n:mdaemon:6.8.2:*:*:*:*:*:*:*;cpe:2.3:a:alt-n:mdaemon:6.8.3:*:*:*:*:*:*:*;cpe:2.3:a:alt-n:mdaemon:6.8.4:*:*:*:*:*:*:*;cpe:2.3:a:alt-n:mdaemon:6.8.5:*:*:*:*:*:*:*,Alt-N,Mdaemon
CVE-2003-1336,0.0,,0.35706,CWE-119,Buffer overflow in mIRC before 6.11 allows remote attackers to execute arbitrary code via a long irc:// URL.,2003-12-31,Metasploit,cpe:2.3:a:mirc:mirc:*:*:*:*:*:*:*:*,Mirc,Mirc
CVE-2004-0206,0.0,,0.74657,NVD-CWE-Other,"Network Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an ""unchecked buffer,"" possibly a buffer overflow.",2004-11-03,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_98:*:gold:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:gold:*:*:*:*:*:*,Microsoft,Windows 2000
CVE-2004-0210,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.07156,CWE-120,"The POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain parameters, possibly by modifying message length values and causing a buffer overflow.",2004-08-06,CISA,cpe:2.3:a:microsoft:interix:2.2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:-:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp6a:*:*:server:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp6a:*:*:terminal_server:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp6a:*:*:workstation:*:*:*,Microsoft,Windows 2000
CVE-2004-0297,0.0,,0.68129,NVD-CWE-Other,Buffer overflow in the Lightweight Directory Access Protocol (LDAP) daemon (iLDAP.exe 3.9.15.10) in Ipswitch IMail Server 8.03 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via an LDAP message with a large tag length.,2004-11-23,Metasploit,cpe:2.3:a:ipswitch:imail:8.0.3:*:*:*:*:*:*:*;cpe:2.3:a:ipswitch:imail:8.0.5:*:*:*:*:*:*:*,Ipswitch,Imail
CVE-2004-0313,0.0,,0.63605,NVD-CWE-Other,"Buffer overflow in PSOProxy 0.91 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long HTTP request, as demonstrated using a long (1) GET argument or (2) method name.",2004-11-23,Metasploit,cpe:2.3:a:psoproxy:psoproxy_server:0.91:*:*:*:*:*:*:*,Psoproxy,Psoproxy Server
CVE-2004-0326,0.0,,0.62809,NVD-CWE-Other,Buffer overflow in the web proxy for GateKeeper Pro 4.7 allows remote attackers to execute arbitrary code via a long GET request.,2004-11-23,Metasploit,cpe:2.3:a:proxy-pro:professional_gatekeeper:4.7:*:*:*:*:*:*:*,Proxy-Pro,Professional Gatekeeper
CVE-2004-0330,0.0,,0.8547,CWE-119,Buffer overflow in Serv-U ftp before 5.0.0.4 allows remote authenticated users to execute arbitrary code via a long time zone argument to the MDTM command.,2004-11-23,Metasploit,cpe:2.3:a:solarwinds:serv-u_file_server:*:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:3.0.0.16:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:3.0.0.17:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:3.1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:3.1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:3.1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:4.0.0.4:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:4.1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:4.1.0.3:*:*:*:*:*:*:*,Solarwinds,Serv-U File Server
CVE-2004-0331,0.0,,0.1583,NVD-CWE-Other,Heap-based buffer overflow in Dell OpenManage Web Server 3.4.0 allows remote attackers to cause a denial of service (crash) via a HTTP POST with a long application variable.,2004-11-23,Metasploit,cpe:2.3:a:dell:openmanage:3.2:*:*:*:*:*:*:*;cpe:2.3:a:dell:openmanage:3.4:*:*:*:*:*:*:*;cpe:2.3:a:dell:openmanage:3.7.1:*:*:*:*:*:*:*;cpe:2.3:a:dell:openmanage:3.7:*:*:*:*:*:*:*,Dell,Openmanage
CVE-2004-0362,0.0,,0.7333,NVD-CWE-Other,"Multiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module (PAM) component, as used in various RealSecure, Proventia, and BlackICE products, allow remote attackers to execute arbitrary code via a SRV_MULTI response containing a SRV_USER_ONLINE response packet and a SRV_META_USER response packet with long (1) nickname, (2) firstname, (3) lastname, or (4) email address fields, as exploited by the Witty worm.",2004-04-15,Metasploit,cpe:2.3:a:iss:blackice_agent_server:3.6ebz:*:*:*:*:*:*:*;cpe:2.3:a:iss:blackice_agent_server:3.6eca:*:*:*:*:*:*:*;cpe:2.3:a:iss:blackice_agent_server:3.6ecb:*:*:*:*:*:*:*;cpe:2.3:a:iss:blackice_agent_server:3.6ecc:*:*:*:*:*:*:*;cpe:2.3:a:iss:blackice_agent_server:3.6ecd:*:*:*:*:*:*:*;cpe:2.3:a:iss:blackice_agent_server:3.6ece:*:*:*:*:*:*:*;cpe:2.3:a:iss:blackice_agent_server:3.6ecf:*:*:*:*:*:*:*;cpe:2.3:a:iss:blackice_pc_protection:3.6cbz:*:*:*:*:*:*:*;cpe:2.3:a:iss:blackice_pc_protection:3.6cca:*:*:*:*:*:*:*;cpe:2.3:a:iss:blackice_pc_protection:3.6ccb:*:*:*:*:*:*:*;cpe:2.3:a:iss:blackice_pc_protection:3.6ccc:*:*:*:*:*:*:*;cpe:2.3:a:iss:blackice_pc_protection:3.6ccd:*:*:*:*:*:*:*;cpe:2.3:a:iss:blackice_pc_protection:3.6cce:*:*:*:*:*:*:*;cpe:2.3:a:iss:blackice_pc_protection:3.6ccf:*:*:*:*:*:*:*;cpe:2.3:a:iss:blackice_server_protection:3.6cbz:*:*:*:*:*:*:*;cpe:2.3:a:iss:blackice_server_protection:3.6cca:*:*:*:*:*:*:*;cpe:2.3:a:iss:blackice_server_protection:3.6ccb:*:*:*:*:*:*:*;cpe:2.3:a:iss:blackice_server_protection:3.6ccc:*:*:*:*:*:*:*;cpe:2.3:a:iss:blackice_server_protection:3.6ccd:*:*:*:*:*:*:*;cpe:2.3:a:iss:blackice_server_protection:3.6cce:*:*:*:*:*:*:*;cpe:2.3:a:iss:blackice_server_protection:3.6ccf:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_desktop:3.6ebz:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_desktop:3.6eca:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_desktop:3.6ecb:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_desktop:3.6ecd:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_desktop:3.6ece:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_desktop:3.6ecf:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_desktop:7.0eba:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_desktop:7.0ebf:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_desktop:7.0ebg:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_desktop:7.0ebh:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_desktop:7.0ebj:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_desktop:7.0ebk:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_desktop:7.0ebl:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_guard:3.6ebz:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_guard:3.6eca:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_guard:3.6ecb:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_guard:3.6ecc:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_guard:3.6ecd:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_guard:3.6ece:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_guard:3.6ecf:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_network_sensor:7.0:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_network_sensor:7.0:xpu_20.11:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_network_sensor:7.0:xpu_22.10:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_network_sensor:7.0:xpu_22.4:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_network_sensor:7.0:xpu_22.9:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_sentry:3.6ebz:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_sentry:3.6eca:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_sentry:3.6ecb:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_sentry:3.6ecc:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_sentry:3.6ecd:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_sentry:3.6ece:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_sentry:3.6ecf:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:6.0.1:*:windows:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:6.0.1_win_sr1.1:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:6.0:*:windows:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:6.5:*:windows:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:6.5:sr3.2:windows:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:6.5:sr3.3:windows:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:6.5_win_sr3.10:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:6.5_win_sr3.1:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:6.5_win_sr3.4:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:6.5_win_sr3.5:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:6.5_win_sr3.6:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:6.5_win_sr3.7:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:6.5_win_sr3.8:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:6.5_win_sr3.9:*:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:7.0:xpu22.10:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:7.0:xpu22.11:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:7.0:xpu22.1:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:7.0:xpu22.2:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:7.0:xpu22.3:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:7.0:xpu22.4:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:7.0:xpu22.5:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:7.0:xpu22.6:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:7.0:xpu22.7:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:7.0:xpu22.8:*:*:*:*:*:*;cpe:2.3:a:iss:realsecure_server_sensor:7.0:xpu22.9:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_a_series_xpu:20.11:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_a_series_xpu:22.10:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_a_series_xpu:22.1:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_a_series_xpu:22.2:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_a_series_xpu:22.3:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_a_series_xpu:22.4:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_a_series_xpu:22.5:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_a_series_xpu:22.6:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_a_series_xpu:22.7:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_a_series_xpu:22.8:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_a_series_xpu:22.9:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_g_series_xpu:22.10:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_g_series_xpu:22.11:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_g_series_xpu:22.1:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_g_series_xpu:22.2:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_g_series_xpu:22.3:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_g_series_xpu:22.4:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_g_series_xpu:22.5:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_g_series_xpu:22.6:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_g_series_xpu:22.7:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_g_series_xpu:22.8:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_g_series_xpu:22.9:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_m_series_xpu:1.1:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_m_series_xpu:1.2:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_m_series_xpu:1.3:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_m_series_xpu:1.4:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_m_series_xpu:1.5:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_m_series_xpu:1.6:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_m_series_xpu:1.7:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_m_series_xpu:1.8:*:*:*:*:*:*:*;cpe:2.3:h:iss:proventia_m_series_xpu:1.9:*:*:*:*:*:*:*,Iss,Proventia A Series Xpu
CVE-2004-0363,0.0,,0.66567,NVD-CWE-Other,"Stack-based buffer overflow in the SymSpamHelper ActiveX component (symspam.dll) in Norton AntiSpam 2004, as used in Norton Internet Security 2004, allows remote attackers to execute arbitrary code via a long parameter to the LaunchCustomRuleWizard method.",2004-04-15,Metasploit,cpe:2.3:a:symantec:norton_antispam:2004:*:*:*:*:*:*:*,Symantec,Norton Antispam
CVE-2004-0397,0.0,,0.7525,NVD-CWE-Other,Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn-protocol command.,2004-07-07,Metasploit,cpe:2.3:a:subversion:subversion:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:subversion:subversion:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:subversion:subversion:1.0:*:*:*:*:*:*:*,Subversion,Subversion
CVE-2004-0430,0.0,,0.41303,NVD-CWE-Other,Stack-based buffer overflow in AppleFileServer for Mac OS X 10.3.3 and earlier allows remote attackers to execute arbitrary code via a LoginExt packet for a Cleartext Password User Authentication Method (UAM) request with a PathName argument that includes an AFPName type string that is longer than the associated length field.,2004-07-07,Metasploit,cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x_server:*:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2004-0437,0.0,,0.07672,NVD-CWE-Other,"Titan FTP Server version 3.01 build 163, and possibly other versions before build 169, allows remote authenticated users to cause a denial of service (crash) by disconnecting from the system during a ""LIST -L"" command, which causes Titan to access an invalid socket.",2004-07-07,Nuclei,cpe:2.3:a:south_river_technologies:titan_ftp_server:3.01_build_163:*:*:*:*:*:*:*,South River Technologies,Titan Ftp Server
CVE-2004-0519,0.0,,0.22528,NVD-CWE-Other,"Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php.",2004-08-18,Nuclei,cpe:2.3:a:sgi:propack:3.0:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.2.10:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.2.11:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.2.1:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.2.2:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.2.3:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.2.4:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.2.5:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.2.6:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.2.7:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.2.8:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.2.9:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.4.1:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.4.2:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.4:*:*:*:*:*:*:*,Sgi,Propack
CVE-2004-0541,0.0,,0.7107,NVD-CWE-Other,"Buffer overflow in the ntlm_check_auth (NTLM authentication) function for Squid Web Proxy Cache 2.5.x and 3.x, when compiled with NTLM handlers enabled, allows remote attackers to execute arbitrary code via a long password (""pass"" variable).",2004-08-06,Metasploit,cpe:2.3:a:national_science_foundation:squid_web_proxy_cache:2.5_stable:*:*:*:*:*:*:*;cpe:2.3:a:national_science_foundation:squid_web_proxy_cache:3_pre:*:*:*:*:*:*:*,National Science Foundation,Squid Web Proxy Cache
CVE-2004-0608,0.0,,0.73544,NVD-CWE-Other,"The Unreal Engine, as used in DeusEx 1.112fm and earlier, Devastation 390 and earlier, Mobile Forces 20000 and earlier, Nerf Arena Blast 1.2 and earlier, Postal 2 1337 and earlier, Rune 107 and earlier, Tactical Ops 3.4.0 and earlier, Unreal 1 226f and earlier, Unreal II XMP 7710 and earlier, Unreal Tournament 451b and earlier, Unreal Tournament 2003 2225 and earlier, Unreal Tournament 2004 before 3236, Wheel of Time 333b and earlier, and X-com Enforcer, allows remote attackers to execute arbitrary code via a UDP packet containing a secure query with a long value, which overwrites memory.",2004-12-06,Metasploit,cpe:2.3:a:arush:devastation:390.0:*:*:*:*:*:*:*;cpe:2.3:a:dreamforge:tnn_outdoors_pro_hunter:*:*:*:*:*:*:*:*;cpe:2.3:a:epic_games:unreal_engine:226f:*:*:*:*:*:*:*;cpe:2.3:a:epic_games:unreal_engine:433:*:*:*:*:*:*:*;cpe:2.3:a:epic_games:unreal_engine:436:*:*:*:*:*:*:*;cpe:2.3:a:epic_games:unreal_tournament:451b:*:*:*:*:*:*:*;cpe:2.3:a:epic_games:unreal_tournament_2003:2199_linux:*:*:*:*:*:*:*;cpe:2.3:a:epic_games:unreal_tournament_2003:2199_macos:*:*:*:*:*:*:*;cpe:2.3:a:epic_games:unreal_tournament_2003:2199_win32:*:*:*:*:*:*:*;cpe:2.3:a:epic_games:unreal_tournament_2003:2225_macos:*:*:*:*:*:*:*;cpe:2.3:a:epic_games:unreal_tournament_2003:2225_win32:*:*:*:*:*:*:*;cpe:2.3:a:epic_games:unreal_tournament_2004:macos:*:*:*:*:*:*:*;cpe:2.3:a:epic_games:unreal_tournament_2004:win32:*:*:*:*:*:*:*;cpe:2.3:a:infogrames:tacticalops:3.4:*:*:*:*:*:*:*;cpe:2.3:a:infogrames:x-com_enforcer:*:*:*:*:*:*:*:*;cpe:2.3:a:ion_storm:deusex:1.112_fm:*:*:*:*:*:*:*;cpe:2.3:a:nerf_arena_blast:nerf_arena_blast:1.2:*:*:*:*:*:*:*;cpe:2.3:a:rage_software:mobile_forces:20000.0:*:*:*:*:*:*:*;cpe:2.3:a:robert_jordan:wheel_of_time:333.0b:*:*:*:*:*:*:*;cpe:2.3:a:running_with_scissors:postal_2:1337:*:*:*:*:*:*:*;cpe:2.3:o:gentoo:linux:1.4:*:*:*:*:*:*:*,Gentoo,Linux
CVE-2004-0636,0.0,,0.66019,NVD-CWE-Other,"Buffer overflow in the goaway function in the aim:goaway URI handler for AOL Instant Messenger (AIM) 5.5, including 5.5.3595, allows remote attackers to execute arbitrary code via a long Away message.",2004-11-23,Metasploit,cpe:2.3:a:aol:instant_messenger:5.5.3415_beta:*:*:*:*:*:*:*;cpe:2.3:a:aol:instant_messenger:5.5.3595:*:*:*:*:*:*:*;cpe:2.3:a:aol:instant_messenger:5.5:*:*:*:*:*:*:*,Aol,Instant Messenger
CVE-2004-0656,0.0,,0.02349,NVD-CWE-Other,The accept_client function in PureFTPd 1.0.18 and earlier allows remote attackers to cause a denial of service by exceeding the maximum number of connections.,2004-08-06,Nuclei,cpe:2.3:a:pureftpd:pureftpd:0.96:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pureftpd:1.0.11:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pureftpd:1.0.12:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pureftpd:1.0.13a:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pureftpd:1.0.14:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pureftpd:1.0.15:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pureftpd:1.0.16:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pureftpd:1.0.16a:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pureftpd:1.0.16b:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pureftpd:1.0.16c:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pureftpd:1.0.17a:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pureftpd:1.0.18:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pureftpd:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pureftpd:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pureftpd:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pureftpd:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pureftpd:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pureftpd:1.0:*:*:*:*:*:*:*,Pureftpd,Pureftpd
CVE-2004-0695,0.0,,0.38194,NVD-CWE-Other,Stack-based buffer overflow in the FTP service for 4D WebSTAR 5.3.2 and earlier allows remote attackers to execute arbitrary code via a long FTP command.,2004-07-27,Metasploit,cpe:2.3:a:4d:webstar:4.0:*:*:*:*:*:*:*;cpe:2.3:a:4d:webstar:5.2.1:*:*:*:*:*:*:*;cpe:2.3:a:4d:webstar:5.2.2:*:*:*:*:*:*:*;cpe:2.3:a:4d:webstar:5.2.3:*:*:*:*:*:*:*;cpe:2.3:a:4d:webstar:5.2.4:*:*:*:*:*:*:*;cpe:2.3:a:4d:webstar:5.2:*:*:*:*:*:*:*;cpe:2.3:a:4d:webstar:5.3.1:*:*:*:*:*:*:*;cpe:2.3:a:4d:webstar:5.3.2:*:*:*:*:*:*:*;cpe:2.3:a:4d:webstar:5.3:*:*:*:*:*:*:*,4D,Webstar
CVE-2004-0735,0.0,,0.62108,NVD-CWE-Other,"Buffer overflow in Medal of Honor (1) Allied Assault 1.11v9 and earlier, (2) Breakthrough 2.40b and earlier, and (3) Spearhead 2.15 and earlier, when playing on a Local Area Network (LAN), allows remote attackers to execute arbitrary code via vectors such as (1) the getinfo query, (2) the connect packet, and other unknown vectors.",2004-07-27,Metasploit,cpe:2.3:a:electronic_arts:medal_of_honor_allied_assault:1.0:*:*:*:*:*:*:*;cpe:2.3:a:electronic_arts:medal_of_honor_allied_assault:1.11_v9:*:*:*:*:*:*:*;cpe:2.3:a:electronic_arts:medal_of_honor_allied_assault:1.1:*:*:*:*:*:*:*;cpe:2.3:a:electronic_arts:medal_of_honor_allied_assault:breakthrough_2.40_b:*:*:*:*:*:*:*;cpe:2.3:a:electronic_arts:medal_of_honor_allied_assault:spearhead_2.15:*:*:*:*:*:*:*,Electronic Arts,Medal Of Honor Allied Assault
CVE-2004-0795,0.0,,0.02212,NVD-CWE-Other,"DB2 8.1 remote command server (DB2RCMD.EXE) executes the db2rcmdc.exe program as the db2admin administrator, which allows local users to gain privileges via the DB2REMOTECMD named pipe.",2004-10-20,Metasploit,cpe:2.3:a:ibm:db2_universal_database:8.1:*:aix:*:*:*:*:*,Ibm,Db2 Universal Database
CVE-2004-0798,0.0,,0.62577,NVD-CWE-Other,Buffer overflow in the _maincfgret.cgi script for Ipswitch WhatsUp Gold before 8.03 Hotfix 1 allows remote attackers to execute arbitrary code via a long instancename parameter.,2004-10-20,Metasploit,cpe:2.3:a:progress:whatsup_gold:7.03:*:*:*:*:*:*:*;cpe:2.3:a:progress:whatsup_gold:7.04:*:*:*:*:*:*:*;cpe:2.3:a:progress:whatsup_gold:7.0:*:*:*:*:*:*:*;cpe:2.3:a:progress:whatsup_gold:8.01:*:*:*:*:*:*:*;cpe:2.3:a:progress:whatsup_gold:8.03:*:*:*:*:*:*:*;cpe:2.3:a:progress:whatsup_gold:8.0:*:*:*:*:*:*:*,Progress,Whatsup Gold
CVE-2004-0964,0.0,,0.62678,NVD-CWE-Other,"Buffer overflow in Zinf 2.2.1 on Windows, and other older versions for Linux, allows remote attackers or local users to execute arbitrary code via certain values in a .pls file.",2005-02-09,Metasploit,cpe:2.3:a:zinf:zinf:2.2.1:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:3.0:*:alpha:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:3.0:*:arm:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:3.0:*:hppa:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:3.0:*:ia-32:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:3.0:*:ia-64:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:3.0:*:m68k:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:3.0:*:mips:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:3.0:*:mipsel:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:3.0:*:ppc:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:3.0:*:s-390:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:3.0:*:sparc:*:*:*:*:*,Debian,Debian Linux
CVE-2004-1037,0.0,,0.61668,NVD-CWE-Other,The search function in TWiki 20030201 allows remote attackers to execute arbitrary commands via shell metacharacters in a search string.,2005-03-01,Metasploit,cpe:2.3:a:twiki:twiki:2003-02-01:*:*:*:*:*:*:*;cpe:2.3:o:gentoo:linux:*:*:*:*:*:*:*:*,Gentoo,Linux
CVE-2004-1080,0.0,,0.79801,NVD-CWE-Other,"The WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remote attackers to write to arbitrary memory locations and possibly execute arbitrary code via a modified memory pointer in a WINS replication packet to TCP port 42, aka the ""Association Context Vulnerability.""",2005-01-10,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:2000:*:small_business_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:2003:*:small_business_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:enterprise:*:64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:enterprise_64-bit:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:r2:*:64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:r2:*:datacenter_64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:standard:*:64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:web:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:*:enterprise_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:*:server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:*:terminal_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp1:enterprise_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp1:server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp1:terminal_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp2:enterprise_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp2:server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp2:terminal_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp3:enterprise_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp3:server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp3:terminal_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp4:enterprise_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp4:server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp4:terminal_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp5:enterprise_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp5:server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp5:terminal_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp6:enterprise_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp6:server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp6:terminal_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp6a:enterprise_server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp6a:server:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:sp6a:terminal_server:*:*:*:*:*,Microsoft,Windows 2000
CVE-2004-1134,0.0,,0.72326,NVD-CWE-Other,Buffer overflow in the Microsoft W3Who ISAPI (w3who.dll) allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long query string.,2005-01-10,Metasploit,cpe:2.3:a:microsoft:w3who.dll:*:*:*:*:*:*:*:*,Microsoft,W3Who.Dll
CVE-2004-1135,0.0,,0.49642,NVD-CWE-Other,"Multiple buffer overflows in WS_FTP Server 5.03 2004.10.14 allow remote attackers to cause a denial of service (service crash) via long (1) SITE, (2) XMKD, (3) MKD, and (4) RNFR commands.",2005-01-10,Metasploit,cpe:2.3:a:ipswitch:ws_ftp_server:5.03:*:*:*:*:*:*:*,Ipswitch,Ws Ftp Server
CVE-2004-1172,0.0,,0.81791,NVD-CWE-Other,"Stack-based buffer overflow in the Agent Browser in Veritas Backup Exec 8.x before 8.60.3878 Hotfix 68, and 9.x before 9.1.4691 Hotfix 40, allows remote attackers to execute arbitrary code via a registration request with a long hostname.",2005-01-10,Metasploit,cpe:2.3:a:symantec_veritas:backup_exec:8.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:8.5:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:8.6:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.1:*:*:*:*:*:*:*,Symantec Veritas,Backup Exec
CVE-2004-1211,0.0,,0.72459,CWE-119,"Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via long arguments to the (1) EXAMINE, (2) SUBSCRIBE, (3) STATUS, (4) APPEND, (5) CHECK, (6) CLOSE, (7) EXPUNGE, (8) FETCH, (9) RENAME, (10) DELETE, (11) LIST, (12) SEARCH, (13) CREATE, or (14) UNSUBSCRIBE commands.",2005-01-10,Metasploit,cpe:2.3:a:david_harris:mercury:4.0.1a:*:win32:*:*:*:*:*,David Harris,Mercury
CVE-2004-1315,0.0,,0.72096,NVD-CWE-Other,"viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows remote attackers to execute arbitrary PHP code by double-encoding the highlight value so that special characters are inserted into the result, which is then processed by PHP exec, as exploited by the Santy.A worm.",2004-11-12,Metasploit,cpe:2.3:a:phpbb_group:phpbb:*:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:1.2.1:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:1.4.1:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:1.4.2:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:1.4.4:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:2.0.10:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:2.0.6:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:2.0.6c:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:2.0.6d:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:2.0.7:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:2.0.7a:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:2.0.8:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:2.0.8a:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:2.0.9:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:2.0_beta1:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:2.0_rc1:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:2.0_rc2:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:2.0_rc3:*:*:*:*:*:*:*;cpe:2.3:a:phpbb_group:phpbb:2.0_rc4:*:*:*:*:*:*:*,Phpbb Group,Phpbb
CVE-2004-1317,0.0,,0.60412,NVD-CWE-Other,"Stack-based buffer overflow in doexec.c in Netcat for Windows 1.1, when running with the -e option, allows remote attackers to execute arbitrary code via a long DNS command.",2004-12-27,Metasploit,cpe:2.3:a:netcat:netcat:1.1:*:*:*:*:*:*:*,Netcat,Netcat
CVE-2004-1373,0.0,,0.70066,NVD-CWE-Other,"Format string vulnerability in SHOUTcast 1.9.4 allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via format string specifiers in a content URL, as demonstrated in the filename portion of a .mp3 file.",2004-12-23,Metasploit,cpe:2.3:a:nullsoft:shoutcast_server:1.9.4:*:linux:*:*:*:*:*;cpe:2.3:a:nullsoft:shoutcast_server:1.9.4:*:mac_os_x:*:*:*:*:*;cpe:2.3:a:nullsoft:shoutcast_server:1.9.4:*:win32:*:*:*:*:*,Nullsoft,Shoutcast Server
CVE-2004-1388,0.0,,0.68195,NVD-CWE-Other,"Format string vulnerability in the gpsd_report function for BerliOS GPD daemon (gpsd, formerly pygps) 1.9.0 through 2.7 allows remote attackers to execute arbitrary code via certain GPS requests containing format string specifiers that are not properly handled in syslog calls.",2004-12-31,Metasploit,cpe:2.3:a:berlios:gps_daemon:1.25:*:*:*:*:*:*:*;cpe:2.3:a:berlios:gps_daemon:1.26:*:*:*:*:*:*:*;cpe:2.3:a:berlios:gps_daemon:1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:berlios:gps_daemon:1.91:*:*:*:*:*:*:*;cpe:2.3:a:berlios:gps_daemon:1.92:*:*:*:*:*:*:*;cpe:2.3:a:berlios:gps_daemon:1.93:*:*:*:*:*:*:*;cpe:2.3:a:berlios:gps_daemon:1.94:*:*:*:*:*:*:*;cpe:2.3:a:berlios:gps_daemon:1.95:*:*:*:*:*:*:*;cpe:2.3:a:berlios:gps_daemon:1.96:*:*:*:*:*:*:*;cpe:2.3:a:berlios:gps_daemon:1.97:*:*:*:*:*:*:*;cpe:2.3:a:berlios:gps_daemon:1.98:*:*:*:*:*:*:*;cpe:2.3:a:berlios:gps_daemon:2.0:*:*:*:*:*:*:*;cpe:2.3:a:berlios:gps_daemon:2.1:*:*:*:*:*:*:*;cpe:2.3:a:berlios:gps_daemon:2.2:*:*:*:*:*:*:*;cpe:2.3:a:berlios:gps_daemon:2.3:*:*:*:*:*:*:*;cpe:2.3:a:berlios:gps_daemon:2.4:*:*:*:*:*:*:*;cpe:2.3:a:berlios:gps_daemon:2.7:*:*:*:*:*:*:*,Berlios,Gps Daemon
CVE-2004-1389,0.0,,0.09863,NVD-CWE-Other,"Unknown vulnerability in the Veritas NetBackup Administrative Assistant interface for NetBackup BusinesServer 3.4, 3.4.1, and 4.5, DataCenter 3.4, 3.4.1, and 4.5, Enterprise Server 5.1, and NetBackup Server 5.0 and 5.1, allows attackers to execute arbitrary commands via the bpjava-susvc process, possibly related to the call-back feature.",2004-12-31,Metasploit,cpe:2.3:a:veritas:netbackup:3.4.0:*:businessserver:*:*:*:*:*;cpe:2.3:a:veritas:netbackup:3.4.0:*:datacenter:*:*:*:*:*;cpe:2.3:a:veritas:netbackup:3.4.1:*:businessserver:*:*:*:*:*;cpe:2.3:a:veritas:netbackup:3.4.1:*:datacenter:*:*:*:*:*;cpe:2.3:a:veritas:netbackup:4.5.0:*:businessserver:*:*:*:*:*;cpe:2.3:a:veritas:netbackup:4.5.0:*:datacenter:*:*:*:*:*;cpe:2.3:a:veritas:netbackup:5.0:*:server:*:*:*:*:*;cpe:2.3:a:veritas:netbackup:5.1:*:enterprise_server:*:*:*:*:*;cpe:2.3:a:veritas:netbackup:5.1:*:server:*:*:*:*:*,Veritas,Netbackup
CVE-2004-1464,5.9,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H,0.05133,CWE-400,"Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a crafted TCP connection to the Telnet or reverse Telnet port.",2004-12-31,CISA,cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*,Cisco,Ios
CVE-2004-1520,0.0,,0.88509,NVD-CWE-Other,Stack-based buffer overflow in IPSwitch IMail 8.13 allows remote authenticated users to execute arbitrary code via a long IMAP DELETE command.,2004-12-31,Metasploit,cpe:2.3:a:ipswitch:imail:8.13:*:*:*:*:*:*:*,Ipswitch,Imail
CVE-2004-1550,0.0,,0.18614,NVD-CWE-Other,"Motorola Wireless Router WR850G running firmware 4.03 allows remote attackers to bypass authentication, log on as an administrator, and obtain sensitive information by repeatedly making an HTTP request for ver.asp until an administrator logs on.",2004-12-31,Metasploit,cpe:2.3:h:motorola:wr850g:4.0.3_firmware:*:*:*:*:*:*:*,Motorola,Wr850G
CVE-2004-1558,0.0,,0.71107,NVD-CWE-Other,Multiple stack-based buffer overflows in YPOPs! (aka YahooPOPS) 0.4 through 0.6 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) POP3 USER command or (2) SMTP request.,2004-12-31,Metasploit,cpe:2.3:a:ypops:ypops:0.4.1:*:*:*:*:*:*:*;cpe:2.3:a:ypops:ypops:0.4.2:*:*:*:*:*:*:*;cpe:2.3:a:ypops:ypops:0.4.3:*:*:*:*:*:*:*;cpe:2.3:a:ypops:ypops:0.4.4:*:*:*:*:*:*:*;cpe:2.3:a:ypops:ypops:0.4.5:*:*:*:*:*:*:*;cpe:2.3:a:ypops:ypops:0.4.6:*:*:*:*:*:*:*;cpe:2.3:a:ypops:ypops:0.4:*:*:*:*:*:*:*;cpe:2.3:a:ypops:ypops:0.5:*:*:*:*:*:*:*;cpe:2.3:a:ypops:ypops:0.6:*:*:*:*:*:*:*,Ypops,Ypops
CVE-2004-1561,0.0,,0.7827,NVD-CWE-Other,Buffer overflow in Icecast 2.0.1 and earlier allows remote attackers to execute arbitrary code via an HTTP request with a large number of headers.,2004-12-31,Metasploit,cpe:2.3:a:icecast:icecast:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:icecast:icecast:2.0:*:*:*:*:*:*:*,Icecast,Icecast
CVE-2004-1595,0.0,,0.5932,NVD-CWE-Other,Buffer overflow in ShixxNote 6.net build 117 allows remote attackers to execute arbitrary code via a long font field.,2004-10-13,Metasploit,cpe:2.3:a:shixxnote:shixxnote:6.net:*:*:*:*:*:*:*,Shixxnote,Shixxnote
CVE-2004-1602,0.0,,0.30679,CWE-203,"ProFTPD 1.2.x, including 1.2.8 and 1.2.10, responds in a different amount of time when a given username exists, which allows remote attackers to identify valid usernames by timing the server response.",2004-10-15,Nuclei,cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*,Proftpd,Proftpd
CVE-2004-1626,0.0,,0.67387,NVD-CWE-Other,"Buffer overflow in Ability Server 2.34, and possibly other versions, allows remote attackers to execute arbitrary code via a long STOR command.",2004-10-22,Metasploit,cpe:2.3:a:code-crafters:ability_server:2.2.5:*:*:*:*:*:*:*;cpe:2.3:a:code-crafters:ability_server:2.3.2:*:*:*:*:*:*:*;cpe:2.3:a:code-crafters:ability_server:2.3.4:*:*:*:*:*:*:*,Code-Crafters,Ability Server
CVE-2004-1638,0.0,,0.62756,NVD-CWE-Other,Buffer overflow in MailCarrier 2.51 allows remote attackers to execute arbitrary code via a long (1) EHLO and possibly (2) HELO command.,2004-10-16,Metasploit,cpe:2.3:a:tabs_laboratories:mailcarrier:2.51:*:*:*:*:*:*:*,Tabs Laboratories,Mailcarrier
CVE-2004-1641,0.0,,0.0824,NVD-CWE-Other,"Heap-based buffer overflow in Titan FTP 3.21 and earlier allows remote attackers to cause a denial of service (crash) via a long FTP command such as (1) CWD, (2) STAT, or (3) LIST.",2004-08-29,Nuclei,cpe:2.3:a:south_river_technologies:titan_ftp_server:2.10:*:*:*:*:*:*:*;cpe:2.3:a:south_river_technologies:titan_ftp_server:2.2:*:*:*:*:*:*:*;cpe:2.3:a:south_river_technologies:titan_ftp_server:3.01:*:*:*:*:*:*:*;cpe:2.3:a:south_river_technologies:titan_ftp_server:3.10:*:*:*:*:*:*:*;cpe:2.3:a:south_river_technologies:titan_ftp_server:3.21:*:*:*:*:*:*:*,South River Technologies,Titan Ftp Server
CVE-2004-1965,0.0,,0.09001,NVD-CWE-Other,"Multiple cross-site scripting (XSS) vulnerabilities in Open Bulletin Board (OpenBB) 1.0.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) redirect parameter to member.php, (2) to parameter to myhome.php (3) TID parameter to post.php, or (4) redirect parameter to index.php.",2004-04-25,Nuclei,cpe:2.3:a:openbb:openbb:1.0.0_beta1:*:*:*:*:*:*:*;cpe:2.3:a:openbb:openbb:1.0.0_rc1:*:*:*:*:*:*:*;cpe:2.3:a:openbb:openbb:1.0.0_rc2:*:*:*:*:*:*:*;cpe:2.3:a:openbb:openbb:1.0.0_rc3:*:*:*:*:*:*:*;cpe:2.3:a:openbb:openbb:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:openbb:openbb:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:openbb:openbb:1.0.8:*:*:*:*:*:*:*,Openbb,Openbb
CVE-2004-2074,0.0,,0.3578,NVD-CWE-Other,Format string vulnerability in Dream FTP 1.02 allows local users to cause a denial of service (crash) via format string specifiers in the (1) PASS or (2) RETR commands.,2004-12-31,Metasploit,cpe:2.3:a:bolintech:dream_ftp_server:1.02:*:*:*:*:*:*:*,Bolintech,Dream Ftp Server
CVE-2004-2086,0.0,,0.73601,NVD-CWE-Other,Stack-based buffer overflow in results.stm for Sambar Server before the 6.0 production release allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP POST request with a long query parameter.,2004-02-06,Metasploit,cpe:2.3:a:sambar:sambar_server:6.0:*:*:*:*:*:*:*;cpe:2.3:a:sambar:sambar_server:6.0:beta3:*:*:*:*:*:*,Sambar,Sambar Server
CVE-2004-2111,0.0,,0.86867,CWE-119,Stack-based buffer overflow in the site chmod command in Serv-U FTP Server before 4.2 allows remote attackers to execute arbitrary code via a long filename.,2004-12-31,Metasploit,cpe:2.3:a:solarwinds:serv-u_file_server:*:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:3.0.0.16:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:3.0.0.17:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:3.1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:3.1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:3.1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:4.0.0.4:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:4.1.0.0:*:*:*:*:*:*:*,Solarwinds,Serv-U File Server
CVE-2004-2221,0.0,,0.34763,NVD-CWE-Other,Buffer overflow in SoftCart.exe in Mercantec SoftCart 4.00b allows remote attackers to execute arbitrary code via a long parameter in an HTTP GET request.,2004-12-31,Metasploit,cpe:2.3:a:mercantec:softcart:4.00b:*:*:*:*:*:*:*,Mercantec,Softcart
CVE-2004-2271,0.0,,0.71908,NVD-CWE-Other,Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.,2004-12-31,Metasploit,cpe:2.3:a:minishare:minimal_http_server:*:*:*:*:*:*:*:*,Minishare,Minimal Http Server
CVE-2004-2416,0.0,,0.60587,NVD-CWE-Other,Buffer overflow in the logging component of CCProxy allows remote attackers to execute arbitrary code via a long HTTP GET request.,2004-12-31,Metasploit,cpe:2.3:a:youngzsoft:ccproxy:6.0:*:*:*:*:*:*:*,Youngzsoft,Ccproxy
CVE-2004-2466,0.0,,0.74696,CWE-119,"chat.ghp in Easy Chat Server 1.2 allows remote attackers to cause a denial of service (server crash) via a long username parameter, possibly due to a buffer overflow.  NOTE: it was later reported that 2.2 is also affected.",2004-12-31,Metasploit,cpe:2.3:a:efs_software:easy_chat_server:1.2:*:*:*:*:*:*:*;cpe:2.3:a:efs_software:easy_chat_server:2.2:*:*:*:*:*:*:*,Efs Software,Easy Chat Server
CVE-2004-2687,0.0,,0.80978,CWE-16,"distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without authorization checks.",2004-12-31,Metasploit/Nuclei,cpe:2.3:a:apple:xcode:1.5:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*,Apple,Xcode
CVE-2004-2691,0.0,,0.39064,NVD-CWE-Other,Unspecified vulnerability in 3Com SuperStack 3 4400 switches with firmware version before 3.31 allows remote attackers to cause a denial of service (device reset) via a crafted request to the web management interface.  NOTE: the provenance of this information is unknown; details are obtained from third party reports.,2004-12-31,Metasploit,cpe:2.3:h:3com:3c17205-us:*:firmware_3.30:*:*:*:*:*:*;cpe:2.3:h:3com:3c17210-us:*:firmware_3.30:*:*:*:*:*:*;cpe:2.3:h:3com:superstack_3_switch:4400:firmware_3.30:*:*:*:*:*:*;cpe:2.3:h:3com:superstack_3_switch:4400_se:firmware_3.30:*:*:*:*:*:*,3Com,3C17205-Us
CVE-2005-0043,0.0,,0.69005,NVD-CWE-Other,Buffer overflow in Apple iTunes 4.7 allows remote attackers to execute arbitrary code via a long URL in (1) .m3u or (2) .pls playlist files.,2005-05-02,Metasploit,cpe:2.3:a:apple:itunes:4.7:*:*:*:*:*:*:*,Apple,Itunes
CVE-2005-0059,0.0,,0.73868,NVD-CWE-Other,Buffer overflow in the Message Queuing component of Microsoft Windows 2000 and Windows XP SP1 allows remote attackers to execute arbitrary code via a crafted message.,2005-05-02,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_98:*:gold:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_98se:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:*:64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:*:embedded:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:*:home:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:*:media_center:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:gold:professional:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp1:64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp1:embedded:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp1:home:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp1:media_center:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:tablet_pc:*:*:*:*:*,Microsoft,Windows 2000
CVE-2005-0116,0.0,,0.74941,CWE-20,"AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter to aswtats.pl.",2005-01-18,Metasploit,cpe:2.3:a:awstats:awstats:*:*:*:*:*:*:*:*,Awstats,Awstats
CVE-2005-0260,0.0,,0.69727,NVD-CWE-Other,"Stack-based buffer overflow in the Discovery Service for BrightStor ARCserve Backup 11.1 and earlier allows remote attackers to execute arbitrary code via a long packet to UDP port 41524, which is not properly handled in a recvfrom call.",2005-05-02,Metasploit,cpe:2.3:a:broadcom:brightstor_arcserve_backup:11.1:*:*:*:*:*:*:*,Broadcom,Brightstor Arcserve Backup
CVE-2005-0277,0.0,,0.61909,NVD-CWE-Other,"Buffer overflow in the FTP service in 3Com 3CDaemon 2.0 revision 10 allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via (1) a long username in the USER command or (2) an FTP command that contains a long argument, such as cd, send, or ls.",2005-05-02,Metasploit,cpe:2.3:a:3com:3cdaemon:2.0:revision_10:*:*:*:*:*:*,3Com,3Cdaemon
CVE-2005-0308,0.0,,0.63881,NVD-CWE-Other,Buffer overflow in the wsprintf function in W32Dasm 8.93 and earlier allows remote attackers to execute arbitrary code via a large import or export function name.,2005-01-24,Metasploit,cpe:2.3:a:ursoftware:w32dasm:8.94:*:*:*:*:*:*:*,Ursoftware,W32Dasm
CVE-2005-0353,0.0,,0.7113,NVD-CWE-Other,Buffer overflow in the Sentinel LM (Lservnt) service in the Sentinel License Manager 7.2.0.2 allows remote attackers to execute arbitrary code by sending a large amount of data to UDP port 5093.,2005-05-02,Metasploit,cpe:2.3:a:safenet:sentinel_license_manager:7.2_.0.2:*:*:*:*:*:*:*,Safenet,Sentinel License Manager
CVE-2005-0455,0.0,,0.5399,NVD-CWE-Other,"Stack-based buffer overflow in the CSmil1Parser::testAttributeFailed function in smlparse.cpp for RealNetworks RealPlayer 10.5 (6.0.12.1056 and earlier), 10, 8, and RealOne Player V2 and V1 allows remote attackers to execute arbitrary code via a .SMIL file with a large system-screen-size value.",2005-05-02,Metasploit,cpe:2.3:a:realnetworks:realone_player:1.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realone_player:2.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:10.0_6.0.12.690:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:10.0_beta:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:10.5:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:10.5_6.0.12.1016_beta:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:10.5_6.0.12.1040:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:10.5_6.0.12.1053:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:8.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:8.0:*:win32:*:*:*:*:*,Realnetworks,Realone Player
CVE-2005-0478,0.0,,0.65364,NVD-CWE-Other,Multiple buffer overflows in TrackerCam 5.12 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) an HTTP request with a long User-Agent header or (2) a long argument to an arbitrary PHP script.,2005-03-30,Metasploit,cpe:2.3:a:trackercam:trackercam:*:*:*:*:*:*:*:*,Trackercam,Trackercam
CVE-2005-0491,0.0,,0.64901,NVD-CWE-Other,Stack-based buffer overflow in Knox Arkeia Server Backup 5.3.x allows remote attackers to execute arbitrary code via a long type 77 request.,2005-05-02,Metasploit,cpe:2.3:a:knox_software:arkeia_server_backup:5.3.0:*:*:*:*:*:*:*;cpe:2.3:a:knox_software:arkeia_server_backup:5.3.0_rc1:*:*:*:*:*:*:*;cpe:2.3:a:knox_software:arkeia_server_backup:5.3.0_rc2:*:*:*:*:*:*:*;cpe:2.3:a:knox_software:arkeia_server_backup:5.3.0_rc3:*:*:*:*:*:*:*;cpe:2.3:a:knox_software:arkeia_server_backup:5.3.0_rc4:*:*:*:*:*:*:*;cpe:2.3:a:knox_software:arkeia_server_backup:5.3.1:*:*:*:*:*:*:*;cpe:2.3:a:knox_software:arkeia_server_backup:5.3.2:*:*:*:*:*:*:*;cpe:2.3:a:knox_software:arkeia_server_backup:5.3.3:*:*:*:*:*:*:*;cpe:2.3:a:knox_software:arkeia_server_backup:5.3.4:*:*:*:*:*:*:*,Knox Software,Arkeia Server Backup
CVE-2005-0511,0.0,,0.35818,NVD-CWE-Other,"misc.php for vBulletin 3.0.6 and earlier, when ""Add Template Name in HTML Comments"" is enabled, allows remote attackers to execute arbitrary PHP code via nested variables in the template parameter.",2005-02-21,Metasploit,cpe:2.3:a:jelsoft:vbulletin:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:2.0:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:2.0_beta_2:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:2.0_beta_3:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:2.2.1:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:2.2.2:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:2.2.3:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:2.2.4:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:2.2.5:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:2.2.6:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:2.2.7:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:2.2.8:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:2.2.9_can:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:2.3.0:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:2.3.3:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:2.3.4:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:3.0.0_beta_2:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:3.0.0_can4:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:3.0.0_rc4:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:3.0.4:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:3.0.5:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:3.0.6:*:*:*:*:*:*:*;cpe:2.3:a:jelsoft:vbulletin:3.0_beta_2:*:*:*:*:*:*:*,Jelsoft,Vbulletin
CVE-2005-0581,0.0,,0.46344,NVD-CWE-Other,"Multiple buffer overflows in Computer Associates (CA) License Client and Server 0.1.0.15 allow remote attackers to execute arbitrary code via (1) certain long fields in the Checksum item in a GCR request, (2) a long IP address, hostname, or netmask values in a GCR request, (3) a long last parameter in a GETCONFIG packet, or (4) long values in a request with an invalid format.",2005-05-02,Metasploit,cpe:2.3:a:broadcom:license_software:0.1.0.15:*:*:*:*:*:*:*,Broadcom,License Software
CVE-2005-0595,0.0,,0.60083,NVD-CWE-Other,Buffer overflow in ext.dll in BadBlue 2.55 allows remote attackers to execute arbitrary code via a long mfcisapicommand parameter.,2005-05-02,Metasploit,cpe:2.3:a:working_resources_inc.:badblue:2.55:*:*:*:*:*:*:*,Working Resources Inc.,Badblue
CVE-2005-0684,0.0,,0.68504,NVD-CWE-Other,"Multiple buffer overflows in the web tool for MySQL MaxDB before 7.5.00.26 allows remote attackers to execute arbitrary code via (1) an HTTP GET request with a long file parameter after a percent (""%"") sign or (2) a long Lock-Token string to the WebDAV functionality, which is not properly handled by the getLockTokenHeader function in WDVHandler_CommonUtils.c.",2005-04-25,Metasploit,cpe:2.3:a:mysql:maxdb:7.5.00.08:*:*:*:*:*:*:*;cpe:2.3:a:mysql:maxdb:7.5.00.11:*:*:*:*:*:*:*;cpe:2.3:a:mysql:maxdb:7.5.00.12:*:*:*:*:*:*:*;cpe:2.3:a:mysql:maxdb:7.5.00.14:*:*:*:*:*:*:*;cpe:2.3:a:mysql:maxdb:7.5.00.15:*:*:*:*:*:*:*;cpe:2.3:a:mysql:maxdb:7.5.00.16:*:*:*:*:*:*:*;cpe:2.3:a:mysql:maxdb:7.5.00.18:*:*:*:*:*:*:*;cpe:2.3:a:mysql:maxdb:7.5.00.19:*:*:*:*:*:*:*;cpe:2.3:a:mysql:maxdb:7.5.00.23:*:*:*:*:*:*:*;cpe:2.3:a:mysql:maxdb:7.5.00:*:*:*:*:*:*:*,Mysql,Maxdb
CVE-2005-0768,0.0,,0.5953,NVD-CWE-Other,"Buffer overflow in the administration web server for GoodTech Telnet Server 4.0 and 5.0, and possibly all versions before 5.0.7, allows remote attackers to execute arbitrary code via a long string to port 2380.",2005-05-02,Metasploit,cpe:2.3:a:goodtech_systems:goodtech_telnet_server:4.0:*:windows_nt:*:*:*:*:*;cpe:2.3:a:goodtech_systems:goodtech_telnet_server:5.0:*:windows_nt:*:*:*:*:*,Goodtech Systems,Goodtech Telnet Server
CVE-2005-0771,0.0,,0.54155,NVD-CWE-Other,VERITAS Backup Exec Server (beserver.exe) 9.0 through 10.0 for Windows allows remote unauthenticated attackers to modify the registry by calling methods to the RPC interface on TCP port 6106.,2005-06-23,Metasploit,cpe:2.3:a:symantec_veritas:backup_exec:10.0_rev.5484:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.0_rev.4367:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.0_rev.4454:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.1_rev.4691:*:*:*:*:*:*:*,Symantec Veritas,Backup Exec
CVE-2005-0773,0.0,,0.86365,NVD-CWE-Other,"Stack-based buffer overflow in VERITAS Backup Exec Remote Agent 9.0 through 10.0 for Windows, and 9.0.4019 through 9.1.307 for Netware allows remote attackers to execute arbitrary code via a CONNECT_CLIENT_AUTH request with authentication method type 3 (Windows credentials) and a long password argument.",2005-06-18,Metasploit,cpe:2.3:a:symantec_veritas:backup_exec:10.0_rev.5484:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:10.0_rev.5484_sp1:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.0.4019:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.0.4170:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.0.4172:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.0.4174:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.0.4202:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.0_rev.4367:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.0_rev.4367_sp1:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.0_rev.4454:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.0_rev.4454_sp1:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.1.1067.2:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.1.1067.3:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.1.1127.1:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.1.1151.1:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.1.1152.4:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.1.1152:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.1.1154:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.1.306:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.1.307:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.1_rev.4691:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:9.1_rev.4691_sp2:*:*:*:*:*:*:*,Symantec Veritas,Backup Exec
CVE-2005-0850,0.0,,0.0219,CWE-20,"FileZilla FTP server before 0.9.6 allows remote attackers to cause a denial of service via a request for a filename containing an MS-DOS device name such as CON, NUL, COM1, LPT1, and others.",2005-05-02,Nuclei,cpe:2.3:a:filezilla-project:filezilla_server:*:*:*:*:*:*:*:*,Filezilla-Project,Filezilla Server
CVE-2005-0851,0.0,,0.0219,CWE-835,"FileZilla FTP server before 0.9.6, when using MODE Z (zlib compression), allows remote attackers to cause a denial of service (infinite loop) via certain file uploads or directory listings.",2005-05-02,Nuclei,cpe:2.3:a:filezilla-project:filezilla_server:*:*:*:*:*:*:*:*,Filezilla-Project,Filezilla Server
CVE-2005-10004,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01781,CWE-78,"Cacti versions prior to 0.8.6-d contain a remote command execution vulnerability in the graph_view.php script. An authenticated user can inject arbitrary shell commands via the graph_start GET parameter, which is improperly handled during graph rendering. This flaw allows attackers to execute commands on the underlying operating system with the privileges of the web server process, potentially compromising system integrity.",2025-08-30,Metasploit,cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*,Cacti,Cacti
CVE-2005-1009,0.0,,0.57017,NVD-CWE-Other,"Multiple buffer overflows in BakBone NetVault 6.x and 7.x allow (1) remote attackers to execute arbitrary code via a modified computer name and length that leads to a heap-based buffer overflow, or (2) local users to execute arbitrary code via a long Name entry in the configure.cfg file.",2005-05-02,Metasploit,cpe:2.3:a:bakbone:netvault:7.0:*:*:*:*:*:*:*;cpe:2.3:a:bakbone:netvault:7.1:*:*:*:*:*:*:*,Bakbone,Netvault
CVE-2005-1018,0.0,,0.58983,NVD-CWE-Other,Buffer overflow in the UniversalAgent for Computer Associates (CA) BrightStor ARCserve Backup allows remote authenticated users to cause a denial of service or execute arbitrary code via an agent request to TCP port 6050 with a large argument before the option field.,2005-05-02,Metasploit,cpe:2.3:a:ca:brightstor_arcserve_backup:11.1:*:windows:*:*:*:*:*,Ca,Brightstor Arcserve Backup
CVE-2005-1099,0.0,,0.67658,NVD-CWE-Other,"Multiple buffer overflows in the HandleChild function in server.c in Greylisting daemon (GLD) 1.3 and 1.4, when GLD is listening on a network interface, allow remote attackers to execute arbitrary code.",2005-04-12,Metasploit,cpe:2.3:a:salim_gasmi:gld:1.0:*:*:*:*:*:*:*;cpe:2.3:a:salim_gasmi:gld:1.1:*:*:*:*:*:*:*;cpe:2.3:a:salim_gasmi:gld:1.2:*:*:*:*:*:*:*;cpe:2.3:a:salim_gasmi:gld:1.3.1:*:*:*:*:*:*:*;cpe:2.3:a:salim_gasmi:gld:1.3:*:*:*:*:*:*:*;cpe:2.3:a:salim_gasmi:gld:1.4:*:*:*:*:*:*:*,Salim Gasmi,Gld
CVE-2005-1213,0.0,,0.73961,NVD-CWE-Other,"Stack-based buffer overflow in the news reader for Microsoft Outlook Express (MSOE.DLL) 5.5 SP2, 6, and 6 SP1 allows remote malicious NNTP servers to execute arbitrary code via a LIST response with a long second field.",2005-06-14,Metasploit,cpe:2.3:a:microsoft:outlook_express:5.5:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:outlook_express:6.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:outlook_express:6.0:sp1:*:*:*:*:*:*,Microsoft,Outlook Express
CVE-2005-1272,0.0,,0.66121,NVD-CWE-Other,Stack-based buffer overflow in the Backup Agent for Microsoft SQL Server in BrightStor ARCserve Backup Agent for SQL Server 11.0 allows remote attackers to execute arbitrary code via a long string sent to port (1) 6070 or (2) 6050.,2005-08-05,Metasploit,cpe:2.3:a:broadcom:brightstor_enterprise_backup:10.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_enterprise_backup:10.5:*:*:*:*:*:*:*;cpe:2.3:a:ca:brightstor_arcserve_backup:11.0:*:oracle:*:*:*:*:*;cpe:2.3:a:ca:brightstor_arcserve_backup:11.0:*:windows:*:*:*:*:*;cpe:2.3:a:ca:brightstor_arcserve_backup:11.1:*:oracle:*:*:*:*:*;cpe:2.3:a:ca:brightstor_arcserve_backup:11.1:*:windows:*:*:*:*:*;cpe:2.3:a:ca:brightstor_arcserve_backup:9.0.1:*:windows:*:*:*:*:*;cpe:2.3:a:ca:brightstor_arcserve_backup:9.0_1:*:oracle:*:*:*:*:*;cpe:2.3:a:ca:brightstor_arcserve_backup_agent:11.0:*:sap:*:*:*:*:*;cpe:2.3:a:ca:brightstor_arcserve_backup_agent:11.0:*:sql:*:*:*:*:*;cpe:2.3:a:ca:brightstor_arcserve_backup_agent:11.1:*:exchange:*:*:*:*:*;cpe:2.3:a:ca:brightstor_arcserve_backup_agent:11.1:*:sap:*:*:*:*:*;cpe:2.3:a:ca:brightstor_arcserve_backup_agent:11.1:*:sql:*:*:*:*:*;cpe:2.3:a:ca:brightstor_arcserve_backup_agent:11:*:exchange:*:*:*:*:*;cpe:2.3:a:ca:brightstor_arcserve_backup_agent:9.0.1:*:exchange:*:*:*:*:*;cpe:2.3:a:ca:brightstor_arcserve_backup_agent:9.0.1:*:sap:*:*:*:*:*;cpe:2.3:a:ca:brightstor_arcserve_backup_agent:9.0.1:*:sql:*:*:*:*:*;cpe:2.3:a:ca:brightstor_enterprise_backup_agent:10.0:*:oracle:*:*:*:*:*;cpe:2.3:a:ca:brightstor_enterprise_backup_agent:10.0:*:sap:*:*:*:*:*;cpe:2.3:a:ca:brightstor_enterprise_backup_agent:10.0:*:sql:*:*:*:*:*;cpe:2.3:a:ca:brightstor_enterprise_backup_agent:10.5:*:oracle:*:*:*:*:*;cpe:2.3:a:ca:brightstor_enterprise_backup_agent:10.5:*:sap:*:*:*:*:*;cpe:2.3:a:ca:brightstor_enterprise_backup_agent:10.5:*:sql:*:*:*:*:*,Broadcom,Brightstor Enterprise Backup
CVE-2005-1323,0.0,,0.63071,NVD-CWE-Other,Buffer overflow in NetFtpd for NetTerm 5.1.1 and earlier allows remote attackers to execute arbitrary code via a long USER command.,2005-05-02,Metasploit,cpe:2.3:a:intersoft:netterm:4.2.2:*:*:*:*:*:*:*,Intersoft,Netterm
CVE-2005-1348,0.0,,0.72622,NVD-CWE-Other,Buffer overflow in HTTPMail in MailEnable Enterprise 1.04 and earlier and Professional 1.54 and earlier allows remote attackers to execute arbitrary code via a long HTTP Authorization header.,2005-05-02,Metasploit,cpe:2.3:a:mailenable:mailenable_enterprise:*:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_professional:*:*:*:*:*:*:*:*,Mailenable,Mailenable Enterprise
CVE-2005-1415,0.0,,0.60455,NVD-CWE-Other,Buffer overflow in GlobalSCAPE Secure FTP Server 3.0.2 allows remote authenticated users to execute arbitrary code via a long FTP command.,2005-05-03,Metasploit,cpe:2.3:a:globalscape:secure_ftp_server:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:globalscape:secure_ftp_server:3.0:*:*:*:*:*:*:*,Globalscape,Secure Ftp Server
CVE-2005-1543,0.0,,0.66876,NVD-CWE-Other,"Multiple stack-based and heap-based buffer overflows in Remote Management authentication (zenrem32.exe) on Novell ZENworks 6.5 Desktop and Server Management, ZENworks for Desktops 4.x, ZENworks for Servers 3.x, and Remote Management allows remote attackers to execute arbitrary code via (1) unspecified vectors, (2) type 1 authentication requests, and (3) type 2 authentication requests.",2005-05-25,Metasploit,cpe:2.3:a:novell:zenworks:6.5:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_desktops:3.2:sp2:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_desktops:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_desktops:4.0:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_remote_management:*:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_server_management:6.5:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_servers:3.2:*:*:*:*:*:*:*,Novell,Zenworks
CVE-2005-1758,0.0,,0.16078,NVD-CWE-Other,Buffer overflow in the IMAP command continuation function in Novell NetMail 3.52 before 3.52C may allow remote attackers to execute arbitrary code.,2005-06-08,Metasploit,cpe:2.3:a:novell:netmail:3.0.3a:a:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.0.3a:b:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:*:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:a:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:b:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:c:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:d:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:e:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:f:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:g:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:h:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.1:*:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.1:f:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.5.2:a:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.5.2:b:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.5.2:e-ftfl:*:*:*:*:*:*,Novell,Netmail
CVE-2005-1790,0.0,,0.83472,CWE-399,"Microsoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka ""Mismatched Document Object Model Objects Memory Corruption Vulnerability.""",2005-06-01,Metasploit,cpe:2.3:a:microsoft:internet_explorer:6.0.2800.1106:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6.0.2900.2180:*:*:*:*:*:*:*,Microsoft,Internet Explorer
CVE-2005-1812,0.0,,0.62916,CWE-119,Multiple stack-based buffer overflows in FutureSoft TFTP Server Evaluation Version 1.0.0.1 allow remote attackers to execute arbitrary code via a long (1) filename or (2) transfer mode string in a Read Request (RRQ) or Write Request (WRQ) packet.,2005-06-01,Metasploit,cpe:2.3:a:futuresoft:tftp_server_2000:1.0.0.1:*:*:*:*:*:*:*,Futuresoft,Tftp Server 2000
CVE-2005-1815,0.0,,0.47192,NVD-CWE-Other,Multiple buffer overflows in Hummingbird Connectivity inetD 10.0.0.1 and 9.0.0.4 allows attackers to cause a denial of service and possibly execute arbitrary code via (1) an FTP command with a long argument to FTPD (ftpdw.exe) or (2) a large amount of data to LPD (Lpdw.exe).,2005-06-01,Metasploit,cpe:2.3:a:hummingbird:connectivity:10.0:*:*:*:*:*:*:*;cpe:2.3:a:hummingbird:connectivity:7.1:*:*:*:*:*:*:*;cpe:2.3:a:hummingbird:connectivity:9.0:*:*:*:*:*:*:*,Hummingbird,Connectivity
CVE-2005-1921,0.0,,0.79071,CWE-94,"Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.",2005-07-05,Metasploit,cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*;cpe:2.3:a:gggeek:phpxmlrpc:*:*:*:*:*:*:*:*;cpe:2.3:a:php:xml_rpc:*:*:*:*:*:pear:*:*;cpe:2.3:a:tiki:tikiwiki_cms\/groupware:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2005-1983,0.0,,0.93014,NVD-CWE-Other,"Stack-based buffer overflow in the Plug and Play (PnP) service for Microsoft Windows 2000 and Windows XP Service Pack 1 allows remote attackers to execute arbitrary code via a crafted packet, and local users to gain privileges via a malicious application, as exploited by the Zotob (aka Mytob) worm.",2005-08-10,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp1:tablet_pc:*:*:*:*:*,Microsoft,Windows 2000
CVE-2005-2086,0.0,,0.85366,NVD-CWE-Other,PHP remote file inclusion vulnerability in viewtopic.php in phpBB 2.0.15 and earlier allows remote attackers to execute arbitrary PHP code.,2005-07-05,Metasploit,cpe:2.3:a:phpbb_group:phpbb:2.0.15:*:*:*:*:*:*:*,Phpbb Group,Phpbb
CVE-2005-2120,0.0,,0.61971,NVD-CWE-Other,"Stack-based buffer overflow in the Plug and Play (PnP) service (UMPNPMGR.DLL) in Microsoft Windows 2000 SP4, and XP SP1 and SP2, allows remote or local authenticated attackers to execute arbitrary code via a large number of ""\"" (backslash) characters in a registry key name, which triggers the overflow in a wsprintfW function call.",2005-10-13,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:sp4:*:fr:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp1:tablet_pc:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:tablet_pc:*:*:*:*:*,Microsoft,Windows 2000
CVE-2005-2265,0.0,,0.68097,NVD-CWE-Other,"Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 allows remote attackers to cause a denial of service (access violation and crash), and possibly execute arbitrary code, by calling InstallVersion.compareTo with an object instead of a string.",2005-07-13,Metasploit,cpe:2.3:a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:0.9:rc:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.4.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.4:alpha:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.5.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.5:alpha:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.5:rc1:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.5:rc2:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.6:alpha:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.6:beta:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.7.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.7.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.7.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.7.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.7.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.7.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.7.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.7:alpha:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.7:beta:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.7:rc1:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.7:rc2:*:*:*:*:*:*;cpe:2.3:a:mozilla:mozilla:1.7:rc3:*:*:*:*:*:*,Mozilla,Firefox
CVE-2005-2278,0.0,,0.8464,NVD-CWE-Other,Stack-based buffer overflow in the IMAP daemon (imapd) in MailEnable Professional 1.54 allows remote authenticated users to execute arbitrary code via the status command with a long mailbox name.,2005-07-18,Metasploit,cpe:2.3:a:mailenable:mailenable_professional:1.54:*:*:*:*:*:*:*,Mailenable,Mailenable Professional
CVE-2005-2287,0.0,,0.56831,NVD-CWE-Other,"SoftiaCom wMailServer 1.0 and 2.0 allows remote attackers to cause a denial of service (application crash) via a large TCP packet with a leading space, possibly triggering a buffer overflow.",2005-07-18,Metasploit,cpe:2.3:a:softiacom:wmailserver:1.0:*:*:*:*:*:*:*;cpe:2.3:a:softiacom:wmailserver:2.0:*:*:*:*:*:*:*,Softiacom,Wmailserver
CVE-2005-2297,0.0,,0.74202,NVD-CWE-Other,Stack-based buffer overflow in TreeAction.do in Sybase EAServer 4.2.5 through 5.2 allows remote authenticated users to execute arbitrary code via a large javascript parameter.,2005-07-19,Metasploit,cpe:2.3:a:sybase:easerver:4.2.5:*:*:*:*:*:*:*;cpe:2.3:a:sybase:easerver:5.0:*:*:*:*:*:*:*;cpe:2.3:a:sybase:easerver:5.1:*:*:*:*:*:*:*;cpe:2.3:a:sybase:easerver:5.2:*:*:*:*:*:*:*,Sybase,Easerver
CVE-2005-2373,0.0,,0.45745,NVD-CWE-Other,"Buffer overflow in SlimFTPd 3.15 and 3.16 allows remote authenticated users to execute arbitrary code via a long directory name to (1) LIST, (2) DELE or (3) RNFR commands.",2005-07-26,Metasploit,cpe:2.3:a:whitsoft_development:slimftpd:3.15:*:*:*:*:*:*:*;cpe:2.3:a:whitsoft_development:slimftpd:3.16:*:*:*:*:*:*:*,Whitsoft Development,Slimftpd
CVE-2005-2428,0.0,,0.73028,NVD-CWE-Other,"Lotus Domino R5 and R6 WebMail, with ""Generate HTML for all fields"" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attackers to read the HTML source to obtain sensitive information such as (1) the password hash in the HTTPPassword field, (2) the password change date in the HTTPPasswordChangeDate field, (3) the client platform in the ClntPltfrm field, (4) the client machine name in the ClntMachine field, and (5) the client Lotus Domino release in the ClntBld field, a different vulnerability than CVE-2005-2696.",2005-08-03,Nuclei,cpe:2.3:a:ibm:lotus_domino:5.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_domino:6.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_domino:6.5:*:*:*:*:*:*:*,Ibm,Lotus Domino
CVE-2005-2535,0.0,,0.80866,NVD-CWE-Other,"Buffer overflow in the Discovery Service in BrightStor ARCserve Backup 9.0 through 11.1 allows remote attackers to execute arbitrary commands via a large packet to TCP port 41523, a different vulnerability than CVE-2005-0260.",2005-08-10,Metasploit,cpe:2.3:a:broadcom:arcserve_backup_2000:r16.5:*:windows:ja:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:11.0:*:windows:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:11.1:*:aix:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:11.1:*:linux:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:11.1:*:macintosh:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:11.1:*:netware:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:11.1:*:solaris:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:11.1:*:tru64:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:11.1:*:windows:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:7.0:*:linux:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:9.0.1:*:windows:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:9.0:*:linux:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:9.0:*:linux:ja:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:9.0:*:netware:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup_hp:11.1:*:hp:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_enterprise_backup:10.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_enterprise_backup:10.0:*:aix:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_enterprise_backup:10.0:*:hpux:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_enterprise_backup:10.0:*:mainframe_linux:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_enterprise_backup:10.5:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_enterprise_backup:10.5:*:aix:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_enterprise_backup:10.5:*:hp:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_enterprise_backup:10.5:*:solaris:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_enterprise_backup:10.5:*:tru64:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_enterprise_backup:10.5:*:windows:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_enterprise_backup:10:*:solaris:*:*:*:*:*,Broadcom,Arcserve Backup 2000
CVE-2005-2551,0.0,,0.55424,NVD-CWE-Other,Buffer overflow in dhost.exe in iMonitor for Novell eDirectory 8.7.3 on Windows allows attackers to cause a denial of service (crash) and obtain access to files via unknown vectors.,2005-08-12,Metasploit,cpe:2.3:a:novell:edirectory:8.7.3:*:*:*:*:*:*:*,Novell,Edirectory
CVE-2005-2611,0.0,,0.87026,NVD-CWE-Other,"VERITAS Backup Exec for Windows Servers 8.6 through 10.0, Backup Exec for NetWare Servers 9.0 and 9.1, and NetBackup for NetWare Media Server Option 4.5 through 5.1 uses a static password during authentication from the NDMP agent to the server, which allows remote attackers to read and write arbitrary files with the backup server.",2005-08-17,Metasploit,cpe:2.3:a:symantec_veritas:backup_exec:netware_servers_9.0.4019:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:netware_servers_9.0.4170:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:netware_servers_9.0.4172:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:netware_servers_9.0.4174:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:netware_servers_9.0.4202:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:netware_servers_9.1.1067_.2:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:netware_servers_9.1.1067_.3:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:netware_servers_9.1.1127_.1:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:netware_servers_9.1.1151_.1:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:netware_servers_9.1.1152:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:netware_servers_9.1.1152_.4:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:netware_servers_9.1.1154:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:netware_servers_9.1.1156:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:netware_servers_9.1.306:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:netware_servers_9.1.307:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:windows_servers_10.0_rev._5484:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:windows_servers_10.0_rev._5484_sp1:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:windows_servers_10.0_rev._5520:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:windows_servers_8.6:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:windows_servers_9.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:windows_servers_9.0_rev._4367:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:windows_servers_9.0_rev._4367_sp1:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:windows_servers_9.0_rev._4454:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:windows_servers_9.0_rev._4454_sp1:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:windows_servers_9.1:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:windows_servers_9.1_rev._4691:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec:windows_servers_9.1_rev._4691_sp2:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec_remote_agent:netware_server:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec_remote_agent:unix_linux_server:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:backup_exec_remote_agent:windows_server:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_4.5:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_4.5_fp1:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_4.5_fp2:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_4.5_fp3:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_4.5_fp4:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_4.5_fp5:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_4.5_fp6:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_4.5_fp7:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_4.5_fp8:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_4.5_mp1:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_4.5_mp2:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_4.5_mp3:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_4.5_mp4:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_4.5_mp5:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_4.5_mp6:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_4.5_mp7:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_4.5_mp8:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_5.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_5.0_mp1:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_5.0_mp2:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_5.0_mp3:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_5.0_mp4:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_5.0_mp5:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_5.1:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_5.1_mp1:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_5.1_mp2:*:*:*:*:*:*:*;cpe:2.3:a:symantec_veritas:netbackup:netware_media_servers_5.1_mp3:*:*:*:*:*:*:*,Symantec Veritas,Backup Exec
CVE-2005-2612,0.0,,0.38771,NVD-CWE-Other,Direct code injection vulnerability in WordPress 1.5.1.3 and earlier allows remote attackers to execute arbitrary PHP code via the cache_lastpostdate[server] cookie.,2005-08-17,Metasploit,cpe:2.3:a:wordpress:wordpress:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.0:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.5.1.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.5.1.3:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.5.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.5:*:*:*:*:*:*:*,Wordpress,Wordpress
CVE-2005-2668,0.0,,0.75244,NVD-CWE-Other,"Multiple buffer overflows in Computer Associates (CA) Message Queuing (CAM / CAFT) 1.05, 1.07 before Build 220_13, and 1.11 before Build 29_13 allow remote attackers to execute arbitrary code via unknown vectors.",2005-08-23,Metasploit,cpe:2.3:a:broadcom:advantage_data_transport:3.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:adviseit:2.4:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_portal:11.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_san_manager:1.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_san_manager:1.1:sp1:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_san_manager:1.1:sp2:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_san_manager:11.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:cleverpath_aion:10.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:cleverpath_ecm:3.5:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:cleverpath_olap:5.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:cleverpath_predictive_analysis_server:2.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:cleverpath_predictive_analysis_server:3.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:etrust_admin:8.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:etrust_admin:8.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:messaging:1.11:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:messaging:1.5:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:messaging:1.7:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_application_performance_monitor:3.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_application_performance_monitor:3.5:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_asset_management:3.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_asset_management:3.2:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_asset_management:3.2:sp1:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_asset_management:3.2:sp2:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_asset_management:4.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_data_transport_option:2.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_jasmine:3.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_management_portal:2.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_management_portal:3.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_network_and_systems_management:3.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_network_and_systems_management:3.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_nsm_wireless_network_management_option:3.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_performance_management:2.4:sp3:openvms:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_remote_control:6.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_remote_control:6.0:sp1:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_service_level_management:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_service_level_management:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_service_level_management:3.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_service_level_management:3.5:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_software_delivery:3.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_software_delivery:3.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_software_delivery:3.1:sp1:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_software_delivery:3.1:sp2:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_software_delivery:4.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_tng:2.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_tng:2.2:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_tng:2.4.2:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_tng:2.4:*:*:*:*:*:*:*;cpe:2.3:a:ca:etrust_admin:2.1:*:*:*:*:*:*:*;cpe:2.3:a:ca:etrust_admin:2.4:*:*:*:*:*:*:*;cpe:2.3:a:ca:etrust_admin:2.7:*:*:*:*:*:*:*;cpe:2.3:a:ca:etrust_admin:2.9:*:*:*:*:*:*:*;cpe:2.3:a:ca:unicenter_asset_management:4.0:sp1:*:*:*:*:*:*;cpe:2.3:a:ca:unicenter_enterprise_job_manager:1.0:sp1:*:*:*:*:*:*;cpe:2.3:a:ca:unicenter_enterprise_job_manager:1.0:sp2:*:*:*:*:*:*;cpe:2.3:a:ca:unicenter_management:3.5:*:websphere_mq:*:*:*:*:*;cpe:2.3:a:ca:unicenter_management:4.0:*:lotus_notes_domino:*:*:*:*:*;cpe:2.3:a:ca:unicenter_management:4.0:*:microsoft_exchange:*:*:*:*:*;cpe:2.3:a:ca:unicenter_management:4.1:*:microsoft_exchange:*:*:*:*:*;cpe:2.3:a:ca:unicenter_management:5.0.1:*:web_servers:*:*:*:*:*;cpe:2.3:a:ca:unicenter_management:5.0:*:web_servers:*:*:*:*:*;cpe:2.3:a:ca:unicenter_software_delivery:4.0:sp1:*:*:*:*:*:*;cpe:2.3:a:ca:unicenter_tng:2.2:*:*:ja:*:*:*:*,Broadcom,Advantage Data Transport
CVE-2005-2733,0.0,,0.50888,NVD-CWE-Other,"upload_img_cgi.php in Simple PHP Blog (SPHPBlog) does not properly restrict file extensions of uploaded files, which could allow remote attackers to execute arbitrary code.",2005-08-30,Metasploit,cpe:2.3:a:alexander_palmo:simple_php_blog:0.4.0:*:*:*:*:*:*:*,Alexander Palmo,Simple Php Blog
CVE-2005-2773,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.7409,CWE-77,"HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) node parameter to connectedNodes.ovpl, (2) cdpView.ovpl, (3) freeIPaddrs.ovpl, and (4) ecscmg.ovpl.",2005-09-02,CISA/Metasploit,cpe:2.3:a:hp:openview_network_node_manager:*:*:*:*:*:*:*:*,Hp,Openview Network Node Manager
CVE-2005-2799,0.0,,0.70753,NVD-CWE-Other,"Buffer overflow in apply.cgi in Linksys WRT54G 3.01.03, 3.03.6, and possibly other versions before 4.20.7, allows remote attackers to execute arbitrary code via a long HTTP POST request.",2005-09-15,Metasploit,cpe:2.3:h:linksys:wrt54g:3.01.3:*:*:*:*:*:*:*;cpe:2.3:h:linksys:wrt54g:3.03.6:*:*:*:*:*:*:*,Linksys,Wrt54G
CVE-2005-2847,0.0,,0.53375,NVD-CWE-Other,img.pl in Barracuda Spam Firewall running firmware 3.1.16 and 3.1.17 allows remote attackers to execute arbitrary commands via shell metacharacters in the f parameter.,2005-09-08,Metasploit,cpe:2.3:h:barracuda_networks:barracuda_spam_firewall:3.1.16:*:*:*:*:*:*:*;cpe:2.3:h:barracuda_networks:barracuda_spam_firewall:3.1.17:*:*:*:*:*:*:*,Barracuda Networks,Barracuda Spam Firewall
CVE-2005-2852,0.0,,0.40261,NVD-CWE-Other,"Unknown vulnerability in CIFS.NLM in Novell Netware 6.5 SP2 and SP3, 5.1, and 6.0 allows remote attackers to cause a denial of service (ABEND) via an incorrect password length, as exploited by the ""worm.rbot.ccc"" worm.",2005-09-08,Metasploit,cpe:2.3:o:novell:netware:5.1:*:*:*:*:*:*:*;cpe:2.3:o:novell:netware:6.0:*:*:*:*:*:*:*;cpe:2.3:o:novell:netware:6.5:sp2:*:*:*:*:*:*;cpe:2.3:o:novell:netware:6.5:sp3:*:*:*:*:*:*,Novell,Netware
CVE-2005-2877,0.0,,0.71104,NVD-CWE-Other,"The history (revision control) function in TWiki 02-Sep-2004 and earlier allows remote attackers to execute arbitrary code via shell metacharacters, as demonstrated via the rev parameter to TWikiUsers.",2005-09-16,Metasploit,cpe:2.3:a:twiki:twiki:2000-12-01:*:*:*:*:*:*:*;cpe:2.3:a:twiki:twiki:2001-12-01:*:*:*:*:*:*:*;cpe:2.3:a:twiki:twiki:2003-02-01:*:*:*:*:*:*:*;cpe:2.3:a:twiki:twiki:2004-09-01:*:*:*:*:*:*:*;cpe:2.3:a:twiki:twiki:2004-09-02:*:*:*:*:*:*:*,Twiki,Twiki
CVE-2005-3128,0.0,,0.03436,NVD-CWE-Other,Cross-site scripting (XSS) vulnerability in add.php in Address Add Plugin 1.9 and 2.0 for Squirrelmail allows remote attackers to inject arbitrary web script or HTML via the IMG tag.,2005-10-04,Nuclei,cpe:2.3:a:squirrelmail:address_add_plugin:1.9:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:address_add_plugin:2.0:*:*:*:*:*:*:*,Squirrelmail,Address Add Plugin
CVE-2005-3155,0.0,,0.63694,NVD-CWE-Other,Buffer overflow in the W3C logging for MailEnable Enterprise 1.1 and Professional 1.6 allows remote attackers to execute arbitrary code.,2005-10-05,Metasploit,cpe:2.3:a:mailenable:mailenable_enterprise:1.1:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_professional:1.6:*:*:*:*:*:*:*,Mailenable,Mailenable Enterprise
CVE-2005-3190,0.0,,0.65615,NVD-CWE-Other,"Buffer overflow in Computer Associates (CA) iGateway 3.0 and 4.0 before 4.0.050623, when running in debug mode, allows remote attackers to execute arbitrary code via HTTP GET requests.",2005-10-13,Metasploit,cpe:2.3:a:broadcom:igateway:3.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:igateway:4.0:*:*:*:*:*:*:*,Broadcom,Igateway
CVE-2005-3252,0.0,,0.83621,NVD-CWE-Other,Stack-based buffer overflow in the Back Orifice (BO) preprocessor for Snort before 2.4.3 allows remote attackers to execute arbitrary code via a crafted UDP packet.,2005-10-18,Metasploit,cpe:2.3:a:sourcefire:snort:2.4.0:*:*:*:*:*:*:*;cpe:2.3:a:sourcefire:snort:2.4.1:*:*:*:*:*:*:*;cpe:2.3:a:sourcefire:snort:2.4.2:*:*:*:*:*:*:*,Sourcefire,Snort
CVE-2005-3314,0.0,,0.65657,CWE-119,"Stack-based buffer overflow in the IMAP daemon in Novell Netmail 3.5.2 allows remote attackers to execute arbitrary code via ""long verb arguments.""",2005-11-18,Metasploit,cpe:2.3:a:novell:netmail:3.5.2:e-ftfl:*:*:*:*:*:*,Novell,Netmail
CVE-2005-3344,0.0,,0.07986,NVD-CWE-Other,"The default installation of Horde 3.0.4 contains an administrative account with a blank password, which allows remote attackers to gain access.",2005-11-16,Nuclei,cpe:2.3:a:horde:horde:3.0.4:*:*:*:*:*:*:*,Horde,Horde
CVE-2005-3398,0.0,,0.13108,CWE-200,"The default configuration of the web server for the Solaris Management Console (SMC) in Solaris 8, 9, and 10 enables the HTTP TRACE method, which could allow remote attackers to obtain sensitive information such as cookies and authentication data from HTTP headers.",2005-11-01,Metasploit,cpe:2.3:o:sun:solaris:10.0:*:sparc:*:*:*:*:*;cpe:2.3:o:sun:solaris:9.0:*:sparc:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.8:*:*:*:*:*:*:*,Sun,Solaris
CVE-2005-3498,0.0,,0.11293,CWE-200,"IBM WebSphere Application Server 5.0.x before 5.02.15, 5.1.x before 5.1.1.8, and 6.x before fixpack V6.0.2.5, when session trace is enabled, records a full URL including the queryString in the trace logs when an application encodes a URL, which could allow attackers to obtain sensitive information.",2005-11-04,Metasploit,cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*,Ibm,Websphere Application Server
CVE-2005-3589,0.0,,0.5286,NVD-CWE-Other,Buffer overflow in FileZilla Server Terminal 0.9.4d may allow remote attackers to cause a denial of service (terminal crash) via a long USER ftp command.,2005-11-16,Metasploit,cpe:2.3:a:filezilla:filezilla_server_terminal:0.9.4d:*:*:*:*:*:*:*,Filezilla,Filezilla Server Terminal
CVE-2005-3634,0.0,,0.17757,NVD-CWE-Other,frameset.htm in the BSP runtime in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to log users out and redirect them to arbitrary web sites via a close command in the sap-sessioncmd parameter and a URL in the sap-exiturl parameter.,2005-11-16,Nuclei,cpe:2.3:a:sap:sap_web_application_server:6.10:*:*:*:*:*:*:*;cpe:2.3:a:sap:sap_web_application_server:6.20:*:*:*:*:*:*:*;cpe:2.3:a:sap:sap_web_application_server:6.40:*:*:*:*:*:*:*;cpe:2.3:a:sap:sap_web_application_server:7.0:*:*:*:*:*:*:*,Sap,Sap Web Application Server
CVE-2005-3683,0.0,,0.71506,NVD-CWE-Other,"Stack-based buffer overflow in freeFTPd before 1.0.9 with Logging enabled, allows remote attackers to cause a denial of service (application crash), and possibly execute arbitrary code, via a long USER command.",2005-11-19,Metasploit,cpe:2.3:a:freeftpd:freeftpd:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:freeftpd:freeftpd:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:freeftpd:freeftpd:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:freeftpd:freeftpd:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:freeftpd:freeftpd:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:freeftpd:freeftpd:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:freeftpd:freeftpd:1.0.7:*:*:*:*:*:*:*;cpe:2.3:a:freeftpd:freeftpd:1.0.8:*:*:*:*:*:*:*;cpe:2.3:a:freeftpd:freeftpd:1.0:*:*:*:*:*:*:*,Freeftpd,Freeftpd
CVE-2005-3757,0.0,,0.4125,NVD-CWE-Other,"The Saxon XSLT parser in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to obtain sensitive information and execute arbitrary code via dangerous Java class methods in select attribute of xsl:value-of tags in XSLT style sheets, such as (1) system-property, (2) sys:getProperty, and (3) run:exec.",2005-11-22,Metasploit,cpe:2.3:h:google:mini_search_appliance:*:*:*:*:*:*:*:*;cpe:2.3:h:google:search_appliance:*:*:*:*:*:*:*:*,Google,Mini Search Appliance
CVE-2005-4085,0.0,,0.65925,NVD-CWE-Other,Buffer overflow in BlueCoat (a) WinProxy before 6.1a and (b) the web console access functionality in ProxyAV before 2.4.2.3 allows remote attackers to execute arbitrary code via a long Host: header.,2005-12-31,Metasploit,cpe:2.3:a:bluecoat:webproxy:4.0:r1a:*:*:*:*:*:*;cpe:2.3:a:bluecoat:webproxy:4.0:r1b:*:*:*:*:*:*;cpe:2.3:a:bluecoat:webproxy:4.0:r1c:*:*:*:*:*:*;cpe:2.3:a:bluecoat:webproxy:4.0:r1e:*:*:*:*:*:*;cpe:2.3:a:bluecoat:webproxy:4.0:r1f:*:*:*:*:*:*;cpe:2.3:a:bluecoat:webproxy:4.0:r1h:*:*:*:*:*:*;cpe:2.3:a:bluecoat:webproxy:4.0:r1k:*:*:*:*:*:*;cpe:2.3:a:bluecoat:webproxy:4.0:r1m:*:*:*:*:*:*;cpe:2.3:a:bluecoat:webproxy:4.0:r1n:*:*:*:*:*:*;cpe:2.3:a:bluecoat:webproxy:4.0:r1p:*:*:*:*:*:*;cpe:2.3:a:bluecoat:webproxy:5.0:r1a:*:*:*:*:*:*;cpe:2.3:a:bluecoat:webproxy:5.0:r1b:*:*:*:*:*:*;cpe:2.3:a:bluecoat:webproxy:5.0:r1c:*:*:*:*:*:*;cpe:2.3:a:bluecoat:webproxy:5.1:r1a:*:*:*:*:*:*;cpe:2.3:a:bluecoat:webproxy:5.1:r1d:*:*:*:*:*:*;cpe:2.3:a:bluecoat:webproxy:5.1:r1e:*:*:*:*:*:*;cpe:2.3:a:bluecoat:webproxy:5.2:r1a:*:*:*:*:*:*;cpe:2.3:a:bluecoat:webproxy:6.0:r1a:*:*:*:*:*:*;cpe:2.3:a:bluecoat:webproxy:6.0:r1c:*:*:*:*:*:*;cpe:2.3:h:bluecoat:proxyav:*:*:*:*:*:*:*:*,Bluecoat,Proxyav
CVE-2005-4145,0.0,,0.43919,NVD-CWE-Other,"The MSDE version of Lyris ListManager 5.0 through 8.9b configures the sa account in the database to use a password with a small search space (""lyris"" and up to 5 digits, possibly from the process ID), which allows remote attackers to gain access via a brute force attack.",2005-12-10,Metasploit,cpe:2.3:a:lyris_technologies_inc:listmanager:5.0:*:*:*:*:*:*:*;cpe:2.3:a:lyris_technologies_inc:listmanager:6.0:*:*:*:*:*:*:*;cpe:2.3:a:lyris_technologies_inc:listmanager:7.0:*:*:*:*:*:*:*;cpe:2.3:a:lyris_technologies_inc:listmanager:8.0:*:*:*:*:*:*:*;cpe:2.3:a:lyris_technologies_inc:listmanager:8.8a:*:*:*:*:*:*:*,Lyris Technologies Inc,Listmanager
CVE-2005-4267,0.0,,0.66803,CWE-119,"Stack-based buffer overflow in Qualcomm WorldMail 3.0 allows remote attackers to execute arbitrary code via a long IMAP command that ends with a ""}"" character, as demonstrated using long (1) LIST, (2) LSUB, (3) SEARCH TEXT, (4) STATUS INBOX, (5) AUTHENTICATE, (6) FETCH, (7) SELECT, and (8) COPY commands.",2005-12-21,Metasploit,cpe:2.3:a:qualcomm:worldmail:3.0:*:*:*:*:*:*:*,Qualcomm,Worldmail
CVE-2005-4385,0.0,,0.08836,NVD-CWE-Other,Cross-site scripting (XSS) vulnerability in search.htm in Cofax 2.0 RC3 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter.,2005-12-20,Nuclei,cpe:2.3:a:cofax:cofax:1.9.9c:*:*:*:*:*:*:*;cpe:2.3:a:cofax:cofax:1.9.9d:*:*:*:*:*:*:*;cpe:2.3:a:cofax:cofax:2.0_rc1:*:*:*:*:*:*:*;cpe:2.3:a:cofax:cofax:2.0_rc2:*:*:*:*:*:*:*;cpe:2.3:a:cofax:cofax:2.0_rc3:*:*:*:*:*:*:*,Cofax,Cofax
CVE-2005-4411,0.0,,0.64659,NVD-CWE-Other,Buffer overflow in Mercury Mail Transport System 4.01b allows remote attackers to execute arbitrary code via a long request to TCP port 105.,2005-12-20,Metasploit,cpe:2.3:a:david_harris:mercury_mail_transport_system:4.01b:*:*:*:*:*:*:*,David Harris,Mercury Mail Transport System
CVE-2005-4560,0.0,,0.86476,CWE-20,"The Windows Graphical Device Interface library (GDI32.DLL) in Microsoft Windows allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) format image with a crafted SETABORTPROC GDI Escape function call, related to the Windows Picture and Fax Viewer (SHIMGVW.DLL), a different vulnerability than CVE-2005-2123 and CVE-2005-2124, and as originally discovered in the wild on unionseek.com.",2005-12-28,Metasploit,cpe:2.3:o:microsoft:windows_2003_server:enterprise:*:64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:enterprise:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:r2:*:64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:standard:*:64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:standard:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:web:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:web:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:*:home:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:*:media_center:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:gold:professional:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp1:home:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp1:media_center:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:home:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:media_center:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:tablet_pc:*:*:*:*:*,Microsoft,Windows 2003 Server
CVE-2005-4734,0.0,,0.54485,NVD-CWE-Other,Stack-based buffer overflow in IISWebAgentIF.dll in RSA Authentication Agent for Web (aka SecurID Web Agent) 5.2 and 5.3 for IIS allows remote attackers to execute arbitrary code via a long url parameter in the Redirect method.,2005-12-31,Metasploit,cpe:2.3:a:rsa:authentication_agent_for_web:5.2:*:*:*:*:*:*:*;cpe:2.3:a:rsa:authentication_agent_for_web:5.3:*:*:*:*:*:*:*,Rsa,Authentication Agent For Web
CVE-2005-4797,0.0,,0.29182,NVD-CWE-Other,"Directory traversal vulnerability in printd line printer daemon (lpd) in Solaris 7 through 10 allows remote attackers to delete arbitrary files via "".."" sequences in an ""Unlink data file"" command.",2005-12-31,Metasploit,cpe:2.3:o:sun:solaris:10.0:*:sparc:*:*:*:*:*;cpe:2.3:o:sun:solaris:10.0:*:x86:*:*:*:*:*;cpe:2.3:o:sun:solaris:7.0:*:x86:*:*:*:*:*;cpe:2.3:o:sun:solaris:8.0:*:x86:*:*:*:*:*;cpe:2.3:o:sun:solaris:9.0:*:sparc:*:*:*:*:*;cpe:2.3:o:sun:solaris:9.0:*:x86:*:*:*:*:*;cpe:2.3:o:sun:solaris:9.0:x86_update_2:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.7:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.8:*:*:*:*:*:*:*,Sun,Solaris
CVE-2005-4832,0.0,,0.4167,NVD-CWE-Other,"SQL injection vulnerability in the Oracle Database Server 10g allows remote authenticated users to execute arbitrary SQL commands with elevated privileges via the SUBSCRIPTION_NAME parameter in the (1) SYS.DBMS_CDC_SUBSCRIBE and (2) SYS.DBMS_CDC_ISUBSCRIBE packages, a different vector than CVE-2005-1197.",2005-12-31,Metasploit,cpe:2.3:a:oracle:oracle10g:enterprise_10.1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:enterprise_10.1.0.3.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:enterprise_10.1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:enterprise_10.1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:enterprise_10.2.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:enterprise_9.0.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:enterprise_9.0.4_.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:personal_10.1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:personal_10.1.0.3.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:personal_10.1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:personal_10.1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:personal_10.10.3.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:personal_10.1_.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:personal_10.2.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:personal_9.0.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:personal_9.0.4_.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:standard_10.1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:standard_10.1.0.3.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:standard_10.1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:standard_10.1.0.4.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:standard_10.1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:standard_10.1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:standard_10.1_.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:standard_10.2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:standard_10.2.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:standard_9.0.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oracle10g:standard_9.0.4_.0:*:*:*:*:*:*:*,Oracle,Oracle10G
CVE-2006-0003,0.0,,0.825,NVD-CWE-noinfo,"Unspecified vulnerability in the RDS.Dataspace ActiveX control, which is contained in ActiveX Data Objects (ADO) and distributed in Microsoft Data Access Components (MDAC) 2.7 and 2.8, allows remote attackers to execute arbitrary code via unknown attack vectors.",2006-04-12,Metasploit,cpe:2.3:a:microsoft:data_access_components:2.5:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:data_access_components:2.7:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:data_access_components:2.7:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:data_access_components:2.8:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:data_access_components:2.8:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:data_access_components:2.8:sp2:*:*:*:*:*:*,Microsoft,Data Access Components
CVE-2006-0027,0.0,,0.78679,NVD-CWE-noinfo,Unspecified vulnerability in Microsoft Exchange allows remote attackers to execute arbitrary code via e-mail messages with crafted (1) vCal or (2) iCal Calendar properties.,2006-05-10,Metasploit,cpe:2.3:a:microsoft:exchange_server:2000:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2003:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2003:sp2:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2006-0295,0.0,,0.71311,NVD-CWE-Other,"Mozilla Firefox 1.5, Thunderbird 1.5 if Javascript is enabled in mail, and SeaMonkey before 1.0 might allow remote attackers to execute arbitrary code via the QueryInterface method of the built-in Location and Navigator objects, which leads to memory corruption.",2006-02-02,Metasploit,cpe:2.3:a:mozilla:firefox:1.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0:*:alpha:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0:beta:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5:*:*:*:*:*:*:*,Mozilla,Firefox
CVE-2006-0395,0.0,,0.54099,NVD-CWE-Other,"The Download Validation in Mail in Mac OS X 10.4 does not properly recognize attachment file types to warn a user of an unsafe type, which allows user-assisted remote attackers to execute arbitrary code via crafted file types.",2006-08-05,Metasploit,cpe:2.3:o:apple:mac_os_x:10.4.5:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x_server:10.4.5:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2006-0441,0.0,,0.71,NVD-CWE-Other,"Stack-based buffer overflow in Sami FTP Server 2.0.1 allows remote attackers to execute arbitrary code via a long USER command, which triggers the overflow when the log is viewed.",2006-01-26,Metasploit,cpe:2.3:a:karjasoft:sami_ftp_server:2.0.1:*:*:*:*:*:*:*,Karjasoft,Sami Ftp Server
CVE-2006-0460,0.0,,0.67754,NVD-CWE-Other,Multiple buffer overflows in BomberClone before 0.11.6.2 allow remote attackers to execute arbitrary code via long error messages.,2006-02-17,Metasploit,cpe:2.3:a:bomberclone:bomberclone:0.10.0:*:*:*:*:*:*:*;cpe:2.3:a:bomberclone:bomberclone:0.11.3:*:*:*:*:*:*:*;cpe:2.3:a:bomberclone:bomberclone:0.11.4:*:*:*:*:*:*:*;cpe:2.3:a:bomberclone:bomberclone:0.11.5:*:*:*:*:*:*:*;cpe:2.3:a:bomberclone:bomberclone:0.11.6:*:*:*:*:*:*:*;cpe:2.3:a:bomberclone:bomberclone:0.1:*:*:*:*:*:*:*;cpe:2.3:a:bomberclone:bomberclone:0.2:*:*:*:*:*:*:*;cpe:2.3:a:bomberclone:bomberclone:0.3:*:*:*:*:*:*:*;cpe:2.3:a:bomberclone:bomberclone:0.4:*:*:*:*:*:*:*;cpe:2.3:a:bomberclone:bomberclone:0.5:*:*:*:*:*:*:*;cpe:2.3:a:bomberclone:bomberclone:0.6:*:*:*:*:*:*:*;cpe:2.3:a:bomberclone:bomberclone:0.7:*:*:*:*:*:*:*;cpe:2.3:a:bomberclone:bomberclone:0.8:*:*:*:*:*:*:*;cpe:2.3:a:bomberclone:bomberclone:0.9.5:*:*:*:*:*:*:*;cpe:2.3:a:bomberclone:bomberclone:0.9.6:*:*:*:*:*:*:*;cpe:2.3:a:bomberclone:bomberclone:0.9.7:*:*:*:*:*:*:*;cpe:2.3:a:bomberclone:bomberclone:0.9.8:*:*:*:*:*:*:*;cpe:2.3:a:bomberclone:bomberclone:0.9.9:*:*:*:*:*:*:*,Bomberclone,Bomberclone
CVE-2006-0476,0.0,,0.74993,NVD-CWE-Other,Buffer overflow in Nullsoft Winamp 5.12 allows remote attackers to execute arbitrary code via a playlist (pls) file with a long file name (File1 field).,2006-01-31,Metasploit,cpe:2.3:a:nullsoft:winamp:5.12:*:*:*:*:*:*:*,Nullsoft,Winamp
CVE-2006-0564,0.0,,0.71457,NVD-CWE-Other,"Stack-based buffer overflow in Microsoft HTML Help Workshop 4.74.8702.0, and possibly earlier versions, and as included in the Microsoft HTML Help 1.4 SDK, allows context-dependent attackers to execute arbitrary code via a .hhp file with a long Contents file field.",2006-02-06,Metasploit,cpe:2.3:a:microsoft:html_help:1.4:*:sdk:*:*:*:*:*;cpe:2.3:a:microsoft:html_help_workshop:4.74.8702.0:*:*:*:*:*:*:*,Microsoft,Html Help
CVE-2006-0848,0.0,,0.58105,CWE-16,"The ""Open 'safe' files after downloading"" option in Safari on Apple Mac OS X allows remote user-assisted attackers to execute arbitrary commands by tricking a user into downloading a __MACOSX folder that contains metadata (resource fork) that invokes the Terminal, which automatically interprets the script using bash, as demonstrated using a ZIP file that contains a script with a safe file extension.",2006-02-22,Metasploit,cpe:2.3:o:apple:mac_os_x:10.4.5:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x_server:10.4.5:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2006-0900,0.0,,0.64373,NVD-CWE-Other,"nfsd in FreeBSD 6.0 kernel allows remote attackers to cause a denial of service via a crafted NFS mount request, as demonstrated by the ProtoVer NFS test suite.",2006-02-27,Metasploit,cpe:2.3:o:freebsd:freebsd:6.0:*:*:*:*:*:*:*,Freebsd,Freebsd
CVE-2006-0987,0.0,,0.5726,NVD-CWE-Other,"The default configuration of ISC BIND before 9.4.1-P1, when configured as a caching name server, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses.",2006-03-03,Metasploit,cpe:2.3:a:isc:bind:9.3.2:*:*:*:*:*:*:*,Isc,Bind
CVE-2006-0988,0.0,,0.54973,NVD-CWE-Other,"The default configuration of the DNS Server service on Windows Server 2003 and Windows 2000, and the Microsoft DNS Server service on Windows NT 4.0, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses.",2006-03-03,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:4.0:*:*:*:*:*:*:*,Microsoft,Windows 2000
CVE-2006-0992,0.0,,0.72833,NVD-CWE-Other,"Stack-based buffer overflow in Novell GroupWise Messenger before 2.0 Public Beta 2 allows remote attackers to execute arbitrary code via a long Accept-Language value without a comma or semicolon.  NOTE: due to a typo, the original ZDI advisory accidentally referenced CVE-2006-0092.  This is the correct identifier.",2006-04-14,Metasploit,cpe:2.3:a:novell:groupwise_messenger:2.0:*:*:*:*:*:*:*,Novell,Groupwise Messenger
CVE-2006-1016,0.0,,0.66674,NVD-CWE-Other,"Buffer overflow in the IsComponentInstalled method in Internet Explorer 6.0, when used on Windows 2000 before SP4 or Windows XP before SP1, allows remote attackers to execute arbitrary code via JavaScript that calls IsComponentInstalled with a long first argument.",2006-03-07,Metasploit,cpe:2.3:a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*,Microsoft,Internet Explorer
CVE-2006-1148,0.0,,0.72496,CWE-119,"Multiple stack-based buffer overflows in the procConnectArgs function in servmgr.cpp in PeerCast before 0.1217 allow remote attackers to execute arbitrary code via an HTTP GET request with a long (1) parameter name or (2) value in a URL, which triggers the overflow in the nextCGIarg function in servhs.cpp.",2006-03-10,Metasploit,cpe:2.3:a:peercast:peercast:*:*:*:*:*:*:*:*;cpe:2.3:a:peercast:peercast:0.1211:*:*:*:*:*:*:*;cpe:2.3:a:peercast:peercast:0.1212:*:*:*:*:*:*:*,Peercast,Peercast
CVE-2006-1255,0.0,,0.68147,NVD-CWE-Other,"Stack-based buffer overflow in the IMAP service in Mercur Messaging 5.0 SP3 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long string to the (1) LOGIN or (2) SELECT command, a different set of attack vectors and possibly a different vulnerability than CVE-2003-1177.",2006-03-19,Metasploit,cpe:2.3:a:mercur:mercur_messaging:*:*:*:*:*:*:*:*,Mercur,Mercur Messaging
CVE-2006-1359,0.0,,0.68068,CWE-94,"Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRange call on a checkbox object, which results in a dereference of an invalid table pointer.",2006-03-23,Metasploit,cpe:2.3:a:microsoft:ie:6.0:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:ie:6.0:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:ie:7.0:beta_2:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*,Microsoft,Ie
CVE-2006-1547,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.54635,NVD-CWE-Other,"ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.",2006-03-30,CISA,cpe:2.3:a:apache:commons_beanutils:1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*,Apache,Struts
CVE-2006-1551,0.0,,0.36127,NVD-CWE-Other,Eval injection vulnerability in pajax_call_dispatcher.php in PAJAX 0.5.1 and earlier allows remote attackers to execute arbitrary code via the (1) $method and (2) $args parameters.,2006-04-13,Metasploit,cpe:2.3:a:georges_auberger:pajax:0.5.0:*:*:*:*:*:*:*;cpe:2.3:a:georges_auberger:pajax:0.5.1:*:*:*:*:*:*:*,Georges Auberger,Pajax
CVE-2006-1652,0.0,,0.67398,CWE-119,"Multiple buffer overflows in (a) UltraVNC (aka Ultr@VNC) 1.0.1 and earlier and (b) tabbed_viewer 1.29 (1) allow user-assisted remote attackers to execute arbitrary code via a malicious server that sends a long string to a client that connects on TCP port 5900, which triggers an overflow in Log::ReallyPrint; and (2) allow remote attackers to cause a denial of service (server crash) via a long HTTP GET request to TCP port 5800, which triggers an overflow in VNCLog::ReallyPrint.",2006-04-06,Metasploit,cpe:2.3:a:ultravnc:tabbed_viewer:1.29:*:*:*:*:*:*:*;cpe:2.3:a:ultravnc:vnc_viewer:1.0.1:*:*:*:*:*:*:*,Ultravnc,Tabbed Viewer
CVE-2006-1681,0.0,,0.06643,NVD-CWE-Other,"Cross-site scripting (XSS) vulnerability in Cherokee HTTPD 0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a malformed request that generates an HTTP 400 error, which is not properly handled when the error message is generated.",2006-04-11,Nuclei,cpe:2.3:a:cherokee:cherokee_httpd:0.1.5:*:*:*:*:*:*:*;cpe:2.3:a:cherokee:cherokee_httpd:0.1.6:*:*:*:*:*:*:*;cpe:2.3:a:cherokee:cherokee_httpd:0.1:*:*:*:*:*:*:*;cpe:2.3:a:cherokee:cherokee_httpd:0.2.5:*:*:*:*:*:*:*;cpe:2.3:a:cherokee:cherokee_httpd:0.2.6:*:*:*:*:*:*:*;cpe:2.3:a:cherokee:cherokee_httpd:0.2.7:*:*:*:*:*:*:*;cpe:2.3:a:cherokee:cherokee_httpd:0.2:*:*:*:*:*:*:*;cpe:2.3:a:cherokee:cherokee_httpd:0.4.17:*:*:*:*:*:*:*;cpe:2.3:a:cherokee:cherokee_httpd:0.4.6:*:*:*:*:*:*:*;cpe:2.3:a:cherokee:cherokee_httpd:0.4.7:*:*:*:*:*:*:*;cpe:2.3:a:cherokee:cherokee_httpd:0.4.8:*:*:*:*:*:*:*;cpe:2.3:a:cherokee:cherokee_httpd:0.4.9:*:*:*:*:*:*:*;cpe:2.3:a:cherokee:cherokee_httpd:0.5:*:*:*:*:*:*:*,Cherokee,Cherokee Httpd
CVE-2006-2081,0.0,,0.21556,NVD-CWE-Other,"Oracle Database Server 10g Release 2 allows local users to execute arbitrary SQL queries via the GET_DOMAIN_INDEX_METADATA function in the DBMS_EXPORT_EXTENSION package. NOTE: this issue was originally linked to DB05 (CVE-2006-1870), but a reliable third party has claimed that it is not the same issue. Based on details of the problem, the primary issue appears to be insecure privileges that facilitate the introduction of SQL in a way that is not related to special characters, so this is not ""SQL injection"" per se.",2006-04-27,Metasploit,cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*,Oracle,Database Server
CVE-2006-2086,0.0,,0.67312,NVD-CWE-Other,"Buffer overflow in JuniperSetupDLL.dll, loaded from JuniperSetup.ocx by the Juniper SSL-VPN Client when accessing a Juniper NetScreen IVE device running IVE OS before 4.2r8.1, 5.0 before 5.0r6.1, 5.1 before 5.1r8, 5.2 before 5.2r4.1, or 5.3 before 5.3r2.1, allows remote attackers to execute arbitrary code via a long argument in the ProductName parameter.",2006-04-29,Metasploit,cpe:2.3:a:juniper:junipersetup_control:*:*:*:*:*:*:*:*,Juniper,Junipersetup Control
CVE-2006-2173,0.0,,0.06499,NVD-CWE-Other,"Buffer overflow in FileZilla FTP Server 2.2.22 allows remote authenticated attackers to cause a denial of service and possibly execute arbitrary code via a long (1) PORT or (2) PASS followed by the MLSD command, or (2) the remote server interface, as demonstrated by the Infigo FTPStress Fuzzer.",2006-05-04,Nuclei,cpe:2.3:a:filezilla:filezilla_server:*:*:*:*:*:*:*:*,Filezilla,Filezilla Server
CVE-2006-2212,0.0,,0.58229,NVD-CWE-Other,Buffer overflow in KarjaSoft Sami FTP Server 2.0.2 and earlier allows remote attackers to execute arbitrary code via a long (1) USER or (2) PASS command.,2006-05-05,Metasploit,cpe:2.3:a:karjasoft:sami_ftp_server:2.0.2:*:*:*:*:*:*:*,Karjasoft,Sami Ftp Server
CVE-2006-2237,0.0,,0.58356,NVD-CWE-Other,"The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.",2006-05-08,Metasploit,cpe:2.3:a:awstats:awstats:6.4:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:6.5:*:*:*:*:*:*:*,Awstats,Awstats
CVE-2006-2369,0.0,,0.91522,CWE-287,"RealVNC 4.1.1, and other products that use RealVNC such as AdderLink IP and Cisco CallManager, allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as ""Type 1 - None"", which is accepted even if it is not offered by the server, as originally demonstrated using a long password.",2006-05-15,Metasploit,cpe:2.3:a:vnc:realvnc:4.1.1:*:*:*:*:*:*:*,Vnc,Realvnc
CVE-2006-2370,0.0,,0.70144,NVD-CWE-Other,"Buffer overflow in the Routing and Remote Access service (RRAS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted ""RPC related requests,"" aka the ""RRAS Memory Corruption Vulnerability.""",2006-06-13,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:datacenter_edition:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:datacenter_edition:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:datacenter_edition_64-bit:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:datacenter_edition_64-bit:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:enterprise_64-bit:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:enterprise_edition:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:enterprise_edition_64-bit:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:enterprise_edition_64-bit:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:r2:*:datacenter_64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:sp1:*:enterprise:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:standard:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:standard:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:standard_64-bit:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:web:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:web:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:*:64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:*:home:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:*:media_center:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:gold:professional:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp1:home:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp1:media_center:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:home:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:media_center:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:tablet_pc:*:*:*:*:*,Microsoft,Windows 2000
CVE-2006-2407,0.0,,0.71375,CWE-119,"Stack-based buffer overflow in (1) WeOnlyDo wodSSHServer ActiveX Component 1.2.7 and 1.3.3 DEMO, as used in other products including (2) FreeSSHd 1.0.9 and (3) freeFTPd 1.0.10, allows remote attackers to execute arbitrary code via a long key exchange algorithm string.",2006-05-16,Metasploit,cpe:2.3:a:freeftpd:freeftpd:1.0.10:*:*:*:*:*:*:*;cpe:2.3:a:freesshd:freesshd:1.0.9:*:*:*:*:*:*:*;cpe:2.3:a:weonlydo:wodsshserver:1.2.7:*:*:*:*:*:*:*;cpe:2.3:a:weonlydo:wodsshserver:1.3.3_demo:*:*:*:*:*:*:*,Freeftpd,Freeftpd
CVE-2006-2447,0.0,,0.74703,NVD-CWE-noinfo,"SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username.",2006-06-06,Metasploit,cpe:2.3:a:apache:spamassassin:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:spamassassin:3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:spamassassin:3.1.2:*:*:*:*:*:*:*,Apache,Spamassassin
CVE-2006-2492,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.48387,CWE-120,"Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack.",2006-05-20,CISA,cpe:2.3:a:microsoft:office:2000:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2003:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2003:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:works_suite:*:*:*:*:*:*:*:*,Microsoft,Office
CVE-2006-2502,0.0,,0.53333,NVD-CWE-Other,"Stack-based buffer overflow in pop3d in Cyrus IMAPD (cyrus-imapd) 2.3.2, when the popsubfolders option is enabled, allows remote attackers to execute arbitrary code via a long USER command.",2006-05-22,Metasploit,cpe:2.3:a:cyrus:imapd:2.3.2:*:*:*:*:*:*:*,Cyrus,Imapd
CVE-2006-2630,0.0,,0.73558,NVD-CWE-Other,Stack-based buffer overflow in Symantec Antivirus 10.1 and Client Security 3.1 allows remote attackers to execute arbitrary code via unknown attack vectors.,2006-05-27,Metasploit,cpe:2.3:a:symantec:client_security:3.0.2.2010:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.2.2020:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.1.394:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.1.400:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.1:*:*:*:*:*:*:*;cpe:2.3:a:symantec:norton_antivirus:10.0.2.2010:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:norton_antivirus:10.0.2.2020:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:norton_antivirus:10.0.2.2021:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:norton_antivirus:10.0:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:norton_antivirus:10.1.400:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:norton_antivirus:10.1:*:corporate:*:*:*:*:*,Symantec,Client Security
CVE-2006-2685,0.0,,0.49185,CWE-94,"PHP remote file inclusion vulnerability in Basic Analysis and Security Engine (BASE) 1.2.4 and earlier, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via a URL in the BASE_path parameter to (1) base_qry_common.php, (2) base_stat_common.php, and (3) includes/base_include.inc.php.",2006-05-31,Metasploit,cpe:2.3:a:kevin_johnson:basic_analysis_and_security_engine:1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:kevin_johnson:basic_analysis_and_security_engine:1.2.1:*:*:*:*:*:*:*;cpe:2.3:a:kevin_johnson:basic_analysis_and_security_engine:1.2.2:*:*:*:*:*:*:*;cpe:2.3:a:kevin_johnson:basic_analysis_and_security_engine:1.2.4:*:*:*:*:*:*:*,Kevin Johnson,Basic Analysis And Security Engine
CVE-2006-2842,0.0,,0.44016,NVD-CWE-Other,"PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the plugins array parameter.  NOTE: this issue has been disputed by third parties, who state that Squirrelmail provides prominent warnings to the administrator when register_globals is enabled.  Since the varieties of administrator negligence are uncountable, perhaps this type of issue should not be included in CVE.  However, the original developer has posted a security advisory, so there might be relevant real-world environments under which this vulnerability is applicable",2006-06-06,Nuclei,cpe:2.3:a:squirrelmail:squirrelmail:*:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.2.10:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.2.11:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.2.1:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.2.2:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.2.3:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.2.4:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.2.5:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.2.6:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.2.7:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.2.8:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.2.9:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.4.1:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.4.2:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.4.3_r3:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.4.3_rc1:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.4.3a:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.4.4:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.4.4_rc1:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.4.5:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.4.6_rc1:*:*:*:*:*:*:*;cpe:2.3:a:squirrelmail:squirrelmail:1.4:*:*:*:*:*:*:*,Squirrelmail,Squirrelmail
CVE-2006-2926,0.0,,0.70702,NVD-CWE-Other,Stack-based buffer overflow in the WWW Proxy Server of Qbik WinGate 6.1.1.1077 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long URL HTTP request.,2006-06-09,Metasploit,cpe:2.3:a:qbik:wingate:6.1.1.1077:*:*:*:*:*:*:*,Qbik,Wingate
CVE-2006-2961,0.0,,0.61673,NVD-CWE-Other,Stack-based buffer overflow in CesarFTP 0.99g and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long MKD command.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.,2006-06-12,Metasploit,cpe:2.3:a:aclogic:cesarftp:*:*:*:*:*:*:*:*,Aclogic,Cesarftp
CVE-2006-3252,0.0,,0.61627,NVD-CWE-Other,Buffer overflow in the Online Registration Facility for Algorithmic Research PrivateWire VPN software up to 3.7 allows remote attackers to execute arbitrary code via a long GET request.,2006-06-27,Metasploit,cpe:2.3:a:algorithmic_research:privatewire_gateway:3.7:*:*:*:*:*:*:*,Algorithmic Research,Privatewire Gateway
CVE-2006-3392,0.0,,0.77953,NVD-CWE-Other,"Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using ""..%01"" sequences, which bypass the removal of ""../"" sequences before bytes such as ""%01"" are removed from the filename.  NOTE: This is a different issue than CVE-2006-3274.",2006-07-06,Metasploit/Nuclei,cpe:2.3:a:usermin:usermin:*:*:*:*:*:*:*:*;cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*,Usermin,Usermin
CVE-2006-3439,0.0,,0.84957,NVD-CWE-Other,"Buffer overflow in the Server Service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers, including anonymous users, to execute arbitrary code via a crafted RPC message, a different vulnerability than CVE-2006-1314.",2006-08-09,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:sp4:*:fr:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:64-bit:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:itanium:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:sp1:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:sp1:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:*:64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp1:tablet_pc:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:tablet_pc:*:*:*:*:*,Microsoft,Windows 2000
CVE-2006-3459,0.0,,0.53046,CWE-119,"Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2, as used in Adobe Reader 9.3.0 and other products, allow context-dependent attackers to execute arbitrary code or cause a denial of service via unspecified vectors, including a large tdir_count value in the TIFFFetchShortPair function in tif_dirread.c.",2006-08-03,Metasploit,cpe:2.3:a:adobe:acrobat_reader:9.3.0:*:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.4:*:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.4:beta18:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.4:beta24:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.4:beta28:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.4:beta29:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.4:beta31:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.4:beta32:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.4:beta34:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.4:beta35:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.4:beta36:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.4:beta37:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.5.2:*:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.5.3:*:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.5.4:*:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.5.5:*:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.5.6:*:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.5.6:beta:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.5.7:*:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.5.7:alpha2:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.5.7:alpha3:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.5.7:alpha4:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.5.7:alpha:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.5.7:beta:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.6.0:*:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.6.0:beta2:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.6.0:beta:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.6.1:*:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.7.0:*:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.7.0:alpha:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.7.0:beta2:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.7.0:beta:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.7.1:*:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.7.2:*:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.7.3:*:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.7.4:*:*:*:*:*:*:*;cpe:2.3:a:libtiff:libtiff:3.8.0:*:*:*:*:*:*:*,Libtiff,Libtiff
CVE-2006-3524,0.0,,0.66993,NVD-CWE-Other,Buffer overflow in SIPfoundry sipXtapi released before 20060324 allows remote attackers to execute arbitrary code via a long CSeq field value in an INVITE message.,2006-07-12,Metasploit,cpe:2.3:a:sipfoundry:sipxtapi:*:*:*:*:*:*:*:*,Sipfoundry,Sipxtapi
CVE-2006-3677,0.0,,0.78359,CWE-16,"Mozilla Firefox 1.5 before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code by changing certain properties of the window navigator object (window.navigator) that are accessed when Java starts up, which causes a crash that leads to code execution.",2006-07-27,Metasploit,cpe:2.3:a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0:*:dev:*:*:*:*:*,Mozilla,Firefox
CVE-2006-3726,0.0,,0.63999,NVD-CWE-Other,"Buffer overflow in FileCOPA FTP Server before 1.01 released on 18th July 2006, allows remote authenticated attackers to execute arbitrary code via a long argument to the LIST command.",2006-07-21,Metasploit,cpe:2.3:a:intervations:filecopa:*:*:*:*:*:*:*:*,Intervations,Filecopa
CVE-2006-3730,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.63817,CWE-94,"Integer overflow in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a 0x7fffffff argument to the setSlice method on a WebViewFolderIcon ActiveX object, which leads to an invalid memory copy.",2006-07-21,Metasploit,cpe:2.3:a:microsoft:ie:6.0:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*,Microsoft,Windows Xp
CVE-2006-3747,0.0,,0.96436,CWE-189,"Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.",2006-07-28,EPSS/Metasploit,cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:5.04:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:5.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2006-3838,0.0,,0.73149,CWE-119,"Multiple stack-based buffer overflows in eIQnetworks Enterprise Security Analyzer (ESA) before 2.5.0, as used in products including (a) Sidewinder, (b) iPolicy Security Manager, (c) Astaro Report Manager, (d) Fortinet FortiReporter, (e) Top Layer Network Security Analyzer, and possibly other products, allow remote attackers to execute arbitrary code via long (1) DELTAINTERVAL, (2) LOGFOLDER, (3) DELETELOGS, (4) FWASERVER, (5) SYSLOGPUBLICIP, (6) GETFWAIMPORTLOG, (7) GETFWADELTA, (8) DELETERDEPDEVICE, (9) COMPRESSRAWLOGFILE, (10) GETSYSLOGFIREWALLS, (11) ADDPOLICY, and (12) EDITPOLICY commands to the Syslog daemon (syslogserver.exe); (13) GUIADDDEVICE, (14) ADDDEVICE, and (15) DELETEDEVICE commands to the Topology server (Topology.exe); the (15) LICMGR_ADDLICENSE command to the License Manager (EnterpriseSecurityAnalyzer.exe); the (16) TRACE and (17) QUERYMONITOR commands to the Monitoring agent (Monitoring.exe); and possibly other vectors related to the Syslog daemon (syslogserver.exe).",2006-07-27,Metasploit,cpe:2.3:a:eiqnetworks:enterprise_security_analyzer:*:*:*:*:*:*:*:*,Eiqnetworks,Enterprise Security Analyzer
CVE-2006-3942,0.0,,0.75027,CWE-20,"The server driver (srv.sys) in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (system crash) via an SMB_COM_TRANSACTION SMB message that contains a string without null character termination, which leads to a NULL dereference in the ExecuteTransaction function, possibly related to an ""SMB PIPE,"" aka the ""Mailslot DOS"" vulnerability.  NOTE: the name ""Mailslot DOS"" was derived from incomplete initial research; the vulnerability is not associated with a mailslot.",2006-07-31,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:sp4:*:fr:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:64-bit:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:itanium:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:sp1:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:sp1:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:*:64-bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp1:tablet_pc:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:tablet_pc:*:*:*:*:*,Microsoft,Windows 2000
CVE-2006-3952,0.0,,0.67068,NVD-CWE-Other,Stack-based buffer overflow in EFS Software Easy File Sharing FTP Server 2.0 allows remote attackers to execute arbitrary code via a long argument to the PASS command.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.,2006-08-01,Metasploit,cpe:2.3:a:efs_software:efs_ftp_server:2.0:*:*:*:*:*:*:*,Efs Software,Efs Ftp Server
CVE-2006-3961,0.0,,0.33824,CWE-119,"Buffer overflow in McSubMgr ActiveX control (mcsubmgr.dll) in McAfee Security Center 6.0.23 for Internet Security Suite 2006, Wireless Home Network Security, Personal Firewall Plus, VirusScan, Privacy Service, SpamKiller, AntiSpyware, and QuickClean allows remote user-assisted attackers to execute arbitrary commands via long string parameters, which are later used in vsprintf.",2006-08-01,Metasploit,cpe:2.3:a:mcafee:antispyware:2005:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:antispyware:2006:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:internet_security_suite:2004:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:internet_security_suite:2005:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:internet_security_suite:2006:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:personal_firewall_plus:2004:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:personal_firewall_plus:2005:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:personal_firewall_plus:2006:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:privacy_service:2004:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:privacy_service:2005:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:privacy_service:2006:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:quickclean:2004:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:quickclean:2005:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:quickclean:2006:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:security_center:4.3:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:security_center:6.0.22:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:security_center:6.0.23:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:security_center:6.0:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:spamkiller:5.0:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:spamkiller:6.0:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:spamkiller:7.0:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:virusscan:2004:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:virusscan:2005:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:virusscan:2006:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:wireless_home_network_security:2006:*:*:*:*:*:*:*,Mcafee,Antispyware
CVE-2006-4305,0.0,,0.70468,NVD-CWE-Other,Buffer overflow in SAP DB and MaxDB before 7.6.00.30 allows remote attackers to execute arbitrary code via a long database name when connecting via a WebDBM client.,2006-08-30,Metasploit,cpe:2.3:a:mysql:maxdb:*:*:*:*:*:*:*:*;cpe:2.3:a:sap-db:sap-db:*:*:*:*:*:*:*:*,Mysql,Maxdb
CVE-2006-4313,0.0,,0.12135,NVD-CWE-Other,"Multiple unspecified vulnerabilities in Cisco VPN 3000 series concentrators before 4.1, 4.1.x up to 4.1(7)L, and 4.7.x up to 4.7(2)F allow attackers to execute the (1) CWD, (2) MKD, (3) CDUP, (4) RNFR, (5) SIZE, and (6) RMD FTP commands to modify files or create and delete directories via unknown vectors.",2006-08-23,Metasploit,cpe:2.3:o:cisco:vpn_3000_concentrator_series_software:4.0.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:vpn_3000_concentrator_series_software:4.0.5.b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:vpn_3000_concentrator_series_software:4.0:*:*:*:*:*:*:*;cpe:2.3:o:cisco:vpn_3000_concentrator_series_software:4.1.5.b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:vpn_3000_concentrator_series_software:4.1.7.a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:vpn_3000_concentrator_series_software:4.1.7.b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:vpn_3000_concentrator_series_software:4.1.7.l:*:*:*:*:*:*:*;cpe:2.3:o:cisco:vpn_3000_concentrator_series_software:4.7.1.f:*:*:*:*:*:*:*;cpe:2.3:o:cisco:vpn_3000_concentrator_series_software:4.7.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:vpn_3000_concentrator_series_software:4.7.2.f:*:*:*:*:*:*:*;cpe:2.3:o:cisco:vpn_3000_concentrator_series_software:4.7:*:*:*:*:*:*:*,Cisco,Vpn 3000 Concentrator Series Software
CVE-2006-4318,0.0,,0.62409,NVD-CWE-Other,Buffer overflow in WFTPD Server 3.23 allows remote attackers to execute arbitrary code via long SIZE commands.,2006-08-24,Metasploit,cpe:2.3:a:texas_imperial_software:wftpd:3.23:*:*:*:*:*:*:*,Texas Imperial Software,Wftpd
CVE-2006-4602,0.0,,0.42596,NVD-CWE-Other,"Unrestricted file upload vulnerability in jhot.php in TikiWiki 1.9.4 Sirius and earlier allows remote attackers to execute arbitrary PHP code via a filepath parameter that contains a filename with a .php extension, which is uploaded to the img/wiki/ directory.",2006-09-07,Metasploit,cpe:2.3:a:tiki:tikiwiki_cms\/groupware:1.9.4:*:*:*:*:*:*:*,Tiki,Tikiwiki Cms/Groupware
CVE-2006-4688,0.0,,0.7525,NVD-CWE-Other,"Buffer overflow in Client Service for NetWare (CSNW) in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 up to SP1 allows remote attackers to execute arbitrary code via crafted messages, aka ""Client Service for NetWare Memory Corruption Vulnerability.""",2006-11-14,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:sp4:*:fr:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:sp1:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:tablet_pc:*:*:*:*:*,Microsoft,Windows 2000
CVE-2006-4691,0.0,,0.78817,NVD-CWE-Other,Stack-based buffer overflow in the NetpManageIPCConnect function in the Workstation service (wkssvc.dll) in Microsoft Windows 2000 SP4 and XP SP2 allows remote attackers to execute arbitrary code via NetrJoinDomain2 RPC messages with a long hostname.,2006-11-14,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:sp4:*:fr:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:tablet_pc:*:*:*:*:*,Microsoft,Windows 2000
CVE-2006-4704,0.0,,0.42846,NVD-CWE-Other,"Cross-zone scripting vulnerability in the WMI Object Broker (WMIScriptUtils.WMIObjectBroker2) ActiveX control (WmiScriptUtils.dll) in Microsoft Visual Studio 2005 allows remote attackers to bypass Internet zone restrictions and execute arbitrary code by instantiating dangerous objects, aka ""WMI Object Broker Vulnerability.""",2006-11-01,Metasploit,cpe:2.3:a:microsoft:visual_studio_.net:2005:*:*:*:*:*:*:*,Microsoft,Visual Studio .Net
CVE-2006-4777,0.0,,0.78755,CWE-119,"Heap-based buffer overflow in the DirectAnimation Path Control (DirectAnimation.PathControl) COM object (daxctle.ocx) for Internet Explorer 6.0 SP1, on Chinese and possibly other Windows distributions, allows remote attackers to execute arbitrary code via unknown manipulations in arguments to the KeyFrame method, possibly related to an integer overflow, as demonstrated by daxctle2, and a different vulnerability than CVE-2006-4446.",2006-09-14,Metasploit,cpe:2.3:a:microsoft:ie:6.0:sp1:*:*:*:*:*:*,Microsoft,Ie
CVE-2006-4842,0.0,,0.076,CWE-20,"The Netscape Portable Runtime (NSPR) API 4.6.1 and 4.6.2, as used in Sun Solaris 10, trusts user-specified environment variables for specifying log files even when running from setuid programs, which allows local users to create or overwrite arbitrary files.",2006-10-12,Metasploit,cpe:2.3:a:netscape:portable_runtime_api:4.6.1:*:*:*:*:*:*:*;cpe:2.3:a:netscape:portable_runtime_api:4.6.2:*:*:*:*:*:*:*;cpe:2.3:o:sun:solaris:10.0:*:sparc:*:*:*:*:*,Sun,Solaris
CVE-2006-4847,0.0,,0.85213,NVD-CWE-Other,"Multiple buffer overflows in Ipswitch WS_FTP Server 5.05 before Hotfix 1 allow remote authenticated users to execute arbitrary code via long (1) XCRC, (2) XSHA1, or (3) XMD5 commands.",2006-09-19,Metasploit,cpe:2.3:a:ipswitch:ws_ftp_server:1.0.1eval:*:*:*:*:*:*:*;cpe:2.3:a:ipswitch:ws_ftp_server:1.0.2eval:*:*:*:*:*:*:*;cpe:2.3:a:ipswitch:ws_ftp_server:3.0_1:*:*:*:*:*:*:*;cpe:2.3:a:ipswitch:ws_ftp_server:4.01:*:*:*:*:*:*:*;cpe:2.3:a:ipswitch:ws_ftp_server:5.02:*:*:*:*:*:*:*;cpe:2.3:a:ipswitch:ws_ftp_server:5.03:*:*:*:*:*:*:*;cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:*;cpe:2.3:a:progress:ws_ftp_server:1.0.1.e:*:*:*:*:*:*:*;cpe:2.3:a:progress:ws_ftp_server:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:progress:ws_ftp_server:1.0.2.e:*:*:*:*:*:*:*;cpe:2.3:a:progress:ws_ftp_server:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:progress:ws_ftp_server:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:progress:ws_ftp_server:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:progress:ws_ftp_server:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:progress:ws_ftp_server:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:progress:ws_ftp_server:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:progress:ws_ftp_server:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:progress:ws_ftp_server:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:progress:ws_ftp_server:2.0:*:*:*:*:*:*:*;cpe:2.3:a:progress:ws_ftp_server:3.0:*:*:*:*:*:*:*;cpe:2.3:a:progress:ws_ftp_server:3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:progress:ws_ftp_server:3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:progress:ws_ftp_server:3.1.3:*:*:*:*:*:*:*;cpe:2.3:a:progress:ws_ftp_server:3.1:*:*:*:*:*:*:*;cpe:2.3:a:progress:ws_ftp_server:3.4:*:*:*:*:*:*:*;cpe:2.3:a:progress:ws_ftp_server:4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:progress:ws_ftp_server:4.0:*:*:*:*:*:*:*,Ipswitch,Ws Ftp Server
CVE-2006-4868,0.0,,0.59508,CWE-119,"Stack-based buffer overflow in the Vector Graphics Rendering engine (vgx.dll), as used in Microsoft Outlook and Internet Explorer 6.0 on Windows XP SP2, and possibly other versions, allows remote attackers to execute arbitrary code via a Vector Markup Language (VML) file with a long fill parameter within a rect tag.",2006-09-19,Metasploit,cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp4:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:outlook:2003:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:gold:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*,Microsoft,Windows 2000
CVE-2006-4948,0.0,,0.54094,NVD-CWE-Other,Stack-based buffer overflow in tftpd.exe in ProSysInfo TFTP Server TFTPDWIN 0.4.2 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a long file name. NOTE: the provenance of this information is unknown; the details are obtained from third party information.,2006-09-23,Metasploit,cpe:2.3:a:prosysinfo:tftp_server_tftpdwin:*:*:*:*:*:*:*:*,Prosysinfo,Tftp Server Tftpdwin
CVE-2006-5112,0.0,,0.66826,NVD-CWE-Other,Buffer overflow in InterVations NaviCOPA Web Server 2.01 allows remote attackers to execute arbitrary code via a long HTTP GET request.,2006-10-03,Metasploit,cpe:2.3:a:intervations:navicopa_web_server:2.01:*:*:*:*:*:*:*,Intervations,Navicopa Web Server
CVE-2006-5143,0.0,,0.78513,CWE-119,"Multiple buffer overflows in CA BrightStor ARCserve Backup r11.5 SP1 and earlier, r11.1, and 9.01; BrightStor ARCserve Backup for Windows r11; BrightStor Enterprise Backup 10.5; Server Protection Suite r2; and Business Protection Suite r2 allow remote attackers to execute arbitrary code via crafted data on TCP port 6071 to the Backup Agent RPC Server (DBASVR.exe) using the RPC routines with opcode (1) 0x01, (2) 0x02, or (3) 0x18; invalid stub data on TCP port 6503 to the RPC routines with opcode (4) 0x2b or (5) 0x2d in ASCORE.dll in the Message Engine RPC Server (msgeng.exe); (6) a long hostname on TCP port 41523 to ASBRDCST.DLL in the Discovery Service (casdscsvc.exe); or unspecified vectors related to the (7) Job Engine Service.",2006-10-10,Metasploit,cpe:2.3:a:broadcom:brightstor_arcserve_backup:*:sp1:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:11.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:9.01:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_enterprise_backup:10.5:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:business_protection_suite:2.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:server_protection_suite:2:*:*:*:*:*:*:*;cpe:2.3:a:ca:brightstor_arcserve_backup:11:*:windows:*:*:*:*:*,Broadcom,Brightstor Arcserve Backup
CVE-2006-5156,0.0,,0.72228,NVD-CWE-Other,Buffer overflow in McAfee ePolicy Orchestrator before 3.5.0.720 and ProtectionPilot before 1.1.1.126 allows remote attackers to execute arbitrary code via a request to /spipe/pkg/ with a long source header.,2006-10-05,Metasploit,cpe:2.3:a:mcafee:epolicy_orchestrator:3.0:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:epolicy_orchestrator:3.0:sp2a:*:*:*:*:*:*;cpe:2.3:a:mcafee:epolicy_orchestrator:3.5.0:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:protectionpilot:1.1.1:*:*:*:*:*:*:*,Mcafee,Epolicy Orchestrator
CVE-2006-5198,0.0,,0.602,NVD-CWE-Other,"The WZFILEVIEW.FileViewCtrl.61 ActiveX control (aka Sky Software ""FileView"" ActiveX control) for WinZip 10.0 before build 7245 allows remote attackers to execute arbitrary code via unspecified ""unsafe methods.""",2006-11-14,Metasploit,cpe:2.3:a:winzip:winzip:10.0:*:*:*:*:*:*:*,Winzip,Winzip
CVE-2006-5216,0.0,,0.63557,NVD-CWE-Other,Stack-based buffer overflow in Sergey Lyubka Simple HTTPD (shttpd) 1.34 allows remote attackers to execute arbitrary code via a long URI.,2006-10-10,Metasploit,cpe:2.3:a:sergey_lyubka:simple_httpd:1.34:*:*:*:*:*:*:*,Sergey Lyubka,Simple Httpd
CVE-2006-5229,0.0,,0.54212,CWE-200,"OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions, and possibly under limited configurations, allows remote attackers to determine valid usernames via timing discrepancies in which responses take longer for valid usernames than invalid ones, as demonstrated by sshtime.  NOTE: as of 20061014, it appears that this issue is dependent on the use of manually-set passwords that causes delays when processing /etc/shadow due to an increased number of rounds.",2006-10-10,Metasploit,cpe:2.3:a:openbsd:openssh:4.1:*:*:*:*:*:*:*;cpe:2.3:o:novell:suse_linux:*:*:*:*:*:*:*:*,Novell,Suse Linux
CVE-2006-5276,0.0,,0.79319,NVD-CWE-Other,"Stack-based buffer overflow in the DCE/RPC preprocessor in Snort before 2.6.1.3, and 2.7 before beta 2; and Sourcefire Intrusion Sensor; allows remote attackers to execute arbitrary code via crafted SMB traffic.",2007-02-20,Metasploit,cpe:2.3:a:snort:snort:*:*:*:*:*:*:*:*;cpe:2.3:a:snort:snort:2.6.1.1:*:*:*:*:*:*:*;cpe:2.3:a:snort:snort:2.6.1:*:*:*:*:*:*:*;cpe:2.3:a:snort:snort:2.7_beta1:*:*:*:*:*:*:*;cpe:2.3:a:sourcefire:intrusion_sensor:4.1:*:*:*:*:*:*:*;cpe:2.3:a:sourcefire:intrusion_sensor:4.1:*:crossbeam:*:*:*:*:*;cpe:2.3:a:sourcefire:intrusion_sensor:4.5:*:*:*:*:*:*:*;cpe:2.3:a:sourcefire:intrusion_sensor:4.5:*:crossbeam:*:*:*:*:*;cpe:2.3:a:sourcefire:intrusion_sensor:4.6:*:*:*:*:*:*:*;cpe:2.3:a:sourcefire:intrusion_sensor:4.6:*:crossbeam:*:*:*:*:*,Snort,Snort
CVE-2006-5478,0.0,,0.83998,CWE-119,"Multiple stack-based buffer overflows in Novell eDirectory 8.8.x before 8.8.1 FTF1, and 8.x up to 8.7.3.8, and Novell NetMail before 3.52e FTF2, allow remote attackers to execute arbitrary code via (1) a long HTTP Host header, which triggers an overflow in the BuildRedirectURL function; or vectors related to a username containing a . (dot) character in the (2) SMTP, (3) POP, (4) IMAP, (5) HTTP, or (6) Networked Messaging Application Protocol (NMAP) Netmail services.",2006-10-24,Metasploit,cpe:2.3:a:novell:edirectory:8.0:*:*:*:*:*:*:*;cpe:2.3:a:novell:edirectory:8.5.12a:*:*:*:*:*:*:*;cpe:2.3:a:novell:edirectory:8.5.27:*:*:*:*:*:*:*;cpe:2.3:a:novell:edirectory:8.5:*:*:*:*:*:*:*;cpe:2.3:a:novell:edirectory:8.6.2:*:*:*:*:*:*:*;cpe:2.3:a:novell:edirectory:8.7.1:*:*:*:*:*:*:*;cpe:2.3:a:novell:edirectory:8.7.1:sp1:*:*:*:*:*:*;cpe:2.3:a:novell:edirectory:8.7.3.8_presp9:*:*:*:*:*:*:*;cpe:2.3:a:novell:edirectory:8.7.3:*:*:*:*:*:*:*;cpe:2.3:a:novell:edirectory:8.7:*:*:*:*:*:*:*,Novell,Edirectory
CVE-2006-5614,0.0,,0.79086,NVD-CWE-Other,"Microsoft Windows NAT Helper Components (ipnathlp.dll) on Windows XP SP2, when Internet Connection Sharing is enabled, allows remote attackers to cause a denial of service (svchost.exe crash) via a malformed DNS query, which results in a null pointer dereference.",2006-10-31,Metasploit,cpe:2.3:a:microsoft:windows_nt_helper_components:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:tablet_pc:*:*:*:*:*,Microsoft,Windows Xp
CVE-2006-5650,0.0,,0.66368,NVD-CWE-Other,"The ICQPhone.SipxPhoneManager ActiveX control in America Online ICQ 5.1 allows remote attackers to download and execute arbitrary code via the DownloadAgent function, as demonstrated using an ICQ avatar.",2006-11-07,Metasploit,cpe:2.3:a:aol:icq:5.1:*:*:*:*:*:*:*,Aol,Icq
CVE-2006-5702,0.0,,0.53067,CWE-200,"Tikiwiki 1.9.5 allows remote attackers to obtain sensitive information (MySQL username and password) via an empty sort_mode parameter in (1) tiki-listpages.php, (2) tiki-lastchanges.php, (3) messu-archive.php, (4) messu-mailbox.php, (5) messu-sent.php, (6) tiki-directory_add_site.php, (7) tiki-directory_ranking.php, (8) tiki-directory_search.php, (9) tiki-forums.php, (10) tiki-view_forum.php, (11) tiki-friends.php, (12) tiki-list_blogs.php, (13) tiki-list_faqs.php, (14) tiki-list_trackers.php, (15) tiki-list_users.php, (16) tiki-my_tiki.php, (17) tiki-notepad_list.php, (18) tiki-orphan_pages.php, (19) tiki-shoutbox.php, (20) tiki-usermenu.php, and (21) tiki-webmail_contacts.php, which reveal the information in certain database error messages.",2006-11-04,Metasploit,cpe:2.3:a:tiki:tikiwiki_cms\/groupware:1.9.5:*:*:*:*:*:*:*,Tiki,Tikiwiki Cms/Groupware
CVE-2006-5745,0.0,,0.75946,NVD-CWE-Other,"Unspecified vulnerability in the setRequestHeader method in the XMLHTTP (XML HTTP) ActiveX Control 4.0 in Microsoft XML Core Services 4.0 on Windows, when accessed by Internet Explorer, allows remote attackers to execute arbitrary code via crafted arguments that lead to memory corruption, a different vulnerability than CVE-2006-4685.  NOTE: some of these details are obtained from third party information.",2006-11-06,Metasploit,cpe:2.3:a:microsoft:xml_core_services:4.0:*:*:*:*:*:*:*,Microsoft,Xml Core Services
CVE-2006-5780,0.0,,0.61492,NVD-CWE-Other,"Stack-based buffer overflow in nfsd.exe in XLink Omni-NFS Server 5.2 allows remote attackers to execute arbitrary code via a crafted TCP packet to port 2049 (nfsd), as demonstrated by vd_xlink.pm.",2006-11-07,Metasploit,cpe:2.3:a:xlink_technology:omni-nfs_server:5.2:*:*:*:*:*:*:*,Xlink Technology,Omni-Nfs Server
CVE-2006-5792,0.0,,0.59961,NVD-CWE-Other,"Unspecified vulnerability in XLink Omni-NFS Enterprise allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by vd_xlink2.pm, an ""Omni-NFS Enterprise remote exploit."" NOTE: this is probably a different vulnerability than CVE-2006-5780. As of 20061107, this disclosure has no actionable information. However, since it is from a reliable researcher, it is being assigned a CVE identifier for tracking purposes.",2006-11-07,Metasploit,cpe:2.3:a:xlink_technology:omni-nfs_x_enterprise:*:*:*:*:*:*:*:*,Xlink Technology,Omni-Nfs X Enterprise
CVE-2006-5815,0.0,,0.73663,CWE-119,"Stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier allows remote attackers, probably authenticated, to cause a denial of service and execute arbitrary code, as demonstrated by vd_proftpd.pm, a ""ProFTPD remote exploit.""",2006-11-08,Metasploit,cpe:2.3:a:proftpd_project:proftpd:*:*:*:*:*:*:*:*,Proftpd Project,Proftpd
CVE-2006-6010,0.0,,0.138,NVD-CWE-Other,"SAP allows remote attackers to obtain potentially sensitive information such as operating system and SAP version via an RFC_SYSTEM_INFO RfcCallReceive request, a different vulnerability than CVE-2003-0747.",2006-11-21,Metasploit,cpe:2.3:a:sap:sap_web_application_server:*:*:*:*:*:*:*:*,Sap,Sap Web Application Server
CVE-2006-6063,0.0,,0.5808,NVD-CWE-Other,"Stack-based buffer overflow in Un4seen XMPlay 3.3.0.5 and earlier allows remote attackers to execute arbitrary code via a M3U file containing a long (1) FileName, and cause a crash via a long (2) DisplayName.",2006-11-22,Metasploit,cpe:2.3:a:un4seen:xmplay:*:*:*:*:*:*:*:*,Un4Seen,Xmplay
CVE-2006-6076,0.0,,0.70215,NVD-CWE-Other,Buffer overflow in the Tape Engine (tapeeng.exe) in CA (formerly Computer Associates) BrightStor ARCserve Backup 11.5 and earlier allows remote attackers to execute arbitrary code via certain RPC requests to TCP port 6502.,2006-11-24,Metasploit,cpe:2.3:a:broadcom:brightstor_arcserve_backup:*:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:11.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:11.5:sp1:*:*:*:*:*:*;cpe:2.3:a:ca:brightstor_arcserve_backup:11.1:*:windows:*:*:*:*:*;cpe:2.3:a:ca:brightstor_arcserve_backup:11:*:windows:*:*:*:*:*;cpe:2.3:a:ca:brightstor_arcserve_backup_agent:11.0:*:sql:*:*:*:*:*;cpe:2.3:a:ca:brightstor_arcserve_backup_agent:11.1:*:sql:*:*:*:*:*,Broadcom,Brightstor Arcserve Backup
CVE-2006-6183,0.0,,0.7057,CWE-119,"Multiple stack-based buffer overflows in 3Com 3CTftpSvc 2.0.1, and possibly earlier, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a long mode field (aka transporting mode) in a (1) GET or (2) PUT command.",2006-12-01,Metasploit,cpe:2.3:a:3com:3ctftpsvc:*:*:*:*:*:*:*:*,3Com,3Ctftpsvc
CVE-2006-6184,0.0,,0.65651,NVD-CWE-Other,"Multiple stack-based buffer overflows in Allied Telesyn TFTP Server (AT-TFTP) 1.9, and possibly earlier, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a long filename in a (1) GET or (2) PUT command.",2006-12-01,Metasploit,cpe:2.3:a:alliedtelesyn:at-tftp:*:*:*:*:*:*:*:*,Alliedtelesyn,At-Tftp
CVE-2006-6199,0.0,,0.65058,CWE-119,"Stack-based buffer overflow in BlazeVideo BlazeDVD Standard and Professional 5.0, and possibly earlier, allows remote attackers to execute arbitrary code via a long filename in a PLF playlist.",2006-12-01,Metasploit,cpe:2.3:a:blazevideo:blaze_dvd:5.0:*:pro:*:*:*:*:*;cpe:2.3:a:blazevideo:blaze_dvd:5.0:*:standard:*:*:*:*:*,Blazevideo,Blaze Dvd
CVE-2006-6251,0.0,,0.67345,NVD-CWE-Other,"Stack-based buffer overflow in VUPlayer 2.44 and earlier allows remote attackers to execute arbitrary code via a long string in an M3U file, aka an ""M3U UNC Name"" attack.",2006-12-04,Metasploit,cpe:2.3:a:vuplayer:vuplayer:*:*:*:*:*:*:*:*,Vuplayer,Vuplayer
CVE-2006-6423,0.0,,0.69452,NVD-CWE-Other,"Stack-based buffer overflow in the IMAP service for MailEnable Professional and Enterprise Edition 2.0 through 2.35, Professional Edition 1.6 through 1.84, and Enterprise Edition 1.1 through 1.41 allows remote attackers to execute arbitrary code via a pre-authentication command followed by a crafted parameter and a long string, as addressed by the ME-10025 hotfix.",2006-12-12,Metasploit,cpe:2.3:a:mailenable:mailenable_enterprise:1.11:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.12:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.13:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.14:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.15:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.16:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.17:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.18:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.19:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.1:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.21:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.22:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.23:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.24:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.25:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.26:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.27:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.28:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.29:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.2:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.30:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.31:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.32:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.33:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.34:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.35:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.36:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.37:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.38:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.39:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.40:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:1.41:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_enterprise:2.35:*:*:*:*:*:*:*;cpe:2.3:a:mailenable:mailenable_professional:1.84:*:*:*:*:*:*:*,Mailenable,Mailenable Enterprise
CVE-2006-6424,0.0,,0.57909,NVD-CWE-Other,"Multiple buffer overflows in Novell NetMail before 3.52e FTF2 allow remote attackers to execute arbitrary code (1) by appending literals to certain IMAP verbs when specifying command continuation requests to IMAPD, resulting in a heap overflow; and (2) via crafted arguments to the STOR command to the Network Messaging Application Protocol (NMAP) daemon, resulting in a stack overflow.",2006-12-27,Metasploit,cpe:2.3:a:novell:netmail:*:e-ftfl:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.0.3a:a:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.0.3a:b:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:*:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:a:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:b:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:c:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:d:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:e:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:f:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:g:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:h:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.1:*:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.1:f:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.5:*:*:*:*:*:*:*,Novell,Netmail
CVE-2006-6425,0.0,,0.58474,NVD-CWE-Other,Stack-based buffer overflow in the IMAP daemon (IMAPD) in Novell NetMail before 3.52e FTF2 allows remote authenticated users to execute arbitrary code via unspecified vectors involving the APPEND command.,2006-12-27,Metasploit,cpe:2.3:a:novell:netmail:*:e-ftfl:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.0.3a:a:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.0.3a:b:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:*:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:a:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:b:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:c:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:d:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:e:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:f:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:g:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.10:h:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.1:*:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.1:f:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.5:*:*:*:*:*:*:*,Novell,Netmail
CVE-2006-6565,0.0,,0.71504,CWE-476,"FileZilla Server before 0.9.22 allows remote attackers to cause a denial of service (crash) via a wildcard argument to the (1) LIST or (2) NLST commands, which results in a NULL pointer dereference, a different set of vectors than CVE-2006-6564.  NOTE: CVE analysis suggests that the problem might be due to a malformed PORT command.",2006-12-15,Metasploit/Nuclei,cpe:2.3:a:filezilla-project:filezilla_server:*:*:*:*:*:*:*:*,Filezilla-Project,Filezilla Server
CVE-2006-6576,0.0,,0.67016,CWE-787,Heap-based buffer overflow in Golden FTP Server (goldenftpd) 1.92 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long PASS command. NOTE: it was later reported that 4.70 is also affected.  NOTE: the USER vector is already covered by CVE-2005-0634.,2006-12-15,Metasploit,cpe:2.3:a:goldenftpserver:golden_ftp_server:1.92:*:*:*:*:*:*:*,Goldenftpserver,Golden Ftp Server
CVE-2006-6665,0.0,,0.30628,NVD-CWE-Other,Buffer overflow in Astonsoft DeepBurner Pro and Free 1.8.0 and earlier allows user-assisted remote attackers to execute arbitrary code via a long file name tag in a dbr file.,2006-12-20,Metasploit,cpe:2.3:a:astonsoft:deepburner:*:*:free:*:*:*:*:*;cpe:2.3:a:astonsoft:deepburner:*:*:pro:*:*:*:*:*,Astonsoft,Deepburner
CVE-2006-6707,0.0,,0.55929,NVD-CWE-Other,Stack-based buffer overflow in the NeoTraceExplorer.NeoTraceLoader ActiveX control (NeoTraceExplorer.dll) in NeoTrace Express 3.25 and NeoTrace Pro (aka McAfee Visual Trace) 3.25 allows remote attackers to execute arbitrary code via a long argument string to the TraceTarget method.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.,2006-12-23,Metasploit,cpe:2.3:a:mcafee:neotrace:3.25:*:express:*:*:*:*:*;cpe:2.3:a:mcafee:neotrace:3.25:*:professional:*:*:*:*:*;cpe:2.3:a:mcafee:visual_trace:3.25:*:*:*:*:*:*:*,Mcafee,Neotrace
CVE-2006-6761,0.0,,0.5367,NVD-CWE-Other,Stack-based buffer overflow in the IMAP daemon (IMAPD) in Novell NetMail before 3.52e FTF2 allows remote authenticated users to execute arbitrary code via a long argument to the SUBSCRIBE command.,2006-12-27,Metasploit,cpe:2.3:a:novell:netmail:3.5.2:a:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.5.2:b:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.5.2:c1:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.5.2:c:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.5.2:d:*:*:*:*:*:*;cpe:2.3:a:novell:netmail:3.5.2:e-ftfl:*:*:*:*:*:*,Novell,Netmail
CVE-2007-0015,0.0,,0.48419,NVD-CWE-Other,Buffer overflow in Apple QuickTime 7.1.3 allows remote attackers to execute arbitrary code via a long rtsp:// URI.,2007-01-01,Metasploit,cpe:2.3:a:apple:quicktime:7.1.3:*:*:*:*:*:*:*,Apple,Quicktime
CVE-2007-0018,0.0,,0.35162,CWE-119,"Stack-based buffer overflow in the NCTAudioFile2.AudioFile ActiveX control (NCTAudioFile2.dll), as used by multiple products, allows remote attackers to execute arbitrary code via a long argument to the SetFormatLikeSample function. NOTE: the products include (1) NCTsoft NCTAudioStudio, NCTAudioEditor, and NCTDialogicVoice; (2) Magic Audio Recorder, Music Editor, and Audio Converter; (3) Aurora Media Workshop; DB Audio Mixer And Editor; (4) J. Hepple Products including Fx Audio Editor and others; (5) EXPStudio Audio Editor; (6) iMesh; (7) Quikscribe; (8) RMBSoft AudioConvert and SoundEdit Pro 2.1; (9) CDBurnerXP; (10) Code-it Software Wave MP3 Editor and aBasic Editor; (11) Movavi VideoMessage, DVD to iPod, and others; (12) SoftDiv Software Dexster, iVideoMAX, and others; (13) Sienzo Digital Music Mentor (DMM); (14) MP3 Normalizer; (15) Roemer Software FREE and Easy Hi-Q Recorder, and Easy Hi-Q Converter; (16) Audio Edit Magic; (17) Joshua Video and Audio Converter; (18) Virtual CD; (19) Cheetah CD and DVD Burner; (20) Mystik Media AudioEdit Deluxe, Blaze Media, and others; (21) Power Audio Editor; (22) DanDans Digital Media Full Audio Converter, Music Editing Master, and others; (23) Xrlly Software Text to Speech Makerand Arial Sound Recorder / Audio Converter; (24) Absolute Sound Recorder, Video to Audio Converter, and MP3 Splitter; (25) Easy Ringtone Maker; (26) RecordNRip; (27) McFunSoft iPod Audio Studio, Audio Recorder for Free, and others; (28) MP3 WAV Converter; (29) BearShare 6.0.2.26789; and (30) Oracle Siebel SimBuilder and CRM 7.x.",2007-01-24,Metasploit,cpe:2.3:a:altdo:convert_mp3_master:1.1:*:*:*:*:*:*:*;cpe:2.3:a:altdo:mp3_record_and_edit_audio_master:1.2:*:*:*:*:*:*:*;cpe:2.3:a:americanshareware:mp3_wav_converter:3.1.8:*:*:*:*:*:*:*;cpe:2.3:a:audio_edit_magic:audio_edit_magic:9.2.3_389:*:*:*:*:*:*:*;cpe:2.3:a:bearshare:bearshare:6.0.2.26789:*:*:*:*:*:*:*;cpe:2.3:a:cdburnerxp:cdburnerxp_pro:3.0.116:*:*:*:*:*:*:*;cpe:2.3:a:cheetahburner:cheetah_cd_burner:3.56:*:*:*:*:*:*:*;cpe:2.3:a:cheetahburner:cheetah_dvd_burner:1.79:*:*:*:*:*:*:*;cpe:2.3:a:code-it_softare:abasic_editor:10.1:*:*:*:*:*:*:*;cpe:2.3:a:code-it_softare:wave_mp3_editor:10.1:*:*:*:*:*:*:*;cpe:2.3:a:dandans_digital_media_products:easy_audio_editor:7.4:*:*:*:*:*:*:*;cpe:2.3:a:dandans_digital_media_products:full_audio_converter:4.2:*:*:*:*:*:*:*;cpe:2.3:a:dandans_digital_media_products:music_editing_master:5.2:*:*:*:*:*:*:*;cpe:2.3:a:dandans_digital_media_products:visual_video_converter:4.4:*:*:*:*:*:*:*;cpe:2.3:a:digital_borneo:audio_mixer_and_editor:1.1.0:*:*:*:*:*:*:*;cpe:2.3:a:easy_ringtone_maker:easy_ringtone_maker:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:expstudio:audio_editor:4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:iaudiosoft.com:absolute_mp3_splitter:2.5.4:*:*:*:*:*:*:*;cpe:2.3:a:iaudiosoft.com:absolute_sound_recorder:3.4.5:*:*:*:*:*:*:*;cpe:2.3:a:iaudiosoft.com:absolute_video_to_audio_converter:2.7.9:*:*:*:*:*:*:*;cpe:2.3:a:imesh.com:imesh:7.0.2.26789:*:*:*:*:*:*:*;cpe:2.3:a:j_hepple_products:fx_audio_concat:1.2.0_beta:*:*:*:*:*:*:*;cpe:2.3:a:j_hepple_products:fx_audio_editor:4.7.11:*:*:*:*:*:*:*;cpe:2.3:a:j_hepple_products:fx_audio_tools:7.3.4:*:*:*:*:*:*:*;cpe:2.3:a:j_hepple_products:fx_magic_music:5.7.7:*:*:*:*:*:*:*;cpe:2.3:a:j_hepple_products:fx_movie_joiner:6.2.8:*:*:*:*:*:*:*;cpe:2.3:a:j_hepple_products:fx_movie_joiner_and_splitter:6.2.8:*:*:*:*:*:*:*;cpe:2.3:a:j_hepple_products:fx_movie_splitter:6.4.7:*:*:*:*:*:*:*;cpe:2.3:a:j_hepple_products:fx_new_sound:5.1.1:*:*:*:*:*:*:*;cpe:2.3:a:j_hepple_products:fx_video_converter:7.51.21:*:*:*:*:*:*:*;cpe:2.3:a:joshua_mediasoft:audio_convertor_plus:2.2:*:*:*:*:*:*:*;cpe:2.3:a:joshua_mediasoft:video_converter_plus:3.01:*:*:*:*:*:*:*;cpe:2.3:a:magicvideosoftare:magic_audio_converter:8.2.6_build_719:*:*:*:*:*:*:*;cpe:2.3:a:magicvideosoftare:magic_audio_recorder:5.3.7:*:*:*:*:*:*:*;cpe:2.3:a:magicvideosoftare:magic_music_editor:5.2.2:*:*:*:*:*:*:*;cpe:2.3:a:mcfunsoft:audio_editor:6.3.3_build_489:*:*:*:*:*:*:*;cpe:2.3:a:mcfunsoft:audio_recorder_for_free:6.1:*:*:*:*:*:*:*;cpe:2.3:a:mcfunsoft:audio_studio:6.6.3_build_479:*:*:*:*:*:*:*;cpe:2.3:a:mcfunsoft:ipod_audio_studio:6.2.4:*:*:*:*:*:*:*;cpe:2.3:a:mcfunsoft:ipod_music_converter:5.1:*:*:*:*:*:*:*;cpe:2.3:a:mcfunsoft:recording_to_ipod_solution:5.1:*:*:*:*:*:*:*;cpe:2.3:a:mediatox:aurora_media_workshop:3.3.25:*:*:*:*:*:*:*;cpe:2.3:a:movavi:chiliburner:2.3:*:*:*:*:*:*:*;cpe:2.3:a:movavi:convertmovie:4.4:*:*:*:*:*:*:*;cpe:2.3:a:movavi:dvd_to_ipod:1.0:*:*:*:*:*:*:*;cpe:2.3:a:movavi:splitmovie:1.4:*:*:*:*:*:*:*;cpe:2.3:a:movavi:suite:3.5:*:*:*:*:*:*:*;cpe:2.3:a:movavi:videomessage:1.0:*:*:*:*:*:*:*;cpe:2.3:a:mp3-soft:mp3_normalizer:1.03:*:*:*:*:*:*:*;cpe:2.3:a:mystik_media_products:audioedit_deluxe:4.10:*:*:*:*:*:*:*;cpe:2.3:a:mystik_media_products:blaze_media_pro:7.0:*:*:*:*:*:*:*;cpe:2.3:a:mystik_media_products:blaze_mediaconvert:3.4:*:*:*:*:*:*:*;cpe:2.3:a:mystik_media_products:contextconvert_pro:3.1:*:*:*:*:*:*:*;cpe:2.3:a:nctsoft_products:nctaudioeditor:2.7.1:*:*:*:*:*:*:*;cpe:2.3:a:nctsoft_products:nctaudiofile2:*:*:*:*:*:*:*:*;cpe:2.3:a:nctsoft_products:nctaudiostudio:2.7.1:*:*:*:*:*:*:*;cpe:2.3:a:nctsoft_products:nctdialogicvoice:2.7.1:*:*:*:*:*:*:*;cpe:2.3:a:nextlevel_systems:audio_editor_gold:9.2.5_build_424:*:*:*:*:*:*:*;cpe:2.3:a:nextlevel_systems:audio_studio_gold:7.0.1.1_build_500:*:*:*:*:*:*:*;cpe:2.3:a:quikscribe:quikscribe_player:5.022.05:*:*:*:*:*:*:*;cpe:2.3:a:quikscribe:quikscribe_recorder:5.021.29:*:*:*:*:*:*:*;cpe:2.3:a:recordnrip:recordnrip:1.0:*:*:*:*:*:*:*;cpe:2.3:a:rmbsoft:audioconvert:3.1.0.125:*:*:*:*:*:*:*;cpe:2.3:a:rmbsoft:soundedit_pro:2.1:*:*:*:*:*:*:*;cpe:2.3:a:roemer_software:easy_hi-q_converter:1.7:*:*:*:*:*:*:*;cpe:2.3:a:roemer_software:easy_hi-q_recorder:2.0:*:*:*:*:*:*:*;cpe:2.3:a:roemer_software:free_hi-q_recorder:1.9:*:*:*:*:*:*:*;cpe:2.3:a:sienzo:digital_music_mentor:2.6.0.3:*:*:*:*:*:*:*;cpe:2.3:a:smart_media_systems:power_audio_editor:11.0.1:*:*:*:*:*:*:*;cpe:2.3:a:softdiv_softare:dexster:3.0:*:*:*:*:*:*:*;cpe:2.3:a:softdiv_softare:ivideomax:3.9:*:*:*:*:*:*:*;cpe:2.3:a:softdiv_softare:mp3_to_wav_converter:3.0:*:*:*:*:*:*:*;cpe:2.3:a:softdiv_softare:snosh:1.4:*:*:*:*:*:*:*;cpe:2.3:a:softdiv_softare:videozilla:2.5:*:*:*:*:*:*:*;cpe:2.3:a:virtual_cd:virtual_cd:6.0.0.7:*:*:*:*:*:*:*;cpe:2.3:a:virtual_cd:virtual_cd:7.1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:virtual_cd:virtual_cd:8.0.0.6:*:*:*:*:*:*:*;cpe:2.3:a:virtual_cd:virtual_cd_file_server:7.1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:xrlly_software:arial_audio_converter:2.3.40:*:*:*:*:*:*:*;cpe:2.3:a:xrlly_software:arial_sound_recorder:1.4.3:*:*:*:*:*:*:*;cpe:2.3:a:xrlly_software:text_to_speech_maker:1.3.8:*:*:*:*:*:*:*;cpe:2.3:a:xwaver.com:magic_audio_editor_pro:10.3.1_build_476:*:*:*:*:*:*:*;cpe:2.3:a:xwaver.com:magic_music_studio_pro:7.0.2.1_build_500:*:*:*:*:*:*:*,Altdo,Convert Mp3 Master
CVE-2007-0038,0.0,,0.7288,CWE-119,"Stack-based buffer overflow in the animated cursor code in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a large length value in the second (or later) anih block of a RIFF .ANI, cur, or .ico file, which results in memory corruption when processing cursors, animated cursors, and icons, a variant of CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7. NOTE: this might be a duplicate of CVE-2007-1765; if so, then CVE-2007-0038 should be preferred.",2007-03-30,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:gold:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:gold:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:gold:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:sp1:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:sp1:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:sp2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:sp2:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:sp2:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:gold:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:gold:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:gold:professional_x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:professional_x64:*:*:*:*:*,Microsoft,Windows 2000
CVE-2007-0169,0.0,,0.68809,CWE-119,"Multiple buffer overflows in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10.5, and CA Server/Business Protection Suite r2 allow remote attackers to execute arbitrary code via RPC requests with crafted data for opnums (1) 0x2F and (2) 0x75 in the (a) Message Engine RPC service, or opnum (3) 0xCF in the Tape Engine service.",2007-01-11,Metasploit,cpe:2.3:a:broadcom:brightstor_arcserve_backup:*:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:9.01:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_enterprise_backup:10.5:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:business_protection_suite:2.0:*:*:*:*:*:*:*,Broadcom,Brightstor Arcserve Backup
CVE-2007-0325,0.0,,0.34006,CWE-119,"Multiple buffer overflows in the Trend Micro OfficeScan Web-Deployment SetupINICtrl ActiveX control in OfficeScanSetupINI.dll, as used in OfficeScan 7.0 before Build 1344, OfficeScan 7.3 before Build 1241, and Client / Server / Messaging Security 3.0 before Build 1197, allow remote attackers to execute arbitrary code via a crafted HTML document.",2007-02-20,Metasploit,cpe:2.3:a:trend_micro:client-server-messaging_security:3.0:*:*:*:*:*:*:*;cpe:2.3:a:trend_micro:officescan_corporate_edition:7.0:*:*:*:*:*:*:*;cpe:2.3:a:trend_micro:officescan_corporate_edition:7.3:*:*:*:*:*:*:*,Trend Micro,Client-Server-Messaging Security
CVE-2007-0348,0.0,,0.35137,CWE-119,"Stack-based buffer overflow in the IASystemInfo.dll ActiveX control in (1) InterActual Player 2.60.12.0717, (2) Roxio CinePlayer 3.2, (3) WinDVD 7.0.27.172, and possibly other products, allows remote attackers to execute arbitrary code via a long ApplicationType property.",2007-03-21,Metasploit,cpe:2.3:a:interactual_technologies:interactual_player:2.60.12.0717:*:*:*:*:*:*:*;cpe:2.3:a:intervideo:windvd:7.0.27.172:*:*:*:*:*:*:*;cpe:2.3:a:roxio:cineplayer:3.2:*:*:*:*:*:*:*,Interactual Technologies,Interactual Player
CVE-2007-0449,0.0,,0.7924,CWE-119,"Multiple buffer overflows in LGSERVER.EXE in CA BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.1 SP1, Mobile Backup r4.0, Desktop and Business Protection Suite r2, and Desktop Management Suite (DMS) r11.0 and r11.1 allow remote attackers to execute arbitrary code via crafted packets to TCP port (1) 1900 or (2) 2200.",2007-01-23,Metasploit,cpe:2.3:a:broadcom:brightstor_arcserve_backup_laptops_desktops:11.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup_laptops_desktops:11.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup_laptops_desktops:11.1:sp1:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_mobile_backup:r4.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:business_protection_suite:2.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:desktop_management_suite:11.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:desktop_management_suite:11.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:desktop_protection_suite:2.0:*:*:*:*:*:*:*,Broadcom,Brightstor Arcserve Backup Laptops Desktops
CVE-2007-0671,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.42139,NVD-CWE-noinfo,"Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as demonstrated by Exploit-MSExcel.h in targeted zero-day attacks.",2007-02-03,CISA,cpe:2.3:a:microsoft:access:2000:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:access:2002:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:access:2003:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:excel:2000:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:excel:2002:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:excel:2003:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:excel_viewer:2003:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:frontpage:2000:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:frontpage:2002:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:frontpage:2003:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:infopath:2003:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2000:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2003:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2004:*:*:*:*:macos:*:*;cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:onenote:2003:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:outlook:2000:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:outlook:2002:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:outlook:2003:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:powerpoint:2000:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:powerpoint:2002:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:powerpoint:2003:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:project:2000:sr1:*:*:*:*:*:*;cpe:2.3:a:microsoft:project:2002:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:project:2003:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:publisher:2000:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:publisher:2002:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:publisher:2003:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:visio:2002:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:visio:2003:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2000:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2002:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2003:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:word_viewer:2003:*:*:*:*:*:*:*,Microsoft,Access
CVE-2007-0774,0.0,,0.81513,NVD-CWE-Other,"Stack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web Server Connector 1.2.19 and 1.2.20, as used in Tomcat 4.1.34 and 5.5.20, allows remote attackers to execute arbitrary code via a long URL that triggers the overflow in a URI worker map routine.",2007-03-04,Metasploit,cpe:2.3:a:apache:tomcat_jk_web_server_connector:1.2.19:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat_jk_web_server_connector:1.2.20:*:*:*:*:*:*:*,Apache,Tomcat Jk Web Server Connector
CVE-2007-0882,0.0,,0.97848,CWE-88,"Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client ""-f"" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts, as demonstrated by the bin account.",2007-02-12,EPSS/Metasploit,cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*;cpe:2.3:o:oracle:solaris:11:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.10:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:5.11:*:*:*:*:*:*:*,Oracle,Solaris
CVE-2007-0885,0.0,,0.05472,NVD-CWE-Other,Cross-site scripting (XSS) vulnerability in jira/secure/BrowseProject.jspa in Rainbow with the Zen (Rainbow.Zen) extension allows remote attackers to inject arbitrary web script or HTML via the id parameter.,2007-02-12,Nuclei,cpe:2.3:a:rainbow_portal:rainbow.zen:*:*:*:*:*:*:*:*;cpe:2.3:a:rainbow_portal:rainbow_with_the_zen:*:*:*:*:*:*:*:*,Rainbow Portal,Rainbow.Zen
CVE-2007-0977,0.0,,0.18957,NVD-CWE-Other,"IBM Lotus Domino R5 and R6 WebMail, with ""Generate HTML for all fields"" enabled, stores HTTPPassword hashes from names.nsf in a manner accessible through Readviewentries and OpenDocument requests to the defaultview view, a different vector than CVE-2005-2428.",2007-02-16,Metasploit,cpe:2.3:a:ibm:lotus_domino:5.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_domino:6.0:*:*:*:*:*:*:*,Ibm,Lotus Domino
CVE-2007-1036,0.0,,0.81775,CWE-264,"The default configuration of JBoss does not restrict access to the (1) console and (2) web management interfaces, which allows remote attackers to bypass authentication and gain administrative access via direct requests.",2007-02-21,Metasploit,cpe:2.3:a:jboss:jboss_application_server:*:*:*:*:*:*:*:*,Jboss,Jboss Application Server
CVE-2007-1070,0.0,,0.71884,NVD-CWE-Other,"Multiple stack-based buffer overflows in Trend Micro ServerProtect for Windows and EMC 5.58, and for Network Appliance Filer 5.61 and 5.62, allow remote attackers to execute arbitrary code via crafted RPC requests to TmRpcSrv.dll that trigger overflows when calling the (1) CMON_NetTestConnection, (2) CMON_ActiveUpdate, and (3) CMON_ActiveRollback functions in (a) StCommon.dll, and (4) ENG_SetRealTimeScanConfigInfo and (5) ENG_SendEMail functions in (b) eng50.dll.",2007-02-21,Metasploit,cpe:2.3:a:trend_micro:serverprotect:5.58:*:emc:*:*:*:*:*;cpe:2.3:a:trend_micro:serverprotect:5.61:*:network_appliance_filer:*:*:*:*:*;cpe:2.3:a:trend_micro:serverprotect:5.62:*:network_appliance_filer:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:sp2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_nt:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:*:32_bit:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:gold:*:*:*:*:*:*,Microsoft,Windows 2000
CVE-2007-1286,0.0,,0.40435,NVD-CWE-Other,"Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize function, which triggers the overflow in the ZVAL reference counter.",2007-03-06,Metasploit,cpe:2.3:a:php:php:*:*:*:*:*:*:*:*,Php,Php
CVE-2007-1373,0.0,,0.58687,NVD-CWE-Other,Stack-based buffer overflow in Mercury/32 (aka Mercury Mail Transport System) 4.01b and earlier allows remote attackers to execute arbitrary code via a long LOGIN command.  NOTE: this might be the same issue as CVE-2006-5961.,2007-03-10,Metasploit,cpe:2.3:a:pmail:mercury_mail_transport_system:*:*:*:*:*:*:*:*,Pmail,Mercury Mail Transport System
CVE-2007-1435,0.0,,0.42822,NVD-CWE-Other,"Buffer overflow in D-Link TFTP Server 1.0 allows remote attackers to cause a denial of service (crash) via a long (1) GET or (2) PUT request, which triggers memory corruption.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.",2007-03-13,Metasploit,cpe:2.3:a:d-link:tftp_server:1.0:*:*:*:*:*:*:*,D-Link,Tftp Server
CVE-2007-1559,0.0,,0.31815,NVD-CWE-Other,Multiple stack-based buffer overflows in SonicDVDDashVRNav.dll in Roxio CinePlayer 3.2 allow remote attackers to execute arbitrary code via (1) unspecified long property values to SonicMediaPlayer.dll or (2) long arguments to unspecified methods in SonicMediaPlayer.dll.,2007-04-11,Metasploit,cpe:2.3:a:roxio:cineplayer:3.2:*:*:*:*:*:*:*,Roxio,Cineplayer
CVE-2007-1674,0.0,,0.72864,NVD-CWE-Other,Stack-based buffer overflow in the Alert Service (aolnsrvr.exe) in LANDesk Management Suite 8.7 allows remote attackers to execute arbitrary code via a crafted packet to port 65535/UDP.,2007-04-18,Metasploit,cpe:2.3:a:landesk:landesk_management_suite:8.7:*:*:*:*:*:*:*,Landesk,Landesk Management Suite
CVE-2007-1682,0.0,,0.29613,CWE-119,"Multiple stack-based buffer overflows in the FileManager ActiveX control in SAFmgPws.dll in SoftArtisans XFile before 2.4.0 allow remote attackers to execute arbitrary code via unspecified calls to the (1) BuildPath, (2) GetDriveName, (3) DriveExists, or (4) DeleteFile method.",2008-08-27,Metasploit,cpe:2.3:a:softartisans:xfile:*:*:*:*:*:*:*:*;cpe:2.3:a:softartisans:xfile:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:softartisans:xfile:1.0.7:*:*:*:*:*:*:*;cpe:2.3:a:softartisans:xfile:1.0.8:*:*:*:*:*:*:*;cpe:2.3:a:softartisans:xfile:1.01:*:*:*:*:*:*:*;cpe:2.3:a:softartisans:xfile:1.0:*:*:*:*:*:*:*;cpe:2.3:a:softartisans:xfile:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:softartisans:xfile:1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:softartisans:xfile:1.1.3:*:*:*:*:*:*:*;cpe:2.3:a:softartisans:xfile:1.1.4:*:*:*:*:*:*:*;cpe:2.3:a:softartisans:xfile:1.1.5:*:*:*:*:*:*:*;cpe:2.3:a:softartisans:xfile:1.1.6:*:*:*:*:*:*:*;cpe:2.3:a:softartisans:xfile:1.1.7:*:*:*:*:*:*:*;cpe:2.3:a:softartisans:xfile:1.1:*:*:*:*:*:*:*;cpe:2.3:a:softartisans:xfile:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:softartisans:xfile:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:softartisans:xfile:2.0:*:*:*:*:*:*:*;cpe:2.3:a:softartisans:xfile:2.1.3:*:*:*:*:*:*:*;cpe:2.3:a:softartisans:xfile:2.1.4:*:*:*:*:*:*:*;cpe:2.3:a:softartisans:xfile:2.1.5:*:*:*:*:*:*:*;cpe:2.3:a:softartisans:xfile:2.1.6:*:*:*:*:*:*:*;cpe:2.3:a:softartisans:xfile:2.1.7:*:*:*:*:*:*:*;cpe:2.3:a:softartisans:xfile:2.2.3:*:*:*:*:*:*:*;cpe:2.3:a:softartisans:xfile:2.2.4:*:*:*:*:*:*:*,Softartisans,Xfile
CVE-2007-1689,0.0,,0.64441,NVD-CWE-Other,Buffer overflow in the ISAlertDataCOM ActiveX control in ISLALERT.DLL for Norton Personal Firewall 2004 and Internet Security 2004 allows remote attackers to execute arbitrary code via long arguments to the (1) Get and (2) Set functions.,2007-05-16,Metasploit,cpe:2.3:a:symantec:norton_internet_security:2004:*:*:*:*:*:*:*;cpe:2.3:a:symantec:norton_personal_firewall:2004:*:*:*:*:*:*:*,Symantec,Norton Internet Security
CVE-2007-1748,0.0,,0.77664,CWE-119,"Stack-based buffer overflow in the RPC interface in the Domain Name System (DNS) Server Service in Microsoft Windows 2000 Server SP 4, Server 2003 SP 1, and Server 2003 SP 2 allows remote attackers to execute arbitrary code via a long zone name containing character constants represented by escape sequences.",2007-04-13,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:sp1:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:sp1:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:sp1:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:sp2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:sp2:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:sp2:*:x64:*:*:*:*:*,Microsoft,Windows 2000
CVE-2007-1765,0.0,,0.54326,NVD-CWE-noinfo,"Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a malformed ANI file, which results in memory corruption when processing cursors, animated cursors, and icons, a similar issue to CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7.  NOTE: this issue might be a duplicate of CVE-2007-0038; if so, then use CVE-2007-0038 instead of this identifier.",2007-03-30,Metasploit,cpe:2.3:a:avaya:ip600_media_servers:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:ie:7.0:*:vista:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:*:*:*:*:*:*:*:*;cpe:2.3:h:avaya:definity_one_media_server:*:*:*:*:*:*:*:*;cpe:2.3:h:avaya:s3400:*:*:*:*:*:*:*:*;cpe:2.3:h:avaya:s8100:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:*:*:*:advanced_server:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:*:*:*:datacenter_server:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:*:*:*:professional:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:*:*:ja:server:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp1:*:*:advanced_server:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp1:*:*:datacenter_server:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp1:*:*:professional:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp1:*:*:server:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp2:*:*:advanced_server:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp2:*:*:datacenter_server:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp2:*:*:server:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp3:*:*:advanced_server:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp3:*:*:datacenter_server:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp3:*:*:professional:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp3:*:*:server:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:advanced_server:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:datacenter_server:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:professional:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:server:*:*:*;cpe:2.3:o:microsoft:windows_2000:-:sp2:*:*:professional:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:-:*:*:*:datacenter:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:-:*:*:*:enterprise:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:-:*:*:*:standard:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:-:*:*:*:web_edition:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_vista:*:*:*:*:business:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:*:*:*:december_ctp:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:*:*:*:enterprise:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:*:*:*:home_basic:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:*:*:*:home_premium:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:beta1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:beta2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:beta:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:home:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:media_center:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:professional:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:tablet_pc:*:*:*,Microsoft,Windows 2000
CVE-2007-1819,0.0,,0.39735,CWE-119,"Stack-based buffer overflow in the SPIDERLib.Loader ActiveX control (Spider90.ocx) 9.1.0.4353 in TestDirector (TD) for Mercury Quality Center 9.0 before Patch 12.1, and 8.2 SP1 before Patch 32, allows remote attackers to execute arbitrary code via a long ProgColor property.",2007-04-02,Metasploit,cpe:2.3:a:hp:mercury_quality_center:8.2:sp1:*:*:*:*:*:*;cpe:2.3:a:hp:mercury_quality_center:9.0:*:*:*:*:*:*:*,Hp,Mercury Quality Center
CVE-2007-1868,0.0,,0.59338,NVD-CWE-Other,"The management service in IBM Tivoli Provisioning Manager for OS Deployment before 5.1 Fix Pack 2 does not properly handle multipart/form-data in HTTP POST requests, which allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via crafted POST requests to port 8080/tcp or 443/tcp.",2007-04-04,Metasploit,cpe:2.3:a:ibm:tivoli_provisioning_manager_os_deployment:5.1.0.116:*:*:*:*:*:*:*,Ibm,Tivoli Provisioning Manager Os Deployment
CVE-2007-2139,0.0,,0.77996,NVD-CWE-Other,"Multiple stack-based buffer overflows in the SUN RPC service in CA (formerly Computer Associates) BrightStor ARCserve Media Server, as used in BrightStor ARCserve Backup 9.01 through 11.5 SP2, BrightStor Enterprise Backup 10.5, Server Protection Suite 2, and Business Protection Suite 2, allow remote attackers to execute arbitrary code via malformed RPC strings, a different vulnerability than CVE-2006-5171, CVE-2006-5172, and CVE-2007-1785.",2007-04-25,Metasploit,cpe:2.3:a:broadcom:brightstor_arcserve_backup:11.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:11.5:sp2:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:9.01:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:business_protection_suite:2.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:server_protection_suite:2:*:*:*:*:*:*:*;cpe:2.3:a:ca:brightstor_arcserve_backup:11:*:windows:*:*:*:*:*;cpe:2.3:a:ca:business_protection_suite:2.0:*:microsoft_sbs_premium:*:*:*:*:*;cpe:2.3:a:ca:business_protection_suite:2.0:*:microsoft_sbs_standard:*:*:*:*:*,Broadcom,Brightstor Arcserve Backup
CVE-2007-2175,0.0,,0.83804,NVD-CWE-Other,"Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows remote attackers to execute arbitrary code via parameters to the toQTPointer method in quicktime.util.QTHandleRef, which can be used to modify arbitrary memory when creating QTPointerRef objects, as demonstrated during the ""PWN 2 0WN"" contest at CanSecWest 2007.",2007-04-24,Metasploit,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*,Apple,Safari
CVE-2007-2193,0.0,,0.3657,NVD-CWE-Other,"Stack-based buffer overflow in the ID_X.apl plugin in ACDSee 9.0 Build 108, Pro 8.1 Build 99, and Photo Editor 4.0 Build 195 allows user-assisted remote attackers to execute arbitrary code via a crafted XPM file with a long section string.  NOTE: some of these details are obtained from third party information.",2007-04-24,Metasploit,cpe:2.3:a:acd_systems:acdsee:8.1_build_99:*:pro:*:*:*:*:*;cpe:2.3:a:acd_systems:acdsee:9.0_build_108:*:*:*:*:*:*:*;cpe:2.3:a:acd_systems:photo_editor:4.0_build_195:*:*:*:*:*:*:*,Acd Systems,Acdsee
CVE-2007-2238,0.0,,0.45535,CWE-119,"Multiple stack-based buffer overflows in the Whale Client Components ActiveX control (WhlMgr.dll), as used in Microsoft Intelligent Application Gateway (IAG) before 3.7 SP2, allow remote attackers to execute arbitrary code via long arguments to the (1) CheckForUpdates or (2) UpdateComponents methods.",2009-04-16,Metasploit,cpe:2.3:a:microsoft:intelligent_application_gateway_2007:*:sp1:*:*:*:*:*:*,Microsoft,Intelligent Application Gateway 2007
CVE-2007-2280,0.0,,0.60286,CWE-119,"Stack-based buffer overflow in OmniInet.exe (aka the backup client service daemon) in the Application Recovery Manager component in HP OpenView Storage Data Protector 5.50 and 6.0 allows remote attackers to execute arbitrary code via an MSG_PROTOCOL command with long arguments, a different vulnerability than CVE-2009-3844.",2009-12-18,Metasploit,cpe:2.3:a:hp:openview_storage_data_protector:5.50:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_storage_data_protector:6.0:*:*:*:*:*:*:*,Hp,Openview Storage Data Protector
CVE-2007-2386,0.0,,0.49999,NVD-CWE-Other,Buffer overflow in mDNSResponder in Apple Mac OS X 10.4 up to 10.4.9 allows remote attackers to cause a denial of service (application termination) or execute arbitrary code via a crafted UPnP Internet Gateway Device (IGD) packet.,2007-05-24,Metasploit,cpe:2.3:o:apple:mac_os_x:10.4.1:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.4.2:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.4.3:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.4.4:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.4.5:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.4.6:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.4.7:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.4.8:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.4:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2007-2446,0.0,,0.77806,CWE-119,"Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).",2007-05-14,Metasploit,cpe:2.3:a:samba:samba:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.10:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.11:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.12:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.13:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.14:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.14a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.15:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.16:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.17:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.18:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.19:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.20:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.20a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.20b:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.21:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.21a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.21b:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.21c:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.22:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23b:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23c:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23d:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.24:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:pre1:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:pre2:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:rc1:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:rc2:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:rc3:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.2a:*:*:*:*:*:*:*,Samba,Samba
CVE-2007-2447,0.0,,0.49759,NVD-CWE-Other,"The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the ""username map script"" smb.conf option is enabled, and allows remote authenticated users to execute commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file share management.",2007-05-14,Metasploit,cpe:2.3:a:samba:samba:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.10:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.11:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.12:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.13:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.14:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.14a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.15:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.16:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.17:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.18:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.19:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.20:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.20a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.20b:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.21:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.21a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.21b:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.21c:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.22:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23b:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23c:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23d:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.24:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:pre1:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:pre2:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:rc1:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:rc2:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:rc3:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.2a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.4:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.4:rc1:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.5:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.6:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.7:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.8:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.9:*:*:*:*:*:*:*,Samba,Samba
CVE-2007-2449,0.0,,0.77376,NVD-CWE-Other,"Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a ""snp/snoop.jsp;"" sequence.",2007-06-14,Nuclei,cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.0.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.15:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.16:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.17:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.18:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.19:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.21:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.22:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.23:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.24:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.25:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.26:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.27:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.28:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.29:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.30:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:*,Apache,Tomcat
CVE-2007-2508,0.0,,0.77194,CWE-119,"Multiple stack-based buffer overflows in Trend Micro ServerProtect 5.58 before Security Patch 2 Build 1174 allow remote attackers to execute arbitrary code via crafted data to (1) TCP port 5168, which triggers an overflow in the CAgRpcClient::CreateBinding function in the AgRpcCln.dll library in SpntSvc.exe; or (2) TCP port 3628, which triggers an overflow in EarthAgent.exe.  NOTE: both issues are reachable via TmRpcSrv.dll.",2007-05-08,Metasploit,cpe:2.3:a:trend_micro:serverprotect:*:*:*:*:*:*:*:*,Trend Micro,Serverprotect
CVE-2007-2617,0.0,,0.03803,NVD-CWE-Other,"srsexec in Sun Remote Services (SRS) Net Connect Software Proxy Core package in Sun Solaris 10 does not enforce file permissions when opening files, which allows local users to read the first line of arbitrary files via the -d and -v options.",2007-05-11,Metasploit,cpe:2.3:a:sun:net_connect_software:3.2.3:*:*:*:*:*:*:*;cpe:2.3:a:sun:net_connect_software:3.2.4:*:*:*:*:*:*:*;cpe:2.3:o:sun:solaris:10.0:*:sparc:*:*:*:*:*,Sun,Solaris
CVE-2007-2711,0.0,,0.62715,NVD-CWE-Other,Stack-based buffer overflow in TinyIdentD 2.2 and earlier allows remote attackers to execute arbitrary code via a long string to TCP port 113.,2007-05-16,Metasploit,cpe:2.3:a:tinyirc:tinyidentd:*:*:*:*:*:*:*:*,Tinyirc,Tinyidentd
CVE-2007-2864,0.0,,0.49647,NVD-CWE-Other,Stack-based buffer overflow in the Anti-Virus engine before content update 30.6 in multiple CA (formerly Computer Associates) products allows remote attackers to execute arbitrary code via a large invalid value of the coffFiles field in a .CAB file.,2007-06-06,Metasploit,cpe:2.3:a:broadcom:anti-virus_for_the_enterprise:8:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:10.5:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:11.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:11.5:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:11:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:9.01:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:common_services:1.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:common_services:1.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:common_services:2.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:common_services:2.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:common_services:2.2:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:common_services:3.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:etrust_antivirus:8.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:etrust_antivirus:8.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:etrust_antivirus_gateway:7.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:etrust_antivirus_sdk:*:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:etrust_ez_antivirus:6.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:etrust_ez_antivirus:7.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:etrust_ez_armor:1.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:etrust_ez_armor:2.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:etrust_ez_armor:3.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:etrust_ez_armor:3.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:integrated_threat_management:8.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:internet_security_suite:1.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:internet_security_suite:2.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:internet_security_suite:3.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_network_and_systems_management:11.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_network_and_systems_management:11:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_network_and_systems_management:3.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unicenter_network_and_systems_management:3.1:*:*:*:*:*:*:*;cpe:2.3:a:ca:etrust_secure_content_manager:8.0:*:*:*:*:*:*:*;cpe:2.3:a:ca:protection_suites:r2:*:*:*:*:*:*:*;cpe:2.3:a:ca:protection_suites:r3:*:*:*:*:*:*:*,Broadcom,Anti-Virus For The Enterprise
CVE-2007-2888,0.0,,0.54678,NVD-CWE-Other,"Stack-based buffer overflow in UltraISO 8.6.2.2011 and earlier allows user-assisted remote attackers to execute arbitrary code via a long FILE string (filename) in a .cue file, a related issue to CVE-2007-2761.  NOTE: some details are obtained from third party information.",2007-05-30,Metasploit,cpe:2.3:a:ezb_systems:ultraiso:*:*:*:*:*:*:*:*,Ezb Systems,Ultraiso
CVE-2007-2918,0.0,,0.34059,NVD-CWE-Other,"Multiple stack-based buffer overflows in ActiveX controls (1) VibeC in (a) vibecontrol.dll, (2) CallManager and (3) ViewerClient in (b) StarClient.dll, (4) ComLink in (c) uicomlink.dll, and (5) WebCamXMP in (d) wcamxmp.dll in Logitech VideoCall allow remote attackers to cause a denial of service (browser crash) and execute arbitrary code via unspecified vectors.",2007-06-01,Metasploit,cpe:2.3:a:logitech:videocall:*:*:*:*:*:*:*:*,Logitech,Videocall
CVE-2007-2919,0.0,,0.3372,NVD-CWE-Other,"Multiple stack-based buffer overflows in the FViewerLoading ActiveX control (FlipViewerX.dll) in E-Book Systems FlipViewer before 4.1 allow remote attackers to cause a denial of service (crash) or execute arbitrary code via long (1) UID, (2) Opf, (3) PAGENO, (4) LaunchMode, (5) SubID, (6) BookID, (7) LibraryID, (8) SubURL, and (9) LoadOpf properties.",2007-06-06,Metasploit,cpe:2.3:a:e-book_systems:flipviewer:*:*:*:*:*:*:*:*,E-Book Systems,Flipviewer
CVE-2007-2987,0.0,,0.32704,CWE-119,"Multiple buffer overflows in certain ActiveX controls in sasatl.dll in Zenturi ProgramChecker allow remote attackers to execute arbitrary code via unspecified vectors, possibly involving the (1) DebugMsgLog or (2) DoFileProperties methods.",2007-06-01,Metasploit,cpe:2.3:a:zenturi:zenturi_programchecker:*:*:*:*:*:*:*:*,Zenturi,Zenturi Programchecker
CVE-2007-3010,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97759,NVD-CWE-noinfo,masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.,2007-09-18,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:al-enterprise:omnipcx_enterprise_communication_server:*:*:*:*:*:*:*:*,Al-Enterprise,Omnipcx Enterprise Communication Server
CVE-2007-3039,0.0,,0.69055,CWE-119,"Stack-based buffer overflow in the Microsoft Message Queuing (MSMQ) service in Microsoft Windows 2000 Server SP4, Windows 2000 Professional SP4, and Windows XP SP2 allows attackers to execute arbitrary code via a long string in an opnum 0x06 RPC call to port 2103.  NOTE: this is remotely exploitable on Windows 2000 Server.",2007-12-12,Metasploit,cpe:2.3:a:microsoft:message_queuing:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp4:pro:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp4:srv:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*,Microsoft,Windows 2000
CVE-2007-3068,0.0,,0.32948,NVD-CWE-Other,Stack-based buffer overflow in DVD X Player 4.1 Professional allows remote attackers to execute arbitrary code via a PLF playlist containing a long filename.,2007-06-06,Metasploit,cpe:2.3:a:dvd_x_studios:dvd_x_player:4.1:*:professional:*:*:*:*:*,Dvd X Studios,Dvd X Player
CVE-2007-3147,0.0,,0.40374,CWE-119,Buffer overflow in the Yahoo! Webcam Upload ActiveX control in ywcupl.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows remote attackers to execute arbitrary code via a long server property value to the send method.  NOTE: some of these details are obtained from third party information.,2007-06-11,Metasploit,cpe:2.3:a:yahoo:messenger:2.0.1.4:*:*:*:*:*:*:*;cpe:2.3:a:yahoo:messenger:8.0.0.863:*:*:*:*:*:*:*;cpe:2.3:a:yahoo:messenger:8.0.1:*:*:*:*:*:*:*;cpe:2.3:a:yahoo:messenger:8.0:*:*:*:*:*:*:*;cpe:2.3:a:yahoo:messenger:8.0_2005.1.1.4:*:*:*:*:*:*:*;cpe:2.3:a:yahoo:messenger:8.1.0.249:*:*:*:*:*:*:*,Yahoo,Messenger
CVE-2007-3216,0.0,,0.59193,CWE-119,"Multiple buffer overflows in the LGServer component of CA (Computer Associates) BrightStor ARCserve Backup for Laptops and Desktops r11.1 allow remote attackers to execute arbitrary code via crafted arguments to the (1) rxsAddNewUser, (2) rxsSetUserInfo, (3) rxsRenameUser, (4) rxsSetMessageLogSettings, (5) rxsExportData, (6) rxsSetServerOptions, (7) rxsRenameFile, (8) rxsACIManageSend, (9) rxsExportUser, (10) rxsImportUser, (11) rxsMoveUserData, (12) rxsUseLicenseIni, (13) rxsLicGetSiteId, (14) rxsGetLogFileNames, (15) rxsGetBackupLog, (16) rxsBackupComplete, (17) rxsSetDataProtectionSecurityData, (18) rxsSetDefaultConfigName, (19) rxsGetMessageLogSettings, (20) rxsHWDiskGetTotal, (21) rxsHWDiskGetFree, (22) rxsGetSubDirs, (23) rxsGetServerDBPathName, (24) rxsSetServerOptions, (25) rxsDeleteFile, (26) rxsACIManageSend, (27) rxcReadBackupSetList, (28) rxcWriteConfigInfo, (29) rxcSetAssetManagement, (30) rxcWriteFileListForRestore, (31) rxcReadSaveSetProfile, (32) rxcInitSaveSetProfile, (33) rxcAddSaveSetNextAppList, (34) rxcAddSaveSetNextFilesPathList, (35) rxcAddNextBackupSetIncWildCard, (36) rxcGetRevisions, (37) rxrAddMovedUser, (38) rxrSetClientVersion, or (39) rxsSetDataGrowthScheduleAndFilter commands.",2007-06-14,Metasploit,cpe:2.3:a:broadcom:brightstor_arcserve_backup_laptops_desktops:11.1:*:*:*:*:*:*:*,Broadcom,Brightstor Arcserve Backup Laptops Desktops
CVE-2007-3280,0.0,,0.2549,NVD-CWE-Other,"The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE statements that map to arbitrary libraries based on the C programming language, which allows remote authenticated superusers to map and execute a function from any library, as demonstrated by using the system function in libc.so.6 to gain shell access.",2007-06-19,Metasploit,cpe:2.3:a:postgresql:postgresql:8.1:*:*:*:*:*:*:*,Postgresql,Postgresql
CVE-2007-3314,0.0,,0.43408,NVD-CWE-Other,"Stack-based buffer overflow in peviewer.spl in Altap Servant Salamander 2.5 with Portable Executable Viewer 2.02 (English Trial), and 2.0 with Portable Executable Viewer 1.00 (English Trial), allows remote attackers to execute arbitrary code via a long PDB debug filename in a PE file.",2007-06-21,Metasploit,cpe:2.3:a:altap:portable_executable_viewer:1.00:*:english_trial:*:*:*:*:*;cpe:2.3:a:altap:portable_executable_viewer:2.02:*:english_trial:*:*:*:*:*;cpe:2.3:a:altap:servant_salamander:2.0:*:*:*:*:*:*:*;cpe:2.3:a:altap:servant_salamander:2.5:*:*:*:*:*:*:*,Altap,Portable Executable Viewer
CVE-2007-3389,0.0,,0.16258,CWE-20,"Wireshark before 0.99.6 allows remote attackers to cause a denial of service (crash) via a crafted chunked encoding in an HTTP response, possibly related to a zero-length payload.",2007-06-26,Metasploit,cpe:2.3:a:wireshark:wireshark:0.99.0:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:0.99.1:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:0.99.2:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:0.99.3:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:0.99.4:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:0.99.5:*:*:*:*:*:*:*,Wireshark,Wireshark
CVE-2007-3435,0.0,,0.35406,NVD-CWE-Other,Stack-based buffer overflow in the BeginPrint method in a certain ActiveX control in RKD Software (barcodetools.com) BarCodeAx.dll 4.9 allows remote attackers to execute arbitrary code via a long argument.,2007-06-27,Metasploit,cpe:2.3:a:rkd_software:barcode_activex:4.9:*:*:*:*:*:*:*,Rkd Software,Barcode Activex
CVE-2007-3566,0.0,,0.66081,NVD-CWE-Other,Stack-based buffer overflow in the database service (ibserver.exe) in Borland InterBase 2007 before SP2 allows remote attackers to execute arbitrary code via a long size value in a create request to port 3050/tcp.,2007-07-26,Metasploit,cpe:2.3:a:borland_software:interbase:2007:*:*:*:*:*:*:*,Borland Software,Interbase
CVE-2007-3605,0.0,,0.69907,NVD-CWE-Other,Stack-based buffer overflow in the kweditcontrol.kwedit.1 ActiveX control in FrontEnd\SapGui\kwedit.dll in the EnjoySAP SAP GUI allows remote attackers to execute arbitrary code via a long argument to the PrepareToPostHTML function.,2007-07-06,Metasploit,cpe:2.3:a:sap:enjoysap:*:*:*:*:*:*:*:*,Sap,Enjoysap
CVE-2007-3614,0.0,,0.70004,NVD-CWE-Other,"Multiple stack-based buffer overflows in waHTTP.exe (aka the SAP DB Web Server) in SAP DB, possibly 7.3 through 7.5, allow remote attackers to execute arbitrary code via (1) a certain cookie value; (2) a certain additional parameter, related to sapdbwa_GetQueryString; and other unspecified vectors related to ""numerous other fields.""",2007-07-06,Metasploit,cpe:2.3:a:sap:sap_db:7.3.00:*:*:*:*:*:*:*;cpe:2.3:a:sap:sap_db:7.3.29:*:*:*:*:*:*:*;cpe:2.3:a:sap:sap_db:7.4.03.29:*:*:*:*:*:*:*;cpe:2.3:a:sap:sap_db:7.4.03.30:*:*:*:*:*:*:*;cpe:2.3:a:sap:sap_db:7.4.3.7_beta:*:*:*:*:*:*:*;cpe:2.3:a:sap:sap_db:7.4.3:*:*:*:*:*:*:*;cpe:2.3:a:sap:sap_db:7.4:*:*:*:*:*:*:*;cpe:2.3:a:sap:sap_db:7.5:*:*:*:*:*:*:*,Sap,Sap Db
CVE-2007-3872,0.0,,0.30276,NVD-CWE-Other,"Multiple stack-based buffer overflows in the Shared Trace Service (OVTrace) service for HP OpenView Operations A.07.50 for Windows, and possibly earlier versions, allow remote attackers to execute arbitrary code via certain crafted requests.",2007-08-09,Metasploit,cpe:2.3:a:hp:openview_operations:*:*:windows:*:*:*:*:*;cpe:2.3:a:hp:shared_trace_service:*:*:*:*:*:*:*:*,Hp,Openview Operations
CVE-2007-3901,0.0,,0.45873,CWE-119,Stack-based buffer overflow in the DirectShow Synchronized Accessible Media Interchange (SAMI) parser in quartz.dll for Microsoft DirectX 7.0 through 10.0 allows remote attackers to execute arbitrary code via a crafted SAMI file.,2007-12-12,Metasploit,cpe:2.3:a:microsoft:directx:10.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:directx:5.2:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:directx:6.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:directx:7.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:directx:7.0a:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:directx:7.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:directx:8.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:directx:8.0a:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:directx:8.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:directx:8.1a:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:directx:8.1b:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:directx:8.2:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:directx:9.0a:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:directx:9.0b:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:directx:9.0c:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:datacenter_edition:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:enterprise_edition:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:standard:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:web_edition:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:*:home:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:*:professional:*:*:*:*:*,Microsoft,Windows 2000
CVE-2007-3925,0.0,,0.84673,CWE-119,Multiple buffer overflows in the IMAP service (imapd32.exe) in Ipswitch IMail Server 2006 before 2006.21 allow remote authenticated users to execute arbitrary code via the (1) Search or (2) Search Charset command.,2007-07-21,Metasploit,cpe:2.3:a:ipswitch:imail_server:*:*:*:*:*:*:*:*;cpe:2.3:a:ipswitch:ipswitch_collaboration_suite:*:*:*:*:*:*:*:*,Ipswitch,Imail Server
CVE-2007-4006,0.0,,0.34481,NVD-CWE-Other,"Buffer overflow in Mike Dubman Windows RSH daemon (rshd) 1.7 has unknown impact and remote attack vectors, aka ZD-00000034.  NOTE: this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release actionable advisories. A CVE has been assigned for tracking purposes, but duplicates with other CVEs are difficult to determine.",2007-07-26,Metasploit,cpe:2.3:a:mike_dubman:windows_rsh_daemon:1.7:*:*:*:*:*:*:*,Mike Dubman,Windows Rsh Daemon
CVE-2007-4370,0.0,,0.59197,NVD-CWE-Other,Multiple buffer overflows in the (1) client and (2) server in Racer 0.5.3 beta 5 allow remote attackers to execute arbitrary code via a long string to UDP port 26000.,2007-08-15,Metasploit,cpe:2.3:a:racer:racer:0.5.3:*:*:*:*:*:*:*,Racer,Racer
CVE-2007-4387,0.0,,0.09203,NVD-CWE-Other,"Cross-site request forgery (CSRF) vulnerability in /xslt in 2wire 1701HG and 2071 Gateway routers, with 3.17.5 and 5.29.51 software, allows remote attackers to perform certain configuration changes as administrators.",2007-08-17,Metasploit,cpe:2.3:h:2wire:1701hg_router:3.17.5:*:*:*:*:*:*:*;cpe:2.3:h:2wire:1701hg_router:5.29.51:*:*:*:*:*:*:*;cpe:2.3:h:2wire:2071_router:3.17.5:*:*:*:*:*:*:*;cpe:2.3:h:2wire:2071_router:5.29.51:*:*:*:*:*:*:*,2Wire,1701Hg Router
CVE-2007-4440,0.0,,0.64513,CWE-119,"Stack-based buffer overflow in the MercuryS SMTP server in Mercury Mail Transport System, possibly 4.51 and earlier, allows remote attackers to execute arbitrary code via a long AUTH CRAM-MD5 string. NOTE: this might overlap CVE-2006-5961.",2007-08-21,Metasploit,cpe:2.3:a:pmail:mercury_mail_transport_system:*:*:*:*:*:*:*:*,Pmail,Mercury Mail Transport System
CVE-2007-4466,0.0,,0.3089,CWE-94,Multiple stack-based buffer overflows in Electronic Arts (EA) SnoopyCtrl ActiveX control (NPSnpy.dll) allow remote attackers to execute arbitrary code via unspecified methods and parameters.,2007-10-09,Metasploit,cpe:2.3:a:electronic_arts:snoopyctrl:*:*:*:*:*:*:*:*,Electronic Arts,Snoopyctrl
CVE-2007-4474,0.0,,0.44184,CWE-119,"Multiple stack-based buffer overflows in the IBM Lotus Domino Web Access ActiveX control, as provided by inotes6.dll, inotes6w.dll, dwa7.dll, and dwa7w.dll, in Domino 6.x and 7.x allow remote attackers to execute arbitrary code, as demonstrated by an overflow from a long General_ServerName property value when calling the InstallBrowserHelperDll function in the Upload Module in the dwa7.dwa7.1 control in dwa7w.dll 7.0.34.1.",2007-12-27,Metasploit,cpe:2.3:a:ibm:domino_web_access:6.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:domino_web_access:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:domino_web_access:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:domino_web_access:6.0.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:domino_web_access:6.0.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:domino_web_access:6.0.5:*:*:*:*:*:*:*;cpe:2.3:a:ibm:domino_web_access:6.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:domino_web_access:6.5.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:domino_web_access:6.5.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:domino_web_access:6.5.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:domino_web_access:6.5.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:domino_web_access:6.5.5:*:*:*:*:*:*:*;cpe:2.3:a:ibm:domino_web_access:6.5:*:*:*:*:*:*:*;cpe:2.3:a:ibm:domino_web_access:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:domino_web_access:7.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_domino_web_access:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_domino_web_access:7.0.34.1:*:*:*:*:*:*:*,Ibm,Domino Web Access
CVE-2007-4475,0.0,,0.40307,CWE-119,Stack-based buffer overflow in EAI WebViewer3D ActiveX control (webviewer3d.dll) in SAP AG SAPgui before 7.10 Patch Level 9 allows remote attackers to execute arbitrary code via a long argument to the SaveViewToSessionFile method.,2009-04-01,Metasploit,cpe:2.3:a:sap:sapgui:*:*:*:*:*:*:*:*;cpe:2.3:a:sap:sapgui:4.6:*:*:*:*:*:*:*;cpe:2.3:a:sap:sapgui:4.6:*:windows:*:*:*:*:*;cpe:2.3:a:sap:sapgui:4.6a:*:*:*:*:*:*:*;cpe:2.3:a:sap:sapgui:4.6a:*:windows:*:*:*:*:*;cpe:2.3:a:sap:sapgui:4.6b:*:*:*:*:*:*:*;cpe:2.3:a:sap:sapgui:4.6b:*:windows:*:*:*:*:*;cpe:2.3:a:sap:sapgui:4.6c:*:*:*:*:*:*:*;cpe:2.3:a:sap:sapgui:4.6c:*:windows:*:*:*:*:*;cpe:2.3:a:sap:sapgui:4.6d:*:*:*:*:*:*:*;cpe:2.3:a:sap:sapgui:4.6d:*:windows:*:*:*:*:*;cpe:2.3:a:sap:sapgui:6.40:*:*:*:*:*:*:*,Sap,Sapgui
CVE-2007-4504,0.0,,0.09491,NVD-CWE-Other,Directory traversal vulnerability in index.php in the RSfiles component (com_rsfiles) 1.0.2 and earlier for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter in a files.display action.,2007-08-23,Nuclei,cpe:2.3:a:joomla:rsfiles:*:*:*:*:*:*:*:*,Joomla,Rsfiles
CVE-2007-4515,0.0,,0.33011,CWE-119,Buffer overflow in a certain ActiveX control in YVerInfo.dll before 2007.8.27.1 in the Yahoo! services suite for Yahoo! Messenger before 8.1.0.419 allows remote attackers to execute arbitrary code via unspecified vectors involving arguments to the (1) fvCom and (2) info methods.  NOTE: some of these details are obtained from third party information.,2007-08-31,Metasploit,cpe:2.3:a:yahoo:messenger:*:*:*:*:*:*:*:*,Yahoo,Messenger
CVE-2007-4556,0.0,,0.25749,NVD-CWE-Other,"Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a ""%{"" sequence and ending with a ""}"" character.",2007-08-28,Nuclei,cpe:2.3:a:opensymphony:xwork:*:*:*:*:*:*:*:*,Opensymphony,Xwork
CVE-2007-4560,0.0,,0.83539,CWE-78,"clamav-milter in ClamAV before 0.91.2, when run in black hole mode, allows remote attackers to execute arbitrary commands via shell metacharacters that are used in a certain popen call, involving the ""recipient field of sendmail.""",2007-08-28,Metasploit,cpe:2.3:a:clam_anti-virus:clamav:*:*:*:*:*:*:*:*,Clam Anti-Virus,Clamav
CVE-2007-4607,0.0,,0.56379,CWE-119,"Buffer overflow in the EasyMailSMTPObj ActiveX control in emsmtp.dll 6.0.1 in the Quiksoft EasyMail SMTP Object, as used in Postcast Server Pro 3.0.61 and other products, allows remote attackers to execute arbitrary code via a long argument to the SubmitToExpress method, a different vulnerability than CVE-2007-1029. NOTE: this may have been fixed in version 6.0.3.15.",2007-08-31,Metasploit,cpe:2.3:a:gate_comm_software:postcast_server_pro:3.0.61:*:*:*:*:*:*:*;cpe:2.3:a:quicksoft:easymail_objects:*:*:*:*:*:*:*:*,Gate Comm Software,Postcast Server Pro
CVE-2007-4620,0.0,,0.52274,CWE-119,"Multiple stack-based buffer overflows in Computer Associates (CA) Alert Notification Service (Alert.exe) 8.1.586.0, 8.0.450.0, and 7.1.758.0, as used in multiple CA products including Anti-Virus for the Enterprise 7.1 through r11.1 and Threat Manager for the Enterprise 8.1 and r8, allow remote authenticated users to execute arbitrary code via crafted RPC requests.",2008-04-07,Metasploit,cpe:2.3:a:broadcom:anti-virus_for_the_enterprise:7.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:anti-virus_for_the_enterprise:8.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:anti-virus_for_the_enterprise:8:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:11.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup:11.5:*:*:*:*:*:*:*;cpe:2.3:a:ca:brightstor_arcserve_backup:11:*:windows:*:*:*:*:*;cpe:2.3:a:ca:threat_manager_for_the_enterprise:r8.1:*:*:*:*:*:*:*;cpe:2.3:a:ca:threat_manager_for_the_enterprise:r8:*:*:*:*:*:*:*,Broadcom,Anti-Virus For The Enterprise
CVE-2007-4776,0.0,,0.48964,CWE-119,"Buffer overflow in Microsoft Visual Basic 6.0 and Enterprise Edition 6.0 SP6 allows user-assisted remote attackers to execute arbitrary code via a Visual Basic project (vbp) file containing a long Reference line, related to VBP_Open and OLE. NOTE: there are limited usage scenarios under which this would be a vulnerability.",2007-09-10,Metasploit,cpe:2.3:a:microsoft:visual_basic:6.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:visual_basic:6.0:sp6:enterprise:*:*:*:*:*,Microsoft,Visual Basic
CVE-2007-4880,0.0,,0.75945,CWE-119,"Buffer overflow in the Client Acceptor Daemon (CAD), dsmcad.exe, in certain IBM Tivoli Storage Manager (TSM) clients 5.1 before 5.1.8.1, 5.2 before 5.2.5.2, 5.3 before 5.3.5.3, and 5.4 before 5.4.1.2 allows remote attackers to execute arbitrary code via crafted HTTP headers, aka IC52905.",2007-09-28,Metasploit,cpe:2.3:a:ibm:tivoli_storage_manager_client:5.1.8.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_client:5.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_client:5.2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_client:5.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_client:5.3.5.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_client:5.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_client:5.4.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_client:5.4:*:*:*:*:*:*:*,Ibm,Tivoli Storage Manager Client
CVE-2007-4915,0.0,,0.68168,CWE-20,"The Intersil isl3893 extensions for Boa 0.93.15, as used on the FreeLan RO80211G-AP and other devices, do not prevent stack writes from entering memory locations used for string constants, which allows remote attackers to change the admin password stored in memory via a long username in an HTTP Basic Authentication request.",2007-09-17,Metasploit,cpe:2.3:a:boa:boa_webserver:0.93.15:*:*:*:*:*:*:*,Boa,Boa Webserver
CVE-2007-5003,0.0,,0.67204,CWE-119,"Multiple stack-based buffer overflows in CA (Computer Associates) BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.5 allow remote attackers to execute arbitrary code via a long (1) username or (2) password to the rxrLogin command in rxRPC.dll, or a long (3) username argument to the GetUserInfo function.",2007-10-01,Metasploit,cpe:2.3:a:broadcom:brightstor_arcserve_backup_laptops_desktops:11.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup_laptops_desktops:11.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup_laptops_desktops:11.1:sp1:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup_laptops_desktops:11.5:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:brightstor_arcserve_backup_laptops_desktops:4.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:desktop_management_suite:11.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:desktop_management_suite:11.1:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:desktop_management_suite:11.2:*:*:*:*:*:*:*;cpe:2.3:a:ca:protection_suites:r2:*:*:*:*:*:*:*,Broadcom,Brightstor Arcserve Backup Laptops Desktops
CVE-2007-5067,0.0,,0.73243,CWE-119,Multiple buffer overflows in iMatix Xitami Web Server 2.5c2 allow remote attackers to execute arbitrary code via a long If-Modified-Since header to (1) xigui32.exe or (2) xitami.exe.,2007-09-24,Metasploit,cpe:2.3:a:imatix:xitami:2.5_c2:*:*:*:*:*:*:*,Imatix,Xitami
CVE-2007-5082,0.0,,0.6346,CWE-119,"Multiple stack-based buffer overflows in Computer Associates (CA) BrightStor Hierarchical Storage Manager (HSM) before r11.6 allow remote attackers to execute arbitrary code via unspecified CsAgent service commands with certain opcodes, related to missing validation of a length parameter.",2007-10-01,Metasploit,cpe:2.3:a:broadcom:brightstor_hierarchical_storage_manager:11.5:*:*:*:*:*:*:*,Broadcom,Brightstor Hierarchical Storage Manager
CVE-2007-5107,0.0,,0.35862,CWE-119,"Stack-based buffer overflow in the AskJeevesToolBar.SettingsPlugin.1 ActiveX control in askBar.dll in IAC Search & Media ask.com Ask Toolbar 4.0.2.53 and earlier allows remote attackers to execute arbitrary code via a long ShortFormat property value.  NOTE: some of these details are obtained from third party information.  NOTE: the researcher claims that this is the same as CVE-2007-5108, but there is insufficient detail for CVE-2007-5108 to be certain.",2007-09-26,Metasploit,cpe:2.3:a:ask.com:ask_toolbar:*:*:*:*:*:*:*:*,Ask.Com,Ask Toolbar
CVE-2007-5208,0.0,,0.67264,CWE-20,"hpssd in Hewlett-Packard Linux Imaging and Printing Project (hplip) 1.x and 2.x before 2.7.10 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a from address, which is not properly handled when invoking sendmail.",2007-10-13,Metasploit,cpe:2.3:a:hp:linux_imaging_and_printing_project:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:linux_imaging_and_printing_project:1.0:*:*:*:*:*:*:*,Hp,Linux Imaging And Printing Project
CVE-2007-5217,0.0,,0.2999,CWE-119,"Stack-based buffer overflow in the ADM4 ActiveX control in adm4.dll in Altnet Download Manager 4.0.0.6, as used in (1) Kazaa 3.2.7 and (2) Grokster, allows remote attackers to execute arbitrary code via a long argument to the Install method.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.",2007-10-05,Metasploit,cpe:2.3:a:altnet:altnet_download_manager:4.0.0.6:*:*:*:*:*:*:*;cpe:2.3:a:grokster:grokster:2.6:*:*:*:*:*:*:*;cpe:2.3:a:kazaa:kazaa_media_desktop:3.2.7:*:*:*:*:*:*:*,Altnet,Altnet Download Manager
CVE-2007-5243,0.0,,0.40062,CWE-119,"Multiple stack-based buffer overflows in Borland InterBase LI 8.0.0.53 through 8.1.0.253, and WI 5.1.1.680 through 8.1.0.257, allow remote attackers to execute arbitrary code via (1) a long service attach request on TCP port 3050 to the (a) SVC_attach or (b) INET_connect function, (2) a long create request on TCP port 3050 to the (c) isc_create_database or (d) jrd8_create_database function, (3) a long attach request on TCP port 3050 to the (e) isc_attach_database or (f) PWD_db_aliased function, or unspecified vectors involving the (4) jrd8_attach_database or (5) expand_filename2 function.",2007-10-06,Metasploit,cpe:2.3:a:borland_software:interbase:li_8.0.0.253:*:*:*:*:*:*:*;cpe:2.3:a:borland_software:interbase:li_8.0.0.53:*:*:*:*:*:*:*;cpe:2.3:a:borland_software:interbase:li_8.0.0.54:*:*:*:*:*:*:*;cpe:2.3:a:borland_software:interbase:wi-o6.0.1.6:*:*:*:*:*:*:*;cpe:2.3:a:borland_software:interbase:wi-o6.0.2.0:*:*:*:*:*:*:*;cpe:2.3:a:borland_software:interbase:wi-v5.1.1.680:*:*:*:*:*:*:*;cpe:2.3:a:borland_software:interbase:wi-v5.5.0.742:*:*:*:*:*:*:*;cpe:2.3:a:borland_software:interbase:wi-v6.0.0.627:*:*:*:*:*:*:*;cpe:2.3:a:borland_software:interbase:wi-v6.0.1.0:*:*:*:*:*:*:*;cpe:2.3:a:borland_software:interbase:wi-v6.0.1.6:*:*:*:*:*:*:*;cpe:2.3:a:borland_software:interbase:wi-v6.5.0.28:*:*:*:*:*:*:*;cpe:2.3:a:borland_software:interbase:wi-v7.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:borland_software:interbase:wi-v7.5.0.129:*:*:*:*:*:*:*;cpe:2.3:a:borland_software:interbase:wi-v7.5.1.80:*:*:*:*:*:*:*;cpe:2.3:a:borland_software:interbase:wi-v8.0.0.123:*:*:*:*:*:*:*;cpe:2.3:a:borland_software:interbase:wi_5.1.1.680:*:*:*:*:*:*:*;cpe:2.3:a:borland_software:interbase:wi_8.1.0.257:*:*:*:*:*:*:*,Borland Software,Interbase
CVE-2007-5244,0.0,,0.37503,CWE-119,"Stack-based buffer overflow in Borland InterBase LI 8.0.0.53 through 8.1.0.253 on Linux, and possibly unspecified versions on Solaris, allows remote attackers to execute arbitrary code via a long attach request on TCP port 3050 to the open_marker_file function.",2007-10-06,Metasploit,cpe:2.3:a:borland_software:interbase:li_8.0.0.253:*:*:*:*:*:*:*;cpe:2.3:a:borland_software:interbase:li_8.0.0.53:*:*:*:*:*:*:*;cpe:2.3:a:borland_software:interbase:li_8.0.0.54:*:*:*:*:*:*:*,Borland Software,Interbase
CVE-2007-5423,0.0,,0.76661,CWE-94,"tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f array parameter, which are processed by create_function.",2007-10-12,Metasploit,cpe:2.3:a:tiki:tikiwiki_cms\/groupware:1.9.8:*:*:*:*:*:*:*,Tiki,Tikiwiki Cms/Groupware
CVE-2007-5511,0.0,,0.31758,CWE-89,"SQL injection vulnerability in Workspace Manager for Oracle Database before OWM 10.2.0.4.1, OWM 10.1.0.8.0, and OWM 9.2.0.8.0 allows attackers to execute arbitrary SQL commands via the FINDRICSET procedure in the LT package.  NOTE: this is probably covered by CVE-2007-5510, but there are insufficient details to be certain.",2007-10-17,Metasploit,cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*,Oracle,Database Server
CVE-2007-5601,0.0,,0.42365,CWE-119,"Stack-based buffer overflow in the Database Component in MPAMedia.dll in RealNetworks RealPlayer 10.5 and 11 beta, and earlier versions including 10, RealOne Player, and RealOne Player 2, allows remote attackers to execute arbitrary code via certain playlist names, as demonstrated via the import method to the IERPCtl ActiveX control in ierpplug.dll.",2007-10-20,Metasploit,cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:10.5:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11_beta:*:*:*:*:*:*:*,Realnetworks,Realplayer
CVE-2007-5603,0.0,,0.37981,CWE-119,"Stack-based buffer overflow in the SonicWall SSL-VPN NetExtender NELaunchCtrl ActiveX control before 2.1.0.51, and 2.5.x before 2.5.0.56, allows remote attackers to execute arbitrary code via a long string in the second argument to the AddRouteEntry method.",2007-11-05,Metasploit,cpe:2.3:a:sonicwall:ssl_vpn:*:*:*:*:*:*:*:*,Sonicwall,Ssl Vpn
CVE-2007-5659,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.94222,CWE-120,Multiple buffer overflows in Adobe Reader and Acrobat 8.1.1 and earlier allow remote attackers to execute arbitrary code via a PDF file with long arguments to unspecified JavaScript methods.  NOTE: this issue might be subsumed by CVE-2008-0655.,2008-02-12,CISA/Metasploit,cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*,Adobe,Acrobat
CVE-2007-5660,0.0,,0.36619,NVD-CWE-noinfo,"Unspecified vulnerability in the Update Service ActiveX control in isusweb.dll before 6.0.100.65101 in MacroVision FLEXnet Connect and InstallShield 2008 allows remote attackers to execute arbitrary code via an unspecified ""unsafe method,"" possibly involving a buffer overflow.",2007-11-02,Metasploit,cpe:2.3:a:macrovision:flexnet_connect:*:*:*:*:*:*:*:*;cpe:2.3:a:macrovision:installshield_2008:*:*:*:*:*:*:*:*;cpe:2.3:a:macrovision:update_service:3.0:*:*:*:*:*:*:*;cpe:2.3:a:macrovision:update_service:4.0:*:*:*:*:*:*:*;cpe:2.3:a:macrovision:update_service:5.0:*:*:*:*:*:*:*;cpe:2.3:a:macrovision:update_service:5.1.100_47363:*:*:*:*:*:*:*;cpe:2.3:a:macrovision:update_service:6.0.100_60146:*:*:*:*:*:*:*,Macrovision,Flexnet Connect
CVE-2007-5728,0.0,,0.14639,CWE-79,"Cross-site scripting (XSS) vulnerability in phpPgAdmin 3.5 to 4.1.1, and possibly 4.1.2, allows remote attackers to inject arbitrary web script or HTML via certain input available in PHP_SELF in (1) redirect.php, possibly related to (2) login.php, different vectors than CVE-2007-2865.",2007-10-30,Nuclei,cpe:2.3:a:phppgadmin:phppgadmin:3.5.2:*:*:*:*:*:*:*;cpe:2.3:a:phppgadmin:phppgadmin:3.5.3:*:*:*:*:*:*:*;cpe:2.3:a:phppgadmin:phppgadmin:3.5:*:*:*:*:*:*:*;cpe:2.3:a:phppgadmin:phppgadmin:4.1.1:*:*:*:*:*:*:*,Phppgadmin,Phppgadmin
CVE-2007-5755,0.0,,0.12972,CWE-119,Multiple stack-based buffer overflows in the AOL AmpX ActiveX control in AmpX.dll 2.6.1.11 in AOL Radio allow remote attackers to execute arbitrary code via long arguments to unspecified methods.,2007-11-14,Metasploit,cpe:2.3:a:aol:radio:*:*:*:*:*:*:*:*,Aol,Radio
CVE-2007-5779,0.0,,0.71512,CWE-119,Buffer overflow in the GomManager (GomWeb Control) ActiveX control in GomWeb3.dll 1.0.0.12 in Gretech Online Movie Player (GOM Player) 2.1.6.3499 allows remote attackers to execute arbitrary code via a long argument to the OpenUrl method.,2007-11-01,Metasploit,cpe:2.3:a:gom_player:gom_player:2.1.6.3499:*:*:*:*:*:*:*,Gom Player,Gom Player
CVE-2007-5863,0.0,,0.22982,CWE-310,"Software Update in Apple Mac OS X 10.5.1 allows remote attackers to execute arbitrary commands via a man-in-the-middle (MITM) attack between the client and the server, using a modified distribution definition file with the ""allow-external-scripts"" option.",2007-12-19,Metasploit,cpe:2.3:o:apple:mac_os_x:10.5.1:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x_server:10.5.1:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2007-6016,0.0,,0.50419,CWE-119,"Multiple stack-based buffer overflows in the PVATLCalendar.PVCalendar.1 ActiveX control in pvcalendar.ocx in the scheduler component in the Media Server in Symantec Backup Exec for Windows Server (BEWS) 11d 11.0.6235 and 11.0.7170, and 12.0 12.0.1364, allow remote attackers to execute arbitrary code via a long (1) _DOWText0, (2) _DOWText1, (3) _DOWText2, (4) _DOWText3, (5) _DOWText4, (6) _DOWText5, (7) _DOWText6, (8) _MonthText0, (9) _MonthText1, (10) _MonthText2, (11) _MonthText3, (12) _MonthText4, (13) _MonthText5, (14) _MonthText6, (15) _MonthText7, (16) _MonthText8, (17) _MonthText9, (18) _MonthText10, or (19) _MonthText11 property value when executing the Save method. NOTE: the vendor states ""Authenticated user involvement required,"" but authentication is not needed to attack a client machine that loads this control.",2008-02-29,Metasploit,cpe:2.3:a:symantec:backup_exec_for_windows_server:11d:11.0.6235:*:*:*:*:*:*;cpe:2.3:a:symantec:backup_exec_for_windows_server:11d:11.0.7170:*:*:*:*:*:*;cpe:2.3:a:symantec:backup_exec_for_windows_server:12.0:12.0.1364:*:*:*:*:*:*,Symantec,Backup Exec For Windows Server
CVE-2007-6165,0.0,,0.44746,CWE-20,"Mail in Apple Mac OS X Leopard (10.5.1) allows user-assisted remote attackers to execute arbitrary code via an AppleDouble attachment containing an apparently-safe file type and script in a resource fork, which does not warn the user that a separate program is going to be executed.  NOTE: this is a regression error related to CVE-2006-0395.",2007-11-29,Metasploit,cpe:2.3:o:apple:mac_os_x:10.5:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2007-6166,0.0,,0.41916,CWE-119,"Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac OS X, allows remote Real Time Streaming Protocol (RTSP) servers to execute arbitrary code via an RTSP response with a long Content-Type header.",2007-11-29,Metasploit,cpe:2.3:a:apple:quicktime:*:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:-:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:5.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.6:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.3.9:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.4.9:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.5.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.5.1:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.5.2:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.5.3:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.5.4:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.5.5:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.5.6:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.5.7:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.5.8:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.5:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*,Microsoft,Windows Vista
CVE-2007-6204,0.0,,0.69613,CWE-119,"Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 6.41, 7.01, and 7.51 allow remote attackers to execute arbitrary code via unspecified long arguments to (1) ovlogin.exe, (2) OpenView5.exe, (3) snmpviewer.exe, and (4) webappmon.exe, as demonstrated via a long Action parameter to OpenView5.exe.",2007-12-13,Metasploit,cpe:2.3:a:hp:openview_network_node_manager:6.41:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:*:*:*:*:*:*:*,Hp,Openview Network Node Manager
CVE-2007-6377,0.0,,0.66413,CWE-119,Stack-based buffer overflow in the PassThru functionality in ext.dll in BadBlue 2.72b and earlier allows remote attackers to execute arbitrary code via a long query string.,2007-12-15,Metasploit,cpe:2.3:a:badblue:badblue:*:*:*:*:*:*:*:*,Badblue,Badblue
CVE-2007-6507,0.0,,0.36648,CWE-264,"SpntSvc.exe daemon in Trend Micro ServerProtect 5.58 for Windows, before Security Patch 4, exposes unspecified dangerous sub-functions from StRpcSrv.dll in the DCE/RPC interface, which allows remote attackers to obtain ""full file system access"" and execute arbitrary code.",2007-12-20,Metasploit,cpe:2.3:a:trend_micro:serverprotect:5.58_security_patch_3:*:windows:*:*:*:*:*,Trend Micro,Serverprotect
CVE-2007-6509,0.0,,0.55173,CWE-20,Unspecified vulnerability in Appian Enterprise Business Process Management (BPM) Suite 5.6 SP1 allows remote attackers to cause a denial of service via a crafted packet to port 5400/tcp.,2007-12-21,Metasploit,cpe:2.3:a:appian:business_process_management_suite:5.6:sp1:*:*:*:*:*:*,Appian,Business Process Management Suite
CVE-2007-6530,0.0,,0.36833,CWE-119,"Buffer overflow in the XUpload.ocx ActiveX control in Persits Software XUpload 2.1.0.1, and probably other versions before 3.0, as used by HP Mercury LoadRunner and Groove Virtual Office, allows remote attackers to execute arbitrary code via a long argument to the AddFolder function.",2007-12-27,Metasploit,cpe:2.3:a:groove:virtual_office:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:*:*:*:*:*:*:*:*;cpe:2.3:a:persits:xupload:2.1.0.1:*:*:*:*:*:*:*,Groove,Virtual Office
CVE-2007-6750,0.0,,0.71634,CWE-399,"The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris, related to the lack of the mod_reqtimeout module in versions before 2.2.15.",2011-12-27,Metasploit,cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.2.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.2.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.2.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.2.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.15:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.16:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.17:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.18:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.19:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.20:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.22:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.23:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.24:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.25:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.26:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.27:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.28:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.29:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.30:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.31:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.32:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.33:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.34:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.35:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.36:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.37:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.38:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.39:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.41:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.42:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.65:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.68:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.99:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.28:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.28:beta:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.32:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.32:beta:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.34:beta:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.35:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.37:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.38:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.41:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.42:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.43:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.44:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.45:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.46:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.47:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.48:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.49:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.50:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.51:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.52:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.53:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.54:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.55:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.56:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.57:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.58:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.59:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.60:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.61:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.63:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.1.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.1.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.1.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.1.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.1.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.1.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.1.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2:*:*:*:*:*:*:*,Apache,Http Server
CVE-2008-0015,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.76733,CWE-119,"Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX control in msvidctl.dll in DirectShow, in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted web page, as exploited in the wild in July 2009, aka ""Microsoft Video ActiveX Control Vulnerability.""",2009-07-07,CISA/Metasploit,cpe:2.3:o:microsoft:windows_2003_server:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:-:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:-:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows 2003 Server
CVE-2008-0065,0.0,,0.61275,CWE-119,"Multiple stack-based buffer overflows in in_mp3.dll in Winamp 5.21, 5.5, and 5.51 allow remote attackers to execute arbitrary code via a long (1) artist or (2) name tag in Ultravox streaming metadata, related to construction of stream titles.",2008-01-22,Metasploit,cpe:2.3:a:winamp:nullsoft_winamp:5.21:*:*:*:*:*:*:*;cpe:2.3:a:winamp:nullsoft_winamp:5.51:*:*:*:*:*:*:*;cpe:2.3:a:winamp:nullsoft_winamp:5.5:*:*:*:*:*:*:*,Winamp,Nullsoft Winamp
CVE-2008-0067,0.0,,0.63419,CWE-119,"Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via (1) long string parameters to the OpenView5.exe CGI program; (2) a long string parameter to the OpenView5.exe CGI program, related to ov.dll; or a long string parameter to the (3) getcvdata.exe, (4) ovlaunch.exe, or (5) Toolbar.exe CGI program.",2009-01-08,Metasploit,cpe:2.3:a:hp:openview_network_node_manager:7.51:*:*:*:*:*:*:*,Hp,Openview Network Node Manager
CVE-2008-0226,0.0,,0.91602,CWE-119,"Multiple buffer overflows in yaSSL 1.7.5 and earlier, as used in MySQL and possibly other products, allow remote attackers to execute arbitrary code via (1) the ProcessOldClientHello function in handshake.cpp or (2) ""input_buffer& operator>>"" in yassl_imp.cpp.",2008-01-10,Metasploit,cpe:2.3:a:mysql:mysql:5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:mysql:mysql:5.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mysql:mysql:5.0.15:*:*:*:*:*:*:*;cpe:2.3:a:mysql:mysql:5.0.16:*:*:*:*:*:*:*;cpe:2.3:a:mysql:mysql:5.0.17:*:*:*:*:*:*:*;cpe:2.3:a:mysql:mysql:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mysql:mysql:5.0.20:*:*:*:*:*:*:*;cpe:2.3:a:mysql:mysql:5.0.24:*:*:*:*:*:*:*;cpe:2.3:a:mysql:mysql:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mysql:mysql:5.0.30:*:*:*:*:*:*:*;cpe:2.3:a:mysql:mysql:5.0.36:*:*:*:*:*:*:*;cpe:2.3:a:mysql:mysql:5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mysql:mysql:5.0.44:*:*:*:*:*:*:*;cpe:2.3:a:mysql:mysql:5.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mysql:mysql:5.0.54:*:*:*:*:*:*:*;cpe:2.3:a:mysql:mysql:5.0.56:*:*:*:*:*:*:*;cpe:2.3:a:mysql:mysql:5.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mysql:mysql:5.0.60:*:*:*:*:*:*:*;cpe:2.3:a:mysql:mysql:5.0.66:*:*:*:*:*:*:*;cpe:2.3:a:mysql:mysql:5.1.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.23:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.25:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.26:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.28:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.30:sp1:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.32:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.34:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.36:sp1:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.38:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.40:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.41:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.42:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.44:sp1:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.45:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.46:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.48:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.50:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.50:sp1:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.51:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.52:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.56:sp1:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.58:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.60:sp1:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.62:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.64:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.66:sp1:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.10:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.11:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.12:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.13:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.14:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.15:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.16:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.17:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.18:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.19:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.20:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.21:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.22:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.9:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1:*:*:*:*:*:*:*;cpe:2.3:a:yassl:yassl:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.5.4:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:6.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2008-0244,0.0,,0.80311,CWE-20,"SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via ""&&"" and other shell metacharacters in exec_sdbinfo and other unspecified commands, which are executed when MaxDB invokes cons.exe.",2008-01-12,Metasploit,cpe:2.3:a:sap:maxdb:*:*:*:*:*:*:*:*,Sap,Maxdb
CVE-2008-0311,0.0,,0.31024,CWE-119,Stack-based buffer overflow in the PGMWebHandler::parse_request function in the StarTeam Multicast Service component (STMulticastService) 6.4 in Borland CaliberRM 2006 allows remote attackers to execute arbitrary code via a large HTTP request.,2008-04-06,Metasploit,cpe:2.3:a:borland:caliberrm:2006:*:*:*:*:*:*:*,Borland,Caliberrm
CVE-2008-0320,0.0,,0.57015,CWE-119,Heap-based buffer overflow in the OLE importer in OpenOffice.org before 2.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an OLE file with a crafted DocumentSummaryInformation stream.,2008-04-17,Metasploit,cpe:2.3:a:openoffice:openoffice.org:*:*:*:*:*:*:*:*;cpe:2.3:a:openoffice:openoffice.org:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:openoffice:openoffice.org:2.1:*:*:*:*:*:*:*;cpe:2.3:a:openoffice:openoffice.org:2.2.1:*:*:*:*:*:*:*;cpe:2.3:a:openoffice:openoffice.org:2.2:*:*:*:*:*:*:*;cpe:2.3:a:openoffice:openoffice.org:2.3:*:*:*:*:*:*:*,Openoffice,Openoffice.Org
CVE-2008-0492,0.0,,0.29518,CWE-119,Stack-based buffer overflow in the Persits.XUpload.2 ActiveX control in XUpload.ocx 3.0.0.4 and earlier in Persits XUpload 3.0 allows remote attackers to execute arbitrary code via a long argument to the AddFile method.  NOTE: some of these details are obtained from third party information.,2008-01-30,Metasploit,cpe:2.3:a:persits:xupload:3.0:*:*:*:*:*:*:*,Persits,Xupload
CVE-2008-0506,0.0,,0.58902,CWE-20,"include/imageObjectIM.class.php in Coppermine Photo Gallery (CPG) before 1.4.15, when the ImageMagick picture processing method is configured, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) quality, (2) angle, or (3) clipval parameter to picEditor.php.",2008-01-31,Metasploit,cpe:2.3:a:coppermine:coppermine_photo_gallery:*:*:*:*:*:*:*:*,Coppermine,Coppermine Photo Gallery
CVE-2008-0550,0.0,,0.53784,CWE-189,"Off-by-one error in Steamcast 0.9.75 and earlier allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code via a certain HTTP request that leads to a buffer overflow, as demonstrated by a long User-Agent header.",2008-02-01,Metasploit,cpe:2.3:a:radio_toolbox:steamcast:*:*:*:*:*:*:*:*,Radio Toolbox,Steamcast
CVE-2008-0610,0.0,,0.38757,CWE-119,"Stack-based buffer overflow in the ClientConnection::NegotiateProtocolVersion function in vncviewer/ClientConnection.cpp in vncviewer for UltraVNC 1.0.2 and 1.0.4 before 01252008, when in LISTENING mode or when using the DSM plugin, allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a modified size value.",2008-02-06,Metasploit,cpe:2.3:a:ultravnc:ultravnc:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:ultravnc:ultravnc:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:ultravnc:ultravnc:1.0.4_rc6:*:*:*:*:*:*:*;cpe:2.3:a:ultravnc:ultravnc:1.0.4_rc7:*:*:*:*:*:*:*;cpe:2.3:a:ultravnc:ultravnc:1.0.4_rc8:*:*:*:*:*:*:*,Ultravnc,Ultravnc
CVE-2008-0621,0.0,,0.73359,CWE-119,"Buffer overflow in SAPLPD 6.28 and earlier included in SAP GUI 7.10 and SAPSprint before 1018 allows remote attackers to execute arbitrary code via long arguments to the (1) 0x01, (2) 0x02, (3) 0x03, (4) 0x04, and (5) 0x05 LPD commands.",2008-02-06,Metasploit,cpe:2.3:a:sap:sapgui:7.10:*:*:*:*:*:*:*;cpe:2.3:a:sap:saplpd:*:*:*:*:*:*:*:*;cpe:2.3:a:sap:sapsprint:*:*:*:*:*:*:*:*,Sap,Sapgui
CVE-2008-0655,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.36844,CWE-200,Multiple unspecified vulnerabilities in Adobe Reader and Acrobat before 8.1.2 have unknown impact and attack vectors.,2008-02-07,CISA,cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*,Adobe,Acrobat
CVE-2008-0702,0.0,,0.07707,CWE-119,"Multiple heap-based buffer overflows in Titan FTP Server 6.03 and 6.0.5.549 allow remote attackers to cause a denial of service (daemon crash or hang) and possibly execute arbitrary code via a long argument to the (1) USER or (2) PASS command, different vectors than CVE-2004-1641.",2008-02-12,Nuclei,cpe:2.3:a:south_river_technologies:titan_ftp_server:6.0.5.549:*:*:*:*:*:*:*;cpe:2.3:a:south_river_technologies:titan_ftp_server:6.03:*:*:*:*:*:*:*,South River Technologies,Titan Ftp Server
CVE-2008-0871,0.0,,0.32791,CWE-119,Multiple stack-based buffer overflows in Now SMS/MMS Gateway 2007.06.27 and earlier allow remote attackers to execute arbitrary code via a (1) long password in an Authorization header to the HTTP service or a (2) large packet to the SMPP service.,2008-02-21,Metasploit,cpe:2.3:a:now:sms_mms_gateway:*:*:*:*:*:*:*:*,Now,Sms Mms Gateway
CVE-2008-0926,0.0,,0.58179,CWE-287,"The SOAP interface to the eMBox module in Novell eDirectory 8.7.3.9 and earlier, and 8.8.x before 8.8.2, relies on client-side authentication, which allows remote attackers to bypass authentication via requests for /SOAP URIs, and cause a denial of service (daemon shutdown) or read arbitrary files. NOTE: it was later reported that 8.7.3.10 (aka 8.7.3 SP10) is also affected.",2008-03-28,Metasploit,cpe:2.3:a:novell:edirectory:*:*:*:*:*:*:*:*;cpe:2.3:a:novell:edirectory:8.5.12a:*:*:*:*:*:*:*;cpe:2.3:a:novell:edirectory:8.5.27:*:*:*:*:*:*:*;cpe:2.3:a:novell:edirectory:8.5:*:*:*:*:*:*:*;cpe:2.3:a:novell:edirectory:8.6.2:*:*:*:*:*:*:*;cpe:2.3:a:novell:edirectory:8.7.1:*:*:*:*:*:*:*;cpe:2.3:a:novell:edirectory:8.7.1:sp1:*:*:*:*:*:*;cpe:2.3:a:novell:edirectory:8.7.3.8:*:*:*:*:*:*:*;cpe:2.3:a:novell:edirectory:8.7.3.8_presp9:*:*:*:*:*:*:*;cpe:2.3:a:novell:edirectory:8.7.3.9:*:*:*:*:*:*:*;cpe:2.3:a:novell:edirectory:8.7.3:*:*:*:*:*:*:*;cpe:2.3:a:novell:edirectory:8.7:*:*:*:*:*:*:*;cpe:2.3:a:novell:edirectory:8.8:*:*:*:*:*:*:*,Novell,Edirectory
CVE-2008-0935,0.0,,0.6514,CWE-119,Stack-based buffer overflow in the Novell iPrint Control ActiveX control in ienipp.ocx in Novell iPrint Client before 4.34 allows remote attackers to execute arbitrary code via a long argument to the ExecuteRequest method.,2008-02-25,Metasploit,cpe:2.3:a:novell:iprint:*:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint_client:4.26:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint_client:4.32:*:*:*:*:*:*:*,Novell,Iprint
CVE-2008-0955,0.0,,0.41231,CWE-119,Stack-based buffer overflow in the Creative Software AutoUpdate Engine ActiveX control in CTSUEng.ocx allows remote attackers to execute arbitrary code via a long CacheFolder property value.,2008-05-29,Metasploit,cpe:2.3:a:creative:creative_software_autoupdate_engine:*:*:*:*:*:*:*:*,Creative,Creative Software Autoupdate Engine
CVE-2008-1059,0.0,,0.48329,CWE-94,PHP remote file inclusion vulnerability in modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the libpath parameter.,2008-02-28,Nuclei,cpe:2.3:a:wordpress:sniplets_plugin:1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:sniplets_plugin:1.2.2:*:*:*:*:*:*:*,Wordpress,Sniplets Plugin
CVE-2008-1061,0.0,,0.074,CWE-79,"Multiple cross-site scripting (XSS) vulnerabilities in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to (a) warning.php, (b) notice.php, and (c) inset.php in view/sniplets/, and possibly (d) modules/execute.php; the (2) url parameter to (e) view/admin/submenu.php; and the (3) page parameter to (f) view/admin/pager.php.",2008-02-28,Nuclei,cpe:2.3:a:wordpress:sniplets_plugin:1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:sniplets_plugin:1.2.2:*:*:*:*:*:*:*,Wordpress,Sniplets Plugin
CVE-2008-1117,0.0,,0.69473,CWE-22,"Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, allows remote attackers to upload files to arbitrary locations via a destination filename with a \ (backslash) character followed by ../ (dot dot slash) sequences. NOTE: this can be leveraged for code execution by writing to a Startup folder.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4220.",2008-03-14,Metasploit,cpe:2.3:a:netopia:timbuktu_pro:8.6.5:*:windows:*:*:*:*:*,Netopia,Timbuktu Pro
CVE-2008-1309,0.0,,0.4595,CWE-399,"The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer Enterprise, RealPlayer 10, RealPlayer 10.5 before build 6.0.12.1675, and RealPlayer 11 before 11.0.3 build 6.0.14.806 does not properly manage memory for the (1) Console or (2) Controls property, which allows remote attackers to execute arbitrary code or cause a denial of service (browser crash) via a series of assignments of long string values, which triggers an overwrite of freed heap memory.",2008-03-12,Metasploit,cpe:2.3:a:realnetworks:realplayer:*:*:enterprise:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:10.5:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11:*:*:*:*:*:*:*,Realnetworks,Realplayer
CVE-2008-1311,0.0,,0.49167,CWE-20,"The TFTP server in PacketTrap pt360 Tool Suite PRO 2.0.3901.0 and earlier allows remote attackers to cause a denial of service (daemon hang) by uploading a file named (1) '|' (pipe), (2) '""' (quotation mark), or (3) ""<>"" (less than, greater than); or (4) a file with a long name.  NOTE: the issue for vector 4 might exist because of an incomplete fix for CVE-2008-1312.",2008-03-12,Metasploit,cpe:2.3:a:packettrap:pt360_tool_suite_pro:*:*:*:*:*:*:*:*,Packettrap,Pt360 Tool Suite Pro
CVE-2008-1358,0.0,,0.57075,CWE-119,Stack-based buffer overflow in the IMAP server in Alt-N Technologies MDaemon 9.6.4 allows remote authenticated users to execute arbitrary code via a FETCH command with a long BODY.,2008-03-17,Metasploit,cpe:2.3:a:altn:mdaemon:9.6.4:*:*:*:*:*:*:*,Altn,Mdaemon
CVE-2008-1365,0.0,,0.51111,CWE-119,"Stack-based buffer overflow in Trend Micro OfficeScan Corporate Edition 8.0 Patch 2 build 1189 and earlier, and 7.3 Patch 3 build 1314 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a long encrypted password, which triggers the overflow in (1) cgiChkMasterPwd.exe, (2) policyserver.exe as reachable through cgiABLogon.exe, and other vectors.",2008-03-17,Metasploit,cpe:2.3:a:trend_micro:officescan_corporate_edition:*:*:*:*:*:*:*:*,Trend Micro,Officescan Corporate Edition
CVE-2008-1447,6.8,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N,0.95182,CWE-331,"The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka ""DNS Insufficient Socket Entropy Vulnerability"" or ""the Kaminsky bug.""",2008-07-08,EPSS/Metasploit,cpe:2.3:a:isc:bind:4:*:*:*:*:*:*:*;cpe:2.3:a:isc:bind:8:*:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.2.9:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:lts:*:*:*;cpe:2.3:o:cisco:ios:12.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:compute_cluster:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:datacenter:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:enterprise:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:standard:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:storage:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:compute_cluster:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:compute_cluster:*:x64:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:datacenter:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:datacenter:*:x64:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:enterprise:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:enterprise:*:x64:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:standard:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:standard:*:x64:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:storage:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:storage:*:x64:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:-:*:*:professional:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:5:*:client:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:5:*:client_workstation:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2008-1472,0.0,,0.3901,CWE-119,"Stack-based buffer overflow in the ListCtrl ActiveX Control (ListCtrl.ocx), as used in multiple CA products including BrightStor ARCserve Backup R11.5, Desktop Management Suite r11.1 through r11.2, and Unicenter products r11.1 through r11.2, allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a long argument to the AddColumn method.",2008-03-24,Metasploit,cpe:2.3:a:computer_associates:brightstor_arcserve_backup_laptops_desktops:11.5:*:*:*:*:*:*:*;cpe:2.3:a:computer_associates:desktop_management_suite:r11.1:a:*:*:*:*:*:*;cpe:2.3:a:computer_associates:desktop_management_suite:r11.1:c1:*:*:*:*:*:*;cpe:2.3:a:computer_associates:desktop_management_suite:r11.1:ga:*:*:*:*:*:*;cpe:2.3:a:computer_associates:desktop_management_suite:r11.2:*:*:*:*:*:*:*;cpe:2.3:a:computer_associates:unicenter_dsm_r11_list_control_atx:11.2.3.1895:*:*:*:*:*:*:*;cpe:2.3:a:unicenter:asset_management:r11.1:a:*:*:*:*:*:*;cpe:2.3:a:unicenter:asset_management:r11.1:c1:*:*:*:*:*:*;cpe:2.3:a:unicenter:asset_management:r11.1:ga:*:*:*:*:*:*;cpe:2.3:a:unicenter:asset_management:r11.2:*:*:*:*:*:*:*;cpe:2.3:a:unicenter:asset_management:r11.2:a:*:*:*:*:*:*;cpe:2.3:a:unicenter:asset_management:r11.2:c1:*:*:*:*:*:*;cpe:2.3:a:unicenter:desktop_management_bundle:r11.1:a:*:*:*:*:*:*;cpe:2.3:a:unicenter:desktop_management_bundle:r11.1:c1:*:*:*:*:*:*;cpe:2.3:a:unicenter:desktop_management_bundle:r11.1:ga:*:*:*:*:*:*;cpe:2.3:a:unicenter:desktop_management_bundle:r11.2:*:*:*:*:*:*:*;cpe:2.3:a:unicenter:desktop_management_bundle:r11.2:a:*:*:*:*:*:*;cpe:2.3:a:unicenter:desktop_management_bundle:r11.2:c1:*:*:*:*:*:*;cpe:2.3:a:unicenter:remote_control:r11.1:a:*:*:*:*:*:*;cpe:2.3:a:unicenter:remote_control:r11.1:c1:*:*:*:*:*:*;cpe:2.3:a:unicenter:remote_control:r11.1:ga:*:*:*:*:*:*;cpe:2.3:a:unicenter:remote_control:r11.2:*:*:*:*:*:*:*;cpe:2.3:a:unicenter:remote_control:r11.2:a:*:*:*:*:*:*;cpe:2.3:a:unicenter:remote_control:r11.2:c1:*:*:*:*:*:*;cpe:2.3:a:unicenter:software_delivery:r11.1:a:*:*:*:*:*:*;cpe:2.3:a:unicenter:software_delivery:r11.1:c1:*:*:*:*:*:*;cpe:2.3:a:unicenter:software_delivery:r11.1:ga:*:*:*:*:*:*;cpe:2.3:a:unicenter:software_delivery:r11.2:*:*:*:*:*:*:*;cpe:2.3:a:unicenter:software_delivery:r11.2:a:*:*:*:*:*:*;cpe:2.3:a:unicenter:software_delivery:r11.2:c1:*:*:*:*:*:*,Computer Associates,Brightstor Arcserve Backup Laptops Desktops
CVE-2008-1491,0.0,,0.70132,CWE-119,Stack-based buffer overflow in the DPC Proxy server (DpcProxy.exe) in ASUS Remote Console (aka ARC or ASMB3) 2.0.0.19 and 2.0.0.24 allows remote attackers to execute arbitrary code via a long string to TCP port 623.,2008-03-25,Metasploit,cpe:2.3:a:asus:remote_console:2.0.0.19:*:*:*:*:*:*:*;cpe:2.3:a:asus:remote_console:2.0.0.24:*:*:*:*:*:*:*,Asus,Remote Console
CVE-2008-1547,0.0,,0.48137,CWE-601,Open redirect vulnerability in exchweb/bin/redir.asp in Microsoft Outlook Web Access (OWA) for Exchange Server 2003 SP2 (aka build 6.5.7638) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the URL parameter.,2008-10-21,Nuclei,cpe:2.3:a:microsoft:exchange_server:2003:sp2:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2008-1562,0.0,,0.50693,CWE-20,"The LDAP dissector in Wireshark (formerly Ethereal) 0.99.2 through 0.99.8 allows remote attackers to cause a denial of service (application crash) via a malformed packet, a different vulnerability than CVE-2006-5740.",2008-03-31,Metasploit,cpe:2.3:a:wireshark:wireshark:0.99.2:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:0.99.3:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:0.99.4:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:0.99.5:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:0.99.6:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:0.99.7:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:0.99.8:*:*:*:*:*:*:*,Wireshark,Wireshark
CVE-2008-1602,0.0,,0.6749,CWE-119,"Stack-based buffer overflow in Orbit downloader 2.6.3 and 2.6.4 allows remote attackers to execute arbitrary code via a long download URL, which is not properly handled during Unicode conversion for a balloon notification after a download has failed.",2008-04-06,Metasploit,cpe:2.3:a:orbit_downloader:orbit_downloader:2.6.3:*:*:*:*:*:*:*;cpe:2.3:a:orbit_downloader:orbit_downloader:2.6.4:*:*:*:*:*:*:*,Orbit Downloader,Orbit Downloader
CVE-2008-1610,0.0,,0.53906,CWE-119,Stack-based buffer overflow in TallSoft Quick TFTP Server Pro 2.1 allows remote attackers to cause a denial of service or execute arbitrary code via a long mode field in a read or write request.,2008-04-01,Metasploit,cpe:2.3:a:tallsoft_quick:tftp_server_pro:2.1:*:*:*:*:*:*:*,Tallsoft Quick,Tftp Server Pro
CVE-2008-1611,0.0,,0.67642,CWE-119,Stack-based buffer overflow in TFTP Server SP 1.4 for Windows allows remote attackers to cause a denial of service or execute arbitrary code via a long filename in a read or write request.,2008-04-01,Metasploit,cpe:2.3:a:tftp-server:winagents_tftp_server:sp_1.4:*:windows:*:*:*:*:*,Tftp-Server,Winagents Tftp Server
CVE-2008-1661,0.0,,0.68962,CWE-119,Stack-based buffer overflow in DoubleTake.exe in HP StorageWorks Storage Mirroring (SWSM) before 4.5 SP2 allows remote attackers to execute arbitrary code via a crafted encoded authentication request.,2008-06-04,Metasploit,cpe:2.3:a:hp:storageworks_storage_mirroring:4.5:sp1:*:*:*:*:*:*,Hp,Storageworks Storage Mirroring
CVE-2008-1697,0.0,,0.74345,CWE-119,"Stack-based buffer overflow in ovwparser.dll in HP OpenView Network Node Manager (OV NNM) 7.53, 7.51, and earlier allows remote attackers to execute arbitrary code via a long URI in an HTTP request processed by ovas.exe, as demonstrated by a certain topology/homeBaseView request.  NOTE: some of these details are obtained from third party information.",2008-04-08,Metasploit,cpe:2.3:a:hp:openview_network_node_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:*:*:*:*:*:*:*,Hp,Openview Network Node Manager
CVE-2008-1724,0.0,,0.35128,CWE-119,Stack-based buffer overflow in the IActiveXTransfer.FileTransfer method in the SecureTransport FileTransfer ActiveX control in vcst_en.dll 1.0.0.5 in Tumbleweed SecureTransport Server before 4.6.1 Hotfix 20 allows remote attackers to execute arbitrary code via a long remoteFile parameter.,2008-04-11,Metasploit,cpe:2.3:a:tumbleweed:securetransport_server_app:*:*:*:*:*:*:*:*;cpe:2.3:h:tumbleweed:securetransport_server:*:*:*:*:*:*:*:*,Tumbleweed,Securetransport Server
CVE-2008-1898,0.0,,0.52033,CWE-20,"A certain ActiveX control in WkImgSrv.dll 7.03.0616.0, as distributed in Microsoft Works 7 and Microsoft Office 2003 and 2007, allows remote attackers to execute arbitrary code or cause a denial of service (browser crash) via an invalid WksPictureInterface property value, which triggers an improper function call.",2008-04-21,Metasploit,cpe:2.3:a:microsoft:office:2003:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2007:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:works:7.0:*:*:*:*:*:*:*,Microsoft,Office
CVE-2008-1914,0.0,,0.73719,CWE-119,Stack-based buffer overflow in the AntServer module (AntServer.exe) in BigAnt IM Server in BigAnt Messenger 2.2 allows remote attackers to execute arbitrary code via a long URI in a request to TCP port 6080. NOTE: some of these details are obtained from third party information.,2008-04-22,Metasploit,cpe:2.3:a:bigantsoft:bigant_messenger:2.2:*:*:*:*:*:*:*,Bigantsoft,Bigant Messenger
CVE-2008-20001,0.0,,0.01033,CWE-121,"activePDF WebGrabber version 3.8.2.0 contains a stack-based buffer overflow vulnerability in the GetStatus() method of the APWebGrb.ocx ActiveX control. By passing an overly long string to this method, a remote attacker can execute arbitrary code in the context of the vulnerable process. Although the control is not marked safe for scripting, exploitation is possible via crafted HTML content in Internet Explorer under permissive security settings.",2025-08-30,Metasploit,,,
CVE-2008-2031,0.0,,0.46309,CWE-20,"VicFTPS 5.0 allows remote attackers to cause a denial of service (crash) via a crafted LIST command, which triggers a NULL pointer dereference.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.",2008-04-30,Metasploit,cpe:2.3:a:vicftps:vicftps:5.0:*:*:*:*:*:*:*,Vicftps,Vicftps
CVE-2008-2052,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01568,CWE-601,Open redirect vulnerability in redirect.php in Bitrix Site Manager 6.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the goto parameter.,2008-05-02,Nuclei,cpe:2.3:a:bitrix24:bitrix_site_manager:6.5:*:*:*:*:*:*:*,Bitrix24,Bitrix Site Manager
CVE-2008-2157,0.0,,0.35753,CWE-20,robotd in the Library Manager in EMC AlphaStor 3.1 SP1 for Windows allows remote attackers to execute arbitrary commands via an unspecified string field in a packet to TCP port 3500.,2008-05-29,Metasploit,cpe:2.3:a:emc_corporation:alphastor:3.1_sp1:*:*:*:*:*:*:*,Emc Corporation,Alphastor
CVE-2008-2158,0.0,,0.58397,CWE-119,Multiple stack-based buffer overflows in the Command Line Interface process in the Server Agent in EMC AlphaStor 3.1 SP1 for Windows allow remote attackers to execute arbitrary code via crafted TCP packets to port 41025.,2008-05-29,Metasploit,cpe:2.3:a:emc_corporation:alphastor:3.1_sp1:*:*:*:*:*:*:*,Emc Corporation,Alphastor
CVE-2008-2161,0.0,,0.65284,CWE-119,"Buffer overflow in TFTP Server SP 1.4 and 1.5 on Windows, and possibly other versions, allows remote attackers to execute arbitrary code via a long TFTP error packet.  NOTE: some of these details are obtained from third party information.",2008-05-12,Metasploit,cpe:2.3:a:tftp:tftp_server_sp:1.4:*:*:*:*:*:*:*;cpe:2.3:a:tftp:tftp_server_sp:1.5:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:all_windows:*:*:*:*:*:*:*:*,Microsoft,All Windows
CVE-2008-2240,0.0,,0.64815,CWE-119,"Stack-based buffer overflow in the Web Server service in IBM Lotus Domino before 7.0.3 FP1, and 8.x before 8.0.1, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long Accept-Language HTTP header.",2008-05-22,Metasploit,cpe:2.3:a:ibm:lotus_domino:6.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_domino:6.5:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_domino:7.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_domino:8.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_domino:8.0:*:*:*:*:*:*:*,Ibm,Lotus Domino
CVE-2008-2286,0.0,,0.32678,CWE-89,SQL injection vulnerability in axengine.exe in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 allows remote attackers to execute arbitrary SQL commands via unspecified string fields in a notification packet.,2008-05-18,Metasploit,cpe:2.3:a:symantec:altiris_deployment_solution:6.8:*:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_deployment_solution:6.9:*:*:*:*:*:*:*,Symantec,Altiris Deployment Solution
CVE-2008-2398,0.0,,0.06232,CWE-79,Cross-site scripting (XSS) vulnerability in index.php in AppServ Open Project 2.5.10 and earlier allows remote attackers to inject arbitrary web script or HTML via the appservlang parameter.,2008-05-21,Nuclei,cpe:2.3:a:appserv_open_project:appserv:*:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:1.8.0:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.1.0:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.3.0:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.4.1:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.4.2:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.4.3:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.4.4:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.4.4a:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.4.5:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.4.6:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.4.7:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.4.8:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.4.9:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.4:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.5.2:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.5.3:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.5.4:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.5.4a:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.5.5:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.5.6:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.5.7:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.5.8:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.5.9:*:*:*:*:*:*:*;cpe:2.3:a:appserv_open_project:appserv:2.5:*:*:*:*:*:*:*,Appserv Open Project,Appserv
CVE-2008-2439,0.0,,0.2014,CWE-22,"Directory traversal vulnerability in the UpdateAgent function in TmListen.exe in the OfficeScanNT Listener service in the client in Trend Micro OfficeScan 7.3 Patch 4 build 1367 and other builds before 1372, OfficeScan 8.0 SP1 before build 1222, OfficeScan 8.0 SP1 Patch 1 before build 3087, and Worry-Free Business Security 5.0 before build 1220 allows remote attackers to read arbitrary files via directory traversal sequences in an HTTP request.  NOTE: some of these details are obtained from third party information.",2008-10-03,Metasploit,cpe:2.3:a:trend_micro:officescan:7.3:*:*:*:*:*:*:*;cpe:2.3:a:trend_micro:officescan:8.0:sp1:*:*:*:*:*:*;cpe:2.3:a:trend_micro:officescan:8.0:sp1_patch1:*:*:*:*:*:*;cpe:2.3:a:trend_micro:worry_free_business_security:5.0:*:*:*:*:*:*:*,Trend Micro,Officescan
CVE-2008-2463,0.0,,0.59125,CWE-94,"The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed in the standalone Snapshot Viewer and Microsoft Office Access 2000 through 2003, allows remote attackers to download arbitrary files to a client machine via a crafted HTML document or e-mail message, probably involving use of the SnapshotPath and CompressedPath properties and the PrintSnapshot method. NOTE: this can be leveraged for code execution by writing to a Startup folder.",2008-07-07,Metasploit,cpe:2.3:a:microsoft:office_snapshot_viewer_activex:office2000:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_snapshot_viewer_activex:office_2003:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_snapshot_viewer_activex:office_xp:*:*:*:*:*:*:*,Microsoft,Office Snapshot Viewer Activex
CVE-2008-2499,0.0,,0.77466,CWE-119,"Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM Lotus Sametime 7.5.1 CF1 and earlier, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code via a crafted URL.",2008-05-29,Metasploit,cpe:2.3:a:ibm:lotus_sametime:*:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_sametime:7.5.1:cf1:*:*:*:*:*:*,Ibm,Lotus Sametime
CVE-2008-2551,0.0,,0.46936,CWE-264,"The DownloaderActiveX Control (DownloaderActiveX.ocx) in Icona SpA C6 Messenger 1.0.0.1 allows remote attackers to force the download and execution of arbitrary files via a URL in the propDownloadUrl parameter with the propPostDownloadAction parameter set to ""run.""",2008-06-04,Metasploit,cpe:2.3:a:icona:instant_messenger:1.0.0.1:*:*:*:*:*:*:*,Icona,Instant Messenger
CVE-2008-2639,0.0,,0.77717,CWE-119,"Stack-based buffer overflow in the ODBC server service in Citect CitectSCADA 6 and 7, and CitectFacilities 7, allows remote attackers to execute arbitrary code via a long string in the second application packet in a TCP session on port 20222.",2008-06-16,Metasploit,cpe:2.3:a:citect:citectfacilities:7:*:*:*:*:*:*:*;cpe:2.3:a:citect:citectscada:6:*:*:*:*:*:*:*;cpe:2.3:a:citect:citectscada:7:*:*:*:*:*:*:*,Citect,Citectfacilities
CVE-2008-2650,0.0,,0.18809,CWE-22,"Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the sl parameter to index.php.  NOTE: this can be leveraged for remote file execution by including adm.php and then invoking the upload action. NOTE: on 20080601, the vendor patched 3.1 without changing the version number.",2008-06-10,Nuclei,cpe:2.3:a:cmsimple:cmsimple:3.1:*:*:*:*:*:*:*,Cmsimple,Cmsimple
CVE-2008-2683,0.0,,0.34761,CWE-20,"The BIDIB.BIDIBCtrl.1 ActiveX control in BIDIB.ocx 10.9.3.0 in Black Ice Barcode SDK 5.01 allows remote attackers to force the download and storage of arbitrary files by specifying the origin URL in the first argument to the DownloadImageFileURL method, and the local filename in the second argument.  NOTE: some of these details are obtained from third party information.",2008-06-12,Metasploit,cpe:2.3:a:black_ice:barcode_sdk:5.01:*:*:*:*:*:*:*,Black Ice,Barcode Sdk
CVE-2008-2703,0.0,,0.61121,CWE-119,"Multiple stack-based buffer overflows in Novell GroupWise Messenger (GWIM) Client before 2.0.3 HP1 for Windows allow remote attackers to execute arbitrary code via ""spoofed server responses"" that contain a long string after the NM_A_SZ_TRANSACTION_ID field name.",2008-06-13,Metasploit,cpe:2.3:a:novell:groupwise_messenger:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise_messenger:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise_messenger:2.0:*:*:*:*:*:*:*,Novell,Groupwise Messenger
CVE-2008-2789,0.0,,0.22762,CWE-89,SQL injection vulnerability in pages/index.php in BASIC-CMS allows remote attackers to execute arbitrary SQL commands via the page_id parameter.,2008-06-20,Metasploit,cpe:2.3:a:basic-cms:basic-cms:*:*:*:*:*:*:*:*,Basic-Cms,Basic-Cms
CVE-2008-2905,0.0,,0.18401,CWE-94,"PHP remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the Cache_Lite package in Mambo 4.6.4 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.",2008-06-30,Metasploit,cpe:2.3:a:mambo:mambo:4.0.14:*:*:*:*:*:*:*;cpe:2.3:a:mambo:mambo:4.5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mambo:mambo:4.5.1.3:*:*:*:*:*:*:*;cpe:2.3:a:mambo:mambo:4.5.1_1.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mambo:mambo:4.5.1_beta2:*:*:*:*:*:*:*;cpe:2.3:a:mambo:mambo:4.5.1_beta:*:*:*:*:*:*:*;cpe:2.3:a:mambo:mambo:4.5.1a:*:*:*:*:*:*:*;cpe:2.3:a:mambo:mambo:4.5.2.1:*:*:*:*:*:*:*;cpe:2.3:a:mambo:mambo:4.5.2.2:*:*:*:*:*:*:*;cpe:2.3:a:mambo:mambo:4.5.2.3:*:*:*:*:*:*:*;cpe:2.3:a:mambo:mambo:4.5.2:*:*:*:*:*:*:*;cpe:2.3:a:mambo:mambo:4.5.3h:*:*:*:*:*:*:*;cpe:2.3:a:mambo:mambo:4.5.4:*:*:*:*:*:*:*;cpe:2.3:a:mambo:mambo:4.5:*:*:*:*:*:*:*;cpe:2.3:a:mambo:mambo:4.5_1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:mambo:mambo:4.5_1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mambo:mambo:4.5_1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mambo:mambo:4.5_1.0.3_beta:*:*:*:*:*:*:*;cpe:2.3:a:mambo:mambo:4.5_1.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mambo:mambo:4.6.1:*:*:*:*:*:*:*;cpe:2.3:a:mambo:mambo:4.6.2:*:*:*:*:*:*:*;cpe:2.3:a:mambo:mambo:4.6.4:*:*:*:*:*:*:*;cpe:2.3:a:mambo:mambo:4.6:*:*:*:*:*:*:*,Mambo,Mambo
CVE-2008-2908,0.0,,0.35423,CWE-119,"Multiple stack-based buffer overflows in a certain ActiveX control in ienipp.ocx in Novell iPrint Client for Windows before 4.36 allow remote attackers to execute arbitrary code via a long value of the (1) operation, (2) printer-url, or (3) target-frame parameter.  NOTE: some of these details are obtained from third party information.",2008-06-30,Metasploit,cpe:2.3:a:novell:iprint_client:*:*:windows:*:*:*:*:*,Novell,Iprint Client
CVE-2008-2938,0.0,,0.99708,CWE-22,"Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370.  NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.",2008-08-13,EPSS/Metasploit,cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*,Apache,Tomcat
CVE-2008-2992,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.98482,CWE-787,"Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript function with a crafted format string argument, a related issue to CVE-2008-1104.",2008-11-04,CISA/EPSS/Metasploit,cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*;cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*,Oracle,Solaris
CVE-2008-3008,0.0,,0.54553,CWE-119,"Stack-based buffer overflow in the WMEncProfileManager ActiveX control in wmex.dll in Microsoft Windows Media Encoder 9 Series allows remote attackers to execute arbitrary code via a long first argument to the GetDetailsString method, aka ""Windows Media Encoder Buffer Overrun Vulnerability.""",2008-09-11,Metasploit,cpe:2.3:a:microsoft:windows_media_encoder:9_series:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows-nt:2008:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows-nt:2008:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows-nt:xp:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:-:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:-:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*,Microsoft,Windows-Nt
CVE-2008-3158,0.0,,0.05481,CWE-264,"Unspecified vulnerability in NWFS.SYS in Novell Client for Windows 4.91 SP4 has unknown impact and attack vectors, possibly related to IOCTL requests that overwrite arbitrary memory.",2008-07-11,Metasploit,cpe:2.3:a:novell:novell_client_for_windows:4.91_sp4:*:*:*:*:*:*:*,Novell,Novell Client For Windows
CVE-2008-3257,0.0,,0.83589,CWE-119,"Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after ""POST /.jsp"" in an HTTP request.",2008-07-22,Metasploit,cpe:2.3:a:bea:weblogic_server:10.0:*:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:3.1.8:*:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:4.0.4:*:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:4.0:*:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:4.5.1:*:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:4.5.1:sp15:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:4.5.2:*:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:4.5.2:sp1:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:4.5.2:sp2:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:4.5:*:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:5.1:*:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:5.1:sp10:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:5.1:sp11:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:5.1:sp12:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:5.1:sp13:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:5.1:sp1:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:5.1:sp2:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:5.1:sp3:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:5.1:sp4:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:5.1:sp5:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:5.1:sp6:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:5.1:sp7:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:5.1:sp8:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:5.1:sp9:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:6.0:*:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:6.0:sp1:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:6.0:sp2:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:6.0:sp6:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:6.1:*:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:6.1:sp1:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:6.1:sp2:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:6.1:sp3:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:6.1:sp4:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:6.1:sp5:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:6.1:sp6:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:6.1:sp7:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:6.1:sp8:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:7.0.0.1:*:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp1:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp2:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp3:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:7.0.0.1:sp4:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:7.0:*:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:7.0:sp1:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:7.0:sp2:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:7.0:sp3:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:7.0:sp4:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:7.0:sp5:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:7.0:sp6:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:7.0:sp7:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:8.1:*:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:8.1:sp1:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:8.1:sp2:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:8.1:sp3:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:8.1:sp4:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:8.1:sp5:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:8.1:sp6:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:9.0:*:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:9.0:ga:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:9.0:sp1:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:9.0:sp2:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:9.0:sp3:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:9.0:sp4:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:9.0:sp5:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:9.1:*:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:9.1:ga:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:9.2:*:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:9.2:mp1:*:*:*:*:*:*;cpe:2.3:a:bea:weblogic_server:9.2:mp2:*:*:*:*:*:*;cpe:2.3:a:bea_systems:apache_connector_in_weblogic_server:*:*:*:*:*:*:*:*;cpe:2.3:a:bea_systems:weblogic_server:10.0_mp1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:*:*:*:*:*:*:*:*,Bea,Weblogic Server
CVE-2008-3273,0.0,,0.47111,CWE-264,"JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obtain sensitive information about ""deployed web contexts"" via a request to the status servlet, as demonstrated by a full=true query string.",2008-08-10,Metasploit,cpe:2.3:a:jboss:enterprise_application_platform:*:*:*:*:*:*:*:*;cpe:2.3:a:jboss:enterprise_application_platform:4.2.0.cp01:*:*:*:*:*:*:*;cpe:2.3:a:jboss:enterprise_application_platform:4.2.0.cp02:*:*:*:*:*:*:*,Jboss,Enterprise Application Platform
CVE-2008-3431,8.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.06932,NVD-CWE-noinfo,"The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to gain privileges by opening the \\.\VBoxDrv device and calling DeviceIoControl to send a crafted kernel address.",2008-08-05,CISA,cpe:2.3:a:oracle:virtualbox:*:*:*:*:*:*:*:*,Oracle,Virtualbox
CVE-2008-3466,0.0,,0.77741,CWE-287,"Microsoft Host Integration Server (HIS) 2000, 2004, and 2006 does not limit RPC access to administrative functions, which allows remote attackers to bypass authentication and execute arbitrary programs via a crafted SNA RPC message using opcode 1 or 6 to call the CreateProcess function, aka ""HIS Command Execution Vulnerability.""",2008-10-15,Metasploit,cpe:2.3:a:microsoft:host_integration_server_2000:*:*:*:*:client:*:*:*;cpe:2.3:a:microsoft:host_integration_server_2000:*:sp2:*:*:server:*:*:*;cpe:2.3:a:microsoft:host_integration_server_2004:*:*:*:*:client:*:*:*;cpe:2.3:a:microsoft:host_integration_server_2004:*:*:*:*:server:*:*:*;cpe:2.3:a:microsoft:host_integration_server_2004:*:sp1:*:*:server:*:*:*;cpe:2.3:a:microsoft:host_integration_server_2006:*:*:*:*:*:*:x64:*;cpe:2.3:a:microsoft:host_integration_server_2006:*:*:*:*:*:*:x86:*,Microsoft,Host Integration Server 2000
CVE-2008-3558,0.0,,0.65391,CWE-119,Stack-based buffer overflow in the WebexUCFObject ActiveX control in atucfobj.dll in Cisco WebEx Meeting Manager before 20.2008.2606.4919 allows remote attackers to execute arbitrary code via a long argument to the NewObject method.,2008-08-08,Metasploit,cpe:2.3:a:cisco:webex_meeting_manager:20.2008.2601.4928:*:*:*:*:*:*:*,Cisco,Webex Meeting Manager
CVE-2008-3656,0.0,,0.70202,CWE-399,"Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted HTTP request that is processed by a backtracking regular expression.",2008-08-13,Metasploit,cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.6.8:*:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.0:*:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.1:*:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.1:-9:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.2:*:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.2:preview2:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.2:preview3:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.2:preview4:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.3:*:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.3:preview1:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.3:preview2:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.3:preview3:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.4:*:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.4:preview1:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.4:preview2:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.4:preview3:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.5:p113:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.5:p115:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.5:p11:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.5:p12:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.5:p2:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.5:p35:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.5:preview1:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.5:preview2:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.5:preview3:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.5:preview4:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.5:preview5:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.6:*:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.6:p110:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.6:p114:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.6:preview1:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.6:preview2:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.6:preview3:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.7:*:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.7:p17:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.7:p22:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.7:p71:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.7:preview1:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.7:preview2:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.7:preview3:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.8.7:preview4:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.9.0:*:*:*:*:*:*:*,Ruby-Lang,Ruby
CVE-2008-3704,0.0,,0.55917,CWE-119,"Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Microsoft Visual Studio 6.0, Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allows remote attackers to execute arbitrary code via a long Mask parameter, related to not ""validating property values with boundary checks,"" as exploited in the wild in August 2008, aka ""Masked Edit Control Memory Corruption Vulnerability.""",2008-08-18,Metasploit,cpe:2.3:a:microsoft:visual_basic:6.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:visual_foxpro:9.0:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:visual_studio:6.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:visual_studio_.net:2002:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1:*:*:*:*:*:*,Microsoft,Visual Basic
CVE-2008-3878,0.0,,0.36228,CWE-119,"Stack-based buffer overflow in the Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 in Ultra Shareware Ultra Office Control allows remote attackers to execute arbitrary code via long strUrl, strFile, and strPostData parameters to the HttpUpload method.",2008-09-02,Metasploit,cpe:2.3:a:ultrashareware:ultra_office_control:2.0.2008.801:*:*:*:*:*:*:*,Ultrashareware,Ultra Office Control
CVE-2008-3922,0.0,,0.53202,CWE-94,"awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function.",2008-09-04,Metasploit,cpe:2.3:a:telartis_bv:awstats_totals:1.0:*:*:*:*:*:*:*;cpe:2.3:a:telartis_bv:awstats_totals:1.11:*:*:*:*:*:*:*;cpe:2.3:a:telartis_bv:awstats_totals:1.13:*:*:*:*:*:*:*;cpe:2.3:a:telartis_bv:awstats_totals:1.14:*:*:*:*:*:*:*;cpe:2.3:a:telartis_bv:awstats_totals:1.1:*:*:*:*:*:*:*,Telartis Bv,Awstats Totals
CVE-2008-3979,0.0,,0.32434,NVD-CWE-noinfo,Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10.1.0.5 and 10.2.0.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.  NOTE: the previous information was obtained from the January 2009 CPU.  Oracle has not commented on reliable researcher claims that this issue is a SQL injection vulnerability that allows remote authenticated users to gain MDSYS privileges via the MDSYS.SDO_TOPO_DROP_FTBL trigger.,2009-01-14,Metasploit,cpe:2.3:a:oracle:database_10g:10.1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_10g:10.2.0.2:*:*:*:*:*:*:*,Oracle,Database 10G
CVE-2008-3982,0.0,,0.1143,NVD-CWE-noinfo,"Unspecified vulnerability in the Workspace Manager component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3, and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity, related to SYS.LT and WMSYS.LT, a different vulnerability than CVE-2008-3983 and CVE-2008-3984.",2008-10-14,Metasploit,cpe:2.3:a:oracle:database_10g:10.1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_10g:10.2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_11i:11.1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_9i:9.2.0.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_9i:9.2.0.8dv:*:*:*:*:*:*:*,Oracle,Database 10G
CVE-2008-3983,0.0,,0.4181,NVD-CWE-noinfo,"Unspecified vulnerability in the Workspace Manager component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3, and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity, related to SYS.LT and WMSYS.LT, a different vulnerability than CVE-2008-3982 and CVE-2008-3984.",2008-10-14,Metasploit,cpe:2.3:a:oracle:database_10g:10.1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_10g:10.2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_11i:11.1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_9i:9.2.0.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_9i:9.2.0.8dv:*:*:*:*:*:*:*,Oracle,Database 10G
CVE-2008-3984,0.0,,0.4181,NVD-CWE-noinfo,"Unspecified vulnerability in the Workspace Manager component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3, and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity, related to SYS.LT and WMSYS.LT, a different vulnerability than CVE-2008-3982 and CVE-2008-3983.",2008-10-14,Metasploit,cpe:2.3:a:oracle:database_10g:10.1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_10g:10.2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_11i:11.1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_9i:9.2.0.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_9i:9.2.0.8dv:*:*:*:*:*:*:*,Oracle,Database 10G
CVE-2008-3995,0.0,,0.0954,NVD-CWE-noinfo,"Unspecified vulnerability in the Change Data Capture component in Oracle Database 10.1.0.5, 10.2.0.4, and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity, related to DBMS_CDC_PUBLISH.",2008-10-14,Metasploit,cpe:2.3:a:oracle:database_10g:10.1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_10g:10.2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_11i:11.1.0.6:*:*:*:*:*:*:*,Oracle,Database 10G
CVE-2008-3996,0.0,,0.09524,NVD-CWE-noinfo,"Unspecified vulnerability in the Change Data Capture component in Oracle Database 10.1.0.5, 10.2.0.4, and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity, related to SYS.DBMS_CDC_IPUBLISH.",2008-10-14,Metasploit,cpe:2.3:a:oracle:database_10g:10.1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_10g:10.2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_11i:11.1.0.6:*:*:*:*:*:*:*,Oracle,Database 10G
CVE-2008-4008,0.0,,0.56268,NVD-CWE-noinfo,"Unspecified vulnerability in the WebLogic Server Plugins for Apache component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0 SP7, and 6.1 SP7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2008 CPU. Oracle has not commented on reliable researcher claims that this issue is a stack-based buffer overflow in the WebLogic Apache Connector, related to an invalid parameter.",2008-10-14,Metasploit,cpe:2.3:a:oracle:bea_product_suite:10.0:mp1:*:*:*:*:*:*;cpe:2.3:a:oracle:bea_product_suite:10.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:bea_product_suite:6.1:sp7:*:*:*:*:*:*;cpe:2.3:a:oracle:bea_product_suite:7.0:sp7:*:*:*:*:*:*;cpe:2.3:a:oracle:bea_product_suite:8.1:sp6:*:*:*:*:*:*;cpe:2.3:a:oracle:bea_product_suite:9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:bea_product_suite:9.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:bea_product_suite:9.2:mp3:*:*:*:*:*:*,Oracle,Bea Product Suite
CVE-2008-4037,0.0,,0.59136,CWE-287,"Microsoft Windows 2000 Gold through SP4, XP Gold through SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote SMB servers to execute arbitrary code on a client machine by replaying the NTLM credentials of a client user, as demonstrated by backrush, aka ""SMB Credential Reflection Vulnerability.""  NOTE: some reliable sources report that this vulnerability exists because of an insufficient fix for CVE-2000-0834.",2008-11-12,Metasploit,cpe:2.3:o:microsoft:windows:server_2003:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:server_2003:sp1:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows:server_2003:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:server_2003:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows:server_2003:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows:server_2003:unknown:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows:xp:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:xp:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows:xp:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:xp:unknown:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:*:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*,Microsoft,Windows
CVE-2008-4114,0.0,,0.49275,CWE-399,"srv.sys in the Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via an SMB WRITE_ANDX packet with an offset that is inconsistent with the packet size, related to ""insufficiently validating the buffer size,"" as demonstrated by a request to the \PIPE\lsarpc named pipe, aka ""SMB Validation Denial of Service Vulnerability.""",2008-09-16,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp1:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:gold:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:gold:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:sp1:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:*:pro_x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:pro_x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*,Microsoft,Windows 2000
CVE-2008-4128,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N,0.23857,CWE-352,"Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain ""show privilege"" command to the /level/15/exec/- URI, and (2) a certain ""alias exec"" command to the /level/15/exec/-/configure/http URI.  NOTE: some of these details are obtained from third party information.",2008-09-18,CISA,cpe:2.3:h:cisco:871_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4:*:*:*:*:*:*:*,Cisco,Ios
CVE-2008-4193,0.0,,0.74612,CWE-119,Stack-based buffer overflow in SecurityGateway.dll in Alt-N Technologies SecurityGateway 1.0.1 allows remote attackers to execute arbitrary code via a long username parameter.,2008-09-24,Metasploit,cpe:2.3:a:alt-n:securitygateway:1.0.1:*:*:*:*:*:*:*,Alt-N,Securitygateway
CVE-2008-4250,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98751,CWE-94,"The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka ""Server Service Vulnerability.""",2008-10-23,CISA/EPSS/Metasploit,cpe:2.3:o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:-:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:-:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:-:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:-:*:x86:*;cpe:2.3:o:microsoft:windows_vista:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:-:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:-:*:*:professional:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows 2000
CVE-2008-4322,0.0,,0.64828,CWE-119,"Stack-based buffer overflow in RealFlex Technologies Ltd. RealWin Server 2.0, as distributed by DATAC, allows remote attackers to execute arbitrary code via a crafted FC_INFOTAG/SET_CONTROL packet.",2008-09-29,Metasploit,cpe:2.3:a:realflex_technologies_ltd:realwin_server:2.0:*:*:*:*:*:*:*,Realflex Technologies Ltd,Realwin Server
CVE-2008-4384,0.0,,0.28706,CWE-119,"Multiple stack-based buffer overflows in MGI Software LPViewer ActiveX control (LPControl.dll), as acquired by Roxio and iseemedia, allow remote attackers to execute arbitrary code via the (1) url, (2) toolbar, and (3) enableZoomPastMax methods.",2008-10-07,Metasploit,cpe:2.3:a:iseemedia:lpviewer:*:*:*:*:*:*:*:*;cpe:2.3:a:mgi_software:lpviewer:*:*:*:*:*:*:*:*;cpe:2.3:a:roxio:lpviewer:*:*:*:*:*:*:*:*,Iseemedia,Lpviewer
CVE-2008-4385,0.0,,0.37683,CWE-94,"Husdawg, LLC Systems Requirements Lab 3, as used by Instant Expert Analysis, allows remote attackers to force the download and execution of arbitrary programs via by specifiying a malicious website argument to the Init method in (1) a certain ActiveX control (sysreqlab2.cab, sysreqlab.dll, sysreqlabsli.dll, or sysreqlab2.dll) and (2) a certain Java applet in RLApplet.class in sysreqlab2.jar or sysreqlab.jar.",2008-10-14,Metasploit,cpe:2.3:a:systemrequirementslab:system_requirements_lab:3:*:*:*:*:*:*:*,Systemrequirementslab,System Requirements Lab
CVE-2008-4388,0.0,,0.37721,CWE-20,"The LaunchObj ActiveX control before 5.2.2.865 in launcher.dll in Symantec AppStream Client 5.2.x before 5.2.2 SP3 MP1 does not properly validate downloaded files, which allows remote attackers to execute arbitrary code via the installAppMgr method and unspecified other methods.",2009-01-20,Metasploit,cpe:2.3:a:symantec:appstream_client:5.2:*:*:*:*:*:*:*,Symantec,Appstream Client
CVE-2008-4397,0.0,,0.80542,CWE-20,Directory traversal vulnerability in the RPC interface (asdbapi.dll) in CA ARCserve Backup (formerly BrightStor ARCserve Backup) r11.1 through r12.0 allows remote attackers to execute arbitrary commands via a .. (dot dot) in an RPC call with opnum 0x10A.,2008-10-14,Metasploit,cpe:2.3:a:broadcom:arcserve_backup:r12.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:business_protection_suite:r2:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:server_protection_suite:r2:*:*:*:*:*:*:*;cpe:2.3:a:ca:arcserve_backup:r11.1:*:*:*:*:*:*:*;cpe:2.3:a:ca:arcserve_backup:r11.5:*:*:*:*:*:*:*;cpe:2.3:a:ca:business_protection_suite:r2:*:microsoft_small_business_server_premium:*:*:*:*:*;cpe:2.3:a:ca:business_protection_suite:r2:*:microsoft_small_business_server_standard:*:*:*:*:*,Broadcom,Arcserve Backup
CVE-2008-4449,0.0,,0.38737,CWE-119,Stack-based buffer overflow in mIRC 6.34 allows remote attackers to execute arbitrary code via a long hostname in a PRIVMSG message.,2008-10-06,Metasploit,cpe:2.3:a:mirc:mirc:6.34:*:*:*:*:*:*:*,Mirc,Mirc
CVE-2008-4556,0.0,,0.69862,CWE-119,Stack-based buffer overflow in the adm_build_path function in sadmind in Sun Solstice AdminSuite on Solaris 8 and 9 allows remote attackers to execute arbitrary code via a crafted request.,2008-10-14,Metasploit,cpe:2.3:o:sun:solaris:8:*:sparc:*:*:*:*:*;cpe:2.3:o:sun:solaris:8:*:x86:*:*:*:*:*;cpe:2.3:o:sun:solaris:9:*:sparc:*:*:*:*:*;cpe:2.3:o:sun:solaris:9:*:x86:*:*:*:*:*,Sun,Solaris
CVE-2008-4572,0.0,,0.60692,CWE-119,"GuildFTPd 0.999.14, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long arguments to the CWD and LIST commands, which triggers heap corruption related to an improper free call, and possibly triggering a heap-based buffer overflow.",2008-10-15,Metasploit,cpe:2.3:a:guildftpd:guildftpd:0.999.14:*:*:*:*:*:*:*,Guildftpd,Guildftpd
CVE-2008-4654,0.0,,0.57547,CWE-119,Stack-based buffer overflow in the parse_master function in the Ty demux plugin (modules/demux/ty.c) in VLC Media Player 0.9.0 through 0.9.4 allows remote attackers to execute arbitrary code via a TiVo TY media file with a header containing a crafted size value.,2008-10-22,Metasploit,cpe:2.3:a:videolan:vlc_media_player:0.9.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.3:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.4:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9:*:*:*:*:*:*:*,Videolan,Vlc Media Player
CVE-2008-4668,0.0,,0.21476,CWE-22,Directory traversal vulnerability in the Image Browser (com_imagebrowser) 0.1.5 component for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the folder parameter to index.php.,2008-10-22,Nuclei,cpe:2.3:a:joomla:com_imagebrowser:0.1.5:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla:*:*:*:*:*:*:*:*,Joomla,Com Imagebrowser
CVE-2008-4687,0.0,,0.67453,CWE-94,"manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by create_function within the multi_sort function in core/utility_api.php.",2008-10-22,Metasploit,cpe:2.3:a:mantis:mantis:*:*:*:*:*:*:*:*;cpe:2.3:a:mantis:mantis:0.19.3:*:*:*:*:*:*:*;cpe:2.3:a:mantis:mantis:0.19.4:*:*:*:*:*:*:*;cpe:2.3:a:mantis:mantis:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mantis:mantis:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mantis:mantis:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mantis:mantis:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mantis:mantis:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mantis:mantis:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mantis:mantis:1.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mantis:mantis:1.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mantis:mantis:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:mantis:mantis:1.1.2:*:*:*:*:*:*:*,Mantis,Mantis
CVE-2008-4696,0.0,,0.45729,CWE-79,"Cross-site scripting (XSS) vulnerability in Opera.dll in Opera before 9.61 allows remote attackers to inject arbitrary web script or HTML via the anchor identifier (aka the ""optional fragment""), which is not properly escaped before storage in the History Search database (aka md.dat).",2008-10-23,Metasploit,cpe:2.3:a:opera:opera:*:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:5..10:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:5.0:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:5.11:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:5.12:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:5.1:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:5.2:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:5.3:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:5.4:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:5.5:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:5.6:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:5.7:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:5.8:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:5.9:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:6.01:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:6.02:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:6.03:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:6.04:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:6.05:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:6.06:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:6.0:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:6:beta_1:*:*:*:*:*:*;cpe:2.3:a:opera:opera:7.01:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:7.02:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:7.03:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:7.0:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:7.0:beta_2:*:*:*:*:*:*;cpe:2.3:a:opera:opera:7.10:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:7.11:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:7.20:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:7.20:beta7:*:*:*:*:*:*;cpe:2.3:a:opera:opera:7.21:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:7.22:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:7.23:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:7.50:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:7.50:beta_1:*:*:*:*:*:*;cpe:2.3:a:opera:opera:7.51:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:7.52:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:7.53:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:7.54:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:7.54:update_1:*:*:*:*:*:*;cpe:2.3:a:opera:opera:7.54:update_2:*:*:*:*:*:*;cpe:2.3:a:opera:opera:7:beta_1.2:*:*:*:*:*:*;cpe:2.3:a:opera:opera:7:beta_1:*:*:*:*:*:*;cpe:2.3:a:opera:opera:8.01:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:8.02:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:8.0:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:8.0:beta_1:*:*:*:*:*:*;cpe:2.3:a:opera:opera:8.0:beta_2:*:*:*:*:*:*;cpe:2.3:a:opera:opera:8.0:beta_3:*:*:*:*:*:*;cpe:2.3:a:opera:opera:8.50:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:8.51:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:8.52:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:8.53:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:8.54:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:9.01:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:9.02:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:9.0:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:9.0:beta_1:*:*:*:*:*:*;cpe:2.3:a:opera:opera:9.0:beta_2:*:*:*:*:*:*;cpe:2.3:a:opera:opera:9.10:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:9.20:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:9.20:beta_1:*:*:*:*:*:*;cpe:2.3:a:opera:opera:9.21:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:9.22:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:9.23:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:9.24:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:9.25:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:9.26:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:9.27:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:9.50:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera:9.50:beta_2:*:*:*:*:*:*;cpe:2.3:a:opera:opera:9.51:*:*:*:*:*:*:*,Opera,Opera
CVE-2008-4764,0.0,,0.16505,CWE-22,Directory traversal vulnerability in the eXtplorer module (com_extplorer) 2.0.0 RC2 and earlier in Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the dir parameter in a show_error action.,2008-10-28,Nuclei,cpe:2.3:a:extplorer:com_extplorer:*:rc2:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Extplorer,Com Extplorer
CVE-2008-4779,0.0,,0.6469,CWE-119,Stack-based buffer overflow in TUGzip 3.5.0.0 allows remote attackers to denial of service (crash) or execute arbitrary code via a long filename in a .zip file.,2008-10-29,Metasploit,cpe:2.3:a:tguzip:tguzip:3.5.5.0.0:*:*:*:*:*:*:*,Tguzip,Tguzip
CVE-2008-4828,0.0,,0.71468,CWE-119,"Multiple stack-based buffer overflows in dsmagent.exe in the Remote Agent Service in the IBM Tivoli Storage Manager (TSM) client 5.1.0.0 through 5.1.8.2, 5.2.0.0 through 5.2.5.3, 5.3.0.0 through 5.3.6.4, and 5.4.0.0 through 5.4.1.96, and the TSM Express client 5.3.3.0 through 5.3.6.4, allow remote attackers to execute arbitrary code via (1) a request packet that is not properly parsed by an unspecified ""generic string handling function"" or (2) a crafted NodeName in a dicuGetIdentifyRequest request packet, related to the (a) Web GUI and (b) Java GUI.",2009-05-05,Metasploit,cpe:2.3:a:ibm:tivoli_storage_manager_client:5.1.8.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_client:5.1.8.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_client:5.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_client:5.2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_client:5.2.5.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_client:5.2.5.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_client:5.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_client:5.3.5.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_client:5.3.5.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_client:5.3.6.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_client:5.3.6.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_client:5.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_client:5.4.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_client:5.4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_client:5.4.1.96:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_client:5.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_express:5.3.3.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_express:5.3.6.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_express:5.3:*:*:*:*:*:*:*,Ibm,Tivoli Storage Manager Client
CVE-2008-4830,0.0,,0.27594,NVD-CWE-Other,Insecure method vulnerability in the KWEdit ActiveX control in SAP GUI 6.40 Patch 29 (KWEDIT.DLL 6400.1.1.41) and 7.10 Patch 5 (KWEDIT.DLL 7100.1.1.43) allows remote attackers to (1) overwrite arbitrary files via the SaveDocumentAs method or (2) read or execute arbitrary files via the OpenDocument method.,2009-04-16,Metasploit,cpe:2.3:a:sap:sap_gui:6.40:*:*:*:*:*:*:*;cpe:2.3:a:sap:sap_gui:7.10:*:*:*:*:*:*:*,Sap,Sap Gui
CVE-2008-4844,0.0,,0.66513,CWE-399,"Use-after-free vulnerability in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet Explorer 5.01, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via DSO bindings involving (1) an XML Island, (2) XML DSOs, or (3) Tabular Data Control (TDC) in a crafted HTML or XML document, as demonstrated by nested SPAN or MARQUEE elements, and exploited in the wild in December 2008.",2008-12-11,Metasploit,cpe:2.3:a:microsoft:internet_explorer:5.01:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*,Microsoft,Internet Explorer
CVE-2008-4922,0.0,,0.32745,CWE-119,"Buffer overflow in the DjVu ActiveX Control 3.0 for Microsoft Office (DjVu_ActiveX_MSOffice.dll) allows remote attackers to execute arbitrary code via a long (1) ImageURL property, and possibly the (2) Mode, (3) Page, or (4) Zoom properties.",2008-11-04,Metasploit,cpe:2.3:a:djvu:activex_control_for_microsoft_office_2000:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2000:*:*:*:*:*:*:*,Djvu,Activex Control For Microsoft Office 2000
CVE-2008-5002,0.0,,0.40655,CWE-20,Insecure method vulnerability in the ChilkatCrypt2.ChilkatCrypt2.1 ActiveX control (ChilkatCrypt2.dll 4.3.2.1) in Chilkat Crypt ActiveX Component allows remote attackers to create and overwrite arbitrary files via the WriteFile method.  NOTE: this could be leveraged for code execution by creating executable files in Startup folders or by accessing files using hcp:// URLs.  NOTE: some of these details are obtained from third party information.,2008-11-10,Metasploit,cpe:2.3:a:chilkat_software:chilkat_crypt_activex_control:2.1:*:*:*:*:*:*:*,Chilkat Software,Chilkat Crypt Activex Control
CVE-2008-5036,0.0,,0.41444,CWE-119,"Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execute arbitrary code via an an invalid RealText (rt) subtitle file, related to the ParseRealText function in modules/demux/subtitle.c.  NOTE: this issue was SPLIT from CVE-2008-5032 on 20081110.",2008-11-10,Metasploit,cpe:2.3:a:videolan:vlc_media_player:0.9.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.3:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.4:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.5:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9:*:*:*:*:*:*:*,Videolan,Vlc Media Player
CVE-2008-5081,0.0,,0.59223,CWE-399,"The originates_from_local_legacy_unicast_socket function (avahi-core/server.c) in avahi-daemon in Avahi before 0.6.24 allows remote attackers to cause a denial of service (crash) via a crafted mDNS packet with a source port of 0, which triggers an assertion failure.",2008-12-17,Metasploit,cpe:2.3:a:avahi:avahi:*:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.1:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.2:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.3:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.4:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.5.1:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.5.2:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.5:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.6.10:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.6.11:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.6.12:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.6.13:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.6.14:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.6.15:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.6.16:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.6.17:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.6.18:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.6.19:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.6.1:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.6.20:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.6.21:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.6.22:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.6.2:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.6.3:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.6.4:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.6.5:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.6.6:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.6.7:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.6.8:*:*:*:*:*:*:*;cpe:2.3:a:avahi:avahi:0.6.9:*:*:*:*:*:*:*,Avahi,Avahi
CVE-2008-5106,0.0,,0.12588,CWE-119,"Buffer overflow in KarjaSoft Sami FTP Server 2.0.x allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a long argument to an arbitrary command, which triggers the overflow when the SamyFtp.binlog log file is viewed in the management console.  NOTE: this may overlap CVE-2006-0441 and CVE-2006-2212.",2008-11-17,Metasploit,cpe:2.3:a:karjasoft:sami_ftp_server:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:karjasoft:sami_ftp_server:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:karjasoft:sami_ftp_server:2.0.2:*:*:*:*:*:*:*,Karjasoft,Sami Ftp Server
CVE-2008-5159,0.0,,0.59668,CWE-189,"Integer overflow in the remote administration protocol processing in Client Software WinCom LPD Total 3.0.2.623 and earlier allows remote attackers to cause a denial of service (crash) via a large string length argument, which triggers memory corruption.",2008-11-18,Metasploit,cpe:2.3:a:clientsoftware:wincome_mpd_total:*:*:*:*:*:*:*:*,Clientsoftware,Wincome Mpd Total
CVE-2008-5161,3.7,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N,0.15395,CWE-200,"Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through 5.3.8; Client and Server and ConnectSecure 6.0 through 6.0.4; Server for Linux on IBM System z 6.0.4; Server for IBM z/OS 5.5.1 and earlier, 6.0.0, and 6.0.1; and Client 4.0-J through 4.3.3-J and 4.0-K through 4.3.10-K; and (2) OpenSSH 4.7p1 and possibly other versions, when using a block cipher algorithm in Cipher Block Chaining (CBC) mode, makes it easier for remote attackers to recover certain plaintext data from an arbitrary block of ciphertext in an SSH session via unknown vectors.",2008-11-19,Metasploit,cpe:2.3:a:openbsd:openssh:4.7p1:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.0.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.0.4:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.0.5:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.3.1:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.3.1j:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.3.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.3.2j:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.3.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.3.4:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.3.5:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.3.6:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.3.7:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.3.8k:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.3.9k:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.4.10:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.4.11:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.4.1:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.4.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.4.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.4.4:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.4.6:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.4.7:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.4.8:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.4.9:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:4.4:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.0.0f:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.0.1f:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.0.2f:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.0.3f:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.1.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.1.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.2.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.2.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.2.4:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.3.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.3.1:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.3.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.3.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.3.5:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.3.6:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.3.7:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:5.3.8:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:6.0.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_client:6.0.4:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:4.0.7:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:4.1.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:4.1.5:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:4.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:4.3.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:4.3.4:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:4.3.5:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:4.4.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:4.4.10:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:4.4.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:4.4.4:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:4.4.6:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:4.4.7:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:4.4.9:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:5.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:5.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:5.1.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:5.1.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:5.2.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:5.3.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:5.3.1:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:5.3.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:5.3.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:5.3.7:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connector:5.3.8:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connectsecure:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connectsecure:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connectsecure:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connectsecure:6.0.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_connectsecure:6.0.4:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.0.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.0.4:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.0.5:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.0.7:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.1.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.1.5:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.2.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.3.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.3.1:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.3.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.3.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.3.4:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.3.5:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.3.6:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.3.7:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.4.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.4.10:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.4.11:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.4.1:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.4.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.4.4:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.4.5:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.4.6:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.4.7:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.4.8:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.4.9:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:4.4:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.1.1:*:ibm_zos:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.1.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.1.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.2.0:*:ibm_zos:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.2.1:*:ibm_zos:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.2.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.2.2:*:ibm_zos:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.2.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.2.4:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.3.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.3.0:*:ibm_zos:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.3.1:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.3.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.3.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.3.4:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.3.5:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.3.6:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.3.7:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.3.8:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.4.0:*:ibm_zos:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.4.1:*:ibm_zos:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.4.2:*:ibm_zos:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.5.0:*:ibm_zos:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:5.5.1:*:ibm_zos:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.0.0:*:ibm_zos:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.0.1:*:ibm_zos:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.0.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.0.4:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.0.4:*:linux_ibm_zos:*:*:*:*:*,Openbsd,Openssh
CVE-2008-5191,0.0,,0.17581,CWE-89,Multiple SQL injection vulnerabilities in SePortal 2.4 allow remote attackers to execute arbitrary SQL commands via the (1) poll_id parameter to poll.php and the (2) sp_id parameter to staticpages.php.,2008-11-21,Metasploit,cpe:2.3:a:seportal:seportal:2.4:*:*:*:*:*:*:*,Seportal,Seportal
CVE-2008-5281,0.0,,0.06401,CWE-119,Heap-based buffer overflow in Titan FTP Server 6.05 build 550 allows remote attackers to execute arbitrary code via a long DELE command.,2008-11-29,Nuclei,cpe:2.3:a:south_river_technologies:titan_ftp_server:6.05:build_550:*:*:*:*:*:*,South River Technologies,Titan Ftp Server
CVE-2008-5353,0.0,,0.85695,NVD-CWE-Other,"The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by ""deserializing Calendar objects"".",2008-12-05,Metasploit,cpe:2.3:a:sun:jdk:*:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:*:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:5.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:5.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:5.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:5.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:5.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:5.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:5.0:update_1:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:5.0:update_2:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:5.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:5.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:5.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:5.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:5.0:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:5.0:update_8:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:5.0:update_9:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:6:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:6:update_1:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:6:update_2:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:6:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:6:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:6:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:6:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:6:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:6:update_8:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:6:update_9:*:*:*:*:*:*;cpe:2.3:a:sun:jre:*:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:*:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jre:*:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_10:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_11:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_12:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_13:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_14:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_15:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_16:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_17:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_1:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_2:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_3:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_4:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_5:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_6:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_7:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_8:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_9:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:5.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:5.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jre:5.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:5.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:5.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:5.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:5.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:5.0:update_1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:5.0:update_2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:5.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:5.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:5.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:5.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:5.0:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:jre:5.0:update_8:*:*:*:*:*:*;cpe:2.3:a:sun:jre:5.0:update_9:*:*:*:*:*:*;cpe:2.3:a:sun:jre:6:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:6:update_1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:6:update_2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:6:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:6:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:6:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:6:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:6:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:jre:6:update_8:*:*:*:*:*:*;cpe:2.3:a:sun:jre:6:update_9:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:*:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_10:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_11:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_12:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_13:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_14:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_15:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_16:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_17:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_1:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_2:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_3:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_4:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_5:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_6:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_7:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_8:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_9:*:*:*:*:*:*:*,Sun,Jdk
CVE-2008-5405,0.0,,0.46979,CWE-119,"Stack-based buffer overflow in the RDP protocol password decoder in Cain & Abel 4.9.23 and 4.9.24, and possibly earlier, allows remote attackers to execute arbitrary code via an RDP file containing a long string.",2008-12-10,Metasploit,cpe:2.3:a:oxid:cain_and_abel:4.9.23:*:*:*:*:*:*:*;cpe:2.3:a:oxid:cain_and_abel:4.9.24:*:*:*:*:*:*:*,Oxid,Cain And Abel
CVE-2008-5416,0.0,,0.87036,CWE-119,"Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server 2005 SP2 and 9.00.1399.06; SQL Server 2000 Desktop Engine (WMSDE) on Windows Server 2003 SP1 and SP2; and Windows Internal Database (WYukon) SP2 allows remote authenticated users to cause a denial of service (access violation exception) or execute arbitrary code by calling the sp_replwritetovarbin extended stored procedure with a set of invalid parameters that trigger memory overwrite, aka ""SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability.""",2008-12-10,Metasploit,cpe:2.3:a:microsoft:sql_server:2000:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server:2005:*:*:*:*:*:*:*,Microsoft,Sql Server
CVE-2008-5444,0.0,,0.60625,NVD-CWE-noinfo,"Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2008-5448 and CVE-2008-5449.",2009-01-14,Metasploit,cpe:2.3:a:oracle:secure_backup:10.2.0.2:*:*:*:*:*:*:*,Oracle,Secure Backup
CVE-2008-5448,0.0,,0.3857,NVD-CWE-noinfo,"Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2008-5444 and CVE-2008-5449.",2009-01-14,Metasploit,cpe:2.3:a:oracle:secure_backup:10.2.0.2:*:*:*:*:*:*:*,Oracle,Secure Backup
CVE-2008-5457,0.0,,0.61309,NVD-CWE-noinfo,"Unspecified vulnerability in the Oracle BEA WebLogic Server Plugins for Apache, Sun and IIS web servers component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, and 7.0 SP7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.",2009-01-14,Metasploit,cpe:2.3:a:oracle:bea_product_suite:10.0:mp1:*:*:*:*:*:*;cpe:2.3:a:oracle:bea_product_suite:10.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:bea_product_suite:7.0:sp7:*:*:*:*:*:*;cpe:2.3:a:oracle:bea_product_suite:8.1:sp6:*:*:*:*:*:*;cpe:2.3:a:oracle:bea_product_suite:9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:bea_product_suite:9.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:bea_product_suite:9.2:mp3:*:*:*:*:*:*,Oracle,Bea Product Suite
CVE-2008-5492,0.0,,0.35275,CWE-119,Heap-based buffer overflow in the PDFVIEW.PdfviewCtrl.1 ActiveX control in pdfview.ocx 2.0.0.1 in VeryDOC PDF Viewer OCX Control allows remote attackers to execute arbitrary code via a long first argument to the OpenPDF method.  NOTE: some of these details are obtained from third party information.,2008-12-12,Metasploit,cpe:2.3:a:verypdf:verydoc_pdf_viewer:2.0.0.1:*:*:*:*:*:*:*,Verypdf,Verydoc Pdf Viewer
CVE-2008-5499,0.0,,0.79426,CWE-94,"Unspecified vulnerability in Adobe Flash Player for Linux 10.0.12.36, and 9.0.151.0 and earlier, allows remote attackers to execute arbitrary code via a crafted SWF file.",2008-12-18,Metasploit,cpe:2.3:a:adobe:flash_player_for_linux:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player_for_linux:10.0.12.36:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player_for_linux:9.0.115.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player_for_linux:9.0.124.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player_for_linux:9.0.31:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player_for_linux:9.0.48.0:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2008-5587,0.0,,0.12865,CWE-22,"Directory traversal vulnerability in libraries/lib.inc.php in phpPgAdmin 4.2.1 and earlier, when register_globals is enabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the _language parameter to index.php.",2008-12-16,Nuclei,cpe:2.3:a:phppgadmin:phppgadmin:*:*:*:*:*:*:*:*;cpe:2.3:a:phppgadmin:phppgadmin:2.2.1:*:*:*:*:*:*:*;cpe:2.3:a:phppgadmin:phppgadmin:2.2:*:*:*:*:*:*:*;cpe:2.3:a:phppgadmin:phppgadmin:3.1:*:*:*:*:*:*:*;cpe:2.3:a:phppgadmin:phppgadmin:3.4.1:*:*:*:*:*:*:*;cpe:2.3:a:phppgadmin:phppgadmin:3.5.2:*:*:*:*:*:*:*;cpe:2.3:a:phppgadmin:phppgadmin:3.5.3:*:*:*:*:*:*:*;cpe:2.3:a:phppgadmin:phppgadmin:3.5:*:*:*:*:*:*:*;cpe:2.3:a:phppgadmin:phppgadmin:4.1.1:*:*:*:*:*:*:*,Phppgadmin,Phppgadmin
CVE-2008-5626,0.0,,0.3586,CWE-399,"XM Easy Personal FTP Server 5.6.0 allows remote authenticated users to cause a denial of service via a crafted argument to the NLST command, as demonstrated by a -1 argument.",2008-12-17,Metasploit,cpe:2.3:a:dxmsoft:xm_easy_personal_ftp_server:5.6.0:*:*:*:*:*:*:*,Dxmsoft,Xm Easy Personal Ftp Server
CVE-2008-5664,0.0,,0.36228,CWE-119,"Stack-based buffer overflow in Realtek Media Player (aka Realtek Sound Manager, RtlRack, or rtlrack.exe) 1.15.0.0 allows remote attackers to execute arbitrary code via a crafted playlist (PLA) file.",2008-12-19,Metasploit,cpe:2.3:a:realtek:realtek_media_player:1.15.0.0:*:*:*:*:*:*:*,Realtek,Realtek Media Player
CVE-2008-5666,0.0,,0.20591,CWE-399,"WinFTP FTP Server 2.3.0, when passive (aka PASV) mode is used, allows remote authenticated users to cause a denial of service via a sequence of FTP sessions that include an invalid ""NLST -1"" command.",2008-12-19,Metasploit,cpe:2.3:a:wftpserver:winftp_ftp_server:2.3.0:*:*:*:*:*:*:*,Wftpserver,Winftp Ftp Server
CVE-2008-5711,0.0,,0.32696,CWE-119,Heap-based buffer overflow in the Facebook PhotoUploader ActiveX control 5.0.14.0 and earlier allows remote attackers to execute arbitrary code via a long FileMask property value.,2008-12-24,Metasploit,cpe:2.3:a:facebook:photouploader:*:*:*:*:*:*:*:*;cpe:2.3:a:facebook:photouploader:4.5.57.0:*:*:*:*:*:*:*,Facebook,Photouploader
CVE-2008-6080,0.0,,0.10637,CWE-22,Directory traversal vulnerability in download.php in the ionFiles (com_ionfiles) 4.4.2 component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.,2009-02-06,Nuclei,cpe:2.3:a:codecall:com_ionfiles:4.4.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla:*:*:*:*:*:*:*:*,Codecall,Com Ionfiles
CVE-2008-6082,0.0,,0.44577,CWE-399,Titan FTP Server 6.26 build 630 allows remote attackers to cause a denial of service (CPU consumption) via the SITE WHO command.,2009-02-06,Metasploit,cpe:2.3:a:southrivertech:titan_ftp_server:6.26:*:*:*:*:*:*:*,Southrivertech,Titan Ftp Server
CVE-2008-6132,0.0,,0.26143,CWE-94,"Eval injection vulnerability in reserve.php in phpScheduleIt 1.2.10 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via the start_date parameter.",2009-02-13,Metasploit,cpe:2.3:a:brickhost:phpscheduleit:*:*:*:*:*:*:*:*;cpe:2.3:a:brickhost:phpscheduleit:1.0.0rc1:*:*:*:*:*:*:*;cpe:2.3:a:brickhost:phpscheduleit:1.0:*:*:*:*:*:*:*;cpe:2.3:a:brickhost:phpscheduleit:1.0_rc1:*:*:*:*:*:*:*;cpe:2.3:a:brickhost:phpscheduleit:1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:brickhost:phpscheduleit:1.2.0:beta:*:*:*:*:*:*;cpe:2.3:a:brickhost:phpscheduleit:1.2.0:rc1:*:*:*:*:*:*;cpe:2.3:a:brickhost:phpscheduleit:1.2.1:*:*:*:*:*:*:*;cpe:2.3:a:brickhost:phpscheduleit:1.2.2:*:*:*:*:*:*:*;cpe:2.3:a:brickhost:phpscheduleit:1.2.3:*:*:*:*:*:*:*;cpe:2.3:a:brickhost:phpscheduleit:1.2.4:*:*:*:*:*:*:*;cpe:2.3:a:brickhost:phpscheduleit:1.2.5:*:*:*:*:*:*:*;cpe:2.3:a:brickhost:phpscheduleit:1.2.6:*:*:*:*:*:*:*;cpe:2.3:a:brickhost:phpscheduleit:1.2.7:*:*:*:*:*:*:*;cpe:2.3:a:brickhost:phpscheduleit:1.2.8:*:*:*:*:*:*:*;cpe:2.3:a:brickhost:phpscheduleit:1.2.9:*:*:*:*:*:*:*,Brickhost,Phpscheduleit
CVE-2008-6172,0.0,,0.12284,CWE-22,"Directory traversal vulnerability in captcha/captcha_image.php in the RWCards (com_rwcards) 3.0.11 component for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the img parameter.",2009-02-19,Nuclei,cpe:2.3:a:joomla:joomla:*:*:*:*:*:*:*:*;cpe:2.3:a:weberr:rwcards:3.0.11:*:*:*:*:*:*:*,Weberr,Rwcards
CVE-2008-6222,0.0,,0.11497,CWE-22,Directory traversal vulnerability in the Pro Desk Support Center (com_pro_desk) component 1.0 and 1.2 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the include_file parameter to index.php.,2009-02-20,Nuclei,cpe:2.3:a:joomla:joomla:*:*:*:*:*:*:*:*;cpe:2.3:a:joomlashowroom:pro_desk_support_center:1.0:*:*:*:*:*:*:*;cpe:2.3:a:joomlashowroom:pro_desk_support_center:1.2:*:*:*:*:*:*:*,Joomlashowroom,Pro Desk Support Center
CVE-2008-6465,0.0,,0.05114,CWE-79,"Multiple cross-site scripting (XSS) vulnerabilities in login.php in webshell4 in Parallels H-Sphere 3.0.0 P9 and 3.1 P1 allow remote attackers to inject arbitrary web script or HTML via the (1) err, (2) errorcode, and (3) login parameters.",2009-03-13,Nuclei,cpe:2.3:a:parallels:h-sphere:3.0.0:p9:*:*:*:*:*:*;cpe:2.3:a:parallels:h-sphere:3.1:p1:*:*:*:*:*:*,Parallels,H-Sphere
CVE-2008-6508,0.0,,0.83382,CWE-22,"Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication and access the admin interface via a .. (dot dot) in a URI that matches the Exclude-Strings list, as demonstrated by a /setup/setup-/.. sequence in a URI.",2009-03-23,Metasploit,cpe:2.3:a:igniterealtime:openfire:*:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:2.6.0:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:2.6.1:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:2.6.2:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:3.2.2:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:3.2.3:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:3.2.4:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:3.3.0:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:3.3.2:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:3.3.3:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:3.4.0:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:3.4.1:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:3.4.3:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:3.4.4:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:3.4.5:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:3.5.0:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:3.5.2:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:3.6.0:*:*:*:*:*:*:*,Igniterealtime,Openfire
CVE-2008-6668,0.0,,0.15346,CWE-22,Multiple directory traversal vulnerabilities in nweb2fax 0.2.7 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) id parameter to comm.php and (2) var_filename parameter to viewrq.php.,2009-04-08,Nuclei,cpe:2.3:a:dirk_bartley:nweb2fax:*:*:*:*:*:*:*:*;cpe:2.3:a:dirk_bartley:nweb2fax:0.2:*:*:*:*:*:*:*,Dirk Bartley,Nweb2Fax
CVE-2008-6825,0.0,,0.20271,CWE-22,Directory traversal vulnerability in user/index.php in Fonality trixbox CE 2.6.1 and earlier allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the langChoice parameter.,2009-06-05,Metasploit,cpe:2.3:a:trixbox:trixbox:*:*:*:*:*:*:*:*;cpe:2.3:a:trixbox:trixbox:2.0:*:*:*:*:*:*:*;cpe:2.3:a:trixbox:trixbox:2.4.2.0:*:*:*:*:*:*:*,Trixbox,Trixbox
CVE-2008-6829,0.0,,0.37607,CWE-20,"VicFTPS 5.0 allows remote attackers to cause a denial of service (crash) via a LIST command that starts with a ""/\/"" (forward slash, backward slash, forward slash).  NOTE: this might be the same issue as CVE-2008-2031.",2009-06-08,Metasploit,cpe:2.3:a:vicftps:vicftps:5.0:*:*:*:*:*:*:*,Vicftps,Vicftps
CVE-2008-6898,0.0,,0.31742,CWE-119,Buffer overflow in the XHTTP Module 4.1.0.0 in the ActiveX control for SaschArt SasCam Webcam Server 2.6.5 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long argument to the Get method and other unspecified methods.,2009-08-05,Metasploit,cpe:2.3:a:saschart:sascam_webcam_server:2.6.5:*:*:*:*:*:*:*,Saschart,Sascam Webcam Server
CVE-2008-6938,0.0,,0.26485,CWE-20,"Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi3, allows remote attackers to cause a denial of service (crash or hang) and obtain the full pathname of the server via a request to a file in the ISAPI directory that is not an executable DLL, which triggers the crash when the DLL load fails, as demonstrated using Isapi\users.txt.",2009-08-11,Metasploit,cpe:2.3:a:holger_zimmermann:pi3web:*:*:*:*:*:*:*:*;cpe:2.3:a:holger_zimmermann:pi3web:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:holger_zimmermann:pi3web:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:holger_zimmermann:pi3web:2.0.2_beta_1:*:*:*:*:*:*:*;cpe:2.3:a:holger_zimmermann:pi3web:2.0:*:*:*:*:*:*:*,Holger Zimmermann,Pi3Web
CVE-2008-6982,0.0,,0.05735,CWE-79,Cross-site scripting (XSS) vulnerability in index.php in devalcms 1.4a allows remote attackers to inject arbitrary web script or HTML via the currentpath parameter.,2009-08-19,Nuclei,cpe:2.3:a:devalcms:devalcms:1.4a:*:*:*:*:*:*:*,Devalcms,Devalcms
CVE-2008-7232,0.0,,0.24511,CWE-119,Buffer overflow in the report function in xtacacsd 4.1.2 and earlier allows remote attackers to execute arbitrary code via a crafted CONNECT TACACS command.,2009-09-14,Metasploit,cpe:2.3:a:netplex-tech:xtacacsd:*:*:*:*:*:*:*:*;cpe:2.3:a:netplex-tech:xtacacsd:2.0:*:*:*:*:*:*:*;cpe:2.3:a:netplex-tech:xtacacsd:3.0:*:*:*:*:*:*:*;cpe:2.3:a:netplex-tech:xtacacsd:3.1:*:*:*:*:*:*:*;cpe:2.3:a:netplex-tech:xtacacsd:3.2:*:*:*:*:*:*:*;cpe:2.3:a:netplex-tech:xtacacsd:3.3:*:*:*:*:*:*:*;cpe:2.3:a:netplex-tech:xtacacsd:3.4:*:*:*:*:*:*:*;cpe:2.3:a:netplex-tech:xtacacsd:3.5:*:*:*:*:*:*:*;cpe:2.3:a:netplex-tech:xtacacsd:4.0:*:*:*:*:*:*:*;cpe:2.3:a:netplex-tech:xtacacsd:4.1.1:*:*:*:*:*:*:*;cpe:2.3:a:netplex-tech:xtacacsd:4.1:*:*:*:*:*:*:*,Netplex-Tech,Xtacacsd
CVE-2008-7269,0.0,,0.08391,CWE-20,Open redirect vulnerability in api.php in SiteEngine 5.x allows user-assisted remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter in a logout action.,2010-12-01,Nuclei,cpe:2.3:a:boka:siteengine:5.0:*:*:*:*:*:*:*,Boka,Siteengine
CVE-2009-0075,0.0,,0.85277,CWE-399,"Microsoft Internet Explorer 7 does not properly handle errors during attempted access to deleted objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to CFunctionPointer and the appending of document objects, aka ""Uninitialized Memory Corruption Vulnerability.""",2009-02-10,Metasploit,cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp1:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:*:professional:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:professional:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows Server 2003
CVE-2009-0133,0.0,,0.67049,CWE-119,"Buffer overflow in Microsoft HTML Help Workshop 4.74 and earlier allows context-dependent attackers to execute arbitrary code via a .hhp file with a long ""Index file"" field, possibly a related issue to CVE-2006-0564.",2009-01-15,Metasploit,cpe:2.3:a:microsoft:html_help_workshop:4.74:*:*:*:*:*:*:*,Microsoft,Html Help Workshop
CVE-2009-0182,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.48398,CWE-120,"Buffer overflow in VUPlayer 2.49 and earlier allows user-assisted attackers to execute arbitrary code via a long URL in a File line in a .pls file, as demonstrated by an http URL on a File1 line.",2009-01-20,Metasploit,cpe:2.3:a:vuplayer:vuplayer:*:*:*:*:*:*:*:*,Vuplayer,Vuplayer
CVE-2009-0183,0.0,,0.66526,CWE-119,Stack-based buffer overflow in Remote Control Server in Free Download Manager (FDM) 2.5 Build 758 and 3.0 Build 844 allows remote attackers to execute arbitrary code via a long Authorization header in an HTTP request.,2009-02-03,Metasploit,cpe:2.3:a:free_download_manager:free_download_manager:2.5:*:*:*:*:*:*:*;cpe:2.3:a:free_download_manager:free_download_manager:3.0:*:*:*:*:*:*:*,Free Download Manager,Free Download Manager
CVE-2009-0184,0.0,,0.27803,CWE-119,"Multiple buffer overflows in the torrent parsing implementation in Free Download Manager (FDM) 2.5 Build 758 and 3.0 Build 844 allow remote attackers to execute arbitrary code via (1) a long file name within a torrent file, (2) a long tracker URL in a torrent file, or (3) a long comment in a torrent file.",2009-02-03,Metasploit,cpe:2.3:a:free_download_manager:free_download_manager:2.5:*:*:*:*:*:*:*;cpe:2.3:a:free_download_manager:free_download_manager:3.0:*:*:*:*:*:*:*,Free Download Manager,Free Download Manager
CVE-2009-0187,0.0,,0.39984,CWE-119,"Stack-based buffer overflow in Orbit Downloader 2.8.2 and 2.8.3, and possibly other versions before 2.8.5, allows remote attackers to execute arbitrary code via a crafted HTTP URL with a long host name, which is not properly handled when constructing a ""Connecting"" log message.",2009-02-26,Metasploit,cpe:2.3:a:orbitdownloader:orbit_downloader:2.8.2:*:*:*:*:*:*:*;cpe:2.3:a:orbitdownloader:orbit_downloader:2.8.3:*:*:*:*:*:*:*;cpe:2.3:a:orbitdownloader:orbit_downloader:2.8.4:*:*:*:*:*:*:*,Orbitdownloader,Orbit Downloader
CVE-2009-0215,0.0,,0.36309,CWE-119,"Stack-based buffer overflow in the GetXMLValue method in the IBM Access Support ActiveX control in IbmEgath.dll, as distributed on IBM and Lenovo computers, allows remote attackers to execute arbitrary code via unspecified vectors.",2009-03-25,Metasploit,cpe:2.3:a:ibm:access_support_activex_control:3.20.284.0:*:*:*:*:*:*:*,Ibm,Access Support Activex Control
CVE-2009-0238,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.43063,CWE-94,"Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object, as exploited in the wild in February 2009 by Trojan.Mdropper.AC.",2009-02-25,CISA,cpe:2.3:a:microsoft:excel:2000:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:excel:2002:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:excel:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:excel:2007:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:excel_viewer:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2004:*:*:*:*:macos:*:*;cpe:2.3:a:microsoft:office:2008:*:*:*:*:macos:*:*;cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_excel_viewer:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_excel_viewer:2003:sp3:*:*:*:*:*:*,Microsoft,Excel
CVE-2009-0255,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.09442,CWE-330,"The System extension Install tool in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 creates the encryption key with an insufficiently random seed, which makes it easier for attackers to crack the key.",2009-01-22,Metasploit,cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2009-0261,0.0,,0.13214,CWE-119,Stack-based buffer overflow in EffectMatrix Total Video Player 1.31 allows user-assisted attackers to execute arbitrary code via a Skins\DefaultSkin\DefaultSkin.ini file with a large ColumnHeaderSpan value.,2009-01-23,Metasploit,cpe:2.3:a:effectmatrix:total_video_player:1.31:*:*:*:*:*:*:*,Effectmatrix,Total Video Player
CVE-2009-0323,0.0,,0.6249,CWE-119,"Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0 and 11.0 allow remote attackers to execute arbitrary code via (1) a long type parameter in an input tag, which is not properly handled by the EndOfXmlAttributeValue function; (2) an ""HTML GI"" in a start tag, which is not properly handled by the ProcessStartGI function; and unspecified vectors in (3) html2thot.c and (4) xml2thot.c, related to the msgBuffer variable.  NOTE: these are different vectors than CVE-2008-6005.",2009-01-28,Metasploit,cpe:2.3:a:w3:amaya:*:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:0.95b:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:0.9:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:1.0:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:1.0a:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:1.1:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:1.1a:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:1.1c:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:1.2:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:1.2a:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:1.3:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:1.3a:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:1.3b:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:1.4:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:1.4a:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:10.0:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:2.0:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:2.1:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:2.2:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:2.3:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:2.4:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:3.0:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:3.1:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:3.2:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:4.0:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:4.1:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:4.2.1:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:4.2:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:4.3.1:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:4.3.2:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:4.3:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:5.0:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:5.1:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:5.2:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:5.3:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:6.0:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:6.1:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:6.2:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:6.3:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:6.4:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:7.0:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:7.1:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:7.2:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:8.0:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:8.1:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:8.1a:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:8.1b:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:8.2:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:8.3:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:8.4:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:8.52:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:8.5:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:8.6:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:8.7.1:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:8.7.2:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:8.7:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:8.8.1:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:8.8.3:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:8.8.4:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:8.8.5:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:9.0:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:9.1:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:9.2.1:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:9.3:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:9.4:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:9.52:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:9.53:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:9.54:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:9.55:*:*:*:*:*:*:*;cpe:2.3:a:w3:amaya:9.5:*:*:*:*:*:*:*,W3,Amaya
CVE-2009-0347,0.0,,0.10932,CWE-59,Open redirect vulnerability in cs.html in the Autonomy (formerly Verity) Ultraseek search engine allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter.,2009-01-29,Nuclei,cpe:2.3:a:autonomy:ultraseek:_nil_:*:*:*:*:*:*:*,Autonomy,Ultraseek
CVE-2009-0476,0.0,,0.37035,CWE-119,"Stack-based buffer overflow in MultiMedia Soft AdjMmsEng.dll 7.11.1.0 and 7.11.2.7, as distributed in multiple MultiMedia Soft audio components for .NET, allows remote attackers to execute arbitrary code via a long string in a playlist (.pls) file, as originally reported for Euphonics Audio Player 1.0.  NOTE: some of these details are obtained from third party information.",2009-02-08,Metasploit,cpe:2.3:a:multimediasoft:audio_dj_studio_for_.net:-:*:*:*:*:*:*:*;cpe:2.3:a:multimediasoft:audio_sound_editer_for_.net:-:*:*:*:*:*:*:*;cpe:2.3:a:multimediasoft:audio_sound_recorder_for_.net:-:*:*:*:*:*:*:*;cpe:2.3:a:multimediasoft:audio_sound_studio_for_.net:-:*:*:*:*:*:*:*;cpe:2.3:a:multimediasoft:audio_sound_suite_for_.net:-:*:*:*:*:*:*:*,Multimediasoft,Audio Dj Studio For .Net
CVE-2009-0545,0.0,,0.90386,CWE-20,cgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the type parameter in a NoAuthREQ x509List action.,2009-02-12,Metasploit/Nuclei,cpe:2.3:a:zeroshell:zeroshell:1.0:beta10:*:*:*:*:*:*;cpe:2.3:a:zeroshell:zeroshell:1.0:beta11:*:*:*:*:*:*;cpe:2.3:a:zeroshell:zeroshell:1.0:beta1:*:*:*:*:*:*;cpe:2.3:a:zeroshell:zeroshell:1.0:beta2:*:*:*:*:*:*;cpe:2.3:a:zeroshell:zeroshell:1.0:beta3:*:*:*:*:*:*;cpe:2.3:a:zeroshell:zeroshell:1.0:beta4:*:*:*:*:*:*;cpe:2.3:a:zeroshell:zeroshell:1.0:beta5:*:*:*:*:*:*;cpe:2.3:a:zeroshell:zeroshell:1.0:beta6:*:*:*:*:*:*;cpe:2.3:a:zeroshell:zeroshell:1.0:beta7:*:*:*:*:*:*;cpe:2.3:a:zeroshell:zeroshell:1.0:beta8:*:*:*:*:*:*;cpe:2.3:a:zeroshell:zeroshell:1.0:beta9:*:*:*:*:*:*,Zeroshell,Zeroshell
CVE-2009-0546,0.0,,0.36511,CWE-119,Stack-based buffer overflow in NewsGator FeedDemon 2.7 and earlier allows user-assisted remote attackers to execute arbitrary code via a long text attribute in an outline element in a .opml file.,2009-02-12,Metasploit,cpe:2.3:a:newsgator:feeddemon:*:*:*:*:*:*:*:*;cpe:2.3:a:newsgator:feeddemon:2.0.0.24:*:*:*:*:*:*:*;cpe:2.3:a:newsgator:feeddemon:2.6.1.4:*:*:*:*:*:*:*;cpe:2.3:a:newsgator:feeddemon:2.6.1.5:*:*:*:*:*:*:*;cpe:2.3:a:newsgator:feeddemon:2.6:*:*:*:*:*:*:*,Newsgator,Feeddemon
CVE-2009-0556,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.67539,CWE-94,"Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka ""Memory Corruption Vulnerability.""",2009-04-03,CISA,cpe:2.3:a:microsoft:office_powerpoint:2004:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:powerpoint:2000:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:powerpoint:2002:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:powerpoint:2003:sp3:*:*:*:*:*:*,Microsoft,Office Powerpoint
CVE-2009-0557,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.58551,CWE-94,"Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a crafted Excel file with a malformed record object, aka ""Object Record Corruption Vulnerability.""",2009-06-10,CISA,cpe:2.3:a:microsoft:office:2000:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2004:*:*:*:*:macos:*:*;cpe:2.3:a:microsoft:office:2007:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2008:*:*:*:*:macos:*:*;cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_excel_viewer:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_excel_viewer:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_sharepoint_server:2007:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_sharepoint_server:2007:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:open_xml_file_format_converter:-:*:*:*:*:macos:*:*,Microsoft,Office
CVE-2009-0563,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.63081,CWE-787,"Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; Microsoft Office Word Viewer 2003 SP3; Microsoft Office Word Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a Word document with a crafted tag containing an invalid length field, aka ""Word Buffer Overflow Vulnerability.""",2009-06-10,CISA,cpe:2.3:a:microsoft:office:2000:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2004:*:*:*:*:macos:*:*;cpe:2.3:a:microsoft:office:2007:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2008:*:*:*:*:macos:*:*;cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_word_viewer:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_word_viewer:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:open_xml_file_format_converter:-:*:*:*:*:macos:*:*,Microsoft,Office
CVE-2009-0580,0.0,,0.9444,CWE-200,"Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.",2009-06-05,Metasploit,cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.15:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.16:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.17:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.18:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.19:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.20:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.21:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.22:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.23:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.24:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.25:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.26:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.27:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.28:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.29:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.30:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.31:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.32:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.33:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.34:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.35:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.36:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.37:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.38:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.39:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.3:beta:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.9:beta:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.26:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.27:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:*,Apache,Tomcat
CVE-2009-0658,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.87719,CWE-119,"Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote attackers to execute arbitrary code via a crafted PDF document, related to a non-JavaScript function call and possibly an embedded JBIG2 image stream, as exploited in the wild in February 2009 by Trojan.Pidief.E.",2009-02-20,Metasploit,cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.0:*:*:*:*:*:*:*,Adobe,Acrobat
CVE-2009-0695,0.0,,0.68887,CWE-287,"hagent.exe in Wyse Device Manager (WDM) 4.7.x does not require authentication for commands, which allows remote attackers to obtain management access via a crafted query, as demonstrated by a V52 query that triggers a power-off action.",2012-06-19,Metasploit,cpe:2.3:a:dell:wyse_device_manager:4.7.0:*:*:*:*:*:*:*;cpe:2.3:a:dell:wyse_device_manager:4.7.1:*:*:*:*:*:*:*;cpe:2.3:a:dell:wyse_device_manager:4.7.2:*:*:*:*:*:*:*,Dell,Wyse Device Manager
CVE-2009-0815,0.0,,0.42227,CWE-200,"The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 leaks a hash secret (juHash) in an error message, which allows remote attackers to read arbitrary files by including the hash in a request.",2009-03-05,Metasploit,cpe:2.3:a:typo3:typo3:3.3.x:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:3.5.x:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:3.6.x:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:3.7.x:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:3.8.x:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.0:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.1.0:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.1.3:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.1.4:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.1.5:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.1.6:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.1.7:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.1.8:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.1.9:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.1:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.2.0:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.2.1:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.2.2:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.2.3:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.2.4:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.2.5:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.2:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.3:alpha1:*:*:*:*:*:*,Typo3,Typo3
CVE-2009-0836,0.0,,0.40857,CWE-119,"Foxit Reader 2.3 before Build 3902 and 3.0 before Build 1506, including 1120 and 1301, does not require user confirmation before performing dangerous actions defined in a PDF file, which allows remote attackers to execute arbitrary programs and have unspecified other impact via a crafted file, as demonstrated by the ""Open/Execute a file"" action.",2009-03-10,Metasploit,cpe:2.3:a:foxitsoftware:reader:2.3:*:*:*:*:*:*:*;cpe:2.3:a:foxitsoftware:reader:3.0:*:*:*:*:*:*:*,Foxitsoftware,Reader
CVE-2009-0837,0.0,,0.75781,CWE-119,"Stack-based buffer overflow in Foxit Reader 3.0 before Build 1506, including 1120 and 1301, allows remote attackers to execute arbitrary code via a long (1) relative path or (2) absolute path in the filename argument in an action, as demonstrated by the ""Open/Execute a file"" action.",2009-03-10,Metasploit,cpe:2.3:a:foxit:reader3.0:*:*:*:*:*:*:*:*,Foxit,Reader3.0
CVE-2009-0880,0.0,,0.31595,CWE-22,Directory traversal vulnerability in the CIM server in IBM Director before 5.20.3 Service Update 2 on Windows allows remote attackers to load and execute arbitrary local DLL code via a .. (dot dot) in a /CIMListener/ URI in an M-POST request.,2009-03-12,Metasploit,cpe:2.3:a:ibm:director:*:service_update_1:*:*:*:*:*:*;cpe:2.3:a:ibm:director:3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:director:4.10:*:*:*:*:*:*:*;cpe:2.3:a:ibm:director:4.11:*:*:*:*:*:*:*;cpe:2.3:a:ibm:director:4.12:*:*:*:*:*:*:*;cpe:2.3:a:ibm:director:4.20:*:*:*:*:*:*:*;cpe:2.3:a:ibm:director:4.21:*:*:*:*:*:*:*;cpe:2.3:a:ibm:director:4.22:*:*:*:*:*:*:*;cpe:2.3:a:ibm:director:5.10.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:director:5.10.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:director:5.10.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:director:5.10.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:director:5.20.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:director:5.20.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:director:5.20.2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2009-0884,0.0,,0.03421,CWE-120,Buffer overflow in FileZilla Server before 0.9.31 allows remote attackers to cause a denial of service via unspecified vectors related to SSL/TLS packets.,2009-03-12,Nuclei,cpe:2.3:a:filezilla-project:filezilla_server:*:*:*:*:*:*:*:*,Filezilla-Project,Filezilla Server
CVE-2009-0920,0.0,,0.7494,CWE-119,"Stack-based buffer overflow in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long OvOSLocale cookie, a variant of CVE-2008-0067.",2009-03-25,Metasploit,cpe:2.3:a:hp:network_node_manager:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:hp:network_node_manager:7.5.1:*:*:*:*:*:*:*;cpe:2.3:a:hp:network_node_manager:7.5.3:*:*:*:*:*:*:*,Hp,Network Node Manager
CVE-2009-0927,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.96632,CWE-20,"Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows remote attackers to execute arbitrary code via a crafted argument to the getIcon method of a Collab object, a different vulnerability than CVE-2009-0658.",2009-03-19,CISA/EPSS/Metasploit,cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*,Adobe,Acrobat Reader
CVE-2009-0932,0.0,,0.41263,CWE-22,Directory traversal vulnerability in framework/Image/Image.php in Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Horde_Image driver name.,2009-03-17,Nuclei,cpe:2.3:a:debian:horde:3.2.2:*:*:*:*:*:*:*;cpe:2.3:a:debian:horde:3.2.3:*:*:*:*:*:*:*;cpe:2.3:a:debian:horde:3.2:*:*:*:*:*:*:*;cpe:2.3:a:debian:horde:3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:debian:horde:3.3.2:*:*:*:*:*:*:*;cpe:2.3:a:debian:horde:3.3:*:*:*:*:*:*:*;cpe:2.3:a:debian:horde_groupware:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:debian:horde_groupware:1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:debian:horde_groupware:1.1.3:*:*:*:*:*:*:*;cpe:2.3:a:debian:horde_groupware:1.1.4:*:*:*:*:*:*:*,Debian,Horde
CVE-2009-0950,0.0,,0.28815,CWE-119,Stack-based buffer overflow in Apple iTunes before 8.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an itms: URL with a long URL component after a colon.,2009-06-02,Metasploit,cpe:2.3:a:apple:itunes:*:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:*:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:1.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:1.0:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:1.0:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:1.0:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:1.1.1:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:1.1.1:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:1.1.1:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:1.1.2:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:1.1.2:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:1.1.2:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:2.0.1:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:2.0.1:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:2.0.1:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:2.0.2:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:2.0.2:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:2.0.2:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:2.0.3:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:2.0.3:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:2.0.3:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:2.0.4:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:2.0.4:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:2.0.4:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:2.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:2.0:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:2.0:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:2.0:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:3.0.1:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:3.0:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.0.0:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.0.0:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.0.1:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.0.1:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.0.1:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.0:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.1.0:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.1.0:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.1:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.2.0:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.2.0:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.2.72:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.2.72:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.2:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.5.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.5.0:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.5.0:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.5:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.6.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.6.0:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.6.0:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.6:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.6:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.7.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.7.0:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.7.0:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.7.1.30:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.7.1.30:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.7.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.7.1:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.7.1:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.7.1:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.7.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.7:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.7:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.8.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.8.0:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.8.0:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.8:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.8:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.9.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.9.0:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.9.0:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.9:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:4.9:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:5.0.0:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:5.0.0:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:5.0.1:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:5.0.1:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:5.0.1:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:5.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:5.0:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.0:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.0:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.1:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.1:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.1:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.2:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.2:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.2:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.3:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.3:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.3:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.4.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.4.2:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.4:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.4:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.4:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.5:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.5:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0.5:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:6.0:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.0.0:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.0.0:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.0.1:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.0.1:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.0.2:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.0.2:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.0.2:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.1.0:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.1.0:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.1.1:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.1.1:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.2.0:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.2.0:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.3.0:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.3.0:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.3.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.3.1:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.3.1:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.3.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.3.2:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.3.2:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.3.2:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.4.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.4.0:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.4.0:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.4.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.4.1:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.4.1:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.4.1:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.4.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.4.2:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.4.2:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.4.2:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.4.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.4.3:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.4:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.5.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.5.0:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.5.0:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.5:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.6.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.6.0:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.6.0:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.6.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.6.1:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.6.1:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.6.1:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.6.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.6.2:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.6.2:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.6.2:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.6:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.6:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.7.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.7.0:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.7.0:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.7.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.7.1:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.7.1:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.7.1:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.7:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:7.7:*:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:8.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:8.0.0:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:8.0.0:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:8.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:8.0.1:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:8.0.1:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:8.0.2:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:8.0.2:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:8.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:8.0:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:8.0:-:windows:*:*:*:*:*;cpe:2.3:a:apple:itunes:8.1:-:mac:*:*:*:*:*;cpe:2.3:a:apple:itunes:8.1:-:windows:*:*:*:*:*,Apple,Itunes
CVE-2009-0978,0.0,,0.17865,NVD-CWE-noinfo,"Unspecified vulnerability in the Workspace Manager component in Oracle Database 10.2.0.4 and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-0975.",2009-04-15,Metasploit,cpe:2.3:a:oracle:database_10g:10.2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_11g:11.1.0.6:*:*:*:*:*:*:*,Oracle,Database 10G
CVE-2009-10005,0.0,,0.00781,CWE-552,"ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 expose the mimencode binary via a CGI endpoint, allowing unauthenticated attackers to retrieve arbitrary files from the filesystem. By crafting a POST request to /cgi-bin/ck/mimencode with traversal and output parameters, attackers can read sensitive files such as /etc/passwd outside the webroot.",2025-08-20,Metasploit,,,
CVE-2009-10006,0.0,,0.00867,CWE-121,"UFO: Alien Invasion versions up to and including 2.2.1 contain a buffer overflow vulnerability in its built-in IRC client component. When the client connects to an IRC server and receives a crafted numeric reply (specifically a 001 message), the application fails to properly validate the length of the response string. This results in a stack-based buffer overflow, which may corrupt control flow structures and allow arbitrary code execution. The vulnerability is triggered during automatic IRC connection handling and does not require user interaction beyond launching the game.",2025-08-22,Metasploit,,,
CVE-2009-1028,0.0,,0.3301,CWE-119,Stack-based buffer overflow in ediSys eZip Wizard 3.0 allows remote attackers to execute arbitrary code via a crafted .zip file.,2009-03-20,Metasploit,cpe:2.3:a:edisys:ezip_wizard:3.0:*:*:*:*:*:*:*,Edisys,Ezip Wizard
CVE-2009-1029,0.0,,0.31839,CWE-119,"Stack-based buffer overflow in POP Peeper 3.4.0.0 and earlier allows remote POP3 servers to execute arbitrary code via a long Date header, related to Imap.dll.",2009-03-20,Metasploit,cpe:2.3:a:poppeeper:pop_peeper:*:*:*:*:*:*:*:*;cpe:2.3:a:poppeeper:pop_peeper:2.4.3:*:*:*:*:*:*:*;cpe:2.3:a:poppeeper:pop_peeper:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:poppeeper:pop_peeper:3.0:*:*:*:*:*:*:*,Poppeeper,Pop Peeper
CVE-2009-1122,0.0,,0.98161,CWE-287,"The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka ""IIS 5.0 WebDAV Authentication Bypass Vulnerability,"" a different vulnerability than CVE-2009-1535.",2009-06-10,EPSS/Metasploit,cpe:2.3:a:microsoft:internet_information_services:5.0:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*,Microsoft,Windows 2000
CVE-2009-1123,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.04918,NVD-CWE-noinfo,"The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application, aka ""Windows Kernel Desktop Vulnerability.""",2009-06-10,CISA,cpe:2.3:o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:-:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows 2000
CVE-2009-1136,0.0,,0.6202,CWE-94,"The Microsoft Office Web Components Spreadsheet ActiveX control (aka OWC10 or OWC11), as distributed in Office XP SP3 and Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 Gold and SP1, and Office Small Business Accounting 2006, when used in Internet Explorer, allows remote attackers to execute arbitrary code via a crafted call to the msDataSourceObject method, as exploited in the wild in July and August 2009, aka ""Office Web Components HTML Script Vulnerability.""",2009-07-15,Metasploit,cpe:2.3:a:microsoft:isa_server:2004:sp3:enterprise:*:*:*:*:*;cpe:2.3:a:microsoft:isa_server:2004:sp3:standard:*:*:*:*:*;cpe:2.3:a:microsoft:isa_server:2006:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:isa_server:2006:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:isa_server:2006:supportability:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2003:*:small_business_accounting_2006:*:*:*:*:*;cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_web_components:2003:sp1:2007_microsoft_office:*:*:*:*:*;cpe:2.3:a:microsoft:office_web_components:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_web_components:xp:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_xp:sp3:*:*:*:*:*:*:*,Microsoft,Isa Server
CVE-2009-1151,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.95438,CWE-94,Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.,2009-03-26,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2009-1185,0.0,,0.81528,CWE-346,"udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.",2009-04-17,Metasploit,cpe:2.3:a:juniper:ctpview:*:*:*:*:*:*:*:*;cpe:2.3:a:juniper:ctpview:7.1:-:*:*:*:*:*:*;cpe:2.3:a:juniper:ctpview:7.1:r1:*:*:*:*:*:*;cpe:2.3:a:juniper:ctpview:7.2:-:*:*:*:*:*:*;cpe:2.3:a:suse:linux_enterprise_debuginfo:10:sp2:*:*:*:*:*:*;cpe:2.3:a:suse:linux_enterprise_debuginfo:11:-:*:*:*:*:*:*;cpe:2.3:a:udev_project:udev:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:10.3:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:10:sp2:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*,Opensuse,Opensuse
CVE-2009-1260,0.0,,0.4267,CWE-119,Multiple stack-based buffer overflows in UltraISO 9.3.3.2685 and earlier allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted (1) CCD or (2) IMG file.,2009-04-07,Metasploit,cpe:2.3:a:ezbsystems:ultraiso:*:-:pe:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:3.1:*:*:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:3.1_sr1:*:*:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:3.1_sr2:*:*:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:4.0:*:*:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:4.1:*:*:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:4.5:*:*:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:5.0:*:*:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:5.1:*:*:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:5.55:*:*:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:5.55_sr-1:*:*:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:5.55_sr-2:*:*:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:6.0:*:*:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:6.1:*:*:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:6.51:*:*:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:6.52:*:*:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:6.52_sr-1:*:*:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:6.52_sr-2:*:*:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:6.56_sr-1:*:*:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:6.56_sr-2:*:*:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:6.5:*:*:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:7.0:-:me:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:7.1:-:me:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:7.21_sr-1:*:*:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:7.21_sr-2:*:*:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:7.22_me:*:*:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:7.23:-:me:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:7.25:-:me:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:7.51:-:me:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:7.52:-:me:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:7.55:-:me:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:7.56:-:me:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:7.5:-:me:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:7.62:-:me:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:7.65:-:me:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:7.65_sr-2:*:*:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:7.66:-:me:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:7.6:-:me:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:8.12:-:pe:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:8.2:-:pe:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:8.51:-:pe:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:8.61:-:pe:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:8.62:-:pe:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:8.63:-:pe:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:8.65:-:pe:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:8.66:-:pe:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:8.6:-:pe:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:8:-:pe:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:9.0:-:pe:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:9.1.2:-:pe:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:9.2:-:pe:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:9.3.1:-:pe:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:9.3.2:-:pe:*:*:*:*:*;cpe:2.3:a:ezbsystems:ultraiso:9.3:-:pe:*:*:*:*:*,Ezbsystems,Ultraiso
CVE-2009-1285,0.0,,0.10914,CWE-94,Static code injection vulnerability in the getConfigFile function in setup/lib/ConfigFile.class.php in phpMyAdmin 3.x before 3.1.3.2 allows remote attackers to inject arbitrary PHP code into configuration files.,2009-04-16,Metasploit,cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:1:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*,Phpmyadmin,Phpmyadmin
CVE-2009-1350,0.0,,0.65934,CWE-20,"Unspecified vulnerability in xtagent.exe in Novell NetIdentity Client before 1.2.4 allows remote attackers to execute arbitrary code by establishing an IPC$ connection to the XTIERRPCPIPE named pipe, and sending RPC messages that trigger a dereference of an arbitrary pointer.",2009-04-21,Metasploit,cpe:2.3:a:novell:netidentity_client1.2.3:*:*:*:*:*:*:*:*,Novell,Netidentity Client1.2.3
CVE-2009-1386,0.0,,0.80134,CWE-476,ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before ClientHello.,2009-06-04,Metasploit,cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openssl:0.9.6-15:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openssl:0.9.6b-3:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openssl:0.9.7a-2:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2009-1394,0.0,,0.33281,CWE-119,Stack-based buffer overflow in Motorola Timbuktu Pro 8.6.5 on Windows allows remote attackers to execute arbitrary code by sending a long malformed string over the PlughNTCommand named pipe.,2009-06-26,Metasploit,cpe:2.3:a:motorola:timbuktu_pro:8.6.5:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2009-1429,0.0,,0.87464,CWE-94,"The Intel LANDesk Common Base Agent (CBA) in Symantec Alert Management System 2 (AMS2), as used in Symantec System Center (SSS); Symantec AntiVirus Server; Symantec AntiVirus Central Quarantine Server; Symantec AntiVirus (SAV) Corporate Edition 9 before 9.0 MR7, 10.0 and 10.1 before 10.1 MR8, and 10.2 before 10.2 MR2; Symantec Client Security (SCS) 2 before 2.0 MR7 and 3 before 3.1 MR8; and Symantec Endpoint Protection (SEP) before 11.0 MR3, allows remote attackers to execute arbitrary commands via a crafted packet whose contents are interpreted as a command to be launched in a new process by the CreateProcessA function.",2009-04-29,Metasploit,cpe:2.3:a:symantec:antivirus:*:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:*:-:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:-:-:srv:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.1.1:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.1:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.2.1:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.2.2:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.2:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.3:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.4:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.5:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.6:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.7:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.8:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.9:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus_central_quarantine_server:*:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:*:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:2.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.0.359:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.1.1000:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.1.1001:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.1.1007:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.1.1008:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.1.1009:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.2.2000:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.2.2001:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.2.2002:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.2.2010:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.2.2011:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.2.2020:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.2.2021:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec:endpoint_protection:*:*:*:*:*:*:*:*;cpe:2.3:a:symantec:system_center:*:*:*:*:*:*:*:*,Symantec,Antivirus
CVE-2009-1430,0.0,,0.55088,CWE-119,"Multiple stack-based buffer overflows in IAO.EXE in the Intel Alert Originator Service in Symantec Alert Management System 2 (AMS2), as used in Symantec System Center (SSS); Symantec AntiVirus Server; Symantec AntiVirus Central Quarantine Server; Symantec AntiVirus (SAV) Corporate Edition 9 before 9.0 MR7, 10.0 and 10.1 before 10.1 MR8, and 10.2 before 10.2 MR2; Symantec Client Security (SCS) 2 before 2.0 MR7 and 3 before 3.1 MR8; and Symantec Endpoint Protection (SEP) before 11.0 MR3, allow remote attackers to execute arbitrary code via (1) a crafted packet or (2) data that ostensibly arrives from the MsgSys.exe process.",2009-04-29,Metasploit,cpe:2.3:a:symantec:antivirus:*:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:*:-:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:-:-:srv:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.1.1:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.1:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.2.1:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.2.2:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.2:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.3:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.4:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.5:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.6:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.7:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.8:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.9:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus_central_quarantine_server:*:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:*:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:2.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.0.359:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.1.1000:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.1.1001:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.1.1007:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.1.1008:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.1.1009:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.2.2000:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.2.2001:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.2.2002:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.2.2010:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.2.2011:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.2.2020:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.2.2021:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:symantec:client_security:3.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec:endpoint_protection:*:*:*:*:*:*:*:*;cpe:2.3:a:symantec:system_center:*:*:*:*:*:*:*:*,Symantec,Antivirus
CVE-2009-1496,0.0,,0.07183,CWE-22,Directory traversal vulnerability in the Cmi Marketplace (com_cmimarketplace) component 0.1 for Joomla! allows remote attackers to list arbitrary directories via a .. (dot dot) in the viewit parameter to index.php.,2009-05-01,Nuclei,cpe:2.3:a:ijobid:com_cmimarketplace:0.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla:*:*:*:*:*:*:*:*,Joomla,Joomla
CVE-2009-1534,0.0,,0.5161,CWE-119,"Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Components SP3, BizTalk Server 2002, and Visual Studio .NET 2003 SP1 allows remote attackers to execute arbitrary code via crafted property values, aka ""Office Web Components Buffer Overflow Vulnerability.""",2009-08-12,Metasploit,cpe:2.3:a:microsoft:biztalk_server:2002:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:isa_server:2004:sp3:enterprise:*:*:*:*:*;cpe:2.3:a:microsoft:isa_server:2004:sp3:standard:*:*:*:*:*;cpe:2.3:a:microsoft:isa_server:2006:sp1:enterprise:*:*:*:*:*;cpe:2.3:a:microsoft:isa_server:2006:sp1:standard:*:*:*:*:*;cpe:2.3:a:microsoft:office:-:*:small_business_accounting_2006:*:*:*:*:*;cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_web_components:2000:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_web_components:2003:sp1:2007_microsoft_office:*:*:*:*:*;cpe:2.3:a:microsoft:office_web_components:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_web_components:xp:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1:*:*:*:*:*:*,Microsoft,Biztalk Server
CVE-2009-1535,0.0,,0.98115,CWE-287,"The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af (Unicode / character) at an arbitrary position in the URI, as demonstrated by inserting %c0%af into a ""/protected/"" initial pathname component to bypass the password protection on the protected\ folder, aka ""IIS 5.1 and 6.0 WebDAV Authentication Bypass Vulnerability,"" a different vulnerability than CVE-2009-1122.",2009-06-10,EPSS/Metasploit,cpe:2.3:a:microsoft:internet_information_services:5.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_information_services:6.0:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:-:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:professional:*:-:*,Microsoft,Windows Xp
CVE-2009-1537,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.51207,NVD-CWE-noinfo,"Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime media file, as exploited in the wild in May 2009, aka ""DirectX NULL Byte Overwrite Vulnerability.""",2009-05-29,CISA,cpe:2.3:a:microsoft:directx:7.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:directx:7.0a:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:directx:7.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:directx:8.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:directx:8.1b:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:directx:9.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:directx:9.0a:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:directx:9.0b:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:directx:9.0c:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*,Microsoft,Windows 2000
CVE-2009-1558,0.0,,0.28806,CWE-22,Directory traversal vulnerability in adm/file.cgi on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 allows remote attackers to read arbitrary files via a %2e. (encoded dot dot) or an absolute pathname in the next_file parameter.,2009-05-06,Nuclei,cpe:2.3:h:cisco:wvc54gca:1.00r22:*:*:*:*:*:*:*;cpe:2.3:h:cisco:wvc54gca:1.00r24:*:*:*:*:*:*:*,Cisco,Wvc54Gca
CVE-2009-1568,0.0,,0.32168,CWE-119,"Stack-based buffer overflow in ienipp.ocx in Novell iPrint Client 5.30, and possibly other versions before 5.32, allows remote attackers to execute arbitrary code via a long target-frame parameter.",2009-12-08,Metasploit,cpe:2.3:a:novell:iprint_client:5.30:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint_client:5.31:*:*:*:*:*:*:*,Novell,Iprint Client
CVE-2009-1569,0.0,,0.37524,CWE-119,"Multiple stack-based buffer overflows in Novell iPrint Client 4.38, 5.30, and possibly other versions before 5.32 allow remote attackers to execute arbitrary code via vectors related to (1) Date and (2) Time.",2009-12-08,Metasploit,cpe:2.3:a:novell:iprint:4.38:*:client:*:*:*:*:*;cpe:2.3:a:novell:iprint:5.30:*:client:*:*:*:*:*,Novell,Iprint
CVE-2009-1612,0.0,,0.33255,CWE-119,"Stack-based buffer overflow in the MPS.StormPlayer.1 ActiveX control in mps.dll 3.9.4.27 in Baofeng Storm allows remote attackers to execute arbitrary code via a long argument to the OnBeforeVideoDownload method, as exploited in the wild in April and May 2009. NOTE: some of these details are obtained from third party information. NOTE: it was later reported that 3.09.04.17 and earlier are also affected.",2009-05-11,Metasploit,cpe:2.3:a:baofeng:storm:2.7.9_10:*:*:*:*:*:*:*;cpe:2.3:a:baofeng:storm:2.7.9_8:*:*:*:*:*:*:*;cpe:2.3:a:baofeng:storm:2.8:*:*:*:*:*:*:*;cpe:2.3:a:baofeng:storm:2.9:*:*:*:*:*:*:*;cpe:2.3:a:baofeng:storm:3.9.3_25:*:*:*:*:*:*:*;cpe:2.3:a:baofeng:storm:3.9.3_30:*:*:*:*:*:*:*;cpe:2.3:a:baofeng:storm:3.9.4_17:*:*:*:*:*:*:*;cpe:2.3:a:baofeng:storm:3.9.4_27:*:*:*:*:*:*:*,Baofeng,Storm
CVE-2009-1641,0.0,,0.30917,CWE-119,Multiple stack-based buffer overflows in Mini-stream Ripper 3.0.1.1 allow remote attackers to execute arbitrary code via (1) a long rtsp URL in a .ram file and (2) a long string in the HREF attribute of a REF element in a .asx file.,2009-05-15,Metasploit,cpe:2.3:a:mini-stream:ripper:3.0.1.1:*:*:*:*:*:*:*,Mini-Stream,Ripper
CVE-2009-1675,0.0,,0.13788,CWE-119,Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a long 227 reply to a PASV command.,2009-05-18,Metasploit,cpe:2.3:a:electrasoft:32bit_ftp:09.04.24:*:*:*:*:*:*:*,Electrasoft,32Bit Ftp
CVE-2009-1730,0.0,,0.5451,CWE-22,Multiple directory traversal vulnerabilities in NetMechanica NetDecision TFTP Server 4.2 allow remote attackers to read or modify arbitrary files via directory traversal sequences in the (1) GET or (2) PUT command.,2009-05-20,Metasploit,cpe:2.3:a:netmechanica:netdecision_tftp_server:4.2:*:*:*:*:*:*:*,Netmechanica,Netdecision Tftp Server
CVE-2009-1831,0.0,,0.36337,CWE-189,"The Nullsoft Modern Skins Support module (gen_ff.dll) in Nullsoft Winamp before 5.552 allows remote attackers to execute arbitrary code via a crafted MAKI file, which triggers an incorrect sign extension, an integer overflow, and a stack-based buffer overflow.",2009-05-29,Metasploit,cpe:2.3:a:nullsoft:winamp:*:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.0:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.10:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.24:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.4:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.50:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.5e:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.60:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.60:*:full:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.60:*:lite:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.61:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.61:*:full:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.62:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.62:*:standard:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.64:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.64:*:standard:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.65:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.6x:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.70:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.70:*:full:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.71:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.72:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.73:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.73:*:full:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.74:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.75:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.76:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.77:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.78:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.79:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.7x:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.80:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.81:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.90:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.91:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:2.95:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:3.0:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:3.1:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.01:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.02:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.03:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.03a:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.04:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.05:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.06:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.07:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.08:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.08:c:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.08:d:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.08:e:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.08c:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.08d:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.08e:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.091:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.093:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.094:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.09:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.0:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.111:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.112:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.11:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.12:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.13:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.1:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.21:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.22:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.23:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.24:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.2:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.31:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.32:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.33:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.34:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.35:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.36:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.3:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.51:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.52:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.53:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.541:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.54:*:*:*:*:*:*:*;cpe:2.3:a:nullsoft:winamp:5.5:*:*:*:*:*:*:*,Nullsoft,Winamp
CVE-2009-1862,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.25006,CWE-787,"Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (1) a crafted Flash application in a .pdf file or (2) a crafted .swf file, related to authplay.dll, as exploited in the wild in July 2009.",2009-07-23,CISA,cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*,Adobe,Acrobat
CVE-2009-1872,0.0,,0.1614,CWE-79,"Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion Server 8.0.1, 8, and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the startRow parameter to administrator/logviewer/searchlog.cfm, or the query string to (2) wizards/common/_logintowizard.cfm, (3) wizards/common/_authenticatewizarduser.cfm, or (4) administrator/enter.cfm.",2009-08-18,Nuclei,cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:6.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:6.0:*:enterprise_multi-server:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:6.0:*:enterprise_server:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:6.0:*:linux:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:6.0:*:solaris:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:6.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:6.1:*:enterprise_multi-server:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:6.1:*:enterprise_server:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:6.1:*:linux:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:6.1:*:solaris:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:7.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:7.0:*:enterprise_multi-server:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:7.0:*:enterprise_server:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:7.0:*:linux:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:7.0:*:solaris:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:7.2:unknown:mx:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:8.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:8.1:*:*:*:*:*:*:*,Adobe,Coldfusion
CVE-2009-1943,0.0,,0.7221,CWE-119,Stack-based buffer overflow in the IKE service (ireIke.exe) in SafeNet SoftRemote before 10.8.6 allows remote attackers to execute arbitrary code via a long request to UDP port 62514.,2009-06-05,Metasploit,cpe:2.3:a:safenet-inc:softremote1.4:*:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:*:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:1.7.1:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:1.7.2:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:1.7.7:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:1.8.1:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:10.7.7:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:10.8.0:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:10.8.1:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:10.8.2:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:10.8.3:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:8.0:*:*:*:*:*:*:*,Safenet-Inc,Softremote
CVE-2009-1977,0.0,,0.72638,NVD-CWE-noinfo,"Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the July 2009 Oracle CPU. Oracle has not commented on claims from an independent researcher that this vulnerability allows attackers to bypass authentication via unknown vectors involving the username parameter and login.php.",2009-07-14,Metasploit,cpe:2.3:a:oracle:secure_backup:10.2.0.3:*:*:*:*:*:*:*,Oracle,Secure Backup
CVE-2009-1978,0.0,,0.64694,NVD-CWE-noinfo,"Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the July 2009 Oracle CPU. Oracle has not commented on claims from an independent researcher that this vulnerability allows remote authenticated users to execute arbitrary code with SYSTEM privileges via vectors involving property_box.php.",2009-07-14,Metasploit,cpe:2.3:a:oracle:secure_backup:10.2.0.3:*:*:*:*:*:*:*,Oracle,Secure Backup
CVE-2009-1979,0.0,,0.76361,NVD-CWE-noinfo,"Unspecified vulnerability in the Network Authentication component in Oracle Database 10.1.0.5 and 10.2.0.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the October 2009 CPU.  Oracle has not commented on claims from an independent researcher that this is related to improper validation of the AUTH_SESSKEY parameter length that leads to arbitrary code execution.",2009-10-22,Metasploit,cpe:2.3:a:oracle:database_server:10.1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_server:10.2.0.4:*:*:*:*:*:*:*,Oracle,Database Server
CVE-2009-20002,0.0,,0.0049,CWE-121,"Millenium MP3 Studio versions up to and including 2.0 is vulnerable to a stack-based buffer overflow when parsing .pls playlist files. The application fails to properly validate the length of the File1 field within the playlist, allowing an attacker to craft a malicious .pls file that overwrites the Structured Exception Handler (SEH) and executes arbitrary code. Exploitation requires the victim to open the file locally, though remote execution may be possible if the .pls extension is registered to the application and opened via a browser.",2025-08-21,Metasploit,,,
CVE-2009-20003,0.0,,0.00336,CWE-121,"Xenorate versions up to and including 2.50, a Windows-based multimedia player, is vulnerable to a stack-based buffer overflow when processing .xpl playlist files. The application fails to properly validate the length of input data, allowing an attacker to craft a malicious .xpl file that overwrites the Structured Exception Handler (SEH) and enables arbitrary code execution. Exploitation requires local interaction, typically by convincing a user to open the crafted file.",2025-08-21,Metasploit,,,
CVE-2009-20004,0.0,,0.00345,CWE-121,"gAlan 0.2.1, a modular audio processing environment for Windows, is vulnerable to a stack-based buffer overflow when parsing .galan files. The application fails to properly validate the length of input data, allowing a specially crafted file to overwrite the stack and execute arbitrary code. Exploitation requires local interaction, typically by convincing a user to open the malicious file.",2025-08-21,Metasploit,,,
CVE-2009-20005,0.0,,0.01269,CWE-121,"A stack-based buffer overflow exists in the UtilConfigHome.csp endpoint of InterSystems Caché 2009.1. The vulnerability is triggered by sending a specially crafted HTTP GET request containing an oversized argument to the .csp handler. Due to insufficient bounds checking, the input overflows a stack buffer, allowing an attacker to overwrite control structures and execute arbitrary code. It is unknown if this vulnerability was patched and an affected version range remains undefined.",2025-09-16,Metasploit,,,
CVE-2009-20006,0.0,,0.01142,CWE-434,"osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility (admin/file_manager.php). The interface allows file uploads and edits without sufficient input validation or access control. An unauthenticated attacker can craft a POST request to upload a .php file containing arbitrary code, which is then executed by the server.",2025-09-16,Metasploit,,,
CVE-2009-20007,0.0,,0.01695,CWE-121,"Talkative IRC v0.4.4.16 is vulnerable to a stack-based buffer overflow when processing specially crafted response strings sent to a connected client. An attacker can exploit this flaw by sending an overly long message that overflows a fixed-length buffer, potentially leading to arbitrary code execution in the context of the vulnerable process. This vulnerability is exploitable remotely and does not require authentication.",2025-09-16,Metasploit,,,
CVE-2009-20008,0.0,,0.00854,CWE-121,"Green Dam Youth Escort version 3.17 is vulnerable to a stack-based buffer overflow when processing overly long URLs. The flaw resides in the URL filtering component, which fails to properly validate input length before copying user-supplied data into a fixed-size buffer. A remote attacker can exploit this vulnerability by enticing a user to visit a specially crafted webpage containing a long URL, resulting in arbitrary code execution.",2025-08-30,Metasploit,,,
CVE-2009-20009,0.0,,0.01532,CWE-121,"Belkin Bulldog Plus version 4.0.2 build 1219 contains a stack-based buffer overflow vulnerability in its web service authentication handler. When a specially crafted HTTP request is sent with an oversized Authorization header, the application fails to properly validate the input length before copying it into a fixed-size buffer, resulting in memory corruption and potential remote code execution. Exploitation requires network access and does not require prior authentication.",2025-08-30,Metasploit,,,
CVE-2009-20010,0.0,,0.01617,CWE-78,"Dogfood CRM version 2.0.10 contains a remote command execution vulnerability in the spell.php script used by its mail subsystem. The vulnerability arises from unsanitized user input passed via a POST request to the data parameter, which is processed by the underlying shell without adequate escaping. This allows attackers to inject arbitrary shell commands and execute them on the server. The flaw is exploitable without authentication and was discovered by researcher LSO.",2025-08-30,Metasploit,,,
CVE-2009-20011,0.0,,0.01267,CWE-78,"ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 are vulnerable to remote command execution due to insecure handling of file uploads via the mimencode CGI utility. The vulnerability allows unauthenticated attackers to upload and execute arbitrary scripts as the Apache user. Additionally, the exploit can optionally escalate privileges by abusing insecure PATH usage in the benetool binary, resulting in root-level access if successful.",2025-08-30,Metasploit,,,
CVE-2009-2011,0.0,,0.40176,CWE-78,"Worldweaver DX Studio Player 3.0.29.0, 3.0.22.0, 3.0.12.0, and probably other versions before 3.0.29.1, when used as a plug-in for Firefox, does not restrict access to the shell.execute JavaScript API method, which allows remote attackers to execute arbitrary commands via a .dxstudio file that invokes this method.",2009-06-16,Metasploit,cpe:2.3:a:dxstudio:dx_studio_player:*:*:*:*:*:*:*:*;cpe:2.3:a:dxstudio:dx_studio_player:3.0.12.0:*:*:*:*:*:*:*;cpe:2.3:a:dxstudio:dx_studio_player:3.0.22.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*,Dxstudio,Dx Studio Player
CVE-2009-2015,0.0,,0.06507,CWE-22,Directory traversal vulnerability in includes/file_includer.php in the Ideal MooFAQ (com_moofaq) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.,2009-06-09,Nuclei,cpe:2.3:a:ideal:com_moofaq:1.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla:*:*:*:*:*:*:*:*,Joomla,Joomla
CVE-2009-2055,5.9,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H,0.03326,CWE-20,"Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009.",2009-08-19,CISA,cpe:2.3:o:cisco:ios_xr:3.4.0:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:3.4.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:3.4.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:3.4.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:3.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:3.5.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:3.5.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:3.5.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:3.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:3.6.0:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:3.6.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:3.6.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:3.6.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:3.7.0:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:3.7.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:3.7.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:3.7.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:3.8.0:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:3.8.1:*:*:*:*:*:*:*,Cisco,Ios Xr
CVE-2009-2100,0.0,,0.08229,CWE-22,Directory traversal vulnerability in the JoomlaPraise Projectfork (com_projectfork) component 2.0.10 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the section parameter to index.php.,2009-06-17,Nuclei,cpe:2.3:a:joomla:joomla:*:*:*:*:*:*:*:*;cpe:2.3:a:joomlapraise:com_projectfork:2.0.10:*:*:*:*:*:*:*,Joomla,Joomla
CVE-2009-2227,0.0,,0.68581,CWE-119,Stack-based buffer overflow in B Labs Bopup Communication Server 3.2.26.5460 allows remote attackers to execute arbitrary code via a crafted request to TCP port 19810.,2009-06-26,Metasploit,cpe:2.3:a:blabsoft:bopup_communication_server:3.2.26.5460:*:*:*:*:*:*:*,Blabsoft,Bopup Communication Server
CVE-2009-2261,0.0,,0.41422,CWE-20,"PeaZIP 2.6.1, 2.5.1, and earlier on Windows allows user-assisted remote attackers to execute arbitrary commands via a .zip archive with a .txt file whose name contains | (pipe) characters and a command.",2009-06-30,Metasploit,cpe:2.3:a:giorgio_tani:peazip:*:-:windows:*:*:*:*:*;cpe:2.3:a:giorgio_tani:peazip:1.0:-:windows:*:*:*:*:*;cpe:2.3:a:giorgio_tani:peazip:1.10:-:windows:*:*:*:*:*;cpe:2.3:a:giorgio_tani:peazip:1.11:-:windows:*:*:*:*:*;cpe:2.3:a:giorgio_tani:peazip:1.1:-:windows:*:*:*:*:*;cpe:2.3:a:giorgio_tani:peazip:1.2:-:windows:*:*:*:*:*;cpe:2.3:a:giorgio_tani:peazip:1.3:-:windows:*:*:*:*:*;cpe:2.3:a:giorgio_tani:peazip:1.4:-:windows:*:*:*:*:*;cpe:2.3:a:giorgio_tani:peazip:1.5:-:windows:*:*:*:*:*;cpe:2.3:a:giorgio_tani:peazip:1.6:-:windows:*:*:*:*:*;cpe:2.3:a:giorgio_tani:peazip:1.7:-:windows:*:*:*:*:*;cpe:2.3:a:giorgio_tani:peazip:1.8.1:-:windows:*:*:*:*:*;cpe:2.3:a:giorgio_tani:peazip:1.8.2:-:windows:*:*:*:*:*;cpe:2.3:a:giorgio_tani:peazip:1.8:-:windows:*:*:*:*:*;cpe:2.3:a:giorgio_tani:peazip:1.9.1:-:windows:*:*:*:*:*;cpe:2.3:a:giorgio_tani:peazip:1.9.2:-:windows:*:*:*:*:*;cpe:2.3:a:giorgio_tani:peazip:1.9.3:-:windows:*:*:*:*:*;cpe:2.3:a:giorgio_tani:peazip:1.9:-:windows:*:*:*:*:*;cpe:2.3:a:giorgio_tani:peazip:2.0:-:windows:*:*:*:*:*;cpe:2.3:a:giorgio_tani:peazip:2.1:-:windows:*:*:*:*:*;cpe:2.3:a:giorgio_tani:peazip:2.2:-:windows:*:*:*:*:*;cpe:2.3:a:giorgio_tani:peazip:2.3a:-:windows:*:*:*:*:*;cpe:2.3:a:giorgio_tani:peazip:2.4.1:-:windows:*:*:*:*:*;cpe:2.3:a:giorgio_tani:peazip:2.4:-:windows:*:*:*:*:*;cpe:2.3:a:giorgio_tani:peazip:2.6.1:-:windows:*:*:*:*:*,Giorgio Tani,Peazip
CVE-2009-2265,0.0,,0.83865,CWE-22,"Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution in July 2009, related to the file browser and the editor/filemanager/connectors/ directory.",2009-07-05,Metasploit,cpe:2.3:a:fckeditor:fckeditor:*:*:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.0:*:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.0_fc:*:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.0_rc2:*:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.0rc2:*:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.0rc3:*:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.1:*:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.2:*:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.3.2:*:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.3.3:*:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.3:*:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.3:beta:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.4.1:*:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.4.2:*:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.4.3:*:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.4:*:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.5:*:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.5:beta:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.6.1:*:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.6.2:*:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.6.3:*:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.6.3:beta:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.6.4:beta:*:*:*:*:*:*;cpe:2.3:a:fckeditor:fckeditor:2.6:*:*:*:*:*:*:*,Fckeditor,Fckeditor
CVE-2009-2288,0.0,,0.83453,CWE-78,statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute parameters.,2009-07-01,Metasploit,cpe:2.3:a:nagios:nagios:*:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:1.0:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:1.0b1:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:1.0b2:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:1.0b4:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:1.1:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:1.4.1:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:2.0:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:2.0b4:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:2.10:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:2.7:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0.4:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0.5:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0.6:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:alpha1:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:alpha2:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:alpha3:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:alpha4:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:beta1:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:beta2:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:beta3:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:beta4:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:beta5:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:beta6:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:beta7:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:rc1:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:rc2:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:rc3:*:*:*:*:*:*,Nagios,Nagios
CVE-2009-2335,0.0,,0.85,CWE-16,"WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.  NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for ""user convenience.""",2009-07-10,Metasploit,cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress_mu:*:*:*:*:*:*:*:*,Wordpress,Wordpress
CVE-2009-2367,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.23195,CWE-338,"cgi-bin/makecgi-pro in Iomega StorCenter Pro generates predictable session IDs, which allows remote attackers to hijack active sessions and gain privileges via brute force guessing attacks on the session_id parameter.",2009-07-08,Metasploit,cpe:2.3:h:iomega:storcenter_pro:-:*:*:*:*:*:*:*;cpe:2.3:o:iomega:storcenter_pro_firmware:-:*:*:*:*:*:*:*,Iomega,Storcenter Pro Firmware
CVE-2009-2477,0.0,,0.42689,CWE-94,"js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1 allows remote attackers to execute arbitrary code via certain use of the escape function that triggers access to uninitialized memory locations, as originally demonstrated by a document containing P and FONT elements.",2009-07-15,Metasploit,cpe:2.3:a:mozilla:firefox:3.5:*:*:*:*:*:*:*,Mozilla,Firefox
CVE-2009-2484,0.0,,0.3511,CWE-119,"Stack-based buffer overflow in the Win32AddConnection function in modules/access/smb.c in VideoLAN VLC media player 0.9.9, when running on Microsoft Windows, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long smb URI in a playlist file.",2009-07-16,Metasploit,cpe:2.3:a:videolan:vlc_media_player:0.9.9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2009-2485,0.0,,0.58099,CWE-119,Stack-based buffer overflow in HT-MP3Player 1.0 allows remote attackers to execute arbitrary code via a long string in a .ht3 file.,2009-07-16,Metasploit,cpe:2.3:a:tingan:ht-mp3player:1.0:*:*:*:*:*:*:*,Tingan,Ht-Mp3Player
CVE-2009-2514,0.0,,0.47489,CWE-94,"win32k.sys in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not correctly parse font code during construction of a directory-entry table, which allows remote attackers to execute arbitrary code via a crafted Embedded OpenType (EOT) font, aka ""Win32k EOT Parsing Vulnerability.""",2009-11-11,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:gold:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*,Microsoft,Windows 2000
CVE-2009-2521,0.0,,0.82265,CWE-400,"Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authenticated users to cause a denial of service (daemon crash) via a list (ls) -R command containing a wildcard that references a subdirectory, followed by a .. (dot dot), aka ""IIS FTP Service DoS Vulnerability.""",2009-09-04,Metasploit,cpe:2.3:a:microsoft:internet_information_services:*:*:*:*:*:*:*:*,Microsoft,Internet Information Services
CVE-2009-2566,0.0,,0.31074,CWE-119,"Stack-based buffer overflow in TFM MMPlayer 2.0, and possibly 2.0.0.30, allows remote attackers to execute arbitrary code via a long string in a playlist (.m3u) file.",2009-07-21,Metasploit,cpe:2.3:a:tfm:mmplayer:2.0:*:*:*:*:*:*:*,Tfm,Mmplayer
CVE-2009-2650,0.0,,0.30685,CWE-119,Heap-based buffer overflow in Sorcerer Software MultiMedia Jukebox 4.0 Build 020124 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted (1) .m3u or possibly (2) .pst file.,2009-07-30,Metasploit,cpe:2.3:a:sorcerersoftware:multimedia_jukebox:4.0:*:*:*:*:*:*:*,Sorcerersoftware,Multimedia Jukebox
CVE-2009-2685,0.0,,0.76706,CWE-119,Stack-based buffer overflow in the login form in the management web server in HP Power Manager allows remote attackers to execute arbitrary code via the Login variable.,2009-11-06,Metasploit,cpe:2.3:a:hp:power_manager:*:*:*:*:*:*:*:*,Hp,Power Manager
CVE-2009-2692,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.14633,CWE-908,"The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.",2009-08-14,Metasploit,cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:4.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:4.8:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:5.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:4.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:5.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:4.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_real_time:10:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2009-2727,0.0,,0.26749,CWE-119,"Stack-based buffer overflow in the _tt_internal_realpath function in the ToolTalk library (libtt.a) in IBM AIX 5.2.0, 5.3.0, 5.3.7 through 5.3.10, and 6.1.0 through 6.1.3, when the rpc.ttdbserver daemon is enabled in /etc/inetd.conf, allows remote attackers to execute arbitrary code via a long XDR-encoded ASCII string to remote procedure 15.",2009-08-10,Metasploit,cpe:2.3:o:ibm:aix:5.2.0.50:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.2.0.54:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.2.0:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.2.2:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.2:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.2_l:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.3.0:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.3.10:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.3.7:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.3.8:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.3.9:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.3:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:6.1.0:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:6.1.1:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:6.1.2:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:6.1:*:*:*:*:*:*:*,Ibm,Aix
CVE-2009-2765,0.0,,0.82504,CWE-20,"httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI.",2009-08-14,Metasploit,cpe:2.3:a:dd-wrt:dd-wrt:*:sp1:*:*:*:*:*:*,Dd-Wrt,Dd-Wrt
CVE-2009-2936,0.0,,0.63824,CWE-287,"The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to (1) execute arbitrary code via a vcl.inline directive that provides a VCL configuration file containing inline C code; (2) change the ownership of the master process via param.set, stop, and start directives; (3) read the initial line of an arbitrary file via a vcl.load directive; or (4) conduct cross-site request forgery (CSRF) attacks that leverage a victim's location on a trusted network and improper input validation of directives.  NOTE: the vendor disputes this report, saying that it is ""fundamentally misguided and pointless.",2010-04-05,Metasploit,cpe:2.3:a:varnish.projects.linpro:varnish:0.9.1:*:*:*:*:*:*:*;cpe:2.3:a:varnish.projects.linpro:varnish:0.9:*:*:*:*:*:*:*;cpe:2.3:a:varnish.projects.linpro:varnish:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:varnish.projects.linpro:varnish:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:varnish.projects.linpro:varnish:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:varnish.projects.linpro:varnish:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:varnish.projects.linpro:varnish:1.0:*:*:*:*:*:*:*;cpe:2.3:a:varnish.projects.linpro:varnish:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:varnish.projects.linpro:varnish:1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:varnish.projects.linpro:varnish:1.1:*:*:*:*:*:*:*;cpe:2.3:a:varnish.projects.linpro:varnish:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:varnish.projects.linpro:varnish:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:varnish.projects.linpro:varnish:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:varnish.projects.linpro:varnish:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:varnish.projects.linpro:varnish:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:varnish.projects.linpro:varnish:2.0.6:*:*:*:*:*:*:*;cpe:2.3:a:varnish.projects.linpro:varnish:2.0:*:*:*:*:*:*:*;cpe:2.3:a:varnish.projects.linpro:varnish:2.0:beta1:*:*:*:*:*:*;cpe:2.3:a:varnish.projects.linpro:varnish:2.0:beta2:*:*:*:*:*:*;cpe:2.3:a:varnish.projects.linpro:varnish:2.0:rc1:*:*:*:*:*:*,Varnish.Projects.Linpro,Varnish
CVE-2009-2990,0.0,,0.68669,CWE-189,"Array index error in Adobe Reader and Acrobat 9.x before 9.2, 8.x before 8.1.7, and possibly 7.x through 7.1.4 might allow attackers to execute arbitrary code via unspecified vectors.",2009-10-19,Metasploit,cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:7.0.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:7.0.4:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:7.0.5:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:7.0.6:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:7.0.7:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:7.0.8:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:7.0.9:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:7.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:7.1.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:7.1.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:8.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:8.1.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:8.1.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:8.1.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:8.1.4:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:8.1.6:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:8.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.1.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.1.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:7.0.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:7.0.4:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:7.0.5:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:7.0.6:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:7.0.7:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:7.0.8:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:7.0.9:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:7.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:7.1.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:7.1.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:8.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:8.1.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:8.1.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:8.1.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:8.1.4:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:8.1.5:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:8.1.6:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:8.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.1.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.1.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.1:*:*:*:*:*:*:*,Adobe,Acrobat
CVE-2009-3023,0.0,,0.90913,CWE-120,"Buffer overflow in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 6.0 allows remote authenticated users to execute arbitrary code via a crafted NLST (NAME LIST) command that uses wildcards, leading to memory corruption, aka ""IIS FTP Service RCE and DoS Vulnerability.""",2009-08-31,Metasploit,cpe:2.3:a:microsoft:internet_information_server:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:-:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:-:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:-:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:-:*:x86:*;cpe:2.3:o:microsoft:windows_vista:-:*:*:*:*:*:-:*;cpe:2.3:o:microsoft:windows_vista:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:-:*;cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:-:*:x64:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:-:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows 2000
CVE-2009-3028,0.0,,0.42598,NVD-CWE-Other,"The Altiris eXpress NS SC Download ActiveX control in AeXNSPkgDLLib.dll, as used in Symantec Altiris Deployment Solution 6.9.x, Notification Server 6.0.x, and Symantec Management Platform 7.0.x exposes an unsafe method, which allows remote attackers to force the download of arbitrary files and possibly execute arbitrary code via the DownloadAndInstall method.",2011-03-07,Metasploit,cpe:2.3:a:symantec:altiris_deployment_solution:6.9:*:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_deployment_solution:6.9:sp1:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_deployment_solution:6.9:sp2:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_deployment_solution:6.9:sp3:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_deployment_solution:6.9:sp4:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:sp1:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:sp1_hf12:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:sp2:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r10:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r11:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r12:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r13:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r1:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r2:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r3:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r4:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r5:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r6:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r7:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r8:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r9:*:*:*:*:*:*;cpe:2.3:a:symantec:management_platform:7.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec:management_platform:7.0:rc5:*:*:*:*:*:*;cpe:2.3:a:symantec:management_platform:7.0:sp1:*:*:*:*:*:*;cpe:2.3:a:symantec:management_platform:7.0:sp2:*:*:*:*:*:*;cpe:2.3:a:symantec:management_platform:7.0:sp3:*:*:*:*:*:*;cpe:2.3:a:symantec:management_platform:7.0:sp4:*:*:*:*:*:*;cpe:2.3:a:symantec:management_platform:7.0:sp5:*:*:*:*:*:*,Symantec,Altiris Deployment Solution
CVE-2009-3031,0.0,,0.45435,CWE-119,"Stack-based buffer overflow in the BrowseAndSaveFile method in the Altiris eXpress NS ConsoleUtilities ActiveX control 6.0.0.1846 in AeXNSConsoleUtilities.dll in Symantec Altiris Notification Server (NS) 6.0 before R12, Deployment Server 6.8 and 6.9 in Symantec Altiris Deployment Solution 6.9 SP3, and Symantec Management Platform (SMP) 7.0 before SP3 allows remote attackers to execute arbitrary code via a long string in the second argument.",2009-11-03,Metasploit,cpe:2.3:a:symantec:altiris_deployment_solution:6.9:*:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_deployment_solution:6.9:sp1:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_deployment_solution:6.9:sp2:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_deployment_solution:6.9:sp3:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_management_platform:7.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_management_platform:7.0:sp1:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:*:sp1:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:sp2:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r7:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:7.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:7.0:sp3:*:*:*:*:*:*,Symantec,Altiris Deployment Solution
CVE-2009-3033,0.0,,0.39967,CWE-119,"Buffer overflow in the RunCmd method in the Altiris eXpress NS Console Utilities ActiveX control in AeXNSConsoleUtilities.dll in the web console in Symantec Altiris Deployment Solution 6.9.x, Altiris Notification Server 6.0.x, and Management Platform 7.0.x allows remote attackers to execute arbitrary code via a long string in the second argument.",2009-11-25,Metasploit,cpe:2.3:a:symantec:altiris_deployment_solution:6.9.164:*:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_deployment_solution:6.9.176:*:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_deployment_solution:6.9.355:*:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_deployment_solution:6.9.355:sp1:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_deployment_solution:6.9:*:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_deployment_solution:6.9:sp1:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_deployment_solution:6.9:sp2:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_deployment_solution:6.9:sp3:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_management_platform:7.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_management_platform:7.0:sp1:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:sp1:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:sp2:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r7:*:*:*:*:*:*;cpe:2.3:a:symantec:altiris_notification_server:6.0_sp3:*:*:*:*:*:*:*,Symantec,Altiris Deployment Solution
CVE-2009-3053,0.0,,0.05925,CWE-22,"Directory traversal vulnerability in the Agora (com_agora) component 3.0.0b for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the action parameter to the avatars page, reachable through index.php.",2009-09-03,Nuclei,cpe:2.3:a:joomla:joomla:*:*:*:*:*:*:*:*;cpe:2.3:a:jvitals:com_agora:3.0.0b:*:*:*:*:*:*:*,Joomla,Joomla
CVE-2009-3068,0.0,,0.78177,CWE-264,"Unrestricted file upload vulnerability in the RoboHelpServer Servlet (robohelp/server) in Adobe RoboHelp Server 8 allows remote attackers to execute arbitrary code by uploading a Java Archive (.jsp) file during a PUBLISH action, then accessing it via a direct request to the file in the robohelp/robo/reserved/web directory under its sessionid subdirectory, as demonstrated by the vd_adobe module in VulnDisco Pack Professional 8.7 through 8.11.",2009-09-04,Metasploit,cpe:2.3:a:adobe:robohelp_server:8:*:*:*:*:*:*:*,Adobe,Robohelp Server
CVE-2009-3103,0.0,,0.90121,CWE-399,"Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location, aka ""SMBv2 Negotiation Vulnerability."" NOTE: some of these details are obtained from third party information.",2009-09-08,Metasploit,cpe:2.3:o:microsoft:windows_server_2008:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:sp2:x32:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:sp2:x64:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*,Microsoft,Windows Server 2008
CVE-2009-3129,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.85731,CWE-787,"Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset, aka ""Excel Featheader Record Memory Corruption Vulnerability.""",2009-11-11,CISA/Metasploit,cpe:2.3:a:microsoft:excel:2002:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:excel:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:excel:2007:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:excel:2007:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:excel_viewer:-:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:excel_viewer:-:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:excel_viewer:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2004:*:*:*:*:macos:*:*;cpe:2.3:a:microsoft:office:2008:*:*:*:*:macos:*:*;cpe:2.3:a:microsoft:open_xml_file_format_converter:*:*:*:*:*:macos:*:*,Microsoft,Excel
CVE-2009-3214,0.0,,0.30787,CWE-119,"Multiple stack-based buffer overflows in Photodex ProShow Gold 4.0.2549 allow remote attackers to execute arbitrary code via a crafted Slideshow project (.psh) file, related to the (1) cell[n].images[m].image and (2) cell[n].sound.file fields.",2009-09-16,Metasploit,cpe:2.3:a:photodex:proshow_gold:4.0.2549:*:*:*:*:*:*:*,Photodex,Proshow Gold
CVE-2009-3318,0.0,,0.06455,CWE-22,Directory traversal vulnerability in the Roland Breedveld Album (com_album) component 1.14 for Joomla! allows remote attackers to access arbitrary directories and have unspecified other impact via a .. (dot dot) in the target parameter to index.php.,2009-09-23,Nuclei,cpe:2.3:a:breedveld:com_album:1.14:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla:*:*:*:*:*:*:*:*,Joomla,Joomla
CVE-2009-3429,0.0,,0.35046,CWE-119,Stack-based buffer overflow in Pirate Radio Destiny Media Player 1.61 allows remote attackers to execute arbitrary code via a long string in a .pls playlist file.,2009-09-25,Metasploit,cpe:2.3:a:pirateradio:destiny_media_player:1.61:*:*:*:*:*:*:*,Pirateradio,Destiny Media Player
CVE-2009-3459,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.86583,CWE-119,"Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.",2009-10-13,CISA/Metasploit,cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*,Adobe,Acrobat
CVE-2009-3548,0.0,,0.78995,CWE-255,"The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.",2009-11-12,Metasploit,cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:3.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:3.2.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:3.2.2:beta2:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:3.2.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:3.2.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:3.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:3.3.1a:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:3.3.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:3.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.0.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.0.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.15:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.16:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.17:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.18:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.19:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.20:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.21:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.22:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.23:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.24:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.25:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.26:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.27:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.28:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.29:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.30:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.31:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.32:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.33:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.34:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.35:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.36:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.37:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.38:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.39:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.3:beta:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:4.1.9:beta:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.15:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.16:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.17:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.18:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.19:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.21:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.22:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.23:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.24:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.25:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.26:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.27:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.28:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.29:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.30:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.0.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.26:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.27:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.28:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:*,Apache,Tomcat
CVE-2009-3563,0.0,,0.31303,NVD-CWE-Other,"ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons.",2009-12-09,Metasploit,cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.0.72:*:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.0.73:*:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.0.90:*:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.0.91:*:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.0.92:*:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.0.93:*:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.0.94:*:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.0.95:*:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.0.96:*:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.0.97:*:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.0.98:*:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.0.99:*:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.2:*:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.2p1:*:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.2p2:*:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.2p3:*:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:*:*:*:*:*:*:*,Ntp,Ntp
CVE-2009-3591,0.0,,0.52844,CWE-20,Dopewars 1.5.12 allows remote attackers to cause a denial of service (segmentation fault) via a REQUESTJET message with an invalid location.,2009-10-08,Metasploit,cpe:2.3:a:ben_webb:dopewars:1.5.12:*:*:*:*:*:*:*,Ben Webb,Dopewars
CVE-2009-3672,0.0,,0.71802,CWE-94,"Microsoft Internet Explorer 6 and 7 does not properly handle objects in memory that (1) were not properly initialized or (2) are deleted, which allows remote attackers to execute arbitrary code via vectors involving a call to the getElementsByTagName method for the STYLE tag name, selection of the single element in the returned list, and a change to the outerHTML property of this element, related to Cascading Style Sheets (CSS) and mshtml.dll, aka ""HTML Object Memory Corruption Vulnerability."" NOTE: some of these details are obtained from third party information. NOTE: this issue was originally assigned CVE-2009-4054, but Microsoft assigned a duplicate identifier of CVE-2009-3672. CVE consumers should use this identifier instead of CVE-2009-4054.",2009-12-02,Metasploit,cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*,Microsoft,Windows 2000
CVE-2009-3693,0.0,,0.4158,CWE-22,Directory traversal vulnerability in the Persits.XUpload.2 ActiveX control (XUpload.ocx) in HP LoadRunner 9.5 allows remote attackers to create arbitrary files via \.. (backwards slash dot dot) sequences in the third argument to the MakeHttpRequest method.,2009-10-13,Metasploit,cpe:2.3:a:hp:loadrunner:9.5:*:*:*:*:*:*:*;cpe:2.3:a:persits:xupload:2.0:*:*:*:*:*:*:*,Persits,Xupload
CVE-2009-3699,0.0,,0.62089,CWE-119,"Stack-based buffer overflow in libcsa.a (aka the calendar daemon library) in IBM AIX 5.x through 5.3.10 and 6.x through 6.1.3, and VIOS 2.1 and earlier, allows remote attackers to execute arbitrary code via a long XDR string in the first argument to procedure 21 of rpc.cmsd.",2009-10-15,Metasploit,cpe:2.3:a:ibm:vios:*:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:1.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:1.5.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:1.5.2:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.1.0.10:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.1:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.1l:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.2.0.50:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.2.0.54:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.2.0:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.2.2:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.2:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.2_l:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.3.0.20:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.3.0:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.3.10:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.3.7:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.3.8:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.3.9:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.3:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.3:sp6:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.3_l:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.3_ml03:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5l:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:6.1.0:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:6.1.1:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:6.1.2:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:6.1.3:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:6.1:*:*:*:*:*:*:*,Ibm,Aix
CVE-2009-3711,0.0,,0.63909,CWE-119,"Stack-based buffer overflow in the h_handlepeer function in http.cpp in httpdx 1.4, and possibly 1.4.3, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.",2009-10-16,Metasploit,cpe:2.3:a:jasper:httpdx:1.4.3:*:*:*:*:*:*:*;cpe:2.3:a:jasper:httpdx:1.4:*:*:*:*:*:*:*,Jasper,Httpdx
CVE-2009-3733,0.0,,0.83378,CWE-22,"Directory traversal vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138 on Linux, VMware ESXi 3.5, and VMware ESX 3.0.3 and 3.5 allows remote attackers to read arbitrary files via unspecified vectors.",2009-11-02,Metasploit,cpe:2.3:a:vmware:esx:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:vmware:esx:3.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:esxi:3.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:server:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:server:1.0.1_build_29996:*:*:*:*:*:*:*;cpe:2.3:a:vmware:server:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:server:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:vmware:server:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:vmware:server:1.0.4_build_56528:*:*:*:*:*:*:*;cpe:2.3:a:vmware:server:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:server:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:vmware:server:1.0.7:*:*:*:*:*:*:*;cpe:2.3:a:vmware:server:1.0.8:*:*:*:*:*:*:*;cpe:2.3:a:vmware:server:1.0.9:*:*:*:*:*:*:*;cpe:2.3:a:vmware:server:1.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:server:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:server:2.0.1:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2009-3837,0.0,,0.32071,CWE-119,Stack-based buffer overflow in Eureka Email 2.2q allows remote POP3 servers to execute arbitrary code via a long error message.,2009-11-02,Metasploit,cpe:2.3:a:eureka-email:eureka_email:2.2q:*:*:*:*:*:*:*,Eureka-Email,Eureka Email
CVE-2009-3843,0.0,,0.78968,CWE-264,"HP Operations Manager 8.10 on Windows contains a ""hidden account"" in the XML file that specifies Tomcat users, which allows remote attackers to conduct unrestricted file upload attacks, and thereby execute arbitrary code, by using the org.apache.catalina.manager.HTMLManagerServlet class to make requests to manager/html/upload.",2009-11-24,Metasploit,cpe:2.3:a:hp:operations_manager:8.10:*:windows:*:*:*:*:*,Hp,Operations Manager
CVE-2009-3844,0.0,,0.74063,CWE-119,Stack-based buffer overflow in the OmniInet process in HP OpenView Data Protector Application Recovery Manager 5.50 and 6.0 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted MSG_PROTOCOL packet.,2009-12-08,Metasploit,cpe:2.3:a:hp:openview_data_protector_application_recovery_manager:5.50:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_data_protector_application_recovery_manager:6.0:*:*:*:*:*:*:*,Hp,Openview Data Protector Application Recovery Manager
CVE-2009-3849,0.0,,0.73694,CWE-119,"Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via (1) a long Template parameter to nnmRptConfig.exe, related to the strcat function; or (2) a long Oid parameter to snmp.exe.",2009-12-10,Metasploit,cpe:2.3:a:hp:openview_network_node_manager:7.0.1:*:hp_ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.0.1:*:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.0.1:*:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.0.1:*:windows:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:hp-ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:windows:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:hp-ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:windows:*:*:*:*:*,Hp,Openview Network Node Manager
CVE-2009-3853,0.0,,0.36717,CWE-119,"Stack-based buffer overflow in the client acceptor daemon (CAD) scheduler in the client in IBM Tivoli Storage Manager (TSM) 5.3 before 5.3.6.7, 5.4 before 5.4.3, 5.5 before 5.5.2.2, and 6.1 before 6.1.0.2, and TSM Express 5.3.3.0 through 5.3.6.6, allows remote attackers to execute arbitrary code via crafted data in a TCP packet.",2009-11-04,Metasploit,cpe:2.3:a:ibm:tivoli_storage_manager:5.2.5.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.3.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.3.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.3.2.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.3.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.3.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.3.3:*:express:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.3.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.3.4:*:express:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.3.5:*:express:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.3.6.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.3.6.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.3.6.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.3.6.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.3.6.5:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.3.6.6:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.3.6.6:*:express:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.3.6:*:express:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.4.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.4.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.4.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.5.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.5.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:5.5.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager:6.1.0:*:*:*:*:*:*:*,Ibm,Tivoli Storage Manager
CVE-2009-3861,0.0,,0.03727,CWE-119,"Stack-based buffer overflow in SafeNet SoftRemote 10.8.5 (Build 2) and 10.3.5 (Build 6), and possibly other versions before 10.8.9, allows local users to execute arbitrary code via a long string in a (1) TREENAME or (2) GROUPNAME Policy file (spd).",2009-11-04,Metasploit,cpe:2.3:a:safenet-inc:softremote:*:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:1.7.1:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:1.7.2:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:1.7.7:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:1.8.1:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:10.3.5:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:10.7.7:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:10.8.0:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:10.8.1:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:10.8.2:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:10.8.3:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:10.8.4:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:10.8.5:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:10.8.6:*:*:*:*:*:*:*;cpe:2.3:a:safenet-inc:softremote:10.8.7:*:*:*:*:*:*:*,Safenet-Inc,Softremote
CVE-2009-3867,0.0,,0.73376,CWE-119,"Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a long file: URL in an argument, aka Bug Id 6854303.",2009-11-05,Metasploit,cpe:2.3:a:sun:java_se:*:*:business:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_19:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_1:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_20:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_21:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_2:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_8:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_9:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_1:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_8:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_9:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_01:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_01a:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_02:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_03:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_04:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_05:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_06:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_07:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_08:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_09:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_10:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_11:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_12:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_13:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_14:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_15:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_16:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_17:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_18:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_19:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_1:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_20:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_21:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_22:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_23:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_24:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_25:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_2:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_3:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_4:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_5:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_6:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_7:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_8:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_9:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_01:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_02:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_03:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_04:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_05:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_06:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_07:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_08:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_09:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_10:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_11:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_12:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_13:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_14:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_15:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_16:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_17:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_18:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_19:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_1:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_20:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_21:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_22:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_2:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_3:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_4:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_5:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_6:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_7:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_8:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_9:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_19:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_20:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_21:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_8:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_9:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_8:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_9:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_01:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_01a:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_02:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_03:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_04:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_05:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_06:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_07:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_08:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_09:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_10:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_11:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_12:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_13:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_14:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_15:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_16:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_17:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_18:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_19:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_20:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_21:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_22:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_23:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_24:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_25:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_2:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_3:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_4:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_5:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_6:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_7:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_8:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_9:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_01:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_02:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_03:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_04:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_05:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_06:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_07:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_08:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_09:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_10:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_11:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_12:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_13:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_14:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_15:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_16:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_17:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_18:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_19:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_1:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_20:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_21:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_22:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_2:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_3:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_4:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_5:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_6:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_7:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_8:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*;cpe:2.3:o:sun:solaris:*:*:*:*:*:*:*:*,Sun,Solaris
CVE-2009-3869,0.0,,0.65461,CWE-119,"Stack-based buffer overflow in the setDiffICM function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a crafted argument, aka Bug Id 6872357.",2009-11-05,Metasploit,cpe:2.3:a:sun:java_se:*:*:business:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_19:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_1:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_20:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_21:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_2:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_8:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update_9:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_1:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_8:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_9:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_01:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_01a:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_02:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_03:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_04:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_05:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_06:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_07:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_08:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_09:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_10:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_11:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_12:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_13:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_14:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_15:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_16:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_17:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_18:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_19:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_1:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_20:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_21:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_22:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_23:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_24:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_25:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_2:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_3:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_4:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_5:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_6:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_7:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_8:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_9:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_01:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_02:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_03:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_04:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_05:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_06:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_07:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_08:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_09:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_10:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_11:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_12:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_13:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_14:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_15:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_16:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_17:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_18:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_19:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_1:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_20:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_21:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_22:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_2:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_3:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_4:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_5:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_6:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_7:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_8:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_9:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_19:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_20:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_21:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_8:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update_9:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_8:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_9:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_01:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_01a:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_02:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_03:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_04:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_05:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_06:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_07:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_08:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_09:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_10:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_11:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_12:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_13:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_14:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_15:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_16:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_17:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_18:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_19:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_20:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_21:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_22:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_23:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_24:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_25:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_2:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_3:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_4:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_5:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_6:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_7:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_8:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_9:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_01:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_02:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_03:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_04:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_05:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_06:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_07:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_08:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_09:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_10:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_11:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_12:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_13:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_14:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_15:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_16:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_17:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_18:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_19:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_1:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_20:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_21:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_22:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_2:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_3:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_4:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_5:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_6:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_7:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_8:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*;cpe:2.3:o:sun:solaris:*:*:*:*:*:*:*:*,Sun,Solaris
CVE-2009-3953,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.83855,CWE-787,"The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration ""array boundary issue,"" a different vulnerability than CVE-2009-2994.",2010-01-13,CISA/Metasploit,cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*;cpe:2.3:a:suse:linux_enterprise_debuginfo:11:-:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise:10.0:sp2:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise:10.0:sp3:*:*:*:*:*:*,Apple,Mac Os X
CVE-2009-3960,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.90012,NVD-CWE-noinfo,"Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.",2010-02-15,CISA/Metasploit,cpe:2.3:a:adobe:blazeds:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:8.0.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:8.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:9.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flex_data_services:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:livecycle:8.0.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:livecycle:8.2.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:livecycle:9.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:livecycle_data_services:2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:livecycle_data_services:2.6.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:livecycle_data_services:3.0:*:*:*:*:*:*:*,Adobe,Blazeds
CVE-2009-3976,0.0,,0.28277,CWE-119,Buffer overflow in Labtam ProFTP 2.9 allows remote FTP servers to cause a denial of service (application crash) or execute arbitrary code via a long 220 reply (aka connection greeting or welcome message).,2009-11-18,Metasploit,cpe:2.3:a:labtam-inc:proftp:2.9:*:*:*:*:*:*:*,Labtam-Inc,Proftp
CVE-2009-3999,0.0,,0.71807,CWE-119,Stack-based buffer overflow in goform/formExportDataLogs in HP Power Manager before 4.2.10 allows remote attackers to execute arbitrary code via a long fileName parameter.,2010-01-20,Metasploit,cpe:2.3:a:hp:power_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:power_manager:4.2.5:*:*:*:*:*:*:*;cpe:2.3:a:hp:power_manager:4.2.6:*:*:*:*:*:*:*,Hp,Power Manager
CVE-2009-4006,0.0,,0.82932,CWE-119,"Stack-based buffer overflow in the TEA decoding algorithm in RhinoSoft Serv-U FTP server 7.0.0.1, 9.0.0.5, and other versions before 9.1.0.0 allows remote attackers to execute arbitrary code via a long hexadecimal string.",2009-11-20,Metasploit,cpe:2.3:a:solarwinds:serv-u_file_server:7.0.0.1:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:7.0.0.2:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:7.0.0.3:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:7.0.0.4:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:7.1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:7.1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:7.1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:7.2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:7.2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:7.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:7.3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:7.3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:7.4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:7.4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:8.0.0.1:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:8.0.0.2:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:8.0.0.4:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:8.0.0.5:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:8.0.0.7:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:8.1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:8.1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:8.2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:8.2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:8.2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:9.0.0.1:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:9.0.0.3:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:9.0.0.5:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u_file_server:9.1.0.0:*:*:*:*:*:*:*,Solarwinds,Serv-U File Server
CVE-2009-4098,0.0,,0.18676,CWE-20,"Unrestricted file upload vulnerability in banner-edit.php in OpenX adserver 2.8.1 and earlier allows remote authenticated users with banner / file upload permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an images directory.",2009-11-29,Metasploit,cpe:2.3:a:openx:openx:*:*:*:*:*:*:*:*;cpe:2.3:a:openx:openx:2.4:*:*:*:*:*:*:*;cpe:2.3:a:openx:openx:2.6.1:*:*:*:*:*:*:*;cpe:2.3:a:openx:openx:2.6.3:*:*:*:*:*:*:*;cpe:2.3:a:openx:openx:2.8:*:*:*:*:*:*:*,Openx,Openx
CVE-2009-4140,0.0,,0.75838,NVD-CWE-Other,"Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3.2, and possibly other products, when register_globals is enabled, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension through the name parameter with the code in the HTTP_RAW_POST_DATA parameter, then accessing it via a direct request to the file in tmp-upload-images/.",2009-12-22,Metasploit,cpe:2.3:a:matomo:matomo:0.2.37:*:*:*:*:*:*:*;cpe:2.3:a:matomo:matomo:0.4.2:*:*:*:*:*:*:*;cpe:2.3:a:matomo:matomo:0.4.3:*:*:*:*:*:*:*;cpe:2.3:a:teethgrinder.co.uk:open_flash_chart:2.0:beta_1:*:*:*:*:*:*;cpe:2.3:a:teethgrinder.co.uk:open_flash_chart:2.0:gamera:*:*:*:*:*:*;cpe:2.3:a:teethgrinder.co.uk:open_flash_chart:2.0:hyperion:*:*:*:*:*:*;cpe:2.3:a:teethgrinder.co.uk:open_flash_chart:2.0:ichor:*:*:*:*:*:*;cpe:2.3:a:teethgrinder.co.uk:open_flash_chart:2.0:j_rmungandr-2:*:*:*:*:*:*;cpe:2.3:a:teethgrinder.co.uk:open_flash_chart:2.0:j_rmungandr:*:*:*:*:*:*;cpe:2.3:a:teethgrinder.co.uk:open_flash_chart:2.0:kvasir:*:*:*:*:*:*;cpe:2.3:a:teethgrinder.co.uk:open_flash_chart:2.0:lug_wyrm_charmer:*:*:*:*:*:*,Teethgrinder.Co.Uk,Open Flash Chart
CVE-2009-4146,0.0,,0.03903,CWE-264,"The _rtld function in the Run-Time Link-Editor (rtld) in libexec/rtld-elf/rtld.c in FreeBSD 7.1, 7.2, and 8.0 does not clear the LD_PRELOAD environment variable, which allows local users to gain privileges by executing a setuid or setguid program with a modified LD_PRELOAD variable containing an untrusted search path that points to a Trojan horse library, a different vector than CVE-2009-4147.",2009-12-02,Metasploit,cpe:2.3:o:freebsd:freebsd:7.1:*:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:7.2:*:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:8.0:*:*:*:*:*:*:*,Freebsd,Freebsd
CVE-2009-4147,0.0,,0.03709,CWE-264,"The _rtld function in the Run-Time Link-Editor (rtld) in libexec/rtld-elf/rtld.c in FreeBSD 7.1 and 8.0 does not clear the (1) LD_LIBMAP, (2) LD_LIBRARY_PATH, (3) LD_LIBMAP_DISABLE, (4) LD_DEBUG, and (5) LD_ELF_HINTS_PATH environment variables, which allows local users to gain privileges by executing a setuid or setguid program with a modified variable containing an untrusted search path that points to a Trojan horse library, different vectors than CVE-2009-4146.",2009-12-02,Metasploit,cpe:2.3:o:freebsd:freebsd:7.1:*:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:8.0:*:*:*:*:*:*:*,Freebsd,Freebsd
CVE-2009-4178,0.0,,0.74024,CWE-119,"Heap-based buffer overflow in OvWebHelp.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long Topic parameter.",2009-12-10,Metasploit,cpe:2.3:a:hp:openview_network_node_manager:7.0.1:*:hp_ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.0.1:*:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.0.1:*:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.0.1:*:windows:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:hp-ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:windows:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:hp-ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:windows:*:*:*:*:*,Hp,Openview Network Node Manager
CVE-2009-4179,0.0,,0.66973,CWE-119,"Stack-based buffer overflow in ovalarm.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long HTTP Accept-Language header in an OVABverbose action.",2009-12-10,Metasploit,cpe:2.3:a:hp:openview_network_node_manager:7.0.1:*:hp_ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.0.1:*:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.0.1:*:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.0.1:*:windows:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:hp-ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:windows:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:hp-ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:windows:*:*:*:*:*,Hp,Openview Network Node Manager
CVE-2009-4188,0.0,,0.69492,CWE-255,"HP Operations Dashboard has a default password of j2deployer for the j2deployer account, which allows remote attackers to execute arbitrary code via a session that uses the manager role to conduct unrestricted file upload attacks against the /manager servlet in the Tomcat servlet container.  NOTE: this might overlap CVE-2009-3098.",2009-12-03,Metasploit,cpe:2.3:a:hp:operations_dashboard:*:*:*:*:*:*:*:*,Hp,Operations Dashboard
CVE-2009-4189,0.0,,0.78531,CWE-255,"HP Operations Manager has a default password of OvW*busr1 for the ovwebusr account, which allows remote attackers to execute arbitrary code via a session that uses the manager role to conduct unrestricted file upload attacks against the /manager servlet in the Tomcat servlet container.  NOTE: this might overlap CVE-2009-3099 and CVE-2009-3843.",2009-12-03,Metasploit,cpe:2.3:a:hp:operations_manager:*:*:*:*:*:*:*:*,Hp,Operations Manager
CVE-2009-4195,0.0,,0.70684,CWE-119,"Buffer overflow in Adobe Illustrator CS4 14.0.0, CS3 13.0.3 and earlier, and CS3 13.0.0 allows remote attackers to execute arbitrary code via a long DSC comment in an Encapsulated PostScript (.eps) file. NOTE: some of these details are obtained from third party information.",2009-12-04,Metasploit,cpe:2.3:a:adobe:illustrator:13.0.0:cs4:*:*:*:*:*:*;cpe:2.3:a:adobe:illustrator:14.0.0:cs4:*:*:*:*:*:*,Adobe,Illustrator
CVE-2009-4202,0.0,,0.08109,CWE-22,Directory traversal vulnerability in the Omilen Photo Gallery (com_omphotogallery) component Beta 0.5 for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the controller parameter to index.php.,2009-12-04,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:omilenitsolutions:com_omphotogallery:0.5:beta:*:*:*:*:*:*,Joomla,Joomla!
CVE-2009-4223,0.0,,0.55507,CWE-94,PHP remote file inclusion vulnerability in adm/krgourl.php in KR-Web 1.1b2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter.,2009-12-07,Nuclei,cpe:2.3:a:gianni_tommasi:kr-php_web_content_server:*:beta_2:*:*:*:*:*:*;cpe:2.3:a:gianni_tommasi:kr-php_web_content_server:1.1:*:*:*:*:*:*:*;cpe:2.3:a:gianni_tommasi:kr-php_web_content_server:1.1:beta:*:*:*:*:*:*,Gianni Tommasi,Kr-Php Web Content Server
CVE-2009-4225,0.0,,0.30619,CWE-119,Stack-based buffer overflow in the PestPatrol ActiveX control (ppctl.dll) 5.6.7.9 in CA eTrust PestPatrol allows remote attackers to execute arbitrary code via a long argument to the Initialize method.,2009-12-08,Metasploit,cpe:2.3:a:ca:etrust_pestpatrole_ppctl.dll_activex:5.6.7.9:*:*:*:*:*:*:*,Ca,Etrust Pestpatrole Ppctl.Dll Activex
CVE-2009-4265,0.0,,0.3139,CWE-119,"Stack-based buffer overflow in Ideal Administration 2009 9.7.1, and possibly other versions, allows remote attackers to execute arbitrary code via a long Computer value in an .ipj project file.",2009-12-10,Metasploit,cpe:2.3:a:pointdev:ideal_administration_2009:9.7.1:*:*:*:*:*:*:*,Pointdev,Ideal Administration 2009
CVE-2009-4324,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.81806,CWE-416,"Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.",2009-12-15,CISA/Metasploit,cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*;cpe:2.3:a:suse:linux_enterprise_debuginfo:11:-:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise:10.0:sp2:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise:10.0:sp3:*:*:*:*:*:*,Apple,Mac Os X
CVE-2009-4484,0.0,,0.69552,CWE-787,"Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp in TaoCrypt in yaSSL before 1.9.9, as used in mysqld in MySQL 5.0.x before 5.0.90, MySQL 5.1.x before 5.1.43, MySQL 5.5.x through 5.5.0-m2, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and daemon crash) by establishing an SSL connection and sending an X.509 client certificate with a crafted name field, as demonstrated by mysql_overflow1.py and the vd_mysql5 module in VulnDisco Pack Professional 8.11. NOTE: this was originally reported for MySQL 5.0.51a.",2009-12-30,Metasploit,cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.0:milestone1:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.0.0:milestone2:*:*:*:*:*:*;cpe:2.3:a:wolfssl:yassl:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2009-4498,0.0,,0.31915,CWE-78,The node_process_command function in Zabbix Server before 1.8 allows remote attackers to execute arbitrary commands via a crafted request.,2009-12-31,Metasploit,cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:1.1.3:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:1.1.4:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:1.1.5:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:1.4.2:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:1.4.3:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:1.6.6:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:1.6.7:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:1.6.8:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:1.7.1:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:1.7.2:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:1.7.3:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:1.7:*:*:*:*:*:*:*,Zabbix,Zabbix
CVE-2009-4502,0.0,,0.20556,CWE-264,"The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, when running on FreeBSD or Solaris, allows remote attackers to bypass the EnableRemoteCommands setting and execute arbitrary commands via shell metacharacters in the argument to net.tcp.listen.  NOTE: this attack is limited to attacks from trusted IP addresses.",2009-12-31,Metasploit,cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:1.1.3:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:1.1.4:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:1.1.5:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:1.4.2:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:1.4.3:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:1.4.4:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:1.4.6:*:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*;cpe:2.3:o:sun:solaris:*:*:*:*:*:*:*:*,Freebsd,Freebsd
CVE-2009-4588,0.0,,0.32035,CWE-119,"Heap-based buffer overflow in the WindsPlayerIE.View.1 ActiveX control in WindsPly.ocx 3.5.0.0 Beta, 3.0.0.5, and earlier in AwingSoft Awakening Web3D Player and Winds3D Viewer allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long SceneUrl property value, a different vulnerability than CVE-2009-2386.  NOTE: some of these details are obtained from third party information.",2010-01-07,Metasploit,cpe:2.3:a:awingsoft:awakening_winds3d_player:3.0.0.5:*:*:*:*:*:*:*;cpe:2.3:a:awingsoft:awakening_winds3d_player:3.5.0.0:beta:*:*:*:*:*:*;cpe:2.3:a:awingsoft:awakening_winds3d_viewer:3.0.0.5:*:*:*:*:*:*:*;cpe:2.3:a:awingsoft:awakening_winds3d_viewer:3.5.0.0:beta:*:*:*:*:*:*,Awingsoft,Awakening Winds3D Player
CVE-2009-4655,0.0,,0.49864,CWE-310,"The dhost web service in Novell eDirectory 8.8.5 uses a predictable session cookie, which makes it easier for remote attackers to hijack sessions via a modified cookie.",2010-02-26,Metasploit,cpe:2.3:a:novell:edirectory:8.8.5:*:*:*:*:*:*:*,Novell,Edirectory
CVE-2009-4656,0.0,,0.31721,CWE-119,"Stack-based buffer overflow in E-Soft DJ Studio Pro 4.2 including 4.2.2.7.5, and 5.x including 5.1.4.3.1, allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a playlist file (.pls) containing a long string.  NOTE: some of these details are obtained from third party information.",2010-03-03,Metasploit,cpe:2.3:a:e-soft.co:dj_studio_pro:4.2.2.7.5:*:*:*:*:*:*:*;cpe:2.3:a:e-soft.co:dj_studio_pro:4.2:*:*:*:*:*:*:*;cpe:2.3:a:e-soft.co:dj_studio_pro:5.1.4.3.1:*:*:*:*:*:*:*;cpe:2.3:a:e-soft.co:dj_studio_pro:5.1:*:*:*:*:*:*:*,E-Soft.Co,Dj Studio Pro
CVE-2009-4660,0.0,,0.6212,CWE-119,Stack-based buffer overflow in the AntServer Module (AntServer.exe) in BigAnt IM Server 2.50 allows remote attackers to execute arbitrary code via a long GET request to TCP port 6660.,2010-03-03,Metasploit,cpe:2.3:a:bigantsoft:bigant_messenger:2.50:*:*:*:*:*:*:*,Bigantsoft,Bigant Messenger
CVE-2009-4679,0.0,,0.07866,CWE-22,Directory traversal vulnerability in the inertialFATE iF Portfolio Nexus (com_if_nexus) component 1.5 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.,2010-03-08,Nuclei,cpe:2.3:a:inertialfate:com_if_nexus:1.5:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Inertialfate,Com If Nexus
CVE-2009-4769,0.0,,0.37895,CWE-134,"Multiple format string vulnerabilities in the tolog function in httpdx 1.4, 1.4.5, 1.4.6, 1.4.6b, and 1.5 allow (1) remote attackers to execute arbitrary code via format string specifiers in a GET request to the HTTP server component when logging is enabled, and allow (2) remote authenticated users to execute arbitrary code via format string specifiers in a PWD command to the FTP server component.",2010-04-20,Metasploit,cpe:2.3:a:jasper:httpdx:1.4.5:*:*:*:*:*:*:*;cpe:2.3:a:jasper:httpdx:1.4.6:*:*:*:*:*:*:*;cpe:2.3:a:jasper:httpdx:1.4.6b:*:*:*:*:*:*:*;cpe:2.3:a:jasper:httpdx:1.4:*:*:*:*:*:*:*;cpe:2.3:a:jasper:httpdx:1.5:*:*:*:*:*:*:*,Jasper,Httpdx
CVE-2009-4850,0.0,,0.24665,CWE-119,The Awingsoft Awakening Winds3D Viewer plugin 3.5.0.9 allows remote attackers to execute arbitrary programs via a SceneURL property value with a URL for a .exe file.,2010-05-07,Metasploit,cpe:2.3:a:awingsoft:awakening_winds3d_viewer_plugin:3.5.0.9:*:*:*:*:*:*:*,Awingsoft,Awakening Winds3D Viewer Plugin
CVE-2009-4962,0.0,,0.31377,CWE-119,Stack-based buffer overflow in Fat Player 0.6b allows remote attackers to execute arbitrary code via a long string in a .wav file.  NOTE: some of these details are obtained from third party information.,2010-07-28,Metasploit,cpe:2.3:a:adammo:fat_player:0.6:b:*:*:*:*:*:*,Adammo,Fat Player
CVE-2009-4988,0.0,,0.65515,CWE-119,Stack-based buffer overflow in NT_Naming_Service.exe in SAP Business One 2005 A 6.80.123 and 6.80.320 allows remote attackers to execute arbitrary code via a long GIOP request to TCP port 30000.,2010-08-25,Metasploit,cpe:2.3:a:sap:business_one_2005-a:6.80.123:*:*:*:*:*:*:*;cpe:2.3:a:sap:business_one_2005-a:6.80.320:*:*:*:*:*:*:*,Sap,Business One 2005-A
CVE-2009-5020,0.0,,0.03488,CWE-20,Open redirect vulnerability in awredir.pl in AWStats before 6.95 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.,2010-12-02,Nuclei,cpe:2.3:a:awstats:awstats:*:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:1.0:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:2.1.:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:2.2.3:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:2.2.4:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:3.0:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:3.1:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:3.2:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:4.0:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:4.1:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:5.0:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:5.1:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:5.2:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:5.3:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:5.4:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:5.5:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:5.6:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:5.7:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:5.8:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:5.9:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:6.0:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:6.1:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:6.2:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:6.3:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:6.4:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:6.5:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:6.6:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:6.7:*:*:*:*:*:*:*;cpe:2.3:a:awstats:awstats:6.8:*:*:*:*:*:*:*,Awstats,Awstats
CVE-2009-5109,0.0,,0.32817,CWE-119,Stack-based buffer overflow in Mini-Stream Ripper 3.0.1.1 allows remote attackers to execute arbitrary code via a long entry in a .pls file.,2011-12-25,Metasploit,cpe:2.3:a:mini-stream:ripper:3.0.1.1:*:*:*:*:*:*:*,Mini-Stream,Ripper
CVE-2009-5114,0.0,,0.13298,CWE-22,Directory traversal vulnerability in wgarcmin.cgi in WebGlimpse 2.18.7 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the DOC parameter.,2012-03-19,Nuclei,cpe:2.3:a:iwork:webglimpse:*:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:1.7.6:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:1.7.9:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.0.03:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.0.04:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.0.07:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.0.10:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.1.01:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.1.04:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.10.2:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.10.4:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.10.5:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.11.0:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.12.0:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.12.1:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.12.2:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.12.3:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.13.0:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.13.1:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.13.2:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.14.0:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.14.1:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.14.3:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.14.6:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.14.8:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.15.2:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.15.3:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.16.1:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.17.0:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.17.2:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.18.0:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.18.2:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.18.3:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.18.4:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.18.5:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.2.2:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.4.3:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.4.6:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.5.4:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.6.7:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.7.4:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.7.6:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.7.7:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.8.0:*:*:*:*:*:*:*;cpe:2.3:a:iwork:webglimpse:2.8.1:*:*:*:*:*:*:*,Iwork,Webglimpse
CVE-2010-0017,0.0,,0.30879,CWE-362,"Race condition in the SMB client implementation in Microsoft Windows Server 2008 R2 and Windows 7 allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code, and in the SMB client implementation in Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 allows local users to gain privileges, via a crafted SMB Negotiate response, aka ""SMB Client Race Condition Vulnerability.""",2010-02-10,Metasploit,cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:-:x64:*:*:*:*:*,Microsoft,Windows 7
CVE-2010-0033,0.0,,0.51073,CWE-119,"Stack-based buffer overflow in Microsoft Office PowerPoint 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint document, aka ""PowerPoint Viewer TextBytesAtom Record Stack Overflow Vulnerability.""",2010-02-10,Metasploit,cpe:2.3:a:microsoft:powerpoint:2003:sp3:*:*:*:*:*:*,Microsoft,Powerpoint
CVE-2010-0094,0.0,,0.81593,NVD-CWE-noinfo,"Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18 and 5.0 Update 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the March 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this is due to missing privilege checks during deserialization of RMIConnectionImpl objects, which allows remote attackers to call system-level Java functions via the ClassLoader of a constructor that is being deserialized.",2010-04-01,Metasploit,cpe:2.3:a:sun:jdk:*:update23:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:*:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update10:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update11:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update12:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update13:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update14:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update15:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update16:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update17:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update18:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update19:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update1:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update20:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update21:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update3:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update4:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update5:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update6:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update7:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update8:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update9:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update1:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update1_b06:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:jre:*:update23:*:*:*:*:*:*;cpe:2.3:a:sun:jre:*:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update10:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update17:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update18:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update19:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update20:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update21:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update7:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update8:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update9:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*,Sun,Jre
CVE-2010-0103,0.0,,0.27429,CWE-94,"UsbCharger.dll in the Energizer DUO USB battery charger software contains a backdoor that is implemented through the Arucer.dll file in the %WINDIR%\system32 directory, which allows remote attackers to download arbitrary programs onto a Windows PC, and execute these programs, via a request to TCP port 7777.",2010-03-10,Metasploit,cpe:2.3:a:energizer:duo_usb:*:*:*:*:*:*:*:*,Energizer,Duo Usb
CVE-2010-0111,0.0,,0.34516,CWE-20,"HDNLRSVC.EXE in the Intel Alert Handler service (aka Symantec Intel Handler service) in Intel Alert Management System (aka AMS or AMS2), as used in Symantec AntiVirus Corporate Edition (SAVCE) 10.x before 10.1 MR10, Symantec System Center (SSC) 10.x, and Symantec Quarantine Server 3.5 and 3.6, allows remote attackers to execute arbitrary programs by sending msgsys.exe a UNC share pathname, which is used directly in a CreateProcessA (aka CreateProcess) call.",2011-01-31,Metasploit,cpe:2.3:a:symantec:antivirus:10.0.1.1:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.1.2:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.1:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.2.1:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.2.2:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.2:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.3:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.4:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.5:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.6:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.7:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.8:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0.9:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0:mr1:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.0:mr2:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.1.0.1:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.1.4.1:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.1.4:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.1.5.1:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.1.5:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.1.6.1:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.1.6:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.1.7:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.1.8:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.1.9:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.1:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.1:mp1:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.1:mr4:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.1:mr5:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.1:mr6:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.1:mr7:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.2:*:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.2:mr2:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus:10.2:mr3:corporate:*:*:*:*:*;cpe:2.3:a:symantec:antivirus_central_quarantine_server:3.5:*:*:*:*:*:*:*;cpe:2.3:a:symantec:antivirus_central_quarantine_server:3.6:*:*:*:*:*:*:*;cpe:2.3:a:symantec:system_center:10.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec:system_center:10.1:*:*:*:*:*:*:*,Symantec,Antivirus
CVE-2010-0157,0.0,,0.12969,CWE-22,Directory traversal vulnerability in the Bible Study (com_biblestudy) component 6.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter in a studieslist action to index.php.,2010-01-06,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:joomlabiblestudy:com_biblestudy:6.1:*:*:*:*:*:*:*,Joomla,Joomla!
CVE-2010-0188,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.88246,NVD-CWE-noinfo,Unspecified vulnerability in Adobe Reader and Acrobat 8.x before 8.2.1 and 9.x before 9.3.1 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors.,2010-02-22,CISA/Metasploit,cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*,Adobe,Acrobat
CVE-2010-0219,0.0,,0.89871,CWE-255,"Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service.",2010-10-18,Metasploit/Nuclei,cpe:2.3:a:apache:axis2:1.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:axis2:1.4.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:axis2:1.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:axis2:1.5.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:axis2:1.5.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:axis2:1.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:axis2:1.6:*:*:*:*:*:*:*;cpe:2.3:a:sap:businessobjects:3.2:*:enterprise_xi:*:*:*:*:*,Apache,Axis2
CVE-2010-0232,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.29253,NVD-CWE-noinfo,"The kernel in Microsoft Windows NT 3.1 through Windows 7, including Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, and Windows Server 2008 Gold and SP2, when access to 16-bit applications is enabled on a 32-bit x86 platform, does not properly validate certain BIOS calls, which allows local users to gain privileges by crafting a VDM_TIB data structure in the Thread Environment Block (TEB), and then calling the NtVdmControl function to start the Windows Virtual DOS Machine (aka NTVDM) subsystem, leading to improperly handled exceptions involving the #GP trap handler (nt!KiTrap0D), aka ""Windows Kernel Exception Handler Vulnerability.""",2010-01-21,CISA/Metasploit,cpe:2.3:o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:-:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows 2000
CVE-2010-0248,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.53085,CWE-94,"Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka ""HTML Object Memory Corruption Vulnerability.""",2010-01-22,Metasploit,cpe:2.3:a:microsoft:internet_explorer:6.0.2600:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6.0.2800.1106:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6.0.2800:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6.0.2900.2180:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6.0.2900:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6.00.2462.0000:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6.00.2479.0006:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6.00.2600.0000:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6.00.2800.1106:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6.00.2900.2180:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6.00.3663.0000:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6.00.3718.0000:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6.00.3790.0000:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6.00.3790.1830:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6.00.3790.3959:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7.0.5730.11:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7.0.5730:unknown:gold:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7.00.5730.1100:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7.00.6000.16386:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7.00.6000.16441:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:8.0.6001:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:r2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:r2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*,Microsoft,Windows 7
CVE-2010-0249,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.91885,CWE-416,"Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object, related to incorrectly initialized memory and improper handling of objects in memory, as exploited in the wild in December 2009 and January 2010 during Operation Aurora, aka ""HTML Object Memory Corruption Vulnerability.""",2010-01-15,CISA/Metasploit,cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp4:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_vista:-:*:*:*:-:*:x64:*;cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:-:*:x64:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:-:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows 2000
CVE-2010-0266,0.0,,0.55278,CWE-94,"Microsoft Office Outlook 2002 SP3, 2003 SP3, and 2007 SP1 and SP2 does not properly verify e-mail attachments with a PR_ATTACH_METHOD property value of ATTACH_BY_REFERENCE, which allows user-assisted remote attackers to execute arbitrary code via a crafted message, aka ""Microsoft Outlook SMB Attachment Vulnerability.""",2010-07-15,Metasploit,cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2007:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:outlook:2002:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:outlook:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:outlook:2007:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:outlook:2007:sp2:*:*:*:*:*:*,Microsoft,Outlook
CVE-2010-0304,0.0,,0.73666,CWE-119,"Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allow remote attackers to cause a denial of service (crash) via a malformed packet, as demonstrated using a stack-based buffer overflow to the dissect_getaddrsbyname_request function.",2010-02-03,Metasploit,cpe:2.3:a:wireshark:wireshark:0.9.15:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.10:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.7:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.8:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.9:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.2.1:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.2.2:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.2.3:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.2.4:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.2.5:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.2:*:*:*:*:*:*:*,Wireshark,Wireshark
CVE-2010-0356,0.0,,0.30383,CWE-119,Stack-based buffer overflow in the MOVIEPLAYER.MoviePlayerCtrl.1 ActiveX control in MoviePlayer.ocx 6.8.0.0 in Viscom Software Movie Player Pro SDK ActiveX 6.8 allows remote attackers to execute arbitrary code via a long strFontName parameter to the DrawText method.,2010-01-18,Metasploit,cpe:2.3:a:viscomsoft:movie_player_pro_sdk_activex:6.8:*:*:*:*:*:*:*,Viscomsoft,Movie Player Pro Sdk Activex
CVE-2010-0361,0.0,,0.80521,CWE-119,Stack-based buffer overflow in the WebDAV implementation in webservd in Sun Java System Web Server (aka SJWS) 7.0 Update 7 allows remote attackers to cause a denial of service (daemon crash) and possibly have unspecified other impact via a long URI in an HTTP OPTIONS request.,2010-01-20,Metasploit,cpe:2.3:a:sun:java_system_web_server:7.0:update_7:*:*:*:*:*:*,Sun,Java System Web Server
CVE-2010-0425,0.0,,0.94248,NVD-CWE-noinfo,"modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and ""orphaned callback pointers.""",2010-03-05,Metasploit,cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:vmware_ace_management_server:*:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.0.2.11:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.0.2.13:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.0.2.15:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.0.2.19:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.0.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.0.2.21:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.0.2.23:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.0.2.25:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.0.2.27:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.0.2.29:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.0.2.31:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.0.2.33:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.0.2.35:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.0.2.37:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.0.2.39:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.0.2.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.0.2.7:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.0.2.9:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.1.0.11:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.1.0.13:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.1.0.15:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.1.0.17:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.1.0.19:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.1.0.21:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.1.0.23:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.1.0.25:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.1.0.27:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.1.0.29:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.1.0.7:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.1.0.9:*:*:*:*:*:*:*;cpe:2.3:a:ibm:http_server:6.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:z\/os:*:*;cpe:2.3:a:oracle:http_server:10.1.3.5.0:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2010-0467,5.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N,0.43296,CWE-22,Directory traversal vulnerability in the ccNewsletter (com_ccnewsletter) component 1.0.5 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter in a ccnewsletter action to index.php.,2010-02-02,Nuclei,cpe:2.3:a:chillcreations:com_ccnewsletter:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Chillcreations,Com Ccnewsletter
CVE-2010-0478,0.0,,0.6042,CWE-119,"Stack-based buffer overflow in nsum.exe in the Windows Media Unicast Service in Media Services for Microsoft Windows 2000 Server SP4 allows remote attackers to execute arbitrary code via crafted packets associated with transport information, aka ""Media Services Stack-based Buffer Overflow Vulnerability.""",2010-04-14,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*,Microsoft,Windows 2000
CVE-2010-0480,0.0,,0.67888,CWE-119,"Multiple stack-based buffer overflows in the MPEG Layer-3 audio codecs in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allow remote attackers to execute arbitrary code via a crafted AVI file, aka ""MPEG Layer-3 Audio Decoder Stack Overflow Vulnerability.""",2010-04-14,Metasploit,cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*,Microsoft,Windows 2000
CVE-2010-0483,0.0,,0.86367,CWE-94,"vbscript.dll in VBScript 5.1, 5.6, 5.7, and 5.8 in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, when Internet Explorer is used, allows user-assisted remote attackers to execute arbitrary code by referencing a (1) local pathname, (2) UNC share pathname, or (3) WebDAV server with a crafted .hlp file in the fourth argument (aka helpfile argument) to the MsgBox function, leading to code execution involving winhlp32.exe when the F1 key is pressed, aka ""VBScript Help Keypress Vulnerability.""",2010-03-03,Metasploit,cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*,Microsoft,Windows 2000
CVE-2010-0557,0.0,,0.51069,CWE-255,"IBM Cognos Express 9.0 allows attackers to obtain unspecified access to the Tomcat Manager component, and cause a denial of service, by leveraging hardcoded credentials.",2010-02-05,Metasploit,cpe:2.3:a:ibm:cognos_express:9.0:*:*:*:*:*:*:*,Ibm,Cognos Express
CVE-2010-0679,0.0,,0.35128,CWE-119,Multiple stack-based buffer overflows in the HyleosChemView.HLChemView ActiveX control (HyleosChemView.ocx) in Hyleos ChemView 1.9.5.1 allow remote attackers to execute arbitrary code via a large number of white space characters in the filename argument to the (1) SaveasMolFile and (2) ReadMolFile methods.,2010-02-22,Metasploit,cpe:2.3:a:hyleos:chemview:1.9.5.1:*:*:*:*:*:*:*,Hyleos,Chemview
CVE-2010-0688,0.0,,0.37895,CWE-119,Stack-based buffer overflow in Orbital Viewer 1.04 allows user-assisted remote attackers to execute arbitrary code via a crafted (1) .orb or (2) .ov file.,2010-03-19,Metasploit,cpe:2.3:a:orbitals:orbital_viewer:1.04:*:*:*:*:*:*:*,Orbitals,Orbital Viewer
CVE-2010-0696,0.0,,0.28222,CWE-22,Directory traversal vulnerability in includes/download.php in the JoomlaWorks AllVideos (Jw_allVideos) plugin 3.0 through 3.2 for Joomla! allows remote attackers to read arbitrary files via a ./../.../ (modified dot dot) in the file parameter.,2010-02-23,Nuclei,cpe:2.3:a:joomla:joomla:*:*:*:*:*:*:*:*;cpe:2.3:a:joomlaworks:jw_allvideos:3.0:*:*:*:*:*:*:*;cpe:2.3:a:joomlaworks:jw_allvideos:3.1:*:*:*:*:*:*:*;cpe:2.3:a:joomlaworks:jw_allvideos:3.2:*:*:*:*:*:*:*,Joomlaworks,Jw Allvideos
CVE-2010-0738,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.79415,NVD-CWE-noinfo,"The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.",2010-04-28,CISA/Metasploit,cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:-:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:-:*:*:*:*:*:*,Redhat,Jboss Enterprise Application Platform
CVE-2010-0759,0.0,,0.15242,CWE-22,"Directory traversal vulnerability in plugins/system/cdscriptegrator/libraries/highslide/js/jsloader.php in the Core Design Scriptegrator plugin 1.4.1 for Joomla! allows remote attackers to read, and possibly include and execute, arbitrary files via directory traversal sequences in the files[] parameter, a different vector than CVE-2010-0760.",2010-02-27,Nuclei,cpe:2.3:a:greatjoomla:scriptegrator_plugin:1.4.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Greatjoomla,Scriptegrator Plugin
CVE-2010-0805,0.0,,0.80603,CWE-94,"The Tabular Data Control (TDC) ActiveX control in Microsoft Internet Explorer 5.01 SP4, 6 on Windows XP SP2 and SP3, and 6 SP1 allows remote attackers to execute arbitrary code via a long URL (DataURL parameter) that triggers memory corruption in the CTDCCtl::SecurityCHeckDataURL function, aka ""Memory Corruption Vulnerability.""",2010-03-31,Metasploit,cpe:2.3:a:microsoft:internet_explorer:5.01:sp4:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*,Microsoft,Windows 2000
CVE-2010-0806,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.82172,CWE-399,"Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka ""Uninitialized Memory Corruption Vulnerability.""",2010-03-10,CISA/Metasploit,cpe:2.3:a:microsoft:internet_explorer:5.01:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows 2000
CVE-2010-0822,0.0,,0.70121,CWE-94,"Stack-based buffer overflow in Microsoft Office Excel 2002 SP3, Office 2004 for Mac, Office 2008 for Mac, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via an Excel file with a crafted OBJ (0x5D) record, aka ""Excel Object Stack Overflow Vulnerability.""",2010-06-08,Metasploit,cpe:2.3:a:microsoft:excel:2002:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2004:*:mac:*:*:*:*:*;cpe:2.3:a:microsoft:office:2008:*:mac:*:*:*:*:*;cpe:2.3:a:microsoft:open_xml_file_format_converter:*:*:mac:*:*:*:*:*,Microsoft,Excel
CVE-2010-0840,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96319,NVD-CWE-noinfo,"Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the March 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) ""a similar trust issue with interfaces,"" aka ""Trusted Methods Chaining Remote Code Execution Vulnerability.""",2010-04-01,CISA/EPSS/Metasploit,cpe:2.3:a:oracle:jre:1.4.2_25:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update23:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update18:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*,Opensuse,Opensuse
CVE-2010-0842,0.0,,0.77721,NVD-CWE-noinfo,"Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the March 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this is an uncontrolled array index that allows remote attackers to execute arbitrary code via a MIDI file with a crafted MixerSequencer object, related to the GM_Song structure.",2010-04-01,Metasploit,cpe:2.3:a:sun:jdk:*:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:*:update23:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:*:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.0_01:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.0_02:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.0_03:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.0_04:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.0_05:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_01:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_01a:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_02:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_03:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_04:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_05:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_06:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_07:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_08:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_09:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_10:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_11:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_12:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_13:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_14:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_15:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_16:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_17:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_18:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_19:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_20:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_21:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_22:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_23:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_24:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_25:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.3.1_26:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update10:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update11:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update12:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update13:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update14:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update15:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update16:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update17:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update18:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update19:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update1:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update20:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update21:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update3:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update4:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update5:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update6:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update7:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update8:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update9:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update1:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update1_b06:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:jre:*:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:*:update23:*:*:*:*:*:*;cpe:2.3:a:sun:jre:*:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.0:update1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.0:update3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.0:update4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.0:update5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1:update1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_03:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_04:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_05:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_06:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_07:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_08:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_09:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_10:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_11:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_12:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_13:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_14:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_15:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_16:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_17:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_18:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_19:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_20:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_21:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_22:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_23:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_24:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_25:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_26:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.3.1_2:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_10:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_11:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_12:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_13:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_14:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_15:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_16:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_17:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_18:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_19:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_1:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_20:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_21:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_22:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_23:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_24:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_2:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_3:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_4:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_5:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_6:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_7:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_8:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_9:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update10:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update17:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update18:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update19:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update20:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update21:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update7:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update8:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update9:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:*:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.0_01:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.0_02:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.0_03:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.0_04:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.0_05:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_01:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_01a:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_02:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_03:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_04:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_05:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_06:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_07:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_08:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_09:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_10:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_11:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_12:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_13:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_14:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_15:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_16:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_17:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_18:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_19:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_20:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_21:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_22:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_23:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_24:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_25:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.3.1_26:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_02:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_10:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_11:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_12:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_13:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_14:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_15:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_16:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_17:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_18:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_19:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_1:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_20:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_21:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_22:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_23:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_24:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_3:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_4:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_5:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_6:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_7:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_8:*:*:*:*:*:*:*;cpe:2.3:a:sun:sdk:1.4.2_9:*:*:*:*:*:*:*,Sun,Jre
CVE-2010-0866,0.0,,0.1125,NVD-CWE-noinfo,"Unspecified vulnerability in the JavaVM component in Oracle Database 11.1.0.7 and 11.2.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.",2010-04-13,Metasploit,cpe:2.3:a:oracle:database_server:11.1.0.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_server:11.2.0.1:*:*:*:*:*:*:*,Oracle,Database Server
CVE-2010-0870,0.0,,0.12555,NVD-CWE-noinfo,"Unspecified vulnerability in the Change Data Capture component in Oracle Database 9.2.0.8 and 9.2.0.8DV allows remote authenticated users to affect confidentiality and integrity, related to SYS.DBMS_CDC_PUBLISH.",2010-04-13,Metasploit,cpe:2.3:a:oracle:database_server:9.2.0.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_server:9.2.0.8dv:*:*:*:*:*:*:*,Oracle,Database Server
CVE-2010-0886,0.0,,0.69949,NVD-CWE-noinfo,"Unspecified vulnerability in the Java Deployment Toolkit component in Oracle Java SE and Java for Business JDK and JRE 6 Update 10 through 19 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.",2010-04-20,Metasploit,cpe:2.3:a:sun:jdk:1.6.0:update10:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update11:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update12:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update13:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update14:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update15:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update16:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update17:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update18:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update19:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update10:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update17:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update18:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update19:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2010-0904,0.0,,0.50625,NVD-CWE-noinfo,Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote attackers to affect integrity via unknown vectors.,2010-07-13,Metasploit,cpe:2.3:a:oracle:secure_backup:10.3.0.1:*:*:*:*:*:*:*,Oracle,Secure Backup
CVE-2010-0926,0.0,,0.3053,CWE-22,"The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to leverage a directory traversal vulnerability, and access arbitrary files, by using the symlink command in smbclient to create a symlink containing .. (dot dot) sequences, related to the combination of the unix extensions and wide links options.",2010-03-10,Metasploit,cpe:2.3:a:samba:samba:3.3.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.10:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.2:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.3:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.4:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.5:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.6:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.7:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.8:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.9:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.1:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.2:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.3:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.4:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.5:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.0:*:*:*:*:*:*:*,Samba,Samba
CVE-2010-0942,0.0,,0.0724,CWE-22,Directory traversal vulnerability in the jVideoDirect (com_jvideodirect) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-03-08,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:jvideodirect:com_jvideodirect:*:*:*:*:*:*:*:*,Jvideodirect,Com Jvideodirect
CVE-2010-0943,0.0,,0.16358,CWE-22,Directory traversal vulnerability in the JA Showcase (com_jashowcase) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter in a jashowcase action to index.php.,2010-03-08,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:joomlart:com_jashowcase:*:*:*:*:*:*:*:*,Joomlart,Com Jashowcase
CVE-2010-0944,0.0,,0.14041,CWE-22,Directory traversal vulnerability in the JCollection (com_jcollection) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-03-08,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:thorsten_riess:com_jcollection:*:*:*:*:*:*:*:*,Thorsten Riess,Com Jcollection
CVE-2010-0972,0.0,,0.13257,CWE-22,Directory traversal vulnerability in the GCalendar (com_gcalendar) component 2.1.5 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.,2010-03-16,Nuclei,cpe:2.3:a:g4j.laoneo:com_gcalendar:2.1.5:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,G4J.Laoneo,Com Gcalendar
CVE-2010-0982,0.0,,0.06238,CWE-22,Directory traversal vulnerability in the CARTwebERP (com_cartweberp) component 1.56.75 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-03-16,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:joomlamo:com_cartweberp:1.56.75:*:*:*:*:*:*:*,Joomlamo,Com Cartweberp
CVE-2010-0985,0.0,,0.13445,CWE-22,Directory traversal vulnerability in the Abbreviations Manager (com_abbrev) component 1.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.  NOTE: some of these details are obtained from third party information.,2010-03-16,Nuclei,cpe:2.3:a:chris_simon:com_abbrev:1.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Chris Simon,Com Abbrev
CVE-2010-10012,0.0,,0.01404,CWE-22,"A path traversal vulnerability exists in httpdasm version 0.92, a lightweight Windows HTTP server, that allows unauthenticated attackers to read arbitrary files on the host system. By sending a specially crafted GET request containing a sequence of URL-encoded backslashes and directory traversal patterns, an attacker can escape the web root and access sensitive files outside of the intended directory.",2025-07-23,Metasploit,,,
CVE-2010-10013,0.0,,0.01163,CWE-78,"An unauthenticated remote command execution vulnerability exists in AjaXplorer (now known as Pydio Cells) versions prior to 2.6. The flaw resides in the checkInstall.php script within the access.ssh plugin, which fails to properly sanitize user-supplied input to the destServer GET parameter. By injecting shell metacharacters, remote attackers can execute arbitrary system commands on the server with the privileges of the web server process.",2025-08-08,Metasploit,,,
CVE-2010-10014,0.0,,0.01031,CWE-121,"Odin Secure FTP <= 4.1 is vulnerable to a stack-based buffer overflow when parsing directory listings received in response to an FTP LIST command. A malicious FTP server can send an overly long filename in the directory listing, which overflows a fixed-size stack buffer in the client and overwrites the Structured Exception Handler (SEH). This allows remote attackers to execute arbitrary code on the client system.",2025-08-20,Metasploit,,,
CVE-2010-10015,0.0,,0.00525,CWE-121,"AOL versions up to and including 9.5 includes an ActiveX control (Phobos.dll) that exposes a method called Import() via the Phobos.Playlist COM object. This method is vulnerable to a stack-based buffer overflow when provided with an excessively long string argument. Exploitation allows remote attackers to execute arbitrary code in the context of the user, but only when the malicious HTML file is opened locally, due to the control not being marked safe for scripting or initialization. AOL remains an active and supported brand offering services like AOL Mail and AOL Desktop Gold, but the legacy AOL 9.5 desktop software—specifically the version containing the vulnerable Phobos.dll ActiveX control—is long discontinued and no longer maintained.",2025-08-21,Metasploit,,,
CVE-2010-10016,0.0,,0.00704,CWE-120,"BS.Player version 2.57 (build 1051) contains a vulnerability in its playlist import functionality. When processing .m3u files, the application fails to properly validate the length of playlist entries, resulting in a buffer overflow condition. This flaw occurs during parsing of long URLs embedded in the playlist, allowing overwrite of Structured Exception Handler (SEH) records. The vulnerability is triggered upon opening a crafted playlist file and affects the Unicode parsing logic in the Windows client.",2025-08-30,Metasploit,,,
CVE-2010-10017,0.0,,0.00307,CWE-120,"WM Downloader version 3.1.2.2 is vulnerable to a buffer overflow when processing a specially crafted .m3u playlist file. The application fails to properly validate input length, allowing an attacker to overwrite structured exception handler (SEH) records and execute arbitrary code. Exploitation occurs locally when a user opens the malicious file, and the payload executes with the privileges of the current user.",2025-08-30,Metasploit,,,
CVE-2010-1056,0.0,,0.11414,CWE-22,Directory traversal vulnerability in the RokDownloads (com_rokdownloads) component before 1.0.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.,2010-03-23,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:rockettheme:com_rokdownloads:*:*:*:*:*:*:*:*;cpe:2.3:a:rockettheme:com_rokdownloads:0.91:a:*:*:*:*:*:*;cpe:2.3:a:rockettheme:com_rokdownloads:0.92:a:*:*:*:*:*:*;cpe:2.3:a:rockettheme:com_rokdownloads:0.93:a:*:*:*:*:*:*;cpe:2.3:a:rockettheme:com_rokdownloads:0.94:a:*:*:*:*:*:*;cpe:2.3:a:rockettheme:com_rokdownloads:0.95:a:*:*:*:*:*:*;cpe:2.3:a:rockettheme:com_rokdownloads:0.96:a:*:*:*:*:*:*;cpe:2.3:a:rockettheme:com_rokdownloads:0.97:a:*:*:*:*:*:*;cpe:2.3:a:rockettheme:com_rokdownloads:0.98:a:*:*:*:*:*:*;cpe:2.3:a:rockettheme:com_rokdownloads:1.0:b1:*:*:*:*:*:*;cpe:2.3:a:rockettheme:com_rokdownloads:1.0:b2:*:*:*:*:*:*;cpe:2.3:a:rockettheme:com_rokdownloads:1.0:b3:*:*:*:*:*:*;cpe:2.3:a:rockettheme:com_rokdownloads:1.0:b4:*:*:*:*:*:*;cpe:2.3:a:rockettheme:com_rokdownloads:1.0:b5:*:*:*:*:*:*;cpe:2.3:a:rockettheme:com_rokdownloads:1.0:b6:*:*:*:*:*:*;cpe:2.3:a:rockettheme:com_rokdownloads:1.0:b7:*:*:*:*:*:*;cpe:2.3:a:rockettheme:com_rokdownloads:1.0:b8:*:*:*:*:*:*;cpe:2.3:a:rockettheme:com_rokdownloads:1.0:b9:*:*:*:*:*:*,Rockettheme,Com Rokdownloads
CVE-2010-1081,0.0,,0.14331,CWE-22,"Directory traversal vulnerability in the Community Polls (com_communitypolls) component 1.5.2, and possibly earlier, for Core Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.",2010-03-23,Nuclei,cpe:2.3:a:corejoomla:com_communitypolls:*:*:*:*:*:*:*:*;cpe:2.3:a:corejoomla:com_communitypolls:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:corejoomla:com_communitypolls:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:corejoomla:com_communitypolls:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:corejoomla:com_communitypolls:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:corejoomla:com_communitypolls:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:corejoomla:com_communitypolls:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:corejoomla:com_communitypolls:1.0.7:*:*:*:*:*:*:*;cpe:2.3:a:corejoomla:com_communitypolls:1.0.8:*:*:*:*:*:*:*;cpe:2.3:a:corejoomla:com_communitypolls:1.0.9:*:*:*:*:*:*:*;cpe:2.3:a:corejoomla:com_communitypolls:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:corejoomla:com_communitypolls:1.5.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Corejoomla,Com Communitypolls
CVE-2010-1217,0.0,,0.06429,CWE-22,"Directory traversal vulnerability in the JE Form Creator (com_jeformcr) component for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via directory traversal sequences in the view parameter to index.php. NOTE: the original researcher states that the affected product is JE Tooltip, not Form Creator; however, the exploit URL suggests that Form Creator is affected.",2010-03-30,Nuclei,cpe:2.3:a:je_form_creator:je_form_creator:*:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla:*:*:*:*:*:*:*:*,Je Form Creator,Je Form Creator
CVE-2010-1219,0.0,,0.08266,CWE-22,Directory traversal vulnerability in the JA News (com_janews) component 1.0 for Joomla! allows remote attackers to read arbitrary local files via a .. (dot dot) in the controller parameter to index.php.  NOTE: some of these details are obtained from third party information.,2010-03-30,Nuclei,cpe:2.3:a:com_janews:com_janews:1.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla:*:*:*:*:*:*:*:*,Com Janews,Com Janews
CVE-2010-1240,0.0,,0.73436,CWE-264,"Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, do not restrict the contents of one text field in the Launch File warning dialog, which makes it easier for remote attackers to trick users into executing an arbitrary local program that was specified in a PDF document, as demonstrated by a text field that claims that the Open button will enable the user to read an encrypted message.",2010-04-05,Metasploit,cpe:2.3:a:adobe:acrobat_reader:9.3.1:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2010-1297,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.82365,CWE-787,"Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.",2010-06-08,CISA/Metasploit,cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:*:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise:10.0:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise:11.0:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise:11.0:sp1:*:*:*:*:*:*,Apple,Mac Os X
CVE-2010-1302,0.0,,0.08483,CWE-22,Directory traversal vulnerability in dwgraphs.php in the DecryptWeb DW Graphs (com_dwgraphs) component 1.0 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.,2010-04-07,Nuclei,cpe:2.3:a:decryptweb:com_dwgraphs:1.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Decryptweb,Com Dwgraphs
CVE-2010-1304,0.0,,0.14041,CWE-22,Directory traversal vulnerability in userstatus.php in the User Status (com_userstatus) component 1.21.16 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-04-08,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:joomlamo:com_userstatus:1.21.16:*:*:*:*:*:*:*,Joomlamo,Com Userstatus
CVE-2010-1305,0.0,,0.20719,CWE-22,"Directory traversal vulnerability in jinventory.php in the JInventory (com_jinventory) component 1.23.02 and possibly other versions before 1.26.03, a module for Joomla!, allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.",2010-04-08,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:joomlamo:com_jinventory:1.23.02:*:*:*:*:*:*:*,Joomlamo,Com Jinventory
CVE-2010-1306,0.0,,0.15722,CWE-22,Directory traversal vulnerability in the Picasa (com_joomlapicasa2) component 2.0 and 2.0.5 for Joomla! allows remote attackers to read arbitrary local files via a .. (dot dot) in the controller parameter to index.php.  NOTE: some of these details are obtained from third party information.,2010-04-08,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:roberto_aloi:com_joomlapicasa2:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:roberto_aloi:com_joomlapicasa2:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:roberto_aloi:com_joomlapicasa2:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:roberto_aloi:com_joomlapicasa2:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:roberto_aloi:com_joomlapicasa2:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:roberto_aloi:com_joomlapicasa2:2.0.5:*:*:*:*:*:*:*,Roberto Aloi,Com Joomlapicasa2
CVE-2010-1307,0.0,,0.10158,CWE-22,Directory traversal vulnerability in the Magic Updater (com_joomlaupdater) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-04-08,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:software.realtyna:com_joomlaupdater:1.0:*:*:*:*:*:*:*;cpe:2.3:a:software.realtyna:com_joomlaupdater:1.1:*:*:*:*:*:*:*;cpe:2.3:a:software.realtyna:com_joomlaupdater:1.2.1:*:*:*:*:*:*:*;cpe:2.3:a:software.realtyna:com_joomlaupdater:1.2.2:*:*:*:*:*:*:*;cpe:2.3:a:software.realtyna:com_joomlaupdater:1.2:*:*:*:*:*:*:*;cpe:2.3:a:software.realtyna:com_joomlaupdater:1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:software.realtyna:com_joomlaupdater:1.3.1:*:*:*:*:*:*:*;cpe:2.3:a:software.realtyna:com_joomlaupdater:1.3.2:*:*:*:*:*:*:*;cpe:2.3:a:software.realtyna:com_joomlaupdater:1.4:*:*:*:*:*:*:*;cpe:2.3:a:software.realtyna:com_joomlaupdater:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:software.realtyna:com_joomlaupdater:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:software.realtyna:com_joomlaupdater:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:software.realtyna:com_joomlaupdater:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:software.realtyna:com_joomlaupdater:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:software.realtyna:com_joomlaupdater:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:software.realtyna:com_joomlaupdater:2.0.6:*:*:*:*:*:*:*;cpe:2.3:a:software.realtyna:com_joomlaupdater:2.0.7:*:*:*:*:*:*:*;cpe:2.3:a:software.realtyna:com_joomlaupdater:2.0.8:*:*:*:*:*:*:*;cpe:2.3:a:software.realtyna:com_joomlaupdater:3.0.0:*:*:*:*:*:*:*,Software.Realtyna,Com Joomlaupdater
CVE-2010-1308,0.0,,0.13997,CWE-22,Directory traversal vulnerability in the SVMap (com_svmap) component 1.1.1 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-04-08,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:la-souris-verte:com_svmap:1.1.1:*:*:*:*:*:*:*,La-Souris-Verte,Com Svmap
CVE-2010-1312,0.0,,0.13621,CWE-22,Directory traversal vulnerability in the iJoomla News Portal (com_news_portal) component 1.5.x for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-04-08,Nuclei,cpe:2.3:a:ijoomla:com_news_portal:1.5.1:*:*:*:*:*:*:*;cpe:2.3:a:ijoomla:com_news_portal:1.5.2:*:*:*:*:*:*:*;cpe:2.3:a:ijoomla:com_news_portal:1.5.3:*:*:*:*:*:*:*;cpe:2.3:a:ijoomla:com_news_portal:1.5.6:*:*:*:*:*:*:*;cpe:2.3:a:ijoomla:com_news_portal:1.5.7:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Ijoomla,Com News Portal
CVE-2010-1313,0.0,,0.08684,CWE-22,"Directory traversal vulnerability in the Seber Cart (com_sebercart) component 1.0.0.12 and 1.0.0.13 for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.  NOTE: some of these details are obtained from third party information.",2010-04-08,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:seber:com_sebercart:1.0.0.12:*:*:*:*:*:*:*;cpe:2.3:a:seber:com_sebercart:1.0.0.13:*:*:*:*:*:*:*,Seber,Com Sebercart
CVE-2010-1314,0.0,,0.15909,CWE-22,Directory traversal vulnerability in the Highslide JS (com_hsconfig) component 1.5 and 2.0.9 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.  NOTE: some of these details are obtained from third party information.,2010-04-08,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:joomlanook:com_hsconfig:1.5:*:*:*:*:*:*:*;cpe:2.3:a:joomlanook:com_hsconfig:2.0.9:*:*:*:*:*:*:*,Joomlanook,Com Hsconfig
CVE-2010-1315,0.0,,0.08233,CWE-22,Directory traversal vulnerability in weberpcustomer.php in the webERPcustomer (com_weberpcustomer) component 1.2.1 and 1.x before 1.06.02 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.  NOTE: some of these details are obtained from third party information.,2010-04-08,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:joomlamo:com_weberpcustomer:1.2.1:*:*:*:*:*:*:*,Joomlamo,Com Weberpcustomer
CVE-2010-1318,0.0,,0.58051,CWE-119,"Stack-based buffer overflow in the AgentX::receive_agentx function in AgentX++ 1.4.16, as used in RealNetworks Helix Server and Helix Mobile Server 11.x through 13.x and other products, allows remote attackers to execute arbitrary code via unspecified vectors.",2010-04-20,Metasploit,cpe:2.3:a:realnetworks:helix_mobile_server:*:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:helix_server:*:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:helix_server:11.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:helix_server:11.1:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:helix_server:12.0.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:helix_server:12.0.1:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:helix_server_mobile:11.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:helix_server_mobile:12.0.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:helix_server_mobile:13.0.0:*:*:*:*:*:*:*,Realnetworks,Helix Mobile Server
CVE-2010-1340,0.0,,0.13621,CWE-22,Directory traversal vulnerability in jresearch.php in the J!Research (com_jresearch) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-04-09,Nuclei,cpe:2.3:a:joomla-research:com_jresearch:*:*:*:*:*:*:*:*;cpe:2.3:a:joomla-research:com_jresearch:1.1.4.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.0:*:*:*:*:*:*:*,Joomla-Research,Com Jresearch
CVE-2010-1345,0.0,,0.16872,CWE-22,Directory traversal vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-04-09,Nuclei,cpe:2.3:a:cookex:com_ckforms:1.3.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Cookex,Com Ckforms
CVE-2010-1352,0.0,,0.13598,CWE-22,Directory traversal vulnerability in the JOOFORGE Jutebox (com_jukebox) component 1.0 and 1.7 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.  NOTE: some of these details are obtained from third party information.,2010-04-12,Nuclei,cpe:2.3:a:jooforge:com_jukebox:1.0:*:*:*:*:*:*:*;cpe:2.3:a:jooforge:com_jukebox:1.7:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Jooforge,Com Jukebox
CVE-2010-1353,0.0,,0.19192,CWE-22,Directory traversal vulnerability in the LoginBox Pro (com_loginbox) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.,2010-04-12,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:wowjoomla:com_loginbox:*:*:*:*:*:*:*:*,Wowjoomla,Com Loginbox
CVE-2010-1354,0.0,,0.15909,CWE-22,Directory traversal vulnerability in the VJDEO (com_vjdeo) component 1.0 and 1.0.1 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. NOTE: some of these details are obtained from third party information.,2010-04-12,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:ternaria:com_vjdeo:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ternaria:com_vjdeo:1.0:*:*:*:*:*:*:*,Ternaria,Com Vjdeo
CVE-2010-1423,0.0,,0.5558,CWE-78,"Argument injection vulnerability in the URI handler in (a) Java NPAPI plugin and (b) Java Deployment Toolkit in Java 6 Update 10, 19, and other versions, when running on Windows and possibly on Linux, allows remote attackers to execute arbitrary code via the (1) -J or (2) -XXaltjvm argument to javaws.exe, which is processed by the launch method.  NOTE: some of these details are obtained from third party information.",2010-04-15,Metasploit,cpe:2.3:a:oracle:jdk:*:update19:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update10:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:*:update19:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update_10:*:*:*:*:*:*,Oracle,Jdk
CVE-2010-1428,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.62308,NVD-CWE-noinfo,"The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.",2010-04-28,CISA/Metasploit,cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:-:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:-:*:*:*:*:*:*,Redhat,Jboss Enterprise Application Platform
CVE-2010-1429,0.0,,0.53728,CWE-264,"Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 allows remote attackers to obtain sensitive information about ""deployed web contexts"" via a request to the status servlet, as demonstrated by a full=true query string.  NOTE: this issue exists because of a CVE-2008-3273 regression.",2010-04-28,Metasploit/Nuclei,cpe:2.3:a:redhat:jboss_enterprise_application_platform:*:cp07:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:*:cp08:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp01:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp02:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp03:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp04:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp05:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp06:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp07:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp01:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp02:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp03:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp04:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp05:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp06:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3:*:*:*:*:*:*:*,Redhat,Jboss Enterprise Application Platform
CVE-2010-1461,0.0,,0.08233,CWE-22,Directory traversal vulnerability in the Photo Battle (com_photobattle) component 1.0.1 for Joomla! allows remote attackers to read arbitrary files via the view parameter to index.php.,2010-04-16,Nuclei,cpe:2.3:a:gogoritas:com_photobattle:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Gogoritas,Com Photobattle
CVE-2010-1465,0.0,,0.31267,CWE-119,"Stack-based buffer overflow in Trellian FTP client 3.01, including 3.1.3.1789, allows remote attackers to execute arbitrary code via a long PASV response.",2010-04-16,Metasploit,cpe:2.3:a:trellian:ftp:3.01:*:*:*:*:*:*:*;cpe:2.3:a:trellian:ftp:3.1.3.1789:*:*:*:*:*:*:*,Trellian,Ftp
CVE-2010-1469,0.0,,0.08163,CWE-22,Directory traversal vulnerability in the Ternaria Informatica JProject Manager (com_jprojectmanager) component 1.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.,2010-04-19,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:ternaria:com_jprojectmanager:1.0:*:*:*:*:*:*:*,Ternaria,Com Jprojectmanager
CVE-2010-1470,0.0,,0.13351,CWE-22,Directory traversal vulnerability in the Web TV (com_webtv) component 1.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.,2010-04-19,Nuclei,cpe:2.3:a:dev.pucit.edu.pk:com_webtv:1.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla:*:*:*:*:*:*:*:*,Dev.Pucit.Edu.Pk,Com Webtv
CVE-2010-1471,0.0,,0.16152,CWE-22,Directory traversal vulnerability in the AddressBook (com_addressbook) component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-04-19,Nuclei,cpe:2.3:a:b-elektro:com_addressbook:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,B-Elektro,Com Addressbook
CVE-2010-1472,0.0,,0.13351,CWE-22,Directory traversal vulnerability in the Daily Horoscope (com_horoscope) component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-04-19,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:kazulah:com_horoscope:1.5.0:*:*:*:*:*:*:*,Kazulah,Com Horoscope
CVE-2010-1473,0.0,,0.08163,CWE-22,Directory traversal vulnerability in the Advertising (com_advertising) component 0.25 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.,2010-04-19,Nuclei,cpe:2.3:a:johnmccollum:com_advertising:0.25:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Johnmccollum,Com Advertising
CVE-2010-1474,0.0,,0.09471,CWE-22,Directory traversal vulnerability in the Sweety Keeper (com_sweetykeeper) component 1.5.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.,2010-04-19,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:supachai_teasakul:com_sweetykeeper:*:*:*:*:*:*:*:*,Supachai Teasakul,Com Sweetykeeper
CVE-2010-1475,0.0,,0.09471,CWE-22,Directory traversal vulnerability in the Preventive & Reservation (com_preventive) component 1.0.5 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.,2010-04-19,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:ternaria:com_preventive:1.0.5:*:*:*:*:*:*:*,Ternaria,Com Preventive
CVE-2010-1476,0.0,,0.0994,CWE-22,Directory traversal vulnerability in the AlphaUserPoints (com_alphauserpoints) component 1.5.5 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the view parameter to index.php.,2010-04-19,Nuclei,cpe:2.3:a:alphaplug:com_alphauserpoints:1.5.5:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Alphaplug,Com Alphauserpoints
CVE-2010-1478,0.0,,0.08163,CWE-22,Directory traversal vulnerability in the Ternaria Informatica Jfeedback! (com_jfeedback) component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.,2010-04-19,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:ternaria:com_jfeedback:1.2:*:*:*:*:*:*:*,Ternaria,Com Jfeedback
CVE-2010-1491,0.0,,0.13598,CWE-22,Directory traversal vulnerability in the MMS Blog (com_mmsblog) component 2.3.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.,2010-04-23,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:mms.pipp:com_mmsblog:2.3.0:*:*:*:*:*:*:*,Mms.Pipp,Com Mmsblog
CVE-2010-1494,0.0,,0.167,CWE-22,Directory traversal vulnerability in the AWDwall (com_awdwall) component 1.5.4 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-04-23,Nuclei,cpe:2.3:a:awdsolution:com_awdwall:1.5.4:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Awdsolution,Com Awdwall
CVE-2010-1495,0.0,,0.18938,CWE-22,Directory traversal vulnerability in the Matamko (com_matamko) component 1.01 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-04-23,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:matamko:com_matamko:1.01:*:*:*:*:*:*:*,Matamko,Com Matamko
CVE-2010-1527,0.0,,0.35987,CWE-119,Stack-based buffer overflow in Novell iPrint Client before 5.44 allows remote attackers to execute arbitrary code via a long call-back-url parameter in an op-client-interface-version action.,2010-08-23,Metasploit,cpe:2.3:a:novell:iprint:*:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:4.26:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:4.27:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:4.28:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:4.30:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:4.32:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:4.34:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:4.36:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:4.38:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:5.04:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:5.12:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:5.20b:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:5.30:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:5.32:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:5.40:*:*:*:*:*:*:*,Novell,Iprint
CVE-2010-1531,0.0,,0.16915,CWE-22,Directory traversal vulnerability in the redSHOP (com_redshop) component 1.0.x for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.,2010-04-26,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:redcomponent:com_redshop:1.0.10:*:*:*:*:*:*:*;cpe:2.3:a:redcomponent:com_redshop:1.0.11:*:*:*:*:*:*:*;cpe:2.3:a:redcomponent:com_redshop:1.0.12:*:*:*:*:*:*:*;cpe:2.3:a:redcomponent:com_redshop:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:redcomponent:com_redshop:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:redcomponent:com_redshop:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:redcomponent:com_redshop:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:redcomponent:com_redshop:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:redcomponent:com_redshop:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:redcomponent:com_redshop:1.0.7:*:*:*:*:*:*:*;cpe:2.3:a:redcomponent:com_redshop:1.0.8:*:*:*:*:*:*:*;cpe:2.3:a:redcomponent:com_redshop:1.0.9:*:*:*:*:*:*:*;cpe:2.3:a:redcomponent:com_redshop:1.0:*:*:*:*:*:*:*,Redcomponent,Com Redshop
CVE-2010-1532,0.0,,0.1633,CWE-22,Directory traversal vulnerability in the givesight PowerMail Pro (com_powermail) component 1.5.3 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.,2010-04-26,Nuclei,cpe:2.3:a:givesight:com_powermail:1.53:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Givesight,Com Powermail
CVE-2010-1533,0.0,,0.15088,CWE-22,Directory traversal vulnerability in the TweetLA (com_tweetla) component 1.0.1 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-04-26,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:peter_hocherl:com_tweetla:1.0.1:*:*:*:*:*:*:*,Peter Hocherl,Com Tweetla
CVE-2010-1534,0.0,,0.13621,CWE-22,Directory traversal vulnerability in the Shoutbox Pro (com_shoutbox) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-04-26,Nuclei,cpe:2.3:a:joomla.batjo:com_shoutbox:*:*:*:*:*:*:*:*;cpe:2.3:a:joomla.batjo:com_shoutbox:1.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla.batjo:com_shoutbox:1.2:beta2:*:*:*:*:*:*;cpe:2.3:a:joomla.batjo:com_shoutbox:1.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Joomla.Batjo,Com Shoutbox
CVE-2010-1535,0.0,,0.15334,CWE-22,Directory traversal vulnerability in the TRAVELbook (com_travelbook) component 1.0.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.,2010-04-26,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:peter_hocherl:com_travelbook:1.0.1:*:*:*:*:*:*:*,Peter Hocherl,Com Travelbook
CVE-2010-1540,0.0,,0.08233,CWE-22,Directory traversal vulnerability in index.php in the MyBlog (com_myblog) component 3.0.329 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the task parameter.  NOTE: some of these details are obtained from third party information.,2010-04-26,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:myblog:com_myblog:3.0.329:*:*:*:*:*:*:*,Myblog,Com Myblog
CVE-2010-1549,0.0,,0.7883,NVD-CWE-noinfo,Unspecified vulnerability in the Agent in HP LoadRunner before 9.50 and HP Performance Center before 9.50 allows remote attackers to execute arbitrary code via unknown vectors.,2010-05-07,Metasploit,cpe:2.3:a:hp:loadrunner:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:7.02:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:7.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:7.51:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:7.5:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:7.6:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:7.8:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:8.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:8.12:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:8.13:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:8.14:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:9.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:performance_center:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2010-1552,0.0,,0.68892,CWE-119,"Stack-based buffer overflow in the doLoad function in snmpviewer.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via the act and app parameters.",2010-05-13,Metasploit,cpe:2.3:a:hp:openview_network_node_manager:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:hp-ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:windows:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:hp-ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:windows:*:*:*:*:*,Hp,Openview Network Node Manager
CVE-2010-1553,0.0,,0.72168,CWE-119,"Stack-based buffer overflow in getnnmdata.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via an invalid MaxAge parameter.",2010-05-13,Metasploit,cpe:2.3:a:hp:openview_network_node_manager:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:hp-ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:windows:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:hp-ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:windows:*:*:*:*:*,Hp,Openview Network Node Manager
CVE-2010-1554,0.0,,0.67786,CWE-119,"Stack-based buffer overflow in getnnmdata.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via an invalid iCount parameter.",2010-05-13,Metasploit,cpe:2.3:a:hp:openview_network_node_manager:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:hp-ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:windows:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:hp-ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:windows:*:*:*:*:*,Hp,Openview Network Node Manager
CVE-2010-1555,0.0,,0.64447,CWE-119,"Stack-based buffer overflow in getnnmdata.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via an invalid Hostname parameter.",2010-05-13,Metasploit,cpe:2.3:a:hp:openview_network_node_manager:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:hp-ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:windows:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:hp-ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:windows:*:*:*:*:*,Hp,Openview Network Node Manager
CVE-2010-1586,0.0,,0.10296,CWE-20,Open redirect vulnerability in red2301.html in HP System Management Homepage (SMH) 2.x.x.x allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the RedirectUrl parameter.,2010-04-28,Nuclei,cpe:2.3:a:hp:system_management_homepage:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1.0-103:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1.0-103\(a\):*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1.0-109:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1.0-118:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1.10-186:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1.11-197:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1.12-118:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1.12-200:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1.2-127:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1.2:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1.3.132:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1.3:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1.4:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1.5-146:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1.5:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1.6-156:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1.6:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1.7-168:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1.7:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1.8-177:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1.8:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1.9-178:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1.9:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.1:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.2.6:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:2.2.8:*:*:*:*:*:*:*,Hp,System Management Homepage
CVE-2010-1587,0.0,,0.78018,CWE-20,"The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // (slash slash) initial substring in a URI for (1) admin/index.jsp, (2) admin/queues.jsp, or (3) admin/topics.jsp.",2010-04-28,Metasploit,cpe:2.3:a:apache:activemq:5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.3.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.3.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.4-snapshot:*:*:*:*:*:*:*,Apache,Activemq
CVE-2010-1601,0.0,,0.15974,CWE-22,Directory traversal vulnerability in the JA Comment (com_jacomment) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.,2010-04-29,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:joomlamart:com_jacomment:*:*:*:*:*:*:*:*,Joomlamart,Com Jacomment
CVE-2010-1602,0.0,,0.15695,CWE-22,Directory traversal vulnerability in the ZiMB Comment (com_zimbcomment) component 0.8.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.,2010-04-29,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:zimbllc:com_zimbcomment:0.8.1:*:*:*:*:*:*:*,Zimbllc,Com Zimbcomment
CVE-2010-1603,0.0,,0.07402,CWE-22,Directory traversal vulnerability in the ZiMB Core (aka ZiMBCore or com_zimbcore) component 0.1 in the ZiMB Manager collection for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.,2010-04-29,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:zimbllc:com_zimbcore:0.1:*:*:*:*:*:*:*,Zimbllc,Com Zimbcore
CVE-2010-1607,0.0,,0.08177,CWE-22,Directory traversal vulnerability in wmi.php in the Webmoney Web Merchant Interface (aka WMI or com_wmi) component 1.5.0 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.,2010-04-29,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:paysyspro:com_wmi:1.5.0:*:*:*:*:*:*:*,Paysyspro,Com Wmi
CVE-2010-1653,0.0,,0.13373,CWE-22,Directory traversal vulnerability in graphics.php in the Graphics (com_graphics) component 1.0.6 and 1.5.0 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.  NOTE: some of these details are obtained from third party information.,2010-05-03,Nuclei,cpe:2.3:a:htmlcoderhelper:com_graphics:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:htmlcoderhelper:com_graphics:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Htmlcoderhelper,Com Graphics
CVE-2010-1657,0.0,,0.19192,CWE-22,Directory traversal vulnerability in the SmartSite (com_smartsite) component 1.0.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-05-03,Nuclei,cpe:2.3:a:recly:com_smartsite:1.0.0:*:*:*:*:*:*:*,Recly,Com Smartsite
CVE-2010-1658,0.0,,0.16014,CWE-22,Directory traversal vulnerability in the Code-Garage NoticeBoard (com_noticeboard) component 1.3 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.,2010-05-03,Nuclei,cpe:2.3:a:code-garage:com_noticeboard:1.3:*:*:*:*:*:*:*,Code-Garage,Com Noticeboard
CVE-2010-1659,0.0,,0.13985,CWE-22,Directory traversal vulnerability in the Ultimate Portfolio (com_ultimateportfolio) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-05-03,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:webkul:com_ultimateportfolio:1.0:*:*:*:*:*:*:*,Webkul,Com Ultimateportfolio
CVE-2010-1681,0.0,,0.67309,CWE-119,"Buffer overflow in VISIODWG.DLL before 10.0.6880.4 in Microsoft Office Visio allows user-assisted remote attackers to execute arbitrary code via a crafted DXF file, a different vulnerability than CVE-2010-0254 and CVE-2010-0256.",2010-05-06,Metasploit,cpe:2.3:a:microsoft:visio:2002:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:visio:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:visio:2007:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:visio:2007:sp2:*:*:*:*:*:*,Microsoft,Visio
CVE-2010-1714,0.0,,0.18703,CWE-22,Directory traversal vulnerability in the Arcade Games (com_arcadegames) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-05-04,Nuclei,cpe:2.3:a:dev.pucit.edu.pk:com_arcadegames:1.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Dev.Pucit.Edu.Pk,Com Arcadegames
CVE-2010-1715,0.0,,0.08177,CWE-22,Directory traversal vulnerability in the Online Examination (aka Online Exam or com_onlineexam) component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.  NOTE: some of these details are obtained from third party information.,2010-05-04,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:pucit.edu:com_onlineexam:1.5.0:*:*:*:*:*:*:*,Pucit.Edu,Com Onlineexam
CVE-2010-1717,0.0,,0.22285,CWE-22,Directory traversal vulnerability in the iF surfALERT (com_if_surfalert) component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.,2010-05-04,Nuclei,cpe:2.3:a:if_surfalert_project:if_surfalert:1.2:*:*:*:*:joomla\!:*:*,If Surfalert Project,If Surfalert
CVE-2010-1718,0.0,,0.09455,CWE-22,Directory traversal vulnerability in archeryscores.php in the Archery Scores (com_archeryscores) component 1.0.6 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.,2010-05-04,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:lispeltuut:com_archeryscores:1.0.6:*:*:*:*:*:*:*,Lispeltuut,Com Archeryscores
CVE-2010-1719,0.0,,0.09371,CWE-22,Directory traversal vulnerability in the MT Fire Eagle (com_mtfireeagle) component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.,2010-05-04,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:moto-treks:com_mtfireeagle:1.2:*:*:*:*:*:*:*,Moto-Treks,Com Mtfireeagle
CVE-2010-1722,0.0,,0.09471,CWE-22,Directory traversal vulnerability in the Online Market (com_market) component 2.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.,2010-05-04,Nuclei,cpe:2.3:a:dev.pucit.edu.pk:com_market:2.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Dev.Pucit.Edu.Pk,Com Market
CVE-2010-1723,0.0,,0.08408,CWE-22,Directory traversal vulnerability in the iNetLanka Contact Us Draw Root Map (com_drawroot) component 1.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.,2010-05-04,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:joomlacomponent.inetlanka:com_drawroot:1.1:*:*:*:*:*:*:*,Joomlacomponent.Inetlanka,Com Drawroot
CVE-2010-1799,0.0,,0.33701,CWE-119,Stack-based buffer overflow in the error-logging functionality in Apple QuickTime before 7.6.7 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file.,2010-08-16,Metasploit,cpe:2.3:a:apple:quicktime:*:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:-:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:4.1.2:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:4.1.2:*:*:ja:*:*:*:*;cpe:2.3:a:apple:quicktime:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:5.0.1:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:5.0.2:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:5.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0.0:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0.1:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0.2:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:6.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:6.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.1.0:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:6.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.1.1:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:6.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.2.0:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:6.3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.3.0:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:6.4.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.4.0:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:6.5.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5.0:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:6.5.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5.1:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:6.5.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5.2:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:6.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.0:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.1:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.2:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:7.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.3:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:7.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.4:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:7.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.0:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:7.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.1:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:7.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.2:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:7.1.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.3:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:7.1.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.4:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:7.1.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.5:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:7.1.6:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.6:*:*:*:*:java:*:*;cpe:2.3:a:apple:quicktime:7.1.6:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:7.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.2.0:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:7.2.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.2.1:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:7.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.2:*:vista:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.2:*:windows_sp_2:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.2:*:windows_vista:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.2:*:windows_xp:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.2:*:windows_xp_sp2:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.3.0:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:7.3.1.70:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.3.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.3.1:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:7.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4.0:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:7.4.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4.1:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:7.4.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4.5:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:7.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.5.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.5.0:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:7.5.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.5.5:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:7.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.0:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:7.6.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.1:*:*:*:*:windows:*:*;cpe:2.3:a:apple:quicktime:7.6.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.6:*:*:*:*:windows:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2010-1818,0.0,,0.42668,CWE-824,"The IPersistPropertyBag2::Read function in QTPlugin.ocx in Apple QuickTime 6.x, 7.x before 7.6.8, and other versions allows remote attackers to execute arbitrary code via the _Marshaled_pUnk attribute, which triggers unmarshalling of an untrusted pointer.",2010-08-31,Metasploit,cpe:2.3:a:apple:quicktime:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.4.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.6:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.2.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.3.1.70:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.3.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.5.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.5.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.6:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.7:*:*:*:*:*:*:*,Apple,Quicktime
CVE-2010-1858,0.0,,0.13621,CWE-22,Directory traversal vulnerability in the SMEStorage (com_smestorage) component before 1.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.,2010-05-07,Nuclei,cpe:2.3:a:gelembjuk:com_smestorage:*:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Gelembjuk,Com Smestorage
CVE-2010-1870,0.0,,0.91079,NVD-CWE-Other,"The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the ""#"" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.",2010-08-17,Metasploit/Nuclei,cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*,Apache,Struts
CVE-2010-1871,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.83397,CWE-917,"JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL.  NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.",2010-08-05,CISA/Metasploit,cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:clustered_data_ontap:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:5:*:*:*:*:*:*:*,Redhat,Enterprise Linux
CVE-2010-1875,0.0,,0.15722,CWE-22,Directory traversal vulnerability in the Real Estate Property (com_properties) component 3.1.22-03 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php. NOTE: some of these details are obtained from third party information.,2010-05-12,Nuclei,cpe:2.3:a:com-property:com_properties:3.1.22-03:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Com-Property,Com Properties
CVE-2010-1878,0.0,,0.11429,CWE-22,Directory traversal vulnerability in the OrgChart (com_orgchart) component 1.0.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-05-12,Nuclei,cpe:2.3:a:blueflyingfish.no-ip:com_orgchart:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Blueflyingfish.No-Ip,Com Orgchart
CVE-2010-1885,0.0,,0.75458,CWE-78,"The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server 2003 does not properly handle malformed escape sequences, which allows remote attackers to bypass the trusted documents whitelist (fromHCP option) and execute arbitrary commands via a crafted hcp:// URL, aka ""Help Center URL Validation Vulnerability.""",2010-06-15,Metasploit,cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*,Microsoft,Windows 2003 Server
CVE-2010-1899,0.0,,0.57231,CWE-119,"Stack consumption vulnerability in the ASP implementation in Microsoft Internet Information Services (IIS) 5.1, 6.0, 7.0, and 7.5 allows remote attackers to cause a denial of service (daemon outage) via a crafted request, related to asp.dll, aka ""IIS Repeated Parameter Request Denial of Service Vulnerability.""",2010-09-15,Metasploit,cpe:2.3:a:microsoft:internet_information_server:6.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_information_services:7.5:*:*:*:*:*:*:*,Microsoft,Internet Information Server
CVE-2010-1952,0.0,,0.12991,CWE-22,Directory traversal vulnerability in the BeeHeard (com_beeheard) and BeeHeard Lite (com_beeheardlite) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-05-19,Nuclei,cpe:2.3:a:cmstactics:com_beeheard:1.0:*:*:*:*:*:*:*;cpe:2.3:a:cmstactics:com_beeheardlite:1.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Cmstactics,Com Beeheard
CVE-2010-1953,0.0,,0.16152,CWE-22,Directory traversal vulnerability in the iNetLanka Multiple Map (com_multimap) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-05-19,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:joomlacomponent.inetlanka:com_multimap:1.0:*:*:*:*:*:*:*,Joomlacomponent.Inetlanka,Com Multimap
CVE-2010-1954,0.0,,0.16152,CWE-22,Directory traversal vulnerability in the iNetLanka Multiple root (com_multiroot) component 1.0 and 1.1 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.  NOTE: some of these details are obtained from third party information.,2010-05-19,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:joomlacomponent.inetlanka:com_multiroot:1.0:*:*:*:*:*:*:*;cpe:2.3:a:joomlacomponent.inetlanka:com_multiroot:1.1:*:*:*:*:*:*:*,Joomlacomponent.Inetlanka,Com Multiroot
CVE-2010-1955,0.0,,0.17938,CWE-22,Directory traversal vulnerability in the Deluxe Blog Factory (com_blogfactory) component 1.1.2 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-05-19,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:thefactory:com_blogfactory:1.1.2:*:*:*:*:*:*:*,Thefactory,Com Blogfactory
CVE-2010-1956,0.0,,0.17003,CWE-22,Directory traversal vulnerability in the Gadget Factory (com_gadgetfactory) component 1.0.0 and 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.  NOTE: some of these details are obtained from third party information.,2010-05-19,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:thefactory:com_gadgetfactory:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:thefactory:com_gadgetfactory:1.5.0:*:*:*:*:*:*:*,Thefactory,Com Gadgetfactory
CVE-2010-1957,0.0,,0.14847,CWE-22,Directory traversal vulnerability in the Love Factory (com_lovefactory) component 1.3.4 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-05-19,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:thefactory:com_lovefactory:1.3.4:*:*:*:*:*:*:*,Thefactory,Com Lovefactory
CVE-2010-1960,0.0,,0.6911,CWE-119,"Buffer overflow in the error handling functionality in ovwebsnmpsrv.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long, invalid option to jovgraph.exe.",2010-06-10,Metasploit,cpe:2.3:a:hp:openview_network_node_manager:7.51:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:hp-ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:windows:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:hp-ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:windows:*:*:*:*:*,Hp,Openview Network Node Manager
CVE-2010-1961,0.0,,0.6911,CWE-119,"Buffer overflow in ovutil.dll in ovwebsnmpsrv.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via unspecified variables to jovgraph.exe, which are not properly handled in a call to the sprintf function.",2010-06-10,Metasploit,cpe:2.3:a:hp:openview_network_node_manager:7.51:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:hp-ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:windows:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:hp-ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:windows:*:*:*:*:*,Hp,Openview Network Node Manager
CVE-2010-1964,0.0,,0.67991,NVD-CWE-noinfo,"Buffer overflow in ovwebsnmpsrv.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via unspecified parameters to jovgraph.exe, aka ZDI-CAN-683.",2010-06-17,Metasploit,cpe:2.3:a:hp:openview_network_node_manager:7.51:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:hp-ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:windows:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:hp-ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:windows:*:*:*:*:*,Hp,Openview Network Node Manager
CVE-2010-1977,0.0,,0.07402,CWE-22,Directory traversal vulnerability in the J!WHMCS Integrator (com_jwhmcs) component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-05-19,Nuclei,cpe:2.3:a:gohigheris:com_jwhmcs:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Gohigheris,Com Jwhmcs
CVE-2010-1979,0.0,,0.1115,CWE-22,Directory traversal vulnerability in the Affiliate Datafeeds (com_datafeeds) component build 880 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-05-19,Nuclei,cpe:2.3:a:affiliatefeeds:com_datafeeds:build_880:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Affiliatefeeds,Com Datafeeds
CVE-2010-1980,0.0,,0.18835,CWE-22,Directory traversal vulnerability in joomlaflickr.php in the Joomla Flickr (com_joomlaflickr) component 1.0.3 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.,2010-05-19,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:roberto_aloi:com_joomlaflickr:1.0.3:*:*:*:*:*:*:*,Roberto Aloi,Com Joomlaflickr
CVE-2010-1981,0.0,,0.11864,CWE-22,Directory traversal vulnerability in the Fabrik (com_fabrik) component 2.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-05-19,Nuclei,cpe:2.3:a:fabrikar:fabrik:2.0:*:*:*:*:joomla\!:*:*,Fabrikar,Fabrik
CVE-2010-1982,0.0,,0.08286,CWE-22,Directory traversal vulnerability in the JA Voice (com_javoice) component 2.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.,2010-05-19,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:joomlart:com_javoice:2.0:*:*:*:*:*:*:*,Joomlart,Com Javoice
CVE-2010-1983,0.0,,0.18816,CWE-22,Directory traversal vulnerability in the redTWITTER (com_redtwitter) component 1.0.x including 1.0b11 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.  NOTE: some of these details are obtained from third party information.,2010-05-19,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:redcomponent:com_redtwitter:1.0b10:*:*:*:*:*:*:*;cpe:2.3:a:redcomponent:com_redtwitter:1.0b11:*:*:*:*:*:*:*;cpe:2.3:a:redcomponent:com_redtwitter:1.0b8:*:*:*:*:*:*:*;cpe:2.3:a:redcomponent:com_redtwitter:1.0b9.1:*:*:*:*:*:*:*;cpe:2.3:a:redcomponent:com_redtwitter:1.0b94.2:*:*:*:*:*:*:*;cpe:2.3:a:redcomponent:com_redtwitter:1.0b9:*:*:*:*:*:*:*,Redcomponent,Com Redtwitter
CVE-2010-20007,0.0,,0.0051,CWE-121,"Seagull FTP Client <= v3.3 Build 409 contains a stack-based buffer overflow vulnerability in its FTP directory listing parser. When the client connects to an FTP server and receives a crafted response to a LIST command containing an excessively long filename, the application fails to properly validate input length, resulting in a buffer overflow that overwrites the Structured Exception Handler (SEH). This may allow remote attackers to execute arbitrary code on the client system. This product line was discontinued and users were advised to use BlueZone Secure FTP instead, at the time of disclosure.",2025-08-21,Metasploit,,,
CVE-2010-20010,0.0,,0.00342,CWE-121,"Foxit PDF Reader before 4.2.0.0928 does not properly bound-check the /Title entry in the PDF Info dictionary. A specially crafted PDF with an overlong Title string can overflow a fixed-size stack buffer, corrupt the Structured Exception Handler (SEH) chain, and lead to arbitrary code execution in the context of the user who opens the file.",2025-08-20,Metasploit,,,
CVE-2010-20034,0.0,,0.0051,CWE-121,"Gekko Manager FTP Client <= 0.77 contains a stack-based buffer overflow in its FTP directory listing parser. When processing a server response to a LIST command, the client fails to properly validate the length of filenames. A crafted response containing an overly long filename can overwrite the Structured Exception Handler (SEH), potentially allowing remote code execution.",2025-08-21,Metasploit,,,
CVE-2010-20042,0.0,,0.00345,CWE-121,"Xion Audio Player versions 1.0.126 and prior are vulnerable to a Unicode-based stack buffer overflow triggered by opening a specially crafted .m3u playlist file. The file contains an overly long string that overwrites the Structured Exception Handler (SEH) chain, allowing an attacker to hijack execution flow and run arbitrary code.",2025-08-20,Metasploit,,,
CVE-2010-20045,0.0,,0.00343,CWE-121,"FileWrangler <= 5.30 suffers from a stack-based buffer overflow vulnerability when parsing directory listings from an FTP server. A malicious server can send an overlong folder name in response to a LIST command, triggering memory corruption during client-side rendering. Exploitation requires passive user interaction—simply connecting to the server—without further input. Successful exploitation may lead to arbitrary code execution.",2025-08-20,Metasploit,,,
CVE-2010-20049,0.0,,0.00797,CWE-121,"LeapFTP < 3.1.x contains a stack-based buffer overflow vulnerability in its FTP client parser. When the client receives a directory listing containing a filename longer than 528 bytes, the application fails to properly bound-check the input and overwrites the Structured Exception Handler (SEH) chain. This allows an attacker operating a malicious FTP server to execute arbitrary code on the victim’s machine when the file is listed or downloaded.",2025-08-20,Metasploit,,,
CVE-2010-20059,0.0,,0.01022,CWE-78,FreeNAS 0.7.2 prior to revision 5543 includes an unauthenticated command‐execution backdoor in its web interface. The exec_raw.php script exposes a cmd parameter that is passed directly to the underlying shell without sanitation.,2025-08-20,Metasploit,,,
CVE-2010-20103,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0509,CWE-912,"A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host.",2025-08-20,Metasploit/Nuclei,cpe:2.3:a:proftpd:proftpd:1.3.3:c:*:*:*:*:*:*,Proftpd,Proftpd
CVE-2010-20107,0.0,,0.0051,CWE-121,"A stack-based buffer overflow exists in FTP Synchronizer Professional <= v4.0.73.274. When the client connects to an FTP server and issues a LIST command—typically during sync preview or profile creation—the server’s response containing an overly long filename triggers a buffer overflow. This results in the corruption of the Structured Exception Handler (SEH), potentially allowing remote code execution.",2025-08-21,Metasploit,,,
CVE-2010-20108,0.0,,0.0051,CWE-121,"FTPPad <= 1.2.0 contains a stack-based buffer overflow vulnerability in its FTP directory listing parser. When the client connects to an FTP server and receives a crafted response to a LIST command containing an excessively long directory and filename, the application fails to properly validate input length. This results in a buffer overflow that overwrites the saved Extended Instruction Pointer (EIP), allowing remote attackers to execute arbitrary code.",2025-08-21,Metasploit,,,
CVE-2010-20109,0.0,,0.01166,CWE-22,"Barracuda products, confirmed in Spam & Virus Firewall, SSL VPN, and Web Application Firewall versions prior to October 2010, contain a path traversal vulnerability in the view_help.cgi endpoint. The locale parameter fails to properly sanitize user input, allowing attackers to inject traversal sequences and null-byte terminators to access arbitrary files on the underlying system. By exploiting this flaw, unauthenticated remote attackers can retrieve sensitive configuration files such as /mail/snapshot/config.snapshot, potentially exposing credentials, internal settings, and other critical data.",2025-08-21,Metasploit,,,
CVE-2010-20111,0.0,,0.00416,CWE-121,"Digital Music Pad v8.2.3.3.4 contains a stack-based buffer overflow vulnerability in its playlist file parser. When opening a .pls file containing an excessively long string in the File1 field, the application fails to properly validate input length, resulting in corruption of the Structured Exception Handler (SEH) on the stack. This flaw may allow an attacker to control execution flow when the file is opened, potentially leading to arbitrary code execution.",2025-08-21,Metasploit,,,
CVE-2010-20112,0.0,,0.01121,CWE-121,"Amlib’s NetOpacs webquery.dll contains a stack-based buffer overflow vulnerability triggered by improper handling of HTTP GET parameters. Specifically, the application fails to enforce bounds on input supplied to the app parameter, allowing excessive data to overwrite memory structures including the Structured Exception Handler (SEH). Additionally, malformed parameter names followed by an equals sign may result in unintended control flow behavior. This vulnerability is exposed through IIS and affects legacy Windows deployments",2025-08-21,Metasploit,,,
CVE-2010-20113,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01555,CWE-121,"EasyFTP Server 1.7.0.11 and earlier contains a stack-based buffer overflow vulnerability in its HTTP interface. When processing a GET request to list.html, the server fails to properly validate the length of the path parameter. Supplying an excessively long value causes a buffer overflow on the stack, potentially corrupting control flow structures. The vulnerability is exposed through the embedded web server and does not require authentication due to default anonymous access. The issue was resolved in version 1.7.0.12, after which the product was renamed to UplusFtp.",2025-08-21,Metasploit,cpe:2.3:a:easyftp_server_project:easyftp_server:*:*:*:*:*:*:*:*,Easyftp Server Project,Easyftp Server
CVE-2010-20114,0.0,,0.00345,CWE-121,"VariCAD EN up to and including version 2010-2.05 is vulnerable to a stack-based buffer overflow when parsing .dwb drawing files. The application fails to properly validate the length of input data embedded in the file, allowing a crafted .dwb file to overwrite critical memory structures. This flaw can be exploited locally by convincing a user to open a malicious file, resulting in arbitrary code execution.",2025-08-21,Metasploit,,,
CVE-2010-20115,0.0,,0.00922,CWE-704,"Arcane Software’s Vermillion FTP Daemon (vftpd) versions up to and including 1.31 contains a memory corruption vulnerability triggered by a malformed FTP PORT command. The flaw arises from an out-of-bounds array access during input parsing, allowing an attacker to manipulate stack memory and potentially execute arbitrary code. Exploitation requires direct access to the FTP service and is constrained by a single execution attempt if the daemon is installed as a Windows service.",2025-08-21,Metasploit,,,
CVE-2010-20119,0.0,,0.0113,CWE-121,"CommuniCrypt Mail versions up to and including 1.16 contains a stack-based buffer overflow vulnerability in its ANSMTP.dll  and AOSMTP.dll  ActiveX controls, specifically within the AddAttachments() method. This method fails to properly validate the length of input strings, allowing data to exceed the bounds of a fixed-size stack buffer. When invoked with an overly long string, the control can corrupt adjacent memory structures, including exception handlers, leading to potential control flow disruption.",2025-08-21,Metasploit,,,
CVE-2010-20120,0.0,,0.00367,CWE-94,Maple versions up to and including 13's Maplet framework allows embedded commands to be executed automatically when a .maplet file is opened. This behavior bypasses standard security restrictions that normally prevent code execution in regular Maple worksheets. The vulnerability enables attackers to craft malicious .maplet files that execute arbitrary code without user interaction.,2025-08-21,Metasploit,,,
CVE-2010-20121,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03221,CWE-121,"EasyFTP Server versions up to 1.7.0.11 contain a stack-based buffer overflow vulnerability in the FTP command parser. When processing the CWD (Change Working Directory) command, the server fails to properly validate the length of the input string, allowing attackers to overwrite memory on the stack. This flaw enables remote code execution without authentication, as EasyFTP allows anonymous access by default. The vulnerability was resolved in version 1.7.0.12, after which the product was renamed “UplusFtp.”",2025-08-21,Metasploit,cpe:2.3:a:easyftp_server_project:easyftp_server:*:*:*:*:*:*:*:*,Easyftp Server Project,Easyftp Server
CVE-2010-20122,0.0,,0.01015,CWE-121,"Xftp FTP Client version up to and including 3.0 (build 0238) contain a stack-based buffer overflow vulnerability triggered by a maliciously crafted PWD response from an FTP server. When the client connects to a server and receives an overly long directory string in response to the PWD command, the client fails to properly validate the length of the input before copying it into a fixed-size buffer. This results in memory corruption and allows remote attackers to execute arbitrary code on the client system.",2025-08-21,Metasploit,,,
CVE-2010-20123,0.0,,0.00345,CWE-121,"Steinberg MyMP3Player version 3.0 (build 3.0.0.67) is vulnerable to a stack-based buffer overflow when parsing .m3u playlist files. The application fails to properly validate the length of input data within the playlist, allowing a specially crafted file to overwrite critical memory structures and execute arbitrary code. This vulnerability can be exploited locally by convincing a user to open a malicious .m3u file.",2025-08-21,Metasploit,,,
CVE-2010-2018,0.0,,0.03258,CWE-22,Directory traversal vulnerability in downlot.php in Lokomedia CMS 1.4.1 and 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.,2010-05-24,Nuclei,cpe:2.3:a:bukulokomedia:lokomedia_cms:1.4.1:*:*:*:*:*:*:*;cpe:2.3:a:bukulokomedia:lokomedia_cms:2.0:*:*:*:*:*:*:*,Bukulokomedia,Lokomedia Cms
CVE-2010-2033,0.0,,0.15795,CWE-22,Directory traversal vulnerability in the Percha Multicategory Article (com_perchacategoriestree) component 0.6 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.,2010-05-25,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:percha:com_perchacategoriestree:0.6:*:*:*:*:*:*:*,Percha,Com Perchacategoriestree
CVE-2010-2034,0.0,,0.11077,CWE-22,Directory traversal vulnerability in the Percha Image Attach (com_perchaimageattach) component 1.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.,2010-05-25,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:percha:com_perchaimageattach:1.1:*:*:*:*:*:*:*,Percha,Com Perchaimageattach
CVE-2010-2035,0.0,,0.15781,CWE-22,Directory traversal vulnerability in the Percha Gallery (com_perchagallery) component 1.6 Beta for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.,2010-05-25,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:percha:com_perchagallery:1.6:beta:*:*:*:*:*:*,Percha,Com Perchagallery
CVE-2010-2036,0.0,,0.1321,CWE-22,Directory traversal vulnerability in the Percha Fields Attach (com_perchafieldsattach) component 1.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.,2010-05-25,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:percha:com_perchafieldsattach:1.0:*:*:*:*:*:*:*,Percha,Com Perchafieldsattach
CVE-2010-2037,0.0,,0.11077,CWE-22,Directory traversal vulnerability in the Percha Downloads Attach (com_perchadownloadsattach) component 1.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.,2010-05-25,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:percha:com_perchadownloadsattach:1.1:*:*:*:*:*:*:*,Percha,Com Perchadownloadsattach
CVE-2010-2045,0.0,,0.08931,CWE-22,Directory traversal vulnerability in the Dione Form Wizard (aka FDione or com_dioneformwizard) component 1.0.2 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.,2010-05-25,Nuclei,cpe:2.3:a:dionesoft:com_dioneformwizard:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Dionesoft,Com Dioneformwizard
CVE-2010-2050,0.0,,0.13074,CWE-22,Directory traversal vulnerability in the Moron Solutions MS Comment (com_mscomment) component 0.8.0b for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2010-05-25,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:m0r0n:com_mscomment:0.8.0:b:*:*:*:*:*:*,M0R0N,Com Mscomment
CVE-2010-2063,0.0,,0.78702,CWE-119,Buffer overflow in the SMB1 packet chaining implementation in the chain_reply function in process.c in smbd in Samba 3.0.x before 3.3.13 allows remote attackers to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted field in a packet.,2010-06-17,Metasploit,cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2010-2075,0.0,,0.83534,CWE-20,"UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally introduced modification (Trojan Horse) in the DEBUG3_DOLOG_SYSTEM macro, which allows remote attackers to execute arbitrary commands.",2010-06-15,Metasploit,cpe:2.3:a:unrealircd:unrealircd:3.2.8.1:*:*:*:*:*:*:*,Unrealircd,Unrealircd
CVE-2010-2115,0.0,,0.55953,CWE-20,SolarWinds TFTP Server 10.4.0.10 allows remote attackers to cause a denial of service (no new connections) via a crafted read request.,2010-05-28,Metasploit,cpe:2.3:a:solarwinds:tftp_server:10.4.0.10:*:*:*:*:*:*:*,Solarwinds,Tftp Server
CVE-2010-2122,0.0,,0.11663,CWE-22,Directory traversal vulnerability in the SimpleDownload (com_simpledownload) component before 0.9.6 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.,2010-06-01,Nuclei,cpe:2.3:a:joelrowley:com_simpledownload:0.9.5:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Joelrowley,Com Simpledownload
CVE-2010-2128,0.0,,0.15821,CWE-22,Directory traversal vulnerability in the JE Quotation Form (com_jequoteform) component 1.0b1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the view parameter to index.php.,2010-06-01,Nuclei,cpe:2.3:a:harmistechnology:com_jequoteform:1.0:b1:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Harmistechnology,Com Jequoteform
CVE-2010-2156,0.0,,0.76412,CWE-189,ISC DHCP 4.1 before 4.1.1-P1 and 4.0 before 4.0.2-P1 allows remote attackers to cause a denial of service (server exit) via a zero-length client ID.,2010-06-07,Metasploit,cpe:2.3:a:isc:dhcp:4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:isc:dhcp:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:isc:dhcp:4.0.1:b1:*:*:*:*:*:*;cpe:2.3:a:isc:dhcp:4.0.1:rc1:*:*:*:*:*:*;cpe:2.3:a:isc:dhcp:4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:isc:dhcp:4.0.2:b1:*:*:*:*:*:*;cpe:2.3:a:isc:dhcp:4.0.2:b2:*:*:*:*:*:*;cpe:2.3:a:isc:dhcp:4.0.2:b3:*:*:*:*:*:*;cpe:2.3:a:isc:dhcp:4.0.2:rc1:*:*:*:*:*:*;cpe:2.3:a:isc:dhcp:4.1.0:*:*:*:*:*:*:*;cpe:2.3:a:isc:dhcp:4.1.1:*:*:*:*:*:*:*;cpe:2.3:a:isc:dhcp:4.1.1:b1:*:*:*:*:*:*;cpe:2.3:a:isc:dhcp:4.1.1:b2:*:*:*:*:*:*;cpe:2.3:a:isc:dhcp:4.1.1:b3:*:*:*:*:*:*;cpe:2.3:a:isc:dhcp:4.1.1:rc1:*:*:*:*:*:*,Isc,Dhcp
CVE-2010-2227,0.0,,0.54779,CWE-119,"Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with ""recycling of a buffer.""",2010-07-13,Metasploit,cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.26:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.27:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.28:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.29:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*,Apache,Tomcat
CVE-2010-2259,0.0,,0.18524,CWE-22,Directory traversal vulnerability in the BF Survey (com_bfsurvey) component for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.,2010-06-09,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:tamlyncreative:com_bfsurvey_basic:*:*:*:*:*:*:*:*;cpe:2.3:a:tamlyncreative:com_bfsurvey_pro:*:*:*:*:*:*:*:*;cpe:2.3:a:tamlyncreative:com_bfsurvey_profree:1.2.6:*:*:*:*:*:*:*,Tamlyncreative,Com Bfsurvey Profree
CVE-2010-2263,0.0,,0.74328,CWE-200,"nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain source code or unparsed content of arbitrary files under the web document root by appending ::$DATA to the URI.",2010-06-15,Metasploit,cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2010-2307,0.0,,0.08604,CWE-22,"Multiple directory traversal vulnerabilities in the web server for Motorola SURFBoard cable modem SBV6120E running firmware SBV6X2X-1.0.0.5-SCM-02-SHPC allow remote attackers to read arbitrary files via (1) ""//"" (multiple leading slash), (2) ../ (dot dot) sequences, and encoded dot dot sequences in a URL request.",2010-06-16,Nuclei,cpe:2.3:h:motorola:surfboard_sbv6120e:sbv6x2x-1.0.0.5-scm-02-shpc:*:*:*:*:*:*:*,Motorola,Surfboard Sbv6120E
CVE-2010-2309,0.0,,0.50845,CWE-119,Buffer overflow in the web server for EvoLogical EvoCam 3.6.6 and 3.6.7 allows remote attackers to execute arbitrary code via a long GET request.,2010-06-16,Metasploit,cpe:2.3:a:evological:evocam:3.6.6:*:*:*:*:*:*:*;cpe:2.3:a:evological:evocam:3.6.7:*:*:*:*:*:*:*,Evological,Evocam
CVE-2010-2333,0.0,,0.60196,CWE-200,LiteSpeed Technologies LiteSpeed Web Server 4.0.x before 4.0.15 allows remote attackers to read the source code of scripts via an HTTP request with a null byte followed by a .txt file extension.,2010-06-18,Metasploit,cpe:2.3:a:litespeedtech:litespeed_web_server:4.0.10:*:*:*:*:*:*:*;cpe:2.3:a:litespeedtech:litespeed_web_server:4.0.11:*:*:*:*:*:*:*;cpe:2.3:a:litespeedtech:litespeed_web_server:4.0.12:*:*:*:*:*:*:*;cpe:2.3:a:litespeedtech:litespeed_web_server:4.0.13:*:*:*:*:*:*:*;cpe:2.3:a:litespeedtech:litespeed_web_server:4.0.14:*:*:*:*:*:*:*;cpe:2.3:a:litespeedtech:litespeed_web_server:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:litespeedtech:litespeed_web_server:4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:litespeedtech:litespeed_web_server:4.0.3:*:*:*:*:*:*:*;cpe:2.3:a:litespeedtech:litespeed_web_server:4.0.4:*:*:*:*:*:*:*;cpe:2.3:a:litespeedtech:litespeed_web_server:4.0.5:*:*:*:*:*:*:*;cpe:2.3:a:litespeedtech:litespeed_web_server:4.0.6:*:*:*:*:*:*:*;cpe:2.3:a:litespeedtech:litespeed_web_server:4.0.7:*:*:*:*:*:*:*;cpe:2.3:a:litespeedtech:litespeed_web_server:4.0.8:*:*:*:*:*:*:*;cpe:2.3:a:litespeedtech:litespeed_web_server:4.0.9:*:*:*:*:*:*:*;cpe:2.3:a:litespeedtech:litespeed_web_server:4.0:*:*:*:*:*:*:*,Litespeedtech,Litespeed Web Server
CVE-2010-2343,0.0,,0.36733,CWE-119,"Stack-based buffer overflow in D.R. Software Audio Converter 8.1, 2007, and 8.05 allows remote attackers to execute arbitrary code via a crafted pls playlist file.",2010-06-21,Metasploit,cpe:2.3:a:dennisre:audio_converter:2007:*:*:*:*:*:*:*;cpe:2.3:a:dennisre:audio_converter:8.05:*:*:*:*:*:*:*;cpe:2.3:a:dennisre:audio_converter:8.1:*:*:*:*:*:*:*,Dennisre,Audio Converter
CVE-2010-2415,0.0,,0.09736,NVD-CWE-noinfo,"Unspecified vulnerability in the Change Data Capture component in Oracle Database Server 10.1.0.5, 10.2.0.4, 11.1.0.7, and 11.2.0.1 allows remote authenticated users to affect confidentiality and integrity, related to DBMS_CDC_PUBLISH.",2010-10-14,Metasploit,cpe:2.3:a:oracle:database_server:10.1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_server:10.2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_server:11.1.0.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_server:11.2.0.1:*:*:*:*:*:*:*,Oracle,Database Server
CVE-2010-2426,0.0,,0.1226,CWE-22,"Directory traversal vulnerability in TitanFTPd in South River Technologies Titan FTP Server 8.10.1125, and probably earlier versions, allows remote authenticated users to read arbitrary files, determine file size, via ""..//"" sequences in the xcrc command.",2010-06-24,Metasploit,cpe:2.3:a:southrivertech:titan_ftp_server:*:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:1.0.17:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:1.0.18:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:1.0.19:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:1.0.20:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:1.0.21:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:1.0.22:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:1.0.23:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:1.0.24:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:1.0.25:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:1.0.26:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:1.0.27:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:1.0.28:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:1.0.29:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:1.0.30:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:1.0.31:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:1.1.33:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:1.11.34:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:2.0.44:beta:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:2.00.95:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:2.01.96:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:2.02.99:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:2.10.119:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:2.10.120:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:2.10.121:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:2.11.132:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:2.20.140:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:2.21.142:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:2.30.151:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:2.31.152:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:2.40.155:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:3.00.162:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:3.01.163:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:3.02.165:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:3.10.169:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:3.12.172:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:3.20.175:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:3.21.177:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:3.22.178:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:3.30.186:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:4.00.245:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:4.01.246:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:4.02.248:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:4.03.249:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:4.05.252:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:4.10.256:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:4.11.257:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:4.13.260:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:4.14.261:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:4.20.263:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:4.21.264:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:4.22.265:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:4.23.266:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:4.30.269:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:4.31.272:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.00.303:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.01.306:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.02.307:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.03.308:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.03.309:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.03.310:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.04.311:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.04.312:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.04.313:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.04.314:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.04.315:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.05.316:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.05.317:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.05.318:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.05.319:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.05.320:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.05.321:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.05.322:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.05.323:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.05.324:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.05.325:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.05.326:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.05.327:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.10.328:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.10.329:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.11.330:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.11.331:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.12.332:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.12.333:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.12.334:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.12.335:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.12.336:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.20.342:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.21.347:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.22.350:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.23.351:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.24.352:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.25.356:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.26.361:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.27.362:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.30.367:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.31.373:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.32.376:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.33.380:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.33.381:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.35.385:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.36.386:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.37.387:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.38.388:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:5.39.389:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:6.00.492:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:6.01.512:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:6.03.537:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:6.04.545:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:6.05.550:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:6.06.555:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:6.10.560:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:6.20.587:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:6.21.596:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:6.23.616:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:6.24.621:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:6.25.622:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:6.26.630:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:7.00:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:7.01:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:7.02:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:7.10:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:7.12:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:8.00:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:8.01:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:8.10:*:*:*:*:*:*:*,Southrivertech,Titan Ftp Server
CVE-2010-2507,0.0,,0.09432,CWE-22,Directory traversal vulnerability in the Picasa2Gallery (com_picasa2gallery) component 1.2.8 and earlier for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.,2010-06-28,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:masselink:com_picasa2gallery:*:*:*:*:*:*:*:*;cpe:2.3:a:masselink:com_picasa2gallery:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:masselink:com_picasa2gallery:1.1.0:*:*:*:*:*:*:*;cpe:2.3:a:masselink:com_picasa2gallery:1.1.7:*:*:*:*:*:*:*;cpe:2.3:a:masselink:com_picasa2gallery:1.1.9:*:*:*:*:*:*:*;cpe:2.3:a:masselink:com_picasa2gallery:1.2.1:*:*:*:*:*:*:*;cpe:2.3:a:masselink:com_picasa2gallery:1.2.2:*:*:*:*:*:*:*;cpe:2.3:a:masselink:com_picasa2gallery:1.2.5:*:*:*:*:*:*:*;cpe:2.3:a:masselink:com_picasa2gallery:1.2.7:*:*:*:*:*:*:*,Masselink,Com Picasa2Gallery
CVE-2010-2550,0.0,,0.7572,CWE-20,"The SMB Server in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate fields in an SMB request, which allows remote attackers to execute arbitrary code via a crafted SMB packet, aka ""SMB Pool Overflow Vulnerability.""",2010-08-11,Metasploit,cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:r2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:r2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*,Microsoft,Windows 2003 Server
CVE-2010-2568,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.91324,NVD-CWE-noinfo,"Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.",2010-07-22,CISA/Metasploit,cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:-:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2010-2572,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.62598,CWE-120,"Buffer overflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint 95 document, aka ""PowerPoint Parsing Buffer Overflow Vulnerability.""",2010-11-10,CISA,cpe:2.3:a:microsoft:powerpoint:2002:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:powerpoint:2003:sp3:*:*:*:*:*:*,Microsoft,Powerpoint
CVE-2010-2590,0.0,,0.46776,CWE-119,Heap-based buffer overflow in the CrystalReports12.CrystalPrintControl.1 ActiveX control in PrintControl.dll 12.3.2.753 in SAP Crystal Reports 2008 SP3 Fix Pack 3.2 allows remote attackers to execute arbitrary code via a long ServerResourceVersion property value.,2010-12-22,Metasploit,cpe:2.3:a:sap:crystal_reports:2008:sp3_fp3.2:*:*:*:*:*:*,Sap,Crystal Reports
CVE-2010-2620,0.0,,0.28605,CWE-287,"Open&Compact FTP Server (Open-FTPD) 1.2 and earlier allows remote attackers to bypass authentication by sending (1) LIST, (2) RETR, (3) STOR, or other commands without performing the required login steps first.",2010-07-02,Metasploit,cpe:2.3:a:open-ftpd:open-ftpd:*:*:*:*:*:*:*:*;cpe:2.3:a:open-ftpd:open-ftpd:1.0:*:*:*:*:*:*:*,Open-Ftpd,Open-Ftpd
CVE-2010-2680,0.0,,0.04848,CWE-22,Directory traversal vulnerability in the JExtensions JE Section/Property Finder (jesectionfinder) component for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the view parameter to index.php.,2010-07-12,Nuclei,cpe:2.3:a:harmistechnology:com_jesectionfinder:*:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Harmistechnology,Com Jesectionfinder
CVE-2010-2682,0.0,,0.14311,CWE-22,Directory traversal vulnerability in the Realtyna Translator (com_realtyna) component 1.0.15 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.,2010-07-12,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:realtyna:com_realtyna:1.0.15:*:*:*:*:*:*:*,Realtyna,Com Realtyna
CVE-2010-2703,0.0,,0.71381,CWE-119,"Stack-based buffer overflow in the execvp_nc function in the ov.dll module in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53, when running on Windows, allows remote attackers to execute arbitrary code via a long HTTP request to webappmon.exe.",2010-07-28,Metasploit,cpe:2.3:a:hp:openview_network_node_manager:7.51:-:windows:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:windows:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2010-2709,0.0,,0.42261,CWE-119,Stack-based buffer overflow in webappmon.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long OvJavaLocale value in a cookie.,2010-08-05,Metasploit,cpe:2.3:a:hp:openview_network_node_manager:7.51:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:hp-ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.51:-:windows:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:hp-ux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:linux:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:solaris:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:-:windows:*:*:*:*:*,Hp,Openview Network Node Manager
CVE-2010-2729,0.0,,0.75636,CWE-20,"The Print Spooler service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, when printer sharing is enabled, does not properly validate spooler access permissions, which allows remote attackers to create files in a system directory, and consequently execute arbitrary code, by sending a crafted print request over RPC, as exploited in the wild in September 2010, aka ""Print Spooler Service Impersonation Vulnerability.""",2010-09-15,Metasploit,cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*,Microsoft,Windows 7
CVE-2010-2731,0.0,,0.31118,CWE-287,"Unspecified vulnerability in Microsoft Internet Information Services (IIS) 5.1 on Windows XP SP3, when directory-based Basic Authentication is enabled, allows remote attackers to bypass intended access restrictions and execute ASP files via a crafted request, aka ""Directory Authentication Bypass Vulnerability.""",2010-09-15,Metasploit,cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*,Microsoft,Windows Xp
CVE-2010-2743,0.0,,0.14849,NVD-CWE-Other,"The kernel-mode drivers in Microsoft Windows XP SP3 do not properly perform indexing of a function-pointer table during the loading of keyboard layouts from disk, which allows local users to gain privileges via a crafted application, as demonstrated in the wild in July 2010 by the Stuxnet worm, aka ""Win32k Keyboard Layout Vulnerability.""  NOTE: this might be a duplicate of CVE-2010-3888 or CVE-2010-3889.",2011-01-20,Metasploit,cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:r2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:r2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*,Microsoft,Windows 2003 Server
CVE-2010-2857,0.0,,0.04848,CWE-22,Directory traversal vulnerability in the Music Manager component for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the cid parameter to album.html.,2010-07-25,Nuclei,cpe:2.3:a:danieljamesscott:com_music:0.10:*:*:*:*:*:*:*;cpe:2.3:a:danieljamesscott:com_music:0.11:*:*:*:*:*:*:*;cpe:2.3:a:danieljamesscott:com_music:0.12:*:*:*:*:*:*:*;cpe:2.3:a:danieljamesscott:com_music:0.1:-:*:*:*:*:*:*;cpe:2.3:a:danieljamesscott:com_music:0.2:*:*:*:*:*:*:*;cpe:2.3:a:danieljamesscott:com_music:0.3:*:*:*:*:*:*:*;cpe:2.3:a:danieljamesscott:com_music:0.4:*:*:*:*:*:*:*;cpe:2.3:a:danieljamesscott:com_music:0.5:*:*:*:*:*:*:*;cpe:2.3:a:danieljamesscott:com_music:0.6:*:*:*:*:*:*:*;cpe:2.3:a:danieljamesscott:com_music:0.7:*:*:*:*:*:*:*;cpe:2.3:a:danieljamesscott:com_music:0.8:*:*:*:*:*:*:*;cpe:2.3:a:danieljamesscott:com_music:0.9:*:*:*:*:*:*:*,Danieljamesscott,Com Music
CVE-2010-2861,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99721,CWE-22,"Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.",2010-08-11,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*,Adobe,Coldfusion
CVE-2010-2883,7.3,CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H,0.82485,CWE-787,"Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information.",2010-09-09,CISA/Metasploit,cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Apple,Macos
CVE-2010-2918,0.0,,0.13704,CWE-94,PHP remote file inclusion vulnerability in core/include/myMailer.class.php in the Visites (com_joomla-visites) component 1.1 RC2 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.,2010-07-30,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:visocrea:com_joomla_visites:1.1:rc2:*:*:*:*:*:*,Visocrea,Com Joomla Visites
CVE-2010-2920,0.0,,0.05688,CWE-22,Directory traversal vulnerability in the Foobla Suggestions (com_foobla_suggestions) component 1.5.1.2 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.,2010-07-30,Nuclei,cpe:2.3:a:foobla:com_foobla_suggestions:1.5.1.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Foobla,Com Foobla Suggestions
CVE-2010-3007,0.0,,0.05518,NVD-CWE-noinfo,"Unspecified vulnerability in HP Data Protector Express, and Data Protector Express Single Server Edition (SSE), 3.x before build 56936 and 4.x before build 56906 allows local users to gain privileges or cause a denial of service via unknown vectors.",2010-09-09,Metasploit,cpe:2.3:a:hp:data_protector_express:3.1:*:*:*:*:*:*:*;cpe:2.3:a:hp:data_protector_express:3.1:*:single_server:*:*:*:*:*;cpe:2.3:a:hp:data_protector_express:3.5:sp1:*:*:*:*:*:*;cpe:2.3:a:hp:data_protector_express:3.5:sp1:single_server:*:*:*:*:*;cpe:2.3:a:hp:data_protector_express:3.5:sp2:*:*:*:*:*:*;cpe:2.3:a:hp:data_protector_express:3.5:sp2:single_server:*:*:*:*:*;cpe:2.3:a:hp:data_protector_express:4.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:data_protector_express:4.0:*:single_server:*:*:*:*:*;cpe:2.3:a:hp:data_protector_express:4.0:sp1:*:*:*:*:*:*;cpe:2.3:a:hp:data_protector_express:4.0:sp1:single_server:*:*:*:*:*,Hp,Data Protector Express
CVE-2010-3035,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.05562,NVD-CWE-noinfo,"Cisco IOS XR 3.4.0 through 3.9.1, when BGP is enabled, does not properly handle unrecognized transitive attributes, which allows remote attackers to cause a denial of service (peering reset) via a crafted prefix announcement, as demonstrated in the wild in August 2010 with attribute type code 99, aka Bug ID CSCti62211.",2010-08-30,CISA,cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*,Cisco,Ios Xr
CVE-2010-3106,0.0,,0.37328,CWE-20,"The ienipp.ocx ActiveX control in the browser plugin in Novell iPrint Client before 5.42 does not properly validate the debug parameter, which allows remote attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via a parameter value with a crafted length, related to the ExecuteRequest method.",2010-08-23,Metasploit,cpe:2.3:a:novell:iprint:*:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:4.26:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:4.27:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:4.28:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:4.30:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:4.32:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:4.34:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:4.36:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:4.38:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:5.04:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:5.12:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:5.20b:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:5.30:*:*:*:*:*:*:*;cpe:2.3:a:novell:iprint:5.32:*:*:*:*:*:*:*,Novell,Iprint
CVE-2010-3189,0.0,,0.39216,CWE-94,The extSetOwner function in the UfProxyBrowserCtrl ActiveX control (UfPBCtrl.dll) in Trend Micro Internet Security Pro 2010 allows remote attackers to execute arbitrary code via an invalid address that is dereferenced as a pointer.,2010-08-31,Metasploit,cpe:2.3:a:trendmicro:internet_security:2010:-:pro:*:*:*:*:*,Trendmicro,Internet Security
CVE-2010-3203,0.0,,0.08523,CWE-22,Directory traversal vulnerability in the PicSell (com_picsell) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the dflink parameter in a prevsell dwnfree action to index.php.,2010-09-03,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:xmlswf:com_picsell:1.0:*:*:*:*:*:*:*,Xmlswf,Com Picsell
CVE-2010-3275,0.0,,0.75515,CWE-119,"libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a crafted width in an AMV file, related to a ""dangling pointer vulnerability.""",2011-03-28,Metasploit,cpe:2.3:a:videolan:vlc_media_player:*:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.1.99b:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.1.99e:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.1.99f:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.1.99g:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.1.99h:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.1.99i:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.60:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.61:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.62:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.63:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.70:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.71:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.72:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.73:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.80:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.81:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.82:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.83:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.90:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.91:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.92:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.3.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.3.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.4.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.4.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.4.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.4.3:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.4.4:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.4.5:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.4.6:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.5.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.5.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.5.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.5.3:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.6.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.6.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.6.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.7.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.7.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.4:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.5:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.6:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.10:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.3:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.4:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.5:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.6:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.8a:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.9:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.3:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.4:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.5:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.6.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.6:*:*:*:*:*:*:*,Videolan,Vlc Media Player
CVE-2010-3333,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.89497,CWE-787,"Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka ""RTF Stack Buffer Overflow Vulnerability.""",2010-11-10,CISA/Metasploit,cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2004:*:*:*:*:macos:*:*;cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2008:*:*:*:*:macos:*:*;cpe:2.3:a:microsoft:office:2010:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2011:*:*:*:*:macos:*:*;cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:open_xml_file_format_converter:-:*:*:*:*:macos:*:*,Microsoft,Office
CVE-2010-3338,0.0,,0.20037,CWE-20,"The Windows Task Scheduler in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly determine the security context of scheduled tasks, which allows local users to gain privileges via a crafted application, aka ""Task Scheduler Vulnerability."" NOTE: this might overlap CVE-2010-3888.",2010-12-16,Metasploit,cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2010-3407,0.0,,0.41475,CWE-119,"Stack-based buffer overflow in the MailCheck821Address function in nnotes.dll in the nrouter.exe service in the server in IBM Lotus Domino 8.0.x before 8.0.2 FP5 and 8.5.x before 8.5.1 FP2 allows remote attackers to execute arbitrary code via a long e-mail address in an ORGANIZER:mailto header in an iCalendar calendar-invitation e-mail message, aka SPR NRBY7ZPJ9V.",2010-09-16,Metasploit,cpe:2.3:a:ibm:lotus_domino:8.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_domino:8.0.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_domino:8.0.2.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_domino:8.0.2.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_domino:8.0.2.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_domino:8.0.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_domino:8.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_domino:8.5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_domino:8.5.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_domino:8.5.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_domino:8.5.1:*:*:*:*:*:*:*,Ibm,Lotus Domino
CVE-2010-3426,0.0,,0.1385,CWE-22,Directory traversal vulnerability in jphone.php in the JPhone (com_jphone) component 1.0 Alpha 3 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.,2010-09-16,Nuclei,cpe:2.3:a:4you-studio:com_jphone:1.0:alpha3:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,4You-Studio,Com Jphone
CVE-2010-3552,0.0,,0.8074,NVD-CWE-noinfo,"Unspecified vulnerability in the New Java Plug-in component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.",2010-10-19,Metasploit,cpe:2.3:a:sun:jdk:*:update_21:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update1:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update1_b06:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_19:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_20:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:jre:*:update_21:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_19:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_20:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*,Sun,Jre
CVE-2010-3563,0.0,,0.8425,NVD-CWE-noinfo,"Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to ""how Web Start retrieves security policies,"" BasicServiceImpl, and forged policies that bypass sandbox restrictions.",2010-10-19,Metasploit,cpe:2.3:a:sun:jdk:*:update_21:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update1:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update1_b06:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_19:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_20:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:jre:*:update_21:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_19:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_20:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*,Sun,Jre
CVE-2010-3585,0.0,,0.52706,NVD-CWE-noinfo,"Unspecified vulnerability in the OracleVM component in Oracle VM 2.2.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to ovs-agent. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a third party researcher that this is related to the exposure of unspecified functions using XML-RPC.",2010-10-14,Metasploit,cpe:2.3:a:oracle:vm:2.2.1:*:*:*:*:*:*:*,Oracle,Vm
CVE-2010-3600,0.0,,0.76694,NVD-CWE-noinfo,"Unspecified vulnerability in the Client System Analyzer component in Oracle Database Server 11.1.0.7 and 11.2.0.1 and Enterprise Manager Grid Control 10.2.0.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2011 CPU.  Oracle has not commented on claims from a reliable third party coordinator that this issue involves an exposed JSP script that accepts XML uploads in conjunction with NULL bytes in an unspecified parameter that allow execution of arbitrary code.",2011-01-19,Metasploit,cpe:2.3:a:oracle:database_server:11.1.0.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_server:11.2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_grid_control:10.2.0.5:*:*:*:*:*:*:*,Oracle,Database Server
CVE-2010-3653,0.0,,0.74626,CWE-119,"The Director module (dirapi.dll) in Adobe Shockwave Player before 11.5.9.615 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a Director movie with a crafted rcsL chunk containing a field whose value is used as a pointer offset, as exploited in the wild in October 2010. NOTE: some of these details are obtained from third party information.",2010-10-26,Metasploit,cpe:2.3:a:adobe:shockwave_player:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:1.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:10.0.0.210:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:10.0.1.004:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:10.1.0.011:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:10.1.0.11:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:10.1.1.016:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:10.1.4.020:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:10.2.0.021:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:10.2.0.022:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:10.2.0.023:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:11.0.0.456:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:11.0.3.471:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:11.5.0.595:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:11.5.0.596:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:11.5.1.601:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:11.5.2.602:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:11.5.6.606:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:11.5.7.609:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:2.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:3.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:4.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:5.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:6.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:8.0.196:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:8.0.196a:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:8.0.204:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:8.0.205:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:8.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:8.5.1.100:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:8.5.1.103:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:8.5.1.105:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:8.5.1.106:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:8.5.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:8.5.321:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:8.5.323:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:8.5.324:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:8.5.325:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:9.0.383:*:*:*:*:*:*:*;cpe:2.3:a:adobe:shockwave_player:9.0.432:*:*:*:*:*:*:*,Adobe,Shockwave Player
CVE-2010-3654,0.0,,0.69679,CWE-119,"Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris and 10.1.95.1 on Android, and authplay.dll (aka AuthPlayLib.bundle or libauthplay.so.0.0.0) in Adobe Reader and Acrobat 9.x through 9.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted SWF content, as exploited in the wild in October 2010.",2010-10-29,Metasploit,cpe:2.3:a:adobe:acrobat:9.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.1.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.1.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.1.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.3.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.3.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.3.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.3.4:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.4:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.1.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.1.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.1.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.3.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.3.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.3.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.3.4:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.4:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.0.0.584:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.0.12.10:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.0.12.36:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.0.15.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.0.22.87:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.0.32.18:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.0.42.34:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.0.45.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.52.14.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.52.15:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.53.64:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.82.76:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.85.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.92.10:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.92.8:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:6.0.21.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:6.0.79:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.25:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.63:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.69.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.70.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.1.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:8.0.22.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:8.0.24.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:8.0.33.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:8.0.34.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:8.0.35.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:8.0.39.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:8.0.42.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:8.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.112.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.114.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.115.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.124.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.125.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.151.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.152.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.159.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.16:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.18d60:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.20.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.20:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.246.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.260.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.28.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.28:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.31.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.31:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.45.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.47.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.48.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.125.0:*:*:*:*:*:*:*;cpe:2.3:a:macromedia:flash_player:5.0:*:*:*:*:*:*:*;cpe:2.3:a:macromedia:flash_player:5.0_r50:*:*:*:*:*:*:*;cpe:2.3:a:macromedia:flash_player:6.0.29.0:*:*:*:*:*:*:*;cpe:2.3:a:macromedia:flash_player:6.0.40.0:*:*:*:*:*:*:*;cpe:2.3:a:macromedia:flash_player:6.0.47.0:*:*:*:*:*:*:*;cpe:2.3:a:macromedia:flash_player:6.0.65.0:*:*:*:*:*:*:*;cpe:2.3:a:macromedia:flash_player:6.0.79.0:*:*:*:*:*:*:*;cpe:2.3:a:macromedia:flash_player:6.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:google:android:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*;cpe:2.3:o:oracle:solaris:*:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2010-3714,0.0,,0.24558,CWE-264,"The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not properly compare certain hash values during access-control decisions, which allows remote attackers to read arbitrary files via unspecified vectors.",2010-10-25,Metasploit,cpe:2.3:a:typo3:typo3:4.2.0:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.2.10:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.2.11:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.2.12:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.2.13:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.2.14:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.2.1:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.2.2:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.2.3:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.2.4:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.2.5:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.2.6:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.2.7:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.2.8:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.2.9:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.3.0:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.3.1:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.3.2:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.3.3:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.3.4:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.3.5:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.3.6:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.4.1:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.4.2:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.4.3:*:*:*:*:*:*:*;cpe:2.3:a:typo3:typo3:4.4:*:*:*:*:*:*:*,Typo3,Typo3
CVE-2010-3747,0.0,,0.35352,CWE-119,"An ActiveX control in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, and RealPlayer Enterprise 2.1.2 does not properly initialize an unspecified object component during parsing of a CDDA URI, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer dereference and application crash) via a long URI.",2010-10-19,Metasploit,cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:2.1.2:*:enterprise:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.1.3:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.1.4:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.1:*:*:*:*:*:*:*,Realnetworks,Realplayer
CVE-2010-3765,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.83279,CWE-119,"Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October 2010 by the Belmoo malware.",2010-10-28,CISA/Metasploit,cpe:2.3:a:mozilla:firefox:3.5.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:alpha_1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:alpha_2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:alpha_3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:beta_1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:beta_2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:rc1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:rc2:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.5:*:*:*:*:*:*:*,Mozilla,Firefox
CVE-2010-3847,0.0,,0.08747,CWE-59,"elf/dl-load.c in ld.so in the GNU C Library (aka glibc or libc6) through 2.11.2, and 2.12.x through 2.12.1, does not properly handle a value of $ORIGIN for the LD_AUDIT environment variable, which allows local users to gain privileges via a crafted dynamic shared object (DSO) located in an arbitrary directory.",2011-01-07,Metasploit,cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:1.00:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:1.01:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:1.02:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:1.03:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:1.04:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:1.05:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:1.06:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:1.07:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:1.08:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:1.09.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:1.09:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.0.6:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.0:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.1.1.6:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.1.2:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.1.3.10:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.1.3:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.1.9:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.10.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.10.2:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.10:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.11.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.11:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.12.0:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.12.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.2.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.2.2:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.2.3:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.2.4:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.2.5:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.2:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.3.10:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.3.2:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.3.3:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.3.4:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.3.5:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.3.6:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.3:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.4:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.5:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.6.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.6:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.7:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.8:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.9:*:*:*:*:*:*:*,Gnu,Glibc
CVE-2010-3856,0.0,,0.10041,CWE-264,"ld.so in the GNU C Library (aka glibc or libc6) before 2.11.3, and 2.12.x before 2.12.2, does not properly restrict use of the LD_AUDIT environment variable to reference dynamic shared objects (DSOs) as audit objects, which allows local users to gain privileges by leveraging an unsafe DSO located in a trusted library directory, as demonstrated by libpcprofile.so.",2011-01-07,Metasploit,cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:1.00:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:1.01:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:1.02:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:1.03:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:1.04:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:1.05:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:1.06:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:1.07:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:1.08:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:1.09.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:1.09:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.0.6:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.0:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.1.1.6:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.1.2:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.1.3.10:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.1.3:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.1.9:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.10.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.10.2:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.10:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.11.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.11:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.12.0:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.12.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.2.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.2.2:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.2.3:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.2.4:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.2.5:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.2:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.3.10:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.3.2:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.3.3:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.3.4:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.3.5:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.3.6:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.3:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.4:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.5:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.6.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.6:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.7:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.8:*:*:*:*:*:*:*;cpe:2.3:a:gnu:glibc:2.9:*:*:*:*:*:*:*,Gnu,Glibc
CVE-2010-3867,0.0,,0.07502,CWE-22,"Multiple directory traversal vulnerabilities in the mod_site_misc module in ProFTPD before 1.3.3c allow remote authenticated users to create directories, delete directories, create symlinks, and modify file timestamps via directory traversal sequences in a (1) SITE MKDIR, (2) SITE RMDIR, (3) SITE SYMLINK, or (4) SITE UTIME command.",2010-11-09,Nuclei,cpe:2.3:a:proftpd:proftpd:1.2.10:*:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.2.10:rc1:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.2.10:rc2:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.2.10:rc3:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.0:a:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.0:rc1:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.0:rc2:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.0:rc3:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.0:rc4:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.0:rc5:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.1:*:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.1:rc1:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.1:rc2:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.1:rc3:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.2:*:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.2:a:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.2:b:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.2:c:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.2:d:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.2:e:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.2:rc1:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.2:rc2:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.2:rc3:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.2:rc4:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.3:*:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.3:a:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.3:b:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.3:rc1:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.3:rc2:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.3:rc3:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.3:rc4:*:*:*:*:*:*,Proftpd,Proftpd
CVE-2010-3904,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.12159,CWE-1284,"The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.",2010-12-06,CISA/Metasploit,cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_real_time_extension:11:sp1:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:3.5:*:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:4.0:*:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:4.1:*:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:5.0:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2010-3962,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96889,CWE-416,"Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an ""invalid flag reference"" issue or ""Uninitialized Memory Corruption Vulnerability,"" as exploited in the wild in November 2010.",2010-11-05,CISA/EPSS/Metasploit,cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:-:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows Server 2003
CVE-2010-3964,0.0,,0.93916,NVD-CWE-Other,"Unrestricted file upload vulnerability in the Document Conversions Launcher Service in Microsoft Office SharePoint Server 2007 SP2, when the Document Conversions Load Balancer Service is enabled, allows remote attackers to execute arbitrary code via a crafted SOAP request to TCP port 8082, aka ""Malformed Request Code Execution Vulnerability.""",2010-12-16,Metasploit,cpe:2.3:a:microsoft:sharepoint_server:2007:sp2:x32:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2007:sp2:x64:*:*:*:*:*,Microsoft,Sharepoint Server
CVE-2010-3970,0.0,,0.67687,CWE-119,"Stack-based buffer overflow in the CreateSizedDIBSECTION function in shimgvw.dll in the Windows Shell graphics processor (aka graphics rendering engine) in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted .MIC or unspecified Office document containing a thumbnail bitmap with a negative biClrUsed value, as reported by Moti and Xu Hao, aka ""Windows Shell Graphics Processing Overrun Vulnerability.""",2010-12-22,Metasploit,cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*,Microsoft,Windows Server 2003
CVE-2010-3971,0.0,,0.81663,CWE-399,"Use-after-free vulnerability in the CSharedStyleSheet::Notify function in the Cascading Style Sheets (CSS) parser in mshtml.dll, as used in Microsoft Internet Explorer 6 through 8 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a self-referential @import rule in a stylesheet, aka ""CSS Memory Corruption Vulnerability.""",2010-12-22,Metasploit,cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*,Microsoft,Internet Explorer
CVE-2010-3972,0.0,,0.94534,CWE-119,"Heap-based buffer overflow in the TELNET_STREAM_CONTEXT::OnSendData function in ftpsvc.dll in Microsoft FTP Service 7.0 and 7.5 for Internet Information Services (IIS) 7.0, and IIS 7.5, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted FTP command, aka ""IIS FTP Service Heap Buffer Overrun Vulnerability."" NOTE: some of these details are obtained from third party information.",2010-12-23,Metasploit,cpe:2.3:a:microsoft:internet_information_services:7.5:*:*:*:*:*:*:*,Microsoft,Internet Information Services
CVE-2010-3973,0.0,,0.71735,CWE-94,"The WMITools ActiveX control in WBEMSingleView.ocx 1.50.1131.0 in Microsoft WMI Administrative Tools 1.1 and earlier in Microsoft Windows XP SP2 and SP3 allows remote attackers to execute arbitrary code via a crafted argument to the AddContextRef method, possibly an untrusted pointer dereference, aka ""Microsoft WMITools ActiveX Control Vulnerability.""",2010-12-23,Metasploit,cpe:2.3:a:microsoft:wmi_administrative_tools:*:*:*:*:*:*:*:*,Microsoft,Wmi Administrative Tools
CVE-2010-4094,0.0,,0.64496,CWE-255,"The Tomcat server in IBM Rational Quality Manager and Rational Test Lab Manager has a default password for the ADMIN account, which makes it easier for remote attackers to execute arbitrary code by leveraging access to the manager role.  NOTE: this might overlap CVE-2009-3548.",2010-10-26,Metasploit,cpe:2.3:a:ibm:rational_quality_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:ibm:rational_test_lab_manager:*:*:*:*:*:*:*:*,Ibm,Rational Quality Manager
CVE-2010-4142,0.0,,0.63573,CWE-119,"Multiple stack-based buffer overflows in DATAC RealWin 2.0 Build 6.1.8.10 and earlier allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) SCPC_INITIALIZE, (2) SCPC_INITIALIZE_RF, or (3) SCPC_TXTEVENT packet. NOTE: it was later reported that 1.06 is also affected by one of these requests.",2010-11-02,Metasploit,cpe:2.3:a:realflex:realwin:1.06:*:*:*:*:*:*:*;cpe:2.3:a:realflex:realwin:2.0:*:*:*:*:*:*:*,Realflex,Realwin
CVE-2010-4170,0.0,,0.05346,CWE-264,"The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before executing modprobe, which allows local users to gain privileges by setting the MODPROBE_OPTIONS environment variable to specify a malicious configuration file.",2010-12-07,Metasploit,cpe:2.3:a:systemtap:systemtap:1.3:*:*:*:*:*:*:*,Systemtap,Systemtap
CVE-2010-4221,0.0,,0.91303,CWE-119,Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a (1) FTP or (2) FTPS server.,2010-11-09,Metasploit,cpe:2.3:a:proftpd:proftpd:1.3.2:*:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.2:a:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.2:b:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.2:c:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.2:d:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.2:e:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.2:rc3:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.2:rc4:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.3:*:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.3:a:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.3:b:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.3:rc1:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.3:rc2:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.3:rc3:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.3:rc4:*:*:*:*:*:*,Proftpd,Proftpd
CVE-2010-4231,0.0,,0.1633,CWE-22,Directory traversal vulnerability in the web-based administration interface on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.,2010-11-17,Nuclei,cpe:2.3:a:camtron:cmnc-200_firmware:1.102a-008:*:*:*:*:*:*:*;cpe:2.3:a:tecvoz:cmnc-200_firmware:1.102a-008:*:*:*:*:*:*:*;cpe:2.3:h:camtron:cmnc-200:*:*:*:*:*:*:*:*;cpe:2.3:h:tecvoz:cmnc-200:*:*:*:*:*:*:*:*,Camtron,Cmnc-200 Firmware
CVE-2010-4239,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.1343,CWE-20,Tiki Wiki CMS Groupware 5.2 has Local File Inclusion,2019-10-28,Nuclei,cpe:2.3:a:tiki:tikiwiki_cms\/groupware:5.2:*:*:*:*:*:*:*,Tiki,Tikiwiki Cms/Groupware
CVE-2010-4279,0.0,,0.65618,CWE-287,"The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which allows remote attackers to bypass authentication by sending a request to index.php with ""admin"" in the loginhash_user parameter, in conjunction with the md5 hash of ""admin"" in the loginhash_data parameter.",2010-12-02,Metasploit,cpe:2.3:a:artica:pandora_fms:*:*:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:1.2:*:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:1.3.1:*:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:1.3:*:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:1.3:beta1:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:1.3:beta2:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:1.3:beta3:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:1.3:beta:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:2.0:*:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:2.0:beta:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:2.1:*:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:3.0:*:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:3.0:rc1:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:3.0:rc2:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:3.1:rc1:*:*:*:*:*:*,Artica,Pandora Fms
CVE-2010-4282,0.0,,0.19495,CWE-22,"Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora_help.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php.",2010-12-02,Nuclei,cpe:2.3:a:artica:pandora_fms:*:*:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:1.2:*:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:1.3.1:*:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:1.3:*:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:1.3:beta1:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:1.3:beta2:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:1.3:beta3:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:1.3:beta:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:2.0:*:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:2.0:beta:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:2.1:*:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:3.0:*:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:3.0:rc1:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:3.0:rc2:*:*:*:*:*:*;cpe:2.3:a:artica:pandora_fms:3.1:rc1:*:*:*:*:*:*,Artica,Pandora Fms
CVE-2010-4321,0.0,,0.32951,CWE-119,"Stack-based buffer overflow in an ActiveX control in ienipp.ocx in Novell iPrint Client 5.52 allows remote attackers to execute arbitrary code via a long argument to (1) the GetDriverSettings2 method, as reachable by (2) the GetDriverSettings method.",2010-12-30,Metasploit,cpe:2.3:a:novell:iprint_client:5.52:*:*:*:*:*:*:*,Novell,Iprint Client
CVE-2010-4335,0.0,,0.55204,CWE-20,"The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Token][fields] value that is processed by the unserialize function, as demonstrated by modifying the file_map cache to execute arbitrary local files.",2011-01-14,Metasploit,cpe:2.3:a:cakefoundation:cakephp:1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:cakephp:cakephp:1.2.8:*:*:*:*:*:*:*;cpe:2.3:a:cakephp:cakephp:1.3.0:alpha:*:*:*:*:*:*;cpe:2.3:a:cakephp:cakephp:1.3.0:beta:*:*:*:*:*:*;cpe:2.3:a:cakephp:cakephp:1.3.0:rc1:*:*:*:*:*:*;cpe:2.3:a:cakephp:cakephp:1.3.0:rc2:*:*:*:*:*:*;cpe:2.3:a:cakephp:cakephp:1.3.0:rc3:*:*:*:*:*:*;cpe:2.3:a:cakephp:cakephp:1.3.0:rc4:*:*:*:*:*:*;cpe:2.3:a:cakephp:cakephp:1.3.1:*:*:*:*:*:*:*;cpe:2.3:a:cakephp:cakephp:1.3.2:*:*:*:*:*:*:*;cpe:2.3:a:cakephp:cakephp:1.3.3:*:*:*:*:*:*:*;cpe:2.3:a:cakephp:cakephp:1.3.4:*:*:*:*:*:*:*;cpe:2.3:a:cakephp:cakephp:1.3.5:*:*:*:*:*:*:*;cpe:2.3:a:cakephp:cakephp:1.3:dev:*:*:*:*:*:*,Cakefoundation,Cakephp
CVE-2010-4344,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.71901,CWE-787,"Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.",2010-12-14,CISA/Metasploit,cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:*,Opensuse,Opensuse
CVE-2010-4345,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.17794,NVD-CWE-noinfo,"Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.",2010-12-14,CISA/Metasploit,cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:*,Opensuse,Opensuse
CVE-2010-4398,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.08661,CWE-787,"Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka ""Driver Improper Interaction with Windows Kernel Vulnerability.""",2010-12-06,CISA,cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2010-4417,0.0,,0.78665,NVD-CWE-noinfo,"Unspecified vulnerability in the Services for Beehive component in Oracle Fusion Middleware 2.0.1.0, 2.0.1.1, 2.0.1.2, 2.0.1.2.1, and 2.0.1.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the January 2011 CPU.  Oracle has not commented on claims from a reliable third party coordinator that voice-servlet/prompt-qa/Index.jspf does not properly handle null (%00) bytes in the evaluation parameter that is used in a filename, which allows attackers to create a file with an executable extension and execute arbitrary JSP code.",2011-01-19,Metasploit,cpe:2.3:a:oracle:beehive:2.0.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:beehive:2.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:beehive:2.0.1.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:beehive:2.0.1.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:beehive:2.0.1.3:*:*:*:*:*:*:*,Oracle,Beehive
CVE-2010-4452,0.0,,0.8316,NVD-CWE-noinfo,"Unspecified vulnerability in the Deployment component in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors.",2011-02-17,Metasploit,cpe:2.3:a:sun:jdk:*:update_23:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update1:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update1_b06:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_19:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_20:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_21:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_22:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:jre:*:update_23:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_19:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_20:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_21:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_22:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*,Sun,Jre
CVE-2010-4566,0.0,,0.27795,NVD-CWE-noinfo,"The web authentication form in the NT4 authentication component in Citrix Access Gateway Enterprise Edition 9.2-49.8 and earlier, and the NTLM authentication component in Access Gateway Standard and Advanced Editions before Access Gateway 5.0, allows attackers to execute arbitrary commands via shell metacharacters in the password field.",2011-01-14,Metasploit,cpe:2.3:a:citrix:access_gateway:*:*:enterprise:*:*:*:*:*;cpe:2.3:a:citrix:access_gateway:.8.0:m50.3:enterprise:*:*:*:*:*;cpe:2.3:a:citrix:access_gateway:4.5.5:*:standard:*:*:*:*:*;cpe:2.3:a:citrix:access_gateway:4.5.6:*:standard:*:*:*:*:*;cpe:2.3:a:citrix:access_gateway:4.5.7:*:standard:*:*:*:*:*;cpe:2.3:a:citrix:access_gateway:4.5:*:advanced:*:*:*:*:*;cpe:2.3:a:citrix:access_gateway:4.5:*:standard:*:*:*:*:*;cpe:2.3:a:citrix:access_gateway:4.5:hf1:*:*:*:*:*:*;cpe:2.3:a:citrix:access_gateway:4.5:hf1:advanced:*:*:*:*:*;cpe:2.3:a:citrix:access_gateway:4.6.1:*:standard:*:*:*:*:*;cpe:2.3:a:citrix:access_gateway:4.6.2:*:standard:*:*:*:*:*;cpe:2.3:a:citrix:access_gateway:4.6.3:*:standard:*:*:*:*:*;cpe:2.3:a:citrix:access_gateway:8.0:m48.7:enterprise:*:*:*:*:*;cpe:2.3:a:citrix:access_gateway:8.0:m49.2:enterprise:*:*:*:*:*;cpe:2.3:a:citrix:access_gateway:8.0:m59.1:enterprise:*:*:*:*:*;cpe:2.3:a:citrix:access_gateway:8.1-69.4:*:enterprise:*:*:*:*:*;cpe:2.3:a:citrix:access_gateway:9.0.71.3:*:enterprise:*:*:*:*:*;cpe:2.3:a:citrix:access_gateway:9.1-104.5:*:enterprise:*:*:*:*:*,Citrix,Access Gateway
CVE-2010-4617,0.0,,0.08571,CWE-22,Directory traversal vulnerability in the JotLoader (com_jotloader) component 2.2.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the section parameter to index.php.,2010-12-29,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:kanich:com_jotloader:2.2.1:*:*:*:*:*:*:*,Kanich,Com Jotloader
CVE-2010-4719,0.0,,0.15786,CWE-22,Directory traversal vulnerability in JRadio (com_jradio) component before 1.5.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.,2011-02-01,Nuclei,cpe:2.3:a:fxwebdesign:com_jradio:*:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Fxwebdesign,Com Jradio
CVE-2010-4740,0.0,,0.41619,CWE-119,"Stack-based buffer overflow in WTclient.dll in SCADA Engine BACnet OPC Client before 1.0.25 allows user-assisted remote attackers to execute arbitrary code via a crafted .csv file, related to a status log message.",2011-02-16,Metasploit,cpe:2.3:a:scadaengine:bacnet_opc_client:*:*:*:*:*:*:*:*,Scadaengine,Bacnet Opc Client
CVE-2010-4741,0.0,,0.27841,CWE-119,Stack-based buffer overflow in MDMUtil.dll in MDMTool.exe in MDM Tool before 2.3 in Moxa Device Manager allows remote MDM Gateways to execute arbitrary code via crafted data in a session on TCP port 54321.,2011-02-18,Metasploit,cpe:2.3:a:moxa:device_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:moxa:mdm_tool:*:*:*:*:*:*:*:*,Moxa,Device Manager
CVE-2010-4742,0.0,,0.5637,CWE-119,Stack-based buffer overflow in a certain ActiveX control in MediaDBPlayback.DLL 2.2.0.5 in the Moxa ActiveX SDK allows remote attackers to execute arbitrary code via a long PlayFileName property value.,2011-02-18,Metasploit,cpe:2.3:a:moxa:activex_sdk:*:*:*:*:*:*:*:*,Moxa,Activex Sdk
CVE-2010-4769,0.0,,0.07593,CWE-22,Directory traversal vulnerability in the Jimtawl (com_jimtawl) component 1.0.2 Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the task parameter to index.php.,2011-03-23,Nuclei,cpe:2.3:a:janguo:com_jimtawl:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Janguo,Com Jimtawl
CVE-2010-4804,0.0,,0.26952,CWE-200,"The Android browser in Android before 2.3.4 allows remote attackers to obtain SD card contents via crafted content:// URIs, related to (1) BrowserActivity.java and (2) BrowserSettings.java in com/android/browser/.",2011-06-09,Metasploit,cpe:2.3:o:google:android:*:*:*:*:*:*:*:*;cpe:2.3:o:google:android:1.5:*:*:*:*:*:*:*;cpe:2.3:o:google:android:1.6:*:*:*:*:*:*:*;cpe:2.3:o:google:android:2.1:*:*:*:*:*:*:*;cpe:2.3:o:google:android:2.2.1:*:*:*:*:*:*:*;cpe:2.3:o:google:android:2.2.2:*:*:*:*:*:*:*;cpe:2.3:o:google:android:2.2:*:*:*:*:*:*:*;cpe:2.3:o:google:android:2.2:rev1:*:*:*:*:*:*;cpe:2.3:o:google:android:2.3:rev1:*:*:*:*:*:*,Google,Android
CVE-2010-4977,0.0,,0.15251,CWE-89,SQL injection vulnerability in menu.php in the Canteen (com_canteen) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the mealid parameter to index.php.,2011-11-01,Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:miniwork:com_canteen:1.0:*:*:*:*:*:*:*,Miniwork,Com Canteen
CVE-2010-5028,0.0,,0.09247,CWE-89,SQL injection vulnerability in the JExtensions JE Job (com_jejob) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in an item action to index.php.,2011-11-02,Nuclei,cpe:2.3:a:harmistechnology:com_jejob:1.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Harmistechnology,Com Jejob
CVE-2010-5081,0.0,,0.31244,CWE-119,Stack-based buffer overflow in Mini-Stream RM-MP3 Converter 3.1.2.1 allows remote attackers to execute arbitrary code via a long URL in a .pls file.,2011-12-25,Metasploit,cpe:2.3:a:mini-stream:rm-mp3_converter:3.1.2.1:*:*:*:*:*:*:*,Mini-Stream,Rm-Mp3 Converter
CVE-2010-5193,0.0,,0.31968,CWE-119,Stack-based buffer overflow in the TIFMergeMultiFiles function in the SCRIBBLE.ScribbleCtrl.1 ActiveX control (ImageViewer2.ocx) in Viscom Image Viewer CP Pro 8.0 and Gold 6.0 allows remote attackers to execute arbitrary code via a long strDelimit parameter.,2012-08-31,Metasploit,cpe:2.3:a:viscomsoft:image_viewer_cp_gold_sdk:6.0:*:*:*:*:*:*:*;cpe:2.3:a:viscomsoft:image_viewer_cp_pro_sdk:8.0:*:*:*:*:*:*:*,Viscomsoft,Image Viewer Cp Gold Sdk
CVE-2010-5278,0.0,,0.17028,CWE-22,"Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the class_key parameter.  NOTE: some of these details are obtained from third party information.",2012-10-07,Nuclei,cpe:2.3:a:modx:modx_revolution:*:*:*:*:*:*:*:*,Modx,Modx Revolution
CVE-2010-5286,0.0,,0.11382,CWE-22,Directory traversal vulnerability in Jstore (com_jstore) component for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.,2012-11-26,Nuclei,cpe:2.3:a:joobi:com_jstore:-:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Joobi,Com Jstore
CVE-2010-5299,0.0,,0.33579,CWE-119,"Stack-based buffer overflow in MicroP 0.1.1.1600 allows remote attackers to execute arbitrary code via a crafted .mppl file.  NOTE: it has been reported that the overflow is in the lpFileName parameter of the CreateFileA function, but the overflow is probably caused by a separate, unnamed function.",2014-05-23,Metasploit,cpe:2.3:a:microp_project:microp:0.1.1.1600:*:*:*:*:*:*:*,Microp Project,Microp
CVE-2010-5324,0.0,,0.72012,CWE-22,"Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management (ZCM) 10 before 10.3 allows remote attackers to execute arbitrary code via a zenworks-fileupload request with a crafted directory name in the type parameter, in conjunction with a WAR filename in the filename parameter and WAR content in the POST data, a different vulnerability than CVE-2010-5323.",2015-06-07,Metasploit,cpe:2.3:a:novell:zenworks_configuration_management:10.0:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_configuration_management:10.1:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_configuration_management:10.2:*:*:*:*:*:*:*,Novell,Zenworks Configuration Management
CVE-2010-5326,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.1745,NVD-CWE-noinfo,"The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a ""Detour"" attack.",2016-05-13,CISA,cpe:2.3:a:sap:netweaver_application_server_java:*:*:*:*:*:*:*:*,Sap,Netweaver Application Server Java
CVE-2010-5330,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.34641,CWE-77,"On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.",2019-06-11,CISA,cpe:2.3:o:ui:airos:*:*:*:*:*:*:*:*,Ui,Airos
CVE-2010-5333,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.16046,CWE-120,"The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long password in an administration login POST request, leading to arbitrary code execution. An SEH-overwrite buffer overflow already existed for the vulnerable software. This CVE is to track an alternate exploitation method, utilizing an EIP-overwrite buffer overflow.",2019-09-13,Metasploit,cpe:2.3:a:integard_home_project:integard_home:*:*:*:*:*:*:*:*;cpe:2.3:a:integard_pro_project:integard_pro:*:*:*:*:*:*:*:*,Integard Home Project,Integard Home
CVE-2011-0049,0.0,,0.95388,CWE-22,"Directory traversal vulnerability in the _list_file_get function in lib/Majordomo.pm in Majordomo 2 before 20110131 allows remote attackers to read arbitrary files via .. (dot dot) sequences in the help command, as demonstrated using (1) a crafted email and (2) cgi-bin/mj_wwwusr in the web interface.",2011-02-04,EPSS/Metasploit/Nuclei,cpe:2.3:a:mj2:majordomo_2:*:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110101:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110102:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110103:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110104:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110105:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110106:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110107:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110108:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110109:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110110:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110111:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110112:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110113:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110114:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110115:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110116:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110117:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110118:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110119:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110120:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110121:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110122:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110123:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110124:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110125:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110126:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110127:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110128:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110129:*:*:*:*:*:*:*,Mj2,Majordomo 2
CVE-2011-0063,0.0,,0.85451,CWE-22,"The _list_file_get function in lib/Majordomo.pm in Majordomo 2 20110203 and earlier allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ./.../ sequence in the ""extra"" parameter to the help command, which causes the regular expression to produce .. (dot dot) sequences.  NOTE: this vulnerability is due to an incomplete fix for CVE-2011-0049.",2011-03-15,Metasploit,cpe:2.3:a:mj2:majordomo_2:*:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110101:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110102:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110103:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110104:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110105:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110106:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110107:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110108:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110109:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110110:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110111:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110112:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110113:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110114:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110115:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110116:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110117:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110118:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110119:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110120:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110121:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110122:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110123:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110124:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110125:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110126:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110127:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110128:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110129:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110130:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110131:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110201:*:*:*:*:*:*:*;cpe:2.3:a:mj2:majordomo_2:20110202:*:*:*:*:*:*:*,Mj2,Majordomo 2
CVE-2011-0065,0.0,,0.73835,CWE-399,"Use-after-free vulnerability in Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, allows remote attackers to execute arbitrary code via vectors related to OBJECT's mChannel.",2011-05-07,Metasploit,cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0:preview_release:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.15:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.16:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.17:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.18:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.19:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.20:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.15:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.16:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.17:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.15:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.16:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.17:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.15:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.16:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0:alpha:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0:beta:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.15:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.16:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.17:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.18:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.19:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1:alpha:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1:beta:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.5.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.5.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.5.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:alpha_1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:alpha_2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:alpha_3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:beta_1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:beta_2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:rc1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:rc2:*:*:*:*:*:*,Mozilla,Firefox
CVE-2011-0073,0.0,,0.70213,CWE-20,"Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, does not properly use nsTreeRange data structures, which allows remote attackers to execute arbitrary code via unspecified vectors that lead to a ""dangling pointer.""",2011-05-07,Metasploit,cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0:preview_release:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.15:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.16:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.17:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.18:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.19:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.20:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.15:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.16:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.17:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.15:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.16:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.17:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.15:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.16:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0:alpha:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0:beta:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.15:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.16:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.17:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.18:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.19:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1:alpha:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1:beta:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.5.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.5.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.5.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:alpha_1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:alpha_2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:alpha_3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:beta_1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:beta_2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:rc1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:rc2:*:*:*:*:*:*,Mozilla,Firefox
CVE-2011-0105,0.0,,0.71268,CWE-119,"Microsoft Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac obtain a certain length value from an uninitialized memory location, which allows remote attackers to trigger a buffer overflow and execute arbitrary code via a crafted Excel file, aka ""Excel Data Initialization Vulnerability.""",2011-04-13,Metasploit,cpe:2.3:a:microsoft:excel:2002:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2004:*:mac:*:*:*:*:*;cpe:2.3:a:microsoft:office:2008:*:mac:*:*:*:*:*;cpe:2.3:a:microsoft:open_xml_file_format_converter:*:*:mac:*:*:*:*:*,Microsoft,Excel
CVE-2011-0257,0.0,,0.60106,CWE-189,Integer signedness error in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PnSize opcode in a PICT file that triggers a stack-based buffer overflow.,2011-08-15,Metasploit,cpe:2.3:a:apple:quicktime:*:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.6:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.2.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.3.1.70:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.3.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.5.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.5.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.6:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.7:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.8:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.66.71.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.67.75.0:*:*:*:*:*:*:*,Apple,Quicktime
CVE-2011-0266,0.0,,0.70111,CWE-119,"Buffer overflow in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long nameParams parameter, a different vulnerability than CVE-2011-0267.2.",2011-01-13,Metasploit,cpe:2.3:a:hp:openview_network_node_manager:7.51:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:*:*:*:*:*:*:*,Hp,Openview Network Node Manager
CVE-2011-0267,0.0,,0.7166,CWE-119,"Multiple buffer overflows in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allow remote attackers to execute arbitrary code via a long (1) schdParams or (2) nameParams parameter, a different vulnerability than CVE-2011-0266.",2011-01-13,Metasploit,cpe:2.3:a:hp:openview_network_node_manager:7.51:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:*:*:*:*:*:*:*,Hp,Openview Network Node Manager
CVE-2011-0276,0.0,,0.82426,NVD-CWE-Other,"HP OpenView Performance Insight Server 5.2, 5.3, 5.31, 5.4, and 5.41 contains a ""hidden account"" in the com.trinagy.security.XMLUserManager Java class, which allows remote attackers to execute arbitrary code via the doPost method in the com.trinagy.servlet.HelpManagerServlet class.",2011-02-02,Metasploit,cpe:2.3:a:hp:openview_performance_insight:5.2:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_performance_insight:5.31:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_performance_insight:5.3:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_performance_insight:5.41:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_performance_insight:5.4:*:*:*:*:*:*:*,Hp,Openview Performance Insight
CVE-2011-0340,0.0,,0.32349,CWE-119,"Multiple buffer overflows in the ISSymbol ActiveX control in ISSymbol.ocx 61.6.0.0 and 301.1009.2904.0 in the ISSymbol virtual machine, as distributed in Advantech Studio 6.1 SP6 61.6.01.05, InduSoft Web Studio before 7.0+SP1, and InduSoft Thin Client 7.0, allow remote attackers to execute arbitrary code via a long (1) InternationalOrder, (2) InternationalSeparator, or (3) LogFileName property value; or (4) a long bstrFileName argument to the OpenScreen method.",2011-05-04,Metasploit,cpe:2.3:a:advantech:advantech_studio:6.1:sp6_61.6.01.05:*:*:*:*:*:*;cpe:2.3:a:indusoft:thin_client:7.0:*:*:*:*:*:*:*;cpe:2.3:a:indusoft:web_studio:*:*:*:*:*:*:*:*;cpe:2.3:a:indusoft:web_studio:6.1:*:*:*:*:*:*:*;cpe:2.3:a:indusoft:web_studio:6.1:sp6:*:*:*:*:*:*,Advantech,Advantech Studio
CVE-2011-0404,0.0,,0.64739,CWE-119,"Stack-based buffer overflow in NetSupport Manager Agent for Linux 11.00, for Solaris 9.50, and for Mac OS X 11.00 allows remote attackers to execute arbitrary code via a long control hostname to TCP port 5405, probably a different vulnerability than CVE-2007-5252.",2011-01-11,Metasploit,cpe:2.3:a:netsupport:netsupport_manager_agent:11.00:*:linux:*:*:*:*:*;cpe:2.3:a:netsupport:netsupport_manager_agent:11.00:*:mac_os_x:*:*:*:*:*;cpe:2.3:a:netsupport:netsupport_manager_agent:9.50:*:solaris:*:*:*:*:*,Netsupport,Netsupport Manager Agent
CVE-2011-0499,0.0,,0.31045,CWE-119,"Buffer overflow in VideoSpirit Pro 1.6.8.1 and possibly earlier versions, and VideoSpirit Lite 1.4.0.1 and possibly other versions, allows user-assisted remote attackers to execute arbitrary code via a VideoSpirit project (.visprj) file containing a valitem element with a long ""name"" attribute.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.",2011-01-20,Metasploit,cpe:2.3:a:verytools:videospirit_lite:*:*:*:*:*:*:*:*;cpe:2.3:a:verytools:videospirit_pro:*:*:*:*:*:*:*:*;cpe:2.3:a:verytools:videospirit_pro:1.68:*:*:*:*:*:*:*,Verytools,Videospirit Lite
CVE-2011-0500,0.0,,0.30708,CWE-119,"Buffer overflow in VideoSpirit Pro 1.6.8.1, 1.68, and earlier; and VideoSpirit Lite 1.4.0.1 and possibly other versions; allows user-assisted remote attackers to execute arbitrary code via a VideoSpirit project (.visprj) file containing a valitem element with a long ""value"" attribute, as demonstrated using a valitem with the mp3 name.",2011-01-20,Metasploit,cpe:2.3:a:verytools:videospirit_lite:1.4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:verytools:videospirit_pro:*:*:*:*:*:*:*:*;cpe:2.3:a:verytools:videospirit_pro:1.6.8.1:*:*:*:*:*:*:*,Verytools,Videospirit Lite
CVE-2011-0514,0.0,,0.48867,CWE-119,The RDS service (rds.exe) in HP Data Protector Manager 6.11 allows remote attackers to cause a denial of service (crash) via a packet with a large data size to TCP port 1530.,2011-01-20,Metasploit,cpe:2.3:a:hp:data_protector_manager:6.11:*:*:*:*:*:*:*,Hp,Data Protector Manager
CVE-2011-0517,0.0,,0.40462,CWE-119,"Stack-based buffer overflow in Sielco Sistemi Winlog Pro 2.07.00 and earlier, when Run TCP/IP server is enabled, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a crafted 0x02 opcode to TCP port 46823.",2011-01-20,Metasploit,cpe:2.3:a:sielcosistemi:winlog_pro:*:*:*:*:*:*:*:*,Sielcosistemi,Winlog Pro
CVE-2011-0518,0.0,,0.15833,CWE-22,"Directory traversal vulnerability in core/lib/router.php in LotusCMS Fraise 3.0, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via the system parameter to index.php.",2011-01-20,Metasploit/Nuclei,cpe:2.3:a:lotuscms:fraise:3.0:*:*:*:*:*:*:*,Lotuscms,Fraise
CVE-2011-0531,0.0,,0.41582,CWE-20,"demux/mkv/mkv.hpp in the MKV demuxer plugin in VideoLAN VLC media player 1.1.6.1 and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary commands via a crafted MKV (WebM or Matroska) file that triggers memory corruption, related to ""class mismatching"" and the MKV_IS_ID macro.",2011-02-07,Metasploit,cpe:2.3:a:videolan:vlc_media_player:*:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.1.99b:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.1.99e:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.1.99f:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.1.99g:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.1.99h:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.1.99i:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.60:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.61:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.62:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.63:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.70:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.71:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.72:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.73:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.80:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.81:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.82:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.83:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.90:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.91:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.92:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.3.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.3.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.4.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.4.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.4.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.4.3:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.4.4:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.4.5:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.4.6:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.5.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.5.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.5.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.5.3:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.6.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.6.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.6.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.7.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.7.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.4:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.5:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.6:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.10:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.3:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.4:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.5:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.6:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.8a:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.9:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.3:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.4:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.5:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.6:*:*:*:*:*:*:*,Videolan,Vlc Media Player
CVE-2011-0609,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.66821,NVD-CWE-noinfo,"Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through 9.4.2 and 10.x through 10.0.1 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content, as demonstrated by a .swf file embedded in an Excel spreadsheet, and as exploited in the wild in March 2011.",2011-03-15,CISA/Metasploit,cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:10.0.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:10.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:10.0.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:10.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:google:android:-:*:*:*:*:*:*:*;cpe:2.3:o:google:chrome_os:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise:10.0:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise:11.0:sp1:*:*:*:*:*:*,Apple,Mac Os X
CVE-2011-0611,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.9941,CWE-843,"Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, Adobe Reader 9.x before 9.4.4 and 10.x before 10.0.3 on Mac OS X, and Adobe Acrobat 9.x before 9.4.4 and 10.x before 10.0.3 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content; as demonstrated by a Microsoft Office document with an embedded .swf file that has a size inconsistency in a ""group of included constants,"" object type confusion, ActionScript that adds custom functions to prototypes, and Date objects; and as exploited in the wild in April 2011.",2011-04-13,CISA/EPSS/Metasploit,cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:google:android:-:*:*:*:*:*:*:*;cpe:2.3:o:google:chrome_os:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1:*:*:*:*:*:*,Apple,Mac Os X
CVE-2011-0647,0.0,,0.63676,CWE-20,The irccd.exe service in EMC Replication Manager Client before 5.3 and NetWorker Module for Microsoft Applications 2.1.x and 2.2.x allows remote attackers to execute arbitrary commands via the RunProgram function to TCP port 6542.,2011-02-10,Metasploit,cpe:2.3:a:emc:networker_module:2.1:-:microsoft_applications:*:*:*:*:*;cpe:2.3:a:emc:networker_module:2.2:-:microsoft_applications:*:*:*:*:*;cpe:2.3:a:emc:replication_manager:*:*:client:*:*:*:*:*;cpe:2.3:a:emc:replication_manager:2.0:*:client:*:*:*:*:*;cpe:2.3:a:emc:replication_manager:5.2.2:*:client:*:*:*:*:*;cpe:2.3:a:emc:replication_manager:5.2:*:client:*:*:*:*:*,Emc,Replication Manager
CVE-2011-0654,0.0,,0.68084,CWE-119,"Integer underflow in the BowserWriteErrorLogEntry function in the Common Internet File System (CIFS) browser service in Mrxsmb.sys or bowser.sys in Active Directory in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via a malformed BROWSER ELECTION message, leading to a heap-based buffer overflow, aka ""Browser Pool Corruption Vulnerability."" NOTE: some of these details are obtained from third party information.",2011-02-16,Metasploit,cpe:2.3:o:microsoft:windows_2003_server:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:r2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:r2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*,Microsoft,Windows 2003 Server
CVE-2011-0657,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.63335,CWE-20,"DNSAPI.dll in the DNS client in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly process DNS queries, which allows remote attackers to execute arbitrary code via (1) a crafted LLMNR broadcast query or (2) a crafted application, aka ""DNS Query Vulnerability.""",2011-04-13,Metasploit,cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*,Microsoft,Windows 2003 Server
CVE-2011-0762,0.0,,0.73946,CWE-400,"The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability than CVE-2010-2632.",2011-03-02,Metasploit/Nuclei,cpe:2.3:a:vsftpd_project:vsftpd:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:13:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:14:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:15:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2011-0807,0.0,,0.60878,NVD-CWE-noinfo,"Unspecified vulnerability in Oracle Sun GlassFish Enterprise Server 2.1, 2.1.1, and 3.0.1, and Sun Java System Application Server 9.1, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Administration.",2011-04-20,Metasploit,cpe:2.3:a:oracle:glassfish_server:2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:glassfish_server:2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:glassfish_server:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:sun:java_system_application_server:9.1:*:*:*:*:*:*:*,Oracle,Glassfish Server
CVE-2011-0922,0.0,,0.64219,CWE-20,The client in HP Data Protector allows remote attackers to execute arbitrary programs via an EXEC_SETUP command that references a UNC share pathname.,2011-02-09,Metasploit,cpe:2.3:a:hp:data_protector:*:*:*:*:*:*:*:*,Hp,Data Protector
CVE-2011-0923,0.0,,0.81081,CWE-20,"The client in HP Data Protector does not properly validate EXEC_CMD arguments, which allows remote attackers to execute arbitrary Perl code via a crafted command, related to the ""local bin directory.""",2011-02-09,Metasploit,cpe:2.3:a:hp:data_protector:*:*:*:*:*:*:*:*,Hp,Data Protector
CVE-2011-0951,0.0,,0.1464,CWE-255,"The web-based management interface in Cisco Secure Access Control System (ACS) 5.1 before 5.1.0.44.6 and 5.2 before 5.2.0.26.3 allows remote attackers to change arbitrary user passwords via unspecified vectors, aka Bug ID CSCtl77440.",2011-04-04,Metasploit,cpe:2.3:a:cisco:secure_access_control_system:5.1.0.44.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_access_control_system:5.1.0.44.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_access_control_system:5.1.0.44.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_access_control_system:5.1.0.44.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_access_control_system:5.1.0.44.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_access_control_system:5.1.0.44:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_access_control_system:5.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_access_control_system:5.2.0.26.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_access_control_system:5.2.0.26.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_access_control_system:5.2.0.26:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_access_control_system:5.2:*:*:*:*:*:*:*,Cisco,Secure Access Control System
CVE-2011-10005,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.0351,CWE-120,"A vulnerability, which was classified as critical, was found in EasyFTP 1.7.0.2. Affected is an unknown function of the component MKD Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250716.",2024-01-16,Metasploit,cpe:2.3:a:easyftp_server_project:easyftp_server:1.7.0.2:*:*:*:*:*:*:*,Easyftp Server Project,Easyftp Server
CVE-2011-10008,0.0,,0.01152,CWE-20,"A stack-based buffer overflow vulnerability exists in MPlayer Lite r33064 due to improper bounds checking when handling M3U playlist files containing long http:// URL entries. An attacker can craft a malicious .m3u file with a specially formatted URL that triggers a stack overflow when processed by the player, particularly via drag-and-drop interaction. This flaw allows for control of the execution flow through SEH overwrite and a DEP bypass using a ROP chain that leverages known gadgets in loaded DLLs. Successful exploitation may result in arbitrary code execution with the privileges of the current user.",2025-07-31,Metasploit,,,
CVE-2011-10009,0.0,,0.01286,CWE-22,"S40 CMS v0.4.2 contains a path traversal vulnerability in its index.php page handler. The p parameter is not properly sanitized, allowing attackers to traverse the file system and access arbitrary files outside the web root. This can be exploited remotely without authentication by appending traversal sequences and a null byte to bypass file extension checks.",2025-08-13,Metasploit,,,
CVE-2011-10010,0.0,,0.01591,CWE-22,"QuickShare File Server 1.2.1 contains a path traversal vulnerability in its FTP service due to improper sanitation of user-supplied file paths. Authenticated users can exploit this flaw by submitting crafted sequences to access or write files outside the intended virtual directory. When the ""Writable"" option is enabled (default during account creation), this allows attackers to upload arbitrary files to privileged locations such as system32, enabling remote code execution via MOF injection or executable placement.",2025-08-13,Metasploit,,,
CVE-2011-10011,0.0,,0.01704,CWE-94,"WeBid 1.0.2 contains a remote code injection vulnerability in the converter.php script, where unsanitized input in the to parameter of a POST request is written directly into includes/currencies.php. This allows unauthenticated attackers to inject arbitrary PHP code, resulting in persistent remote code execution when the modified script is accessed or included by the application.",2025-08-13,Metasploit,,,
CVE-2011-10012,0.0,,0.00429,CWE-121,"NetOp (now part of Impero Software) Remote Control Client v9.5 is vulnerable to a stack-based buffer overflow when processing .dws configuration files. If a .dws file contains a string longer than 520 bytes, the application fails to perform proper bounds checking, allowing an attacker to execute arbitrary code when the file is opened.",2025-08-13,Metasploit,,,
CVE-2011-10013,0.0,,0.01596,CWE-94,"Traq versions 2.0 through 2.3 contain a remote code execution vulnerability in the admincp/common.php script. The flawed authorization logic fails to halt execution after a failed access check, allowing unauthenticated users to reach admin-only functionality. This can be exploited via plugins.php to inject and execute arbitrary PHP code.",2025-08-13,Metasploit,,,
CVE-2011-10014,0.0,,0.00369,CWE-121,"GTA San Andreas Multiplayer (SA-MP) server version 0.3.1.1 is vulnerable to a stack-based buffer overflow triggered by parsing a malformed server.cfg configuration file. The vulnerability allows local attackers to execute arbitrary code when the server binary (samp-server.exe) processes a crafted echo directive containing excessive input. The original 'sa-mp.com' site is defunct, but the community maintains mirrors and forks that may be vulnerable.",2025-08-13,Metasploit,,,
CVE-2011-10015,0.0,,0.00429,CWE-121,Cytel Studio version 9.0 and earlier is vulnerable to a stack-based buffer overflow triggered by parsing a malformed .CY3 file. The vulnerability occurs when the application copies user-controlled strings into a fixed-size stack buffer (256 bytes) without proper bounds checking. Exploitation allows arbitrary code execution when the crafted file is opened.,2025-08-13,Metasploit,,,
CVE-2011-10016,0.0,,0.00427,CWE-121,Real Networks Netzip Classic version 7.5.1.86 is vulnerable to a stack-based buffer overflow when parsing a specially crafted ZIP archive. The vulnerability is triggered when the application attempts to process a file name within the archive that exceeds the expected buffer size. Exploitation allows arbitrary code execution under the context of the victim user when the ZIP file is opened.,2025-08-13,Metasploit,,,
CVE-2011-10017,0.0,,0.01915,CWE-78,"Snort Report versions < 1.3.2 contains a remote command execution vulnerability in the nmap.php and nbtscan.php scripts. These scripts fail to properly sanitize user input passed via the target GET parameter, allowing attackers to inject arbitrary shell commands. Exploitation requires no authentication and can result in full compromise of the underlying system.",2025-08-13,Metasploit,,,
CVE-2011-10018,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01977,CWE-94,myBB version 1.6.4 was distributed with an unauthorized backdoor embedded in the source code. The backdoor allowed remote attackers to execute arbitrary PHP code by injecting payloads into a specially crafted collapsed cookie. This vulnerability was introduced during packaging and was not part of the intended application logic. Exploitation requires no authentication and results in full compromise of the web server under the context of the web application.,2025-08-13,Metasploit,cpe:2.3:a:mybb:mybb:1.6.4:*:*:*:*:*:*:*,Mybb,Mybb
CVE-2011-10019,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04056,CWE-94,"Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbitrary shell commands on the server without authentication.",2025-08-13,Metasploit,cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*,Spreecommerce,Spree
CVE-2011-10020,0.0,,0.00911,CWE-20,"Kaillera Server version 0.86 is vulnerable to a denial-of-service condition triggered by sending a malformed UDP packet after the initial handshake. Once a client sends a valid HELLO0.83 packet and receives a response, any subsequent malformed packet causes the server to crash and become unresponsive. This flaw stems from improper input validation in the server’s UDP packet handler, allowing unauthenticated remote attackers to disrupt service availability.",2025-08-20,Metasploit,,,
CVE-2011-10021,0.0,,0.00345,CWE-121,"Magix Musik Maker 16 is vulnerable to a stack-based buffer overflow due to improper handling of .mmm arrangement files. The vulnerability arises from an unsafe strcpy() operation that fails to validate input length, allowing attackers to overwrite the Structured Exception Handler (SEH). By crafting a malicious .mmm file, an attacker can trigger the overflow when the file is opened, potentially leading to arbitrary code execution. This vulnerability was remediated in version 17.",2025-08-20,Metasploit,,,
CVE-2011-10022,0.0,,0.00803,CWE-120,"SPlayer version 3.7 and earlier is vulnerable to a stack-based buffer overflow when processing HTTP responses containing an overly long Content-Type header. The vulnerability occurs due to improper bounds checking on the header value, allowing an attacker to overwrite the Structured Exception Handler (SEH) and execute arbitrary code. Exploitation requires the victim to open a media file that triggers an HTTP request to a malicious server, which responds with a crafted Content-Type header.",2025-08-20,Metasploit,,,
CVE-2011-10023,0.0,,0.00347,CWE-121,"MJM QuickPlayer (also known as MJM Player) version 2010 contains a stack-based buffer overflow vulnerability triggered by opening a malicious .s3m music file. The flaw occurs due to improper bounds checking in the file parser, allowing an attacker to overwrite memory and execute arbitrary code. Exploitation is achieved via a crafted payload that bypasses DEP and ASLR protections using ROP techniques, and requires user interaction to open the file.",2025-08-20,Metasploit,,,
CVE-2011-10024,0.0,,0.00354,CWE-121,"MJM Core Player (likely now referred to as MJM Player) 2011 is vulnerable to a stack-based buffer overflow when parsing specially crafted .s3m music files. The vulnerability arises from improper bounds checking in the file parser, allowing an attacker to overwrite memory on the stack and execute arbitrary code. Exploitation is triggered when a user opens a malicious .s3m file, and the exploit bypasses DEP and ASLR protections using a ROP chain.",2025-08-20,Metasploit,,,
CVE-2011-10025,0.0,,0.00343,CWE-120,"Subtitle Processor 7.7.1 contains a buffer overflow vulnerability in its .m3u file parser. When a crafted playlist file is opened, the application converts input to Unicode and copies it to a fixed-size stack buffer without proper bounds checking. This allows an attacker to overwrite the Structured Exception Handler (SEH) and execute arbitrary code.",2025-08-20,Metasploit,,,
CVE-2011-10026,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0264,CWE-78,"Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality. Improper input sanitation allows attackers to inject arbitrary shell commands via the search[instance_eval] parameter, which is dynamically invoked using Ruby’s send method. This flaw enables unauthenticated attackers to execute commands on the server.",2025-08-20,Metasploit,cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*,Spreecommerce,Spree
CVE-2011-10027,0.0,,0.0051,CWE-121,"AOL Desktop 9.6 contains a buffer overflow vulnerability in its Tool\rich.rct component when parsing .rtx files. By embedding an overly long string in a hyperlink tag, an attacker can trigger a stack-based buffer overflow due to the use of unsafe strcpy operations. This allows remote attackers to execute arbitrary code when a victim opens a malicious .rtx file. AOL Desktop is end-of-life and no longer supported. Users are encouraged to migrate to AOL Desktop Gold or alternative platforms.",2025-08-20,Metasploit,,,
CVE-2011-10028,0.0,,0.01138,CWE-623,"The RealNetworks RealArcade platform includes an ActiveX control (InstallerDlg.dll, version 2.6.0.445) that exposes a method named Exec via the StubbyUtil.ProcessMgr COM object. This method allows remote attackers to execute arbitrary commands on a victim's Windows machine without proper validation or restrictions. This platform was sometimes referred to or otherwise known as RealArcade or Arcade Games and has since consolidated with RealNetworks' platform, GameHouse.",2025-08-20,Metasploit,,,
CVE-2011-10029,0.0,,0.00723,CWE-134,"Solar FTP Server fails to properly handle format strings passed to the USER command. When a specially crafted string containing format specifiers is sent, the server crashes due to a read access violation in the __output_1() function of sfsservice.exe. This results in a denial of service (DoS) condition.",2025-08-20,Metasploit,,,
CVE-2011-10030,0.0,,0.00378,CWE-73,"Foxit PDF Reader <  4.3.1.0218 exposes a JavaScript API function, createDataObject(), that allows untrusted PDF content to write arbitrary files anywhere on disk. By embedding a malicious PDF that calls this API, an attacker can drop executables or scripts into privileged folders, leading to code execution the next time the system boots or the user logs in.",2025-08-20,Metasploit,,,
CVE-2011-10032,0.0,,0.0127,CWE-121,"Sunway ForceControl version 6.1 SP3 and earlier contains a stack-based buffer overflow vulnerability in the SNMP NetDBServer service, which listens on TCP port 2001. The flaw is triggered when the service receives a specially crafted packet using opcode 0x57 with an overly long payload. Due to improper bounds checking during packet parsing, attacker-controlled data overwrites the Structured Exception Handler (SEH), allowing arbitrary code execution in the context of the service. This vulnerability can be exploited remotely without authentication and may lead to full system compromise on affected Windows hosts.",2025-08-30,Metasploit,,,
CVE-2011-1140,0.0,,0.13064,CWE-399,"Multiple stack consumption vulnerabilities in the dissect_ms_compressed_string and dissect_mscldap_string functions in Wireshark 1.0.x, 1.2.0 through 1.2.14, and 1.4.0 through 1.4.3 allow remote attackers to cause a denial of service (infinite recursion) via a crafted (1) SMB or (2) Connection-less LDAP (CLDAP) packet.",2011-03-03,Metasploit,cpe:2.3:a:wireshark:wireshark:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.10:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.11:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.12:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.13:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.14:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.15:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.16:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.7:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.8:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0.9:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.0:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.2.10:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.2.11:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.2.12:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.2.13:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.2.14:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.2.1:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.2.2:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.2.3:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.2.4:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.2.5:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.2.6:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.2.7:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.2.8:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.2.9:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.4.1:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.4.2:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.4.3:*:*:*:*:*:*:*,Wireshark,Wireshark
CVE-2011-1213,0.0,,0.32961,CWE-189,"Integer underflow in lzhsr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a crafted header in a .lzh attachment that triggers a stack-based buffer overflow, aka SPR PRAD88MJ2W.",2011-05-31,Metasploit,cpe:2.3:a:ibm:lotus_notes:*:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:3.0.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:3.0.0.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:3.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:4.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:4.2.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:4.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:4.5:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:4.6.7a:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:4.6.7h:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:4.6:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.1.02:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.10:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.11:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.12:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.1a:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.1b:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.1c:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.2a:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.2b:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.2c:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.4a:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.5.01:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.5.02:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.5:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.6:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.6a.01:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.6a:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.7:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.7a:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.8:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.9:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0.9a:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.02:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:5.0a:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.0.1:cf1:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.0.1:cf2:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.0.1:cf3:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.0.2.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.0.2:cf1:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.0.2:cf2:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.0.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.0.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.0.5:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.5.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.5.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.5.3.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.5.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.5.4.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.5.4.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.5.4.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.5.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.5.5.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.5.5.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.5.5.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.5.5:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.5.6.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.5.6.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.5.6.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.5.6:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:6.5:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:7.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:7.0.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:7.0.2.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:7.0.2.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:7.0.3.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:7.0.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:7.0.4.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:7.0.4.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:7.0.4.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:7.0.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:7.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.0.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.0.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.0.2.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.0.2.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.0.2.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.0.2.5:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.0.2.6:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.0.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.1.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.1.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.1.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.1.5:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5:*:*:*:*:*:*:*,Ibm,Lotus Notes
CVE-2011-1220,0.0,,0.62663,CWE-119,"Stack-based buffer overflow in lcfd.exe in Tivoli Endpoint in IBM Tivoli Management Framework 3.7.1, 4.1, 4.1.1, and 4.3.1 allows remote authenticated users to execute arbitrary code via a long opts field.",2011-06-02,Metasploit,cpe:2.3:a:ibm:tivoli_management_framework:3.7.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_management_framework:4.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_management_framework:4.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_management_framework:4.3.1:*:*:*:*:*:*:*,Ibm,Tivoli Management Framework
CVE-2011-1260,0.0,,0.60849,CWE-119,"Microsoft Internet Explorer 8 and 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka ""Layout Memory Corruption Vulnerability.""",2011-06-16,Metasploit,cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:r2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:r2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*,Microsoft,Windows 2003 Server
CVE-2011-1485,0.0,,0.05246,CWE-362,"Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.",2011-05-31,Metasploit,cpe:2.3:a:redhat:policykit:0.96:*:*:*:*:*:*:*,Redhat,Policykit
CVE-2011-1563,0.0,,0.74638,CWE-119,"Multiple stack-based buffer overflows in the HMI application in DATAC RealFlex RealWin 2.1 (Build 6.1.10.10) and earlier allow remote attackers to execute arbitrary code via (1) a long username in an On_FC_CONNECT_FCS_LOGIN packet, and crafted (2) On_FC_CTAGLIST_FCS_CADDTAG, (3) On_FC_CTAGLIST_FCS_CDELTAG, (4) On_FC_CTAGLIST_FCS_ADDTAGMS, (5) On_FC_RFUSER_FCS_LOGIN, (6) unspecified ""On_FC_BINFILE_FCS_*FILE"", (7) On_FC_CGETTAG_FCS_GETTELEMETRY, (8) On_FC_CGETTAG_FCS_GETCHANNELTELEMETRY, (9) On_FC_CGETTAG_FCS_SETTELEMETRY, (10) On_FC_CGETTAG_FCS_SETCHANNELTELEMETRY, and (11) On_FC_SCRIPT_FCS_STARTPROG packets to port 910.",2011-04-05,Metasploit,cpe:2.3:a:realflex:realwin:*:*:*:*:*:*:*:*;cpe:2.3:a:realflex:realwin:1.06:*:*:*:*:*:*:*;cpe:2.3:a:realflex:realwin:2.0:*:*:*:*:*:*:*,Realflex,Realwin
CVE-2011-1565,0.0,,0.64063,CWE-22,Directory traversal vulnerability in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Graphical SCADA System (IGSS) allows remote attackers to (1) read (opcode 0x3) or (2) create or write (opcode 0x2) arbitrary files via ..\ (dot dot backslash) sequences to TCP port 12401.,2011-04-05,Metasploit,cpe:2.3:a:7t:igss:*:*:*:*:*:*:*:*,7T,Igss
CVE-2011-1566,0.0,,0.66982,CWE-22,Directory traversal vulnerability in dc.exe 9.00.00.11059 and earlier in 7-Technologies Interactive Graphical SCADA System (IGSS) allows remote attackers to execute arbitrary programs via ..\ (dot dot backslash) sequences in opcodes (1) 0xa and (2) 0x17 to TCP port 12397.,2011-04-05,Metasploit,cpe:2.3:a:7t:igss:*:*:*:*:*:*:*:*,7T,Igss
CVE-2011-1567,0.0,,0.69618,CWE-119,"Multiple stack-based buffer overflows in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Graphical SCADA System (IGSS) allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted (1) ListAll, (2) Write File, (3) ReadFile, (4) Delete, (5) RenameFile, and (6) FileInfo commands in an 0xd opcode; (7) the Add, (8) ReadFile, (9) Write File, (10) Rename, (11) Delete, and (12) Add commands in an RMS report templates (0x7) opcode; and (13) 0x4 command in an STDREP request (0x8) opcode to TCP port 12401.",2011-04-05,Metasploit,cpe:2.3:a:7t:igss:*:*:*:*:*:*:*:*,7T,Igss
CVE-2011-1574,0.0,,0.42941,CWE-119,Stack-based buffer overflow in the ReadS3M method in load_s3m.cpp in libmodplug before 0.8.8.2 allows remote attackers to execute arbitrary code via a crafted S3M file.,2011-05-09,Metasploit,cpe:2.3:a:konstanty_bialkowski:libmodplug:*:*:*:*:*:*:*:*;cpe:2.3:a:konstanty_bialkowski:libmodplug:0.8.4:*:*:*:*:*:*:*;cpe:2.3:a:konstanty_bialkowski:libmodplug:0.8.5:*:*:*:*:*:*:*;cpe:2.3:a:konstanty_bialkowski:libmodplug:0.8.6:*:*:*:*:*:*:*;cpe:2.3:a:konstanty_bialkowski:libmodplug:0.8.7:*:*:*:*:*:*:*;cpe:2.3:a:konstanty_bialkowski:libmodplug:0.8.8:*:*:*:*:*:*:*;cpe:2.3:a:konstanty_bialkowski:libmodplug:0.8:*:*:*:*:*:*:*,Konstanty Bialkowski,Libmodplug
CVE-2011-1591,0.0,,0.41744,CWE-119,Stack-based buffer overflow in the DECT dissector in epan/dissectors/packet-dect.c in Wireshark 1.4.x before 1.4.5 allows remote attackers to execute arbitrary code via a crafted .pcap file.,2011-04-29,Metasploit,cpe:2.3:a:wireshark:wireshark:1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.4.1:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.4.2:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.4.3:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.4.4:*:*:*:*:*:*:*,Wireshark,Wireshark
CVE-2011-1653,0.0,,0.88655,CWE-89,"Multiple SQL injection vulnerabilities in the Unified Network Control (UNC) Server in CA Total Defense (TD) r12 before SE2 allow remote attackers to execute arbitrary SQL commands via vectors involving the (1) UnAssignFunctionalRoles, (2) UnassignAdminRoles, (3) DeleteFilter, (4) NonAssignedUserList, (5) DeleteReportLayout, (6) DeleteReports, and (7) RegenerateReport stored procedures.",2011-04-18,Metasploit,cpe:2.3:a:broadcom:total_defense:r12:*:*:*:*:*:*:*,Broadcom,Total Defense
CVE-2011-1669,0.0,,0.22157,CWE-22,Directory traversal vulnerability in wp-download.php in the WP Custom Pages module 0.5.0.1 for WordPress allows remote attackers to read arbitrary files via ..%2F (encoded dot dot) sequences in the url parameter.,2011-04-10,Nuclei,cpe:2.3:a:mikoviny:wp_custom_pages:0.5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*,Mikoviny,Wp Custom Pages
CVE-2011-1774,0.0,,0.43195,CWE-20,"WebKit in Apple Safari before 5.0.6 has improper libxslt security settings, which allows remote attackers to create arbitrary files, and consequently execute arbitrary code, via a crafted web site.  NOTE: this may overlap CVE-2011-1425.",2011-07-21,Metasploit,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.0.0b1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.0.0b2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.0.3:85.8.1:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.0.3:85.8:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.0:beta2:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.0:beta:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.2.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.2.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.2.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.2.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.2.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.3.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.3.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.3.2:312.5:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.3.2:312.6:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:2.0.3:417.8:*:*:*:*:*:*;cpe:2.3:a:apple:safari:2.0.3:417.9.2:*:*:*:*:*:*;cpe:2.3:a:apple:safari:2.0.3:417.9.3:*:*:*:*:*:*;cpe:2.3:a:apple:safari:2.0.3:417.9:*:*:*:*:*:*;cpe:2.3:a:apple:safari:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:2.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.0b:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.1b:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.2b:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.3b:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.4b:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.1.0b:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.2.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:4.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:4.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:5.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:5.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:webkit:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.5.8:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.6.8:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.6.9:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.7.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x_server:10.5.8:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x_server:10.6.8:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x_server:10.6.9:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x_server:10.7.0:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*,Apple,Mac Os X
CVE-2011-1823,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.41634,CWE-190,"The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.",2011-06-09,CISA,cpe:2.3:o:google:android:*:*:*:*:*:*:*:*;cpe:2.3:o:google:android:3.0:*:*:*:*:*:*:*,Google,Android
CVE-2011-1865,0.0,,0.88948,CWE-119,Multiple stack-based buffer overflows in the inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allow remote attackers to execute arbitrary code via a request containing crafted parameters.,2011-07-01,Metasploit,cpe:2.3:a:hp:openview_storage_data_protector:6.00:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_storage_data_protector:6.10:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_storage_data_protector:6.11:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_storage_data_protector:6.20:*:*:*:*:*:*:*,Hp,Openview Storage Data Protector
CVE-2011-1889,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.48368,CWE-119,"The NSPLookupServiceNext function in the client in Microsoft Forefront Threat Management Gateway (TMG) 2010 allows remote attackers to execute arbitrary code via vectors involving unspecified requests, aka ""TMG Firewall Client Memory Corruption Vulnerability.""",2011-06-16,CISA,cpe:2.3:a:microsoft:forefront_threat_management_gateway:2010:*:*:*:*:*:*:*,Microsoft,Forefront Threat Management Gateway
CVE-2011-1900,0.0,,0.32043,CWE-22,Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 6.1 and 7.x before 7.0+Patch 1 allows remote attackers to execute arbitrary code via an invalid request.,2011-05-04,Metasploit,cpe:2.3:a:indusoft:web_studio:6.1:*:*:*:*:*:*:*;cpe:2.3:a:indusoft:web_studio:7.0:*:*:*:*:*:*:*,Indusoft,Web Studio
CVE-2011-1996,0.0,,0.60456,NVD-CWE-noinfo,"Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka ""Option Element Remote Code Execution Vulnerability.""",2011-10-12,Metasploit,cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:-:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:-:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows Server 2003
CVE-2011-2005,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.31761,NVD-CWE-noinfo,"afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka ""Ancillary Function Driver Elevation of Privilege Vulnerability.""",2011-10-12,CISA/Metasploit,cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows Server 2003
CVE-2011-2039,0.0,,0.69959,CWE-20,"The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.3.185 on Windows, and on Windows Mobile, downloads a client executable file (vpndownloader.exe) without verifying its authenticity, which allows remote attackers to execute arbitrary code via the url property to a certain ActiveX control in vpnweb.ocx, aka Bug ID CSCsy00904.",2011-06-02,Metasploit,cpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:anyconnect_secure_mobility_client:2.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:anyconnect_secure_mobility_client:2.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:anyconnect_secure_mobility_client:2.2.128:*:*:*:*:*:*:*;cpe:2.3:a:cisco:anyconnect_secure_mobility_client:2.2.133:*:*:*:*:*:*:*;cpe:2.3:a:cisco:anyconnect_secure_mobility_client:2.2.136:*:*:*:*:*:*:*;cpe:2.3:a:cisco:anyconnect_secure_mobility_client:2.2.140:*:*:*:*:*:*:*;cpe:2.3:a:cisco:anyconnect_secure_mobility_client:2.2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_mobile:*:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2011-2089,0.0,,0.38316,CWE-119,Stack-based buffer overflow in the SetActiveXGUID method in the VersionInfo ActiveX control in GenVersion.dll 8.0.138.0 in the WebHMI subsystem in ICONICS BizViz 9.x before 9.22 and GENESIS32 9.x before 9.22 allows remote attackers to execute arbitrary code via a long string in the argument.  NOTE: some of these details are obtained from third party information.,2011-05-13,Metasploit,cpe:2.3:a:iconics:bizviz:9.01:*:*:*:*:*:*:*;cpe:2.3:a:iconics:bizviz:9.0:*:*:*:*:*:*:*;cpe:2.3:a:iconics:bizviz:9.13:*:*:*:*:*:*:*;cpe:2.3:a:iconics:bizviz:9.1:*:*:*:*:*:*:*;cpe:2.3:a:iconics:bizviz:9.20:*:*:*:*:*:*:*;cpe:2.3:a:iconics:bizviz:9.21:*:*:*:*:*:*:*;cpe:2.3:a:iconics:bizviz:9.2:*:*:*:*:*:*:*;cpe:2.3:a:iconics:genesis32:9.01:*:*:*:*:*:*:*;cpe:2.3:a:iconics:genesis32:9.0:*:*:*:*:*:*:*;cpe:2.3:a:iconics:genesis32:9.13:*:*:*:*:*:*:*;cpe:2.3:a:iconics:genesis32:9.1:*:*:*:*:*:*:*;cpe:2.3:a:iconics:genesis32:9.20:*:*:*:*:*:*:*;cpe:2.3:a:iconics:genesis32:9.21:*:*:*:*:*:*:*;cpe:2.3:a:iconics:genesis32:9.2:*:*:*:*:*:*:*,Iconics,Bizviz
CVE-2011-2110,0.0,,0.86421,CWE-119,"Adobe Flash Player before 10.3.181.26 on Windows, Mac OS X, Linux, and Solaris, and 10.3.185.23 and earlier on Android, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in June 2011.",2011-06-16,Metasploit,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.0.0.584:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.0.12.10:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.0.12.36:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.0.15.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.0.22.87:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.0.32.18:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.0.42.34:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.0.45.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.102.64:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.105.6:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.106.16:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.52.14.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.52.15:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.53.64:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.82.76:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.85.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.92.10:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.92.8:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.95.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.95.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.2.152.32:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.2.152.33:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.2.152:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.2.154.13:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.2.154.25:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.2.156.12:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.2.157.51:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.2.159.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.3.181.14:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.3.181.16:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.3.185.21:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:6.0.21.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:6.0.79:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.14.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.19.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.24.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.25:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.53.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.60.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.61.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.63:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.66.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.67.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.68.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.69.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.70.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.73.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.1.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:8.0.22.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:8.0.24.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:8.0.33.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:8.0.34.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:8.0.35.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:8.0.39.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:8.0.42.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:8.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.112.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.114.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.115.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.124.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.125.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.151.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.152.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.155.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.159.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.16:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.18d60:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.20.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.20:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.246.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.260.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.262.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.277.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.28.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.283.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.28:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.31.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.31:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.45.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.47.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.48.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.125.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:google:android:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:*:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2011-2140,0.0,,0.82258,CWE-119,"Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2135, CVE-2011-2417, and CVE-2011-2425.",2011-08-10,Metasploit,cpe:2.3:a:adobe:adobe_air:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air:1.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air:1.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air:1.5.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air:1.5.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air:1.5:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air:2.6:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.0.0.584:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.0.12.10:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.0.12.36:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.0.15.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.0.22.87:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.0.32.18:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.0.42.34:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.0.45.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.102.64:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.105.6:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.106.16:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.52.14.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.52.15:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.53.64:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.82.76:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.85.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.92.10:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.92.8:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.95.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.1.95.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.2.152.32:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.2.152.33:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.2.152:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.2.154.13:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.2.154.25:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.2.156.12:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.2.157.51:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.2.159.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.3.181.14:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.3.181.16:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.3.181.23:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.3.181.34:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.3.185.21:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:10.3.185.23:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:6.0.21.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:6.0.79:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.14.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.19.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.24.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.25:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.53.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.60.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.61.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.63:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.66.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.67.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.68.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.69.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.70.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0.73.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.1.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:7.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:8.0.22.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:8.0.24.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:8.0.33.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:8.0.34.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:8.0.35.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:8.0.39.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:8.0.42.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:8.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.112.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.114.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.115.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.124.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.125.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.151.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.152.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.155.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.159.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.16:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.18d60:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.20.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.20:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.246.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.260.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.262.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.277.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.28.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.283.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.28:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.31.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.31:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.45.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.47.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0.48.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:9.125.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:google:android:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:*:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2011-2217,0.0,,0.41956,CWE-119,"Certain ActiveX controls in (1) tsgetxu71ex552.dll and (2) tsgetx71ex552.dll in Tom Sawyer GET Extension Factory 5.5.2.237, as used in VI Client (aka VMware Infrastructure Client) 2.0.2 before Build 230598 and 2.5 before Build 204931 in VMware Infrastructure 3, do not properly handle attempted initialization within Internet Explorer, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted HTML document.",2011-06-06,Metasploit,cpe:2.3:a:tomsawyer:get_extension_factory:5.5.2.237:*:*:*:*:*:*:*;cpe:2.3:a:vmware:infrastructure:3:*:*:*:*:*:*:*;cpe:2.3:a:vmware:virtual_infrastructure_client:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:virtual_infrastructure_client:2.5:*:*:*:*:*:*:*,Tomsawyer,Get Extension Factory
CVE-2011-2371,0.0,,0.75691,CWE-189,"Integer overflow in the Array.reduceRight method in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 allows remote attackers to execute arbitrary code via vectors involving a long JavaScript Array object.",2011-06-30,Metasploit,cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0:preview_release:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.15:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.16:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.17:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.18:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.19:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.20:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.15:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.16:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.17:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.15:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.16:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.17:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.18:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.19:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.15:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.16:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:beta10:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:beta11:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:beta12:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:beta4:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:beta5:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:beta6:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:beta7:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:beta8:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:beta9:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0:alpha:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.0:beta:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.15:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.16:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.17:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.18:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.19:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1:alpha:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.1:beta:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.5.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.5.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:1.5.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:alpha_1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:alpha_2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:alpha_3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:beta_1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:beta_2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:rc1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:rc2:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:0.7.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:0.7.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:0.7.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.7.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.7.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.16:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.17:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.18:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.19:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.21:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.22:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.23:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1:*:*:*:*:*:*:*,Mozilla,Seamonkey
CVE-2011-2386,0.0,,0.4522,CWE-94,"VisiWaveReport.exe in AZO Technologies, Inc. VisiWave Site Survey before 2.1.9 allows user-assisted remote attackers to execute arbitrary code via a (1) vws and (2) vwr file with an invalid Type property, which triggers an untrusted pointer dereference.",2011-06-08,Metasploit,cpe:2.3:a:visiwave:site_survey:*:*:*:*:*:*:*:*;cpe:2.3:a:visiwave:site_survey:1.6.12:*:*:*:*:*:*:*;cpe:2.3:a:visiwave:site_survey:2.0.12:*:*:*:*:*:*:*,Visiwave,Site Survey
CVE-2011-2404,0.0,,0.7374,CWE-94,"A certain ActiveX control in HPTicketMgr.dll in HP Easy Printer Care Software 2.5 and earlier allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via unspecified vectors, a different vulnerability than CVE-2011-4786 and CVE-2011-4787.",2011-08-11,Metasploit,cpe:2.3:a:hp:easy_printer_care_software:*:*:*:*:*:*:*:*,Hp,Easy Printer Care Software
CVE-2011-2462,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.86319,CWE-787,"Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, as exploited in the wild in December 2011.",2011-12-07,CISA/Metasploit,cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:opengroup:unix:-:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2011-2474,0.0,,0.63612,CWE-22,Directory traversal vulnerability in the HTTP Server in Sybase EAServer 6.3.1 Developer Edition allows remote attackers to read arbitrary files via a /.\../\../\ sequence in a path.,2011-06-09,Metasploit,cpe:2.3:a:sybase:easerver:6.3.1:*:developer:*:*:*:*:*,Sybase,Easerver
CVE-2011-2523,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96184,CWE-78,vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.,2019-11-27,EPSS/Metasploit/Nuclei,cpe:2.3:a:vsftpd_project:vsftpd:2.3.4:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2011-2595,0.0,,0.6128,CWE-119,Multiple stack-based buffer overflows in ACDSee FotoSlate 4.0 Build 146 allow remote attackers to execute arbitrary code via a long id parameter in a (1) String or (2) Int tag in a FotoSlate Project (aka PLP) file.,2011-09-14,Metasploit,cpe:2.3:a:acdsee:fotoslate:4.0:*:*:*:*:*:*:*,Acdsee,Fotoslate
CVE-2011-2653,0.0,,0.72493,CWE-22,Directory traversal vulnerability in the rtrlet component in Novell ZENworks Asset Management (ZAM) 7.5 allows remote attackers to execute arbitrary code by uploading an executable file.,2011-12-08,Metasploit,cpe:2.3:a:novell:zenworks_asset_management:7.5:*:*:*:*:*:*:*,Novell,Zenworks Asset Management
CVE-2011-2657,0.0,,0.48366,CWE-22,"Directory traversal vulnerability in the LaunchProcess function in the LaunchHelp.HelpLauncher.1 ActiveX control in LaunchHelp.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 allows remote attackers to execute arbitrary commands via a pathname in the first argument.",2012-07-26,Metasploit,cpe:2.3:a:novell:zenworks_configuration_management:10.2:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_configuration_management:10.3:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_configuration_management:11:sp1:*:*:*:*:*:*,Novell,Zenworks Configuration Management
CVE-2011-2744,0.0,,0.0896,CWE-22,Directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the action parameter to the default URI.,2011-07-19,Nuclei,cpe:2.3:a:chyrp:chyrp:*:*:*:*:*:*:*:*;cpe:2.3:a:chyrp:chyrp:2.0:*:*:*:*:*:*:*;cpe:2.3:a:chyrp:chyrp:2.1:beta1:*:*:*:*:*:*;cpe:2.3:a:chyrp:chyrp:2.1:beta2:*:*:*:*:*:*;cpe:2.3:a:chyrp:chyrp:2.1:rc:*:*:*:*:*:*,Chyrp,Chyrp
CVE-2011-2750,0.0,,0.16676,CWE-399,NFRAgent.exe in Novell File Reporter 1.0.4.2 and earlier allows remote attackers to delete arbitrary files via a full pathname in an SRS OPERATION 4 CMD 5 request to /FSF/CMD.,2011-07-17,Metasploit,cpe:2.3:a:novell:file_reporter:*:*:*:*:*:*:*:*;cpe:2.3:a:novell:file_reporter:1.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:novell:file_reporter:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:novell:file_reporter:1.0.2:*:*:*:*:*:*:*,Novell,File Reporter
CVE-2011-2757,0.0,,0.39366,CWE-22,Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0.0.12 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the FILENAME parameter.  NOTE: this might overlap the US-CERT VU#543310 issue.,2011-07-17,Metasploit,cpe:2.3:a:manageengine:servicedesk_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:manageengine:servicedesk_plus:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:manageengine:servicedesk_plus:7.6:*:*:*:*:*:*:*;cpe:2.3:a:manageengine:servicedesk_plus:8.0:*:*:*:*:*:*:*,Manageengine,Servicedesk Plus
CVE-2011-2763,0.0,,0.36139,CWE-20,The web interface on the LifeSize Room appliance LS_RM1_3.5.3 (11) and 4.7.18 allows remote attackers to execute arbitrary commands via a modified request to the LSRoom_Remoting.doCommand function in gateway.php.,2011-09-02,Metasploit,cpe:2.3:a:lifesize:lifesize_room_appliance_software:4.7.18:*:*:*:*:*:*:*;cpe:2.3:a:lifesize:lifesize_room_appliance_software:ls_rm1_3.5.3:*:*:*:*:*:*:*;cpe:2.3:h:lifesize:lifesize_room_appliance:*:*:*:*:*:*:*:*,Lifesize,Lifesize Room Appliance
CVE-2011-2780,0.0,,0.12991,CWE-22,"Directory traversal vulnerability in includes/lib/gz.php in Chyrp 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, a different vulnerability than CVE-2011-2744.",2011-07-19,Nuclei,cpe:2.3:a:chyrp:chyrp:*:*:*:*:*:*:*:*,Chyrp,Chyrp
CVE-2011-2882,0.0,,0.56368,CWE-119,"Stack-based buffer overflow in the NSEPA.NsepaCtrl.1 ActiveX control in nsepa.ocx in Citrix Access Gateway Enterprise Edition 8.1 before 8.1-67.7, 9.0 before 9.0-70.5, and 9.1 before 9.1-96.4 allows remote attackers to execute arbitrary code via crafted HTTP header data.",2011-07-21,Metasploit,cpe:2.3:a:citrix:access_gateway:8.1:*:enterprise:*:*:*:*:*;cpe:2.3:a:citrix:access_gateway:9.0:*:enterprise:*:*:*:*:*;cpe:2.3:a:citrix:access_gateway:9.1:*:enterprise:*:*:*:*:*,Citrix,Access Gateway
CVE-2011-2921,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.82828,CWE-273,"ktsuss versions 1.4 and prior has the uid set to root and does not drop privileges prior to executing user specified commands, which can result in command execution with root privileges.",2019-11-19,Metasploit,cpe:2.3:a:ktsuss_project:ktsuss:*:*:*:*:*:*:*:*,Ktsuss Project,Ktsuss
CVE-2011-2950,0.0,,0.28612,CWE-119,Heap-based buffer overflow in qcpfformat.dll in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to execute arbitrary code via a crafted QCP file.,2011-08-18,Metasploit,cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:14.0.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:14.0.1:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:14.0.2:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:14.0.3:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:14.0.4:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:14.0.5:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.1.3:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.1.4:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.1.5:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.1:*:*:*:*:*:*:*,Realnetworks,Realplayer
CVE-2011-3011,0.0,,0.71631,CWE-200,"BaseServiceImpl.class in CA ARCserve D2D r15 does not properly handle sessions, which allows remote attackers to obtain credentials, and consequently execute arbitrary commands, via unspecified vectors.",2011-08-15,Metasploit,cpe:2.3:a:ca:arcserve_d2d:r15:*:*:*:*:*:*:*,Ca,Arcserve D2D
CVE-2011-3167,0.0,,0.66402,NVD-CWE-noinfo,"Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1210.",2011-11-02,Metasploit,cpe:2.3:a:hp:openview_network_node_manager:7.51:*:*:*:*:*:*:*;cpe:2.3:a:hp:openview_network_node_manager:7.53:*:*:*:*:*:*:*,Hp,Openview Network Node Manager
CVE-2011-3171,0.0,,0.00585,CWE-22,"Directory traversal vulnerability in pure-FTPd 1.0.22 and possibly other versions, when running on SUSE Linux Enterprise Server and possibly other operating systems, when the Netware OES remote server feature is enabled, allows local users to overwrite arbitrary files via unknown vectors.",2011-11-04,Nuclei,cpe:2.3:a:pureftpd:pure-ftpd:*:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.90:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.91:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.92:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.93:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.94:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.95.1:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.95.2:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.95:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.95:pre1:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.95:pre2:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.95:pre3:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.95:pre4:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.96.1:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.96:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.96:pre1:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.97-final:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.97.1:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.97.2:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.97.3:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.97.4:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.97.5:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.97.6:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.97.7:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.97.7:pre1:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.97.7:pre2:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.97.7:pre3:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.97:pre1:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.97:pre2:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.97:pre3:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.97:pre4:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.97:pre5:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.98.1:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.98.2:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.98.2:a:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.98.3:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.98.4:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.98.5:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.98.6:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.98.7:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.98:final:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.98:pre1:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.98:pre2:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.99.1:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.99.1:a:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.99.1:b:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.99.2:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.99.2:a:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.99.3:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.99.4:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.99.9:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.99:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.99:a:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.99:b:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.99:pre1:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:0.99:pre2:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.10:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.11:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.12:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.13:a:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.14:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.15:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.16:a:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.16:b:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.16:c:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.17:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.17:a:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.18:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.19:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.20:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.21:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.7:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.8:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:1.0.9:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp1:vmware:*:*:*:*:*,Suse,Linux Enterprise Desktop
CVE-2011-3175,0.0,,0.65599,CWE-119,Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute arbitrary code via an opcode 0x6c request.,2012-04-09,Metasploit,cpe:2.3:a:novell:zenworks_configuration_management:11.1:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_configuration_management:11.1a:*:*:*:*:*:*:*,Novell,Zenworks Configuration Management
CVE-2011-3176,0.0,,0.69667,CWE-119,Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute arbitrary code via an opcode 0x4c request.,2012-04-09,Metasploit,cpe:2.3:a:novell:zenworks_configuration_management:11.1:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_configuration_management:11.1a:*:*:*:*:*:*:*,Novell,Zenworks Configuration Management
CVE-2011-3192,0.0,,0.98945,CWE-400,"The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.",2011-08-29,EPSS/Metasploit,cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*;cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:vmware:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp1:*:*:*:*:*:*,Opensuse,Opensuse
CVE-2011-3200,0.0,,0.20759,CWE-119,Stack-based buffer overflow in the parseLegacySyslogMsg function in tools/syslogd.c in rsyslogd in rsyslog 4.6.x before 4.6.8 and 5.2.0 through 5.8.4 might allow remote attackers to cause a denial of service (application exit) via a long TAG in a legacy syslog message.,2011-09-06,Metasploit,cpe:2.3:a:rsyslog:rsyslog:4.6.0:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:4.6.1:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:4.6.2:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:4.6.3:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:4.6.4:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:4.6.5:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:4.6.6:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:4.6.7:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.2.0:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.2.1:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.2.2:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.3.1:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.3.2:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.3.3:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.3.4:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.3.5:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.3.6:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.3.7:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.4.0:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.4.1:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.4.2:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.5.0:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.5.1:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.5.2:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.5.3:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.5.4:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.5.5:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.5.6:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.5.7:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.6.0:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.6.1:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.6.2:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.6.3:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.6.4:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.6.5:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.7.0:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.7.10:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.7.1:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.7.2:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.7.3:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.7.4:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.7.5:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.7.6:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.7.7:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.7.8:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.7.9:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.8.0:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.8.1:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.8.2:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.8.3:*:*:*:*:*:*:*;cpe:2.3:a:rsyslog:rsyslog:5.8.4:*:*:*:*:*:*:*,Rsyslog,Rsyslog
CVE-2011-3230,0.0,,0.50213,CWE-264,"Apple Safari before 5.1.1 on Mac OS X does not enforce an intended policy for file: URLs, which allows remote attackers to execute arbitrary code via a crafted web site.",2011-10-14,Metasploit,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.0.0b1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.0.0b2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.0.3:85.8.1:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.0.3:85.8:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.0:beta2:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.0:beta:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.0b1:-:mac:*:*:*:*:*;cpe:2.3:a:apple:safari:1.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.2.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.2.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.2.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.2.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.2.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.3.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.3.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.3.2:312.5:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.3.2:312.6:*:*:*:*:*:*;cpe:2.3:a:apple:safari:1.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:2.0.3:417.8:*:*:*:*:*:*;cpe:2.3:a:apple:safari:2.0.3:417.9.2:*:*:*:*:*:*;cpe:2.3:a:apple:safari:2.0.3:417.9.3:*:*:*:*:*:*;cpe:2.3:a:apple:safari:2.0.3:417.9:*:*:*:*:*:*;cpe:2.3:a:apple:safari:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:2.0.4:-:mac:*:*:*:*:*;cpe:2.3:a:apple:safari:2.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.0:-:mac:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.0b:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.0b:-:windows:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.1:-:mac:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.1:beta:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.1b:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.1b:-:windows:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.2:-:mac:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.2b:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.2b:-:windows:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.3:-:mac:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.3b:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.3b:-:windows:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.4:-:mac:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.4b:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0.4b:-:windows:*:*:*:*:*;cpe:2.3:a:apple:safari:3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.1.0:-:mac:*:*:*:*:*;cpe:2.3:a:apple:safari:3.1.0b:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.1.0b:-:windows:*:*:*:*:*;cpe:2.3:a:apple:safari:3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.1.1b:-:windows:*:*:*:*:*;cpe:2.3:a:apple:safari:3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.1.2b:-:windows:*:*:*:*:*;cpe:2.3:a:apple:safari:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.2.0b:-:windows:*:*:*:*:*;cpe:2.3:a:apple:safari:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.2.1b:-:windows:*:*:*:*:*;cpe:2.3:a:apple:safari:3.2.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:3.2.2b:-:windows:*:*:*:*:*;cpe:2.3:a:apple:safari:3:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:4.0.0b:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:4.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:4.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:4.0.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:4.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:4.0:beta:*:*:*:*:*:*;cpe:2.3:a:apple:safari:4.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:4.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:5.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:5.0.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:5.0.6:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:5.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x_server:*:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2011-3305,0.0,,0.21593,CWE-22,"Directory traversal vulnerability in Cisco Network Admission Control (NAC) Manager 4.8.x allows remote attackers to read arbitrary files via crafted traffic to TCP port 443, aka Bug ID CSCtq10755.",2011-10-06,Metasploit,cpe:2.3:a:cisco:nac_manager:4.8:*:*:*:*:*:*:*;cpe:2.3:a:cisco:nac_manager:4.8\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:nac_manager:4.8\(2\):*:*:*:*:*:*:*;cpe:2.3:h:cisco:nac_appliance:*:*:*:*:*:*:*:*,Cisco,Nac Appliance
CVE-2011-3315,0.0,,0.26393,CWE-22,"Directory traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x and 6.x before 6.1(5)SU2, 7.x before 7.1(5b)SU2, and 8.x before 8.0(3), and Cisco Unified Contact Center Express (aka Unified CCX or UCCX) and Cisco Unified IP Interactive Voice Response (Unified IP-IVR) before 6.0(1)SR1ES8, 7.0(x) before 7.0(2)ES1, 8.0(x) through 8.0(2)SU3, and 8.5(x) before 8.5(1)SU2, allows remote attackers to read arbitrary files via a crafted URL, aka Bug IDs CSCth09343 and CSCts44049.",2011-10-27,Nuclei,cpe:2.3:a:cisco:unified_ccx:6.0\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_ccx:7.0\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_ccx:7.0\(2\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_ccx:8.0\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_ccx:8.0\(2\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_ccx:8.5\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:5.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:5.1.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:5.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:5.1\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:5.1\(1b\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:5.1\(1c\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:5.1\(2\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:5.1\(2a\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:5.1\(2b\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:5.1\(3\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:5.1\(3a\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:5.1\(3c\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:5.1\(3d\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:5.1\(3e\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:6.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:6.1\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:6.1\(1a\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:6.1\(1b\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:6.1\(2\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:6.1\(2\)su1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:6.1\(2\)su1a:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:6.1\(3\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:6.1\(3a\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:6.1\(3b\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:6.1\(3b\)su1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:6.1\(4\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:6.1\(4\)su1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:6.1\(4a\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:6.1\(4a\)su2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:6.1\(5\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:6.1\(5\)su1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:7.0\(1\)su1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:7.0\(1\)su1a:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:7.0\(2\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:7.0\(2a\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:7.0\(2a\)su1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:7.0\(2a\)su2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:7.1\(2a\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:7.1\(2a\)su1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:7.1\(2b\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:7.1\(2b\)su1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:7.1\(3\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:7.1\(3a\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:7.1\(3a\)su1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:7.1\(3a\)su1a:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:7.1\(3b\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:7.1\(3b\)su1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:7.1\(3b\)su2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:7.1\(5\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:7.1\(5\)su1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:7.1\(5\)su1a:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:7.1\(5a\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:7.1\(5b\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:7.1\(5b\)su1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:7.1\(5b\)su1a:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:8.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:8.0\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:8.0\(2\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:8.0\(2a\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:8.0\(2b\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:8.0\(2c\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:8.0\(2c\)su1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_ip_ivr:6.0\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_ip_ivr:7.0\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_ip_ivr:7.0\(2\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_ip_ivr:8.0\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_ip_ivr:8.0\(2\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_ip_ivr:8.5\(1\):*:*:*:*:*:*:*;cpe:2.3:h:cisco:unified_ip_interactive_voice_response:-:*:*:*:*:*:*:*,Cisco,Unified Ip Interactive Voice Response
CVE-2011-3322,0.0,,0.65312,CWE-119,"Core Server HMI Service (Coreservice.exe) in Scadatec Limited Procyon SCADA 1.06, and other versions before 1.14, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long password to the Telnet (TCP/23) port, which triggers an out-of-bounds read or write, leading to a stack-based buffer overflow.",2011-09-15,Metasploit,cpe:2.3:a:scadatec:procyon_scada:1.06:*:*:*:*:*:*:*;cpe:2.3:a:scadatec:procyon_scada:1.13:*:*:*:*:*:*:*,Scadatec,Procyon Scada
CVE-2011-3360,0.0,,0.35528,NVD-CWE-Other,Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows local users to gain privileges via a Trojan horse Lua script in an unspecified directory.,2011-09-20,Metasploit,cpe:2.3:a:wireshark:wireshark:1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.4.1:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.4.2:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.4.3:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.4.4:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.4.5:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.4.6:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.4.7:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.4.8:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.6.1:*:*:*:*:*:*:*,Wireshark,Wireshark
CVE-2011-3368,0.0,,0.90734,CWE-20,"The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.",2011-10-05,Metasploit,cpe:2.3:a:apache:http_server:1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.15:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.16:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.17:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.18:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.19:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.20:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.22:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.23:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.24:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.25:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.26:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.27:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.28:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.29:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.30:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.31:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.32:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.33:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.34:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.35:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.36:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.37:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.38:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.39:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.41:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.42:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.65:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.68:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:1.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.28:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.28:beta:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.32:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.32:beta:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.34:beta:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.35:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.37:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.38:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.41:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.42:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.43:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.44:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.45:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.46:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.47:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.48:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.49:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.50:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.51:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.52:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.53:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.54:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.55:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.56:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.57:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.58:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.59:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.60:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.61:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.63:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.64:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.16:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.18:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.19:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.20:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.21:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.9:*:*:*:*:*:*:*,Apache,Http Server
CVE-2011-3389,0.0,,0.73327,CWE-326,"The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a ""BEAST"" attack.",2011-09-06,Metasploit,cpe:2.3:a:google:chrome:-:*:*:*:*:*:*:*;cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:-:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:-:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera_browser:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_rf615r:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_rf68xr:-:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_rf615r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_rf68xr_firmware:*:*:*:*:*:*:*:*,Siemens,Simatic Rf68Xr Firmware
CVE-2011-3400,0.0,,0.71722,CWE-94,"Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 do not properly handle OLE objects in memory, which allows remote attackers to execute arbitrary code via a crafted object in a file, aka ""OLE Property Vulnerability.""",2011-12-14,Metasploit,cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*,Microsoft,Windows Server 2003
CVE-2011-3402,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.78285,NVD-CWE-noinfo,"Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by Duqu, aka ""TrueType Font Parsing Vulnerability.""",2011-11-04,CISA/Metasploit,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2011-3486,0.0,,0.50556,CWE-119,"Beckhoff TwinCAT 2.11.0.2004 and earlier allows remote attackers to cause a denial of service via a crafted request to UDP port 48899, which triggers an out-of-bounds read.",2011-09-16,Metasploit,cpe:2.3:a:beckhoff:twincat:*:*:*:*:*:*:*:*;cpe:2.3:a:beckhoff:twincat:2.10:*:*:*:*:*:*:*;cpe:2.3:a:beckhoff:twincat:2.7:*:*:*:*:*:*:*;cpe:2.3:a:beckhoff:twincat:2.8:*:*:*:*:*:*:*;cpe:2.3:a:beckhoff:twincat:2.9:*:*:*:*:*:*:*,Beckhoff,Twincat
CVE-2011-3492,0.0,,0.70909,CWE-119,Stack-based buffer overflow in Azeotech DAQFactory 5.85 build 1853 and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a crafted NETB packet to UDP port 20034.,2011-09-16,Metasploit,cpe:2.3:a:azeotech:daqfactory:*:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:3.03:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:3.05:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:3.09:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:3.0:-:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:3.10:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:3.11:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:3.51:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:3.52:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:3.53:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:3.55:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:3.5:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:4.00:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:4.10:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:4.11:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.01:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.02:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.03:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.04:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.05:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.0:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.10:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.11:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.12:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.15:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.30:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.31:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.32:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.33:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.34:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.35:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.36:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.37:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.38:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.39:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.40:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.70:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.71:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.72:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.73:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.74:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.75:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.76:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.77:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.78:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.79:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.80:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.82:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.83:*:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.83:a:*:*:*:*:*:*;cpe:2.3:a:azeotech:daqfactory:5.84:*:*:*:*:*:*:*,Azeotech,Daqfactory
CVE-2011-3494,0.0,,0.55778,CWE-119,"WinSig.exe in eSignal 10.6.2425 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) a long StyleTemplate element in a QUO, SUM or POR file, which triggers a stack-based buffer overflow, or (2) a long Font->FaceName field (aka FaceName element), which triggers a heap-based buffer overflow.  NOTE: some of these details are obtained from third party information.",2011-09-16,Metasploit,cpe:2.3:a:interactivedata:esignal:*:*:*:*:*:*:*:*;cpe:2.3:a:interactivedata:esignal:10.6:*:*:*:*:*:*:*,Interactivedata,Esignal
CVE-2011-3497,0.0,,0.58746,CWE-200,"service.exe in Measuresoft ScadaPro 4.0.0 and earlier allows remote attackers to execute arbitrary DLL functions via the XF function, possibly related to an insecure exposed method.",2011-09-16,Metasploit,cpe:2.3:a:measuresoft:scadapro:*:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:2.1:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:2.2:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:2.3:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:2.4.1:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:2.4.2:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:2.4.3:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:2.4.4:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:2.4.5:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:2.4.6:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:2.4:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:2.5.2:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:2.5.3:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:2.5.4:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:2.5.5:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:2.5:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:2.6.0:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:2.7.0:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:2.7.1:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:2.7.2:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:2.8.0:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:2.9.0:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:3.2.8:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:3.2.9:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:3.3.0:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:3.3.2:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:3.9.0:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:3.9.10:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:3.9.11:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:3.9.12:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:3.9.13:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:3.9.14:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:3.9.15:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:3.9.1:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:3.9.2:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:3.9.3:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:3.9.4:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:3.9.5:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:3.9.6:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:3.9.7:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:3.9.8:*:*:*:*:*:*:*;cpe:2.3:a:measuresoft:scadapro:3.9.9:*:*:*:*:*:*:*,Measuresoft,Scadapro
CVE-2011-3544,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96714,NVD-CWE-noinfo,"Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.",2011-10-19,CISA/EPSS/Metasploit,cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:-:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update10:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update11:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update12:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update13:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update14:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update15:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update16:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update17:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update18:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update19:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update20:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update21:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update22:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update23:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update24:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update25:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update26:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:-:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update10:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update11:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update13:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update15:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update17:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update21:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update25:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update5:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update6:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update7:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update7_b32:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update9:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update9_b31:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update9_b32:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:-:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update11:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update12:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update13:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update14:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update15:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update16:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update17:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update18:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update19:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update20:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update21:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update22:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update23:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update24:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update25:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update26:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update4:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update5:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update6:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update7:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update8:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update9:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:-:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update10:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update10_b31:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update11:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update13:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update15:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update17:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update17_b31:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update17_b32:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update21:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update21_b31:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update25:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update25_b33:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update25_b34:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update25_b35:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update7:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update7_b32:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update9:*:*:*:*:*:*;cpe:2.3:a:redhat:satellite_with_embedded_oracle:5.4:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_java:10:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*,Canonical,Ubuntu Linux
CVE-2011-3556,0.0,,0.76245,NVD-CWE-noinfo,"Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI, a different vulnerability than CVE-2011-3557.",2011-10-19,Metasploit,cpe:2.3:a:oracle:jrockit:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jrockit:r28.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jrockit:r28.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jrockit:r28.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jrockit:r28.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jrockit:r28.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jrockit:r28.1.3:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:*:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:*:update31:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:*:update_27:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_10:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_11:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_12:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_13:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_14:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_15:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_16:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_17:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_18:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_19:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_1:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_20:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_21:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_22:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_23:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_24:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_25:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_26:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_27:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_28:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_29:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_2:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_30:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_31:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_32:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_3:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_4:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_5:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_6:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_7:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_8:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_9:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update10:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update11:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update11_b03:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update12:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update13:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update14:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update15:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update16:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update17:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update18:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update19:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update1:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update20:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update21:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update22:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update23:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update24:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update25:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update26:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update27:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update28:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update29:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update3:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update4:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update5:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update6:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update7:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update7_b03:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update8:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update9:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update1:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_19:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_20:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_21:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_22:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_23:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_24:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_25:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_26:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:*:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:*:update31:*:*:*:*:*:*;cpe:2.3:a:sun:jre:*:update_27:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_10:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_11:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_12:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_13:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_14:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_15:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_16:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_17:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_18:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_19:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_1:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_20:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_21:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_22:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_23:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_24:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_25:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_26:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_27:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_28:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_29:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_2:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_30:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_31:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_32:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_3:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_4:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_5:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_6:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_7:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_8:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_9:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update10:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update17:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update18:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update19:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update20:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update21:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update22:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update23:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update24:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update25:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update26:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update27:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update29:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update7:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update8:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update9:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_19:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_20:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_21:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_22:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_23:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_24:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_25:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_26:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.7.0:*:*:*:*:*:*:*,Sun,Jdk
CVE-2011-3587,0.0,,0.78546,NVD-CWE-noinfo,"Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.",2011-10-10,Metasploit,cpe:2.3:a:plone:plone:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:plone:plone:4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:plone:plone:4.0.3:*:*:*:*:*:*:*;cpe:2.3:a:plone:plone:4.0.4:*:*:*:*:*:*:*;cpe:2.3:a:plone:plone:4.0.5:*:*:*:*:*:*:*;cpe:2.3:a:plone:plone:4.0.6.1:*:*:*:*:*:*:*;cpe:2.3:a:plone:plone:4.0.7:*:*:*:*:*:*:*;cpe:2.3:a:plone:plone:4.0.8:*:*:*:*:*:*:*;cpe:2.3:a:plone:plone:4.0.9:*:*:*:*:*:*:*;cpe:2.3:a:plone:plone:4.0:*:*:*:*:*:*:*;cpe:2.3:a:plone:plone:4.1:*:*:*:*:*:*:*;cpe:2.3:a:plone:plone:4.2:*:*:*:*:*:*:*;cpe:2.3:a:plone:plone:4.2a1:*:*:*:*:*:*:*;cpe:2.3:a:plone:plone:4.2a2:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.0:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.0:a1:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.0:a2:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.0:a3:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.0:a4:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.0:b1:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.0:b2:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.0:b3:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.0:b4:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.10:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.11:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.12:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.13:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.14:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.15:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.16:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.17:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.18:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.19:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.1:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.20:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.2:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.3:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.4:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.5:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.6:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.7:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.8:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.12.9:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.13.0:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.13.0:a1:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.13.0:a2:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.13.0:a3:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.13.0:a4:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.13.0:b1:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.13.0:c1:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.13.10:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.13.1:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.13.2:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.13.3:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.13.4:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.13.5:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.13.6:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.13.7:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.13.8:*:*:*:*:*:*:*;cpe:2.3:a:zope:zope:2.13.9:*:*:*:*:*:*:*,Plone,Plone
CVE-2011-3600,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.1591,CWE-611,"The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.",2019-11-26,Nuclei,cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*,Apache,Ofbiz
CVE-2011-3625,0.0,,0.24105,CWE-119,"Stack-based buffer overflow in the sub_read_line_sami function in subreader.c in MPlayer, as used in SMPlayer 0.6.9, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a SAMI subtitle file.",2014-06-11,Metasploit,cpe:2.3:a:mplayer2:mplayer2:-:*:*:*:*:*:*:*;cpe:2.3:a:ricardo_villalba:smplayer:0.6.9:*:*:*:*:*:*:*,Mplayer2,Mplayer2
CVE-2011-3658,0.0,,0.70091,CWE-399,"The SVG implementation in Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5 does not properly interact with DOMAttrModified event handlers, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via vectors involving removal of SVG elements.",2011-12-21,Metasploit,cpe:2.3:a:mozilla:firefox:8.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:8.0:*:*:*:*:*:*:*,Mozilla,Firefox
CVE-2011-3659,0.0,,0.36511,CWE-416,"Use-after-free vulnerability in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 might allow remote attackers to execute arbitrary code via vectors related to incorrect AttributeChildRemoved notifications that affect access to removed nsDOMAttribute child nodes.",2012-02-01,Metasploit,cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:vmware:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp1:*:*:*:*:*:*,Opensuse,Opensuse
CVE-2011-3829,0.0,,0.17884,CWE-200,"ftp_upload_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to obtain sensitive information via the file name, which reveals the installation path in an error message.",2012-01-29,Metasploit,cpe:2.3:a:sitracker:support_incident_tracker:3.65:*:*:*:*:*:*:*,Sitracker,Support Incident Tracker
CVE-2011-3833,0.0,,0.19783,NVD-CWE-Other,"Unrestricted file upload vulnerability in ftp_upload_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in an unspecified directory.",2012-01-29,Metasploit,cpe:2.3:a:sitracker:support_incident_tracker:3.65:*:*:*:*:*:*:*,Sitracker,Support Incident Tracker
CVE-2011-3923,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.88829,CWE-732,Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.,2019-11-01,Metasploit,cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_web_server:1.0.0:*:*:*:*:*:*:*,Apache,Struts
CVE-2011-3976,0.0,,0.30592,CWE-119,"Stack-based buffer overflow in AmmSoft ScriptFTP 3.3 allows remote FTP servers to execute arbitrary code via a long filename in a response to a LIST command, as demonstrated using (1) GETLIST or (2) GETFILE in a ScriptFTP script.",2011-10-04,Metasploit,cpe:2.3:a:ammsoft:scriptftp:3.3:*:*:*:*:*:*:*,Ammsoft,Scriptftp
CVE-2011-4034,0.0,,0.13368,CWE-119,"Buffer overflow in the Steema TeeChart ActiveX control, as used in Schneider Electric Vijeo Historian 4.30 and earlier, CitectHistorian 4.30 and earlier, and CitectSCADAReports 4.10 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service via unspecified vectors.",2011-12-02,Metasploit,cpe:2.3:a:schneider-electric:citecthistorian:*:*:*:*:*:*:*:*;cpe:2.3:a:schneider-electric:citecthistorian:4.20:*:*:*:*:*:*:*;cpe:2.3:a:schneider-electric:citectscada_reports:*:*:*:*:*:*:*:*;cpe:2.3:a:schneider-electric:citectscada_reports:4.0:*:*:*:*:*:*:*;cpe:2.3:a:schneider-electric:vijeo_historian:*:*:*:*:*:*:*:*;cpe:2.3:a:schneider-electric:vijeo_historian:4.0:*:*:*:*:*:*:*;cpe:2.3:a:schneider-electric:vijeo_historian:4.10:*:*:*:*:*:*:*;cpe:2.3:a:schneider-electric:vijeo_historian:4.20:*:*:*:*:*:*:*,Schneider-Electric,Vijeo Historian
CVE-2011-4040,0.0,,0.65262,CWE-119,Buffer overflow in MiniSmtp 3.0.11818 in NJStar Communicator allows remote attackers to execute arbitrary code via a crafted packet.,2011-11-21,Metasploit,cpe:2.3:a:njstar:njstar_communicator:3.0.11818:*:*:*:*:*:*:*,Njstar,Njstar Communicator
CVE-2011-4044,0.0,,0.26732,NVD-CWE-noinfo,"An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to modify files via calls to unknown methods.",2012-04-03,Metasploit,cpe:2.3:a:arcinfo:frontvue:-:*:*:*:*:*:*:*;cpe:2.3:a:arcinfo:pcvue:*:*:*:*:*:*:*:*;cpe:2.3:a:arcinfo:plantvue:-:*:*:*:*:*:*:*,Arcinfo,Frontvue
CVE-2011-4050,0.0,,0.21149,CWE-119,Buffer overflow in 7-Technologies (7T) Interactive Graphical SCADA System (IGSS) 9.0.0.11200 allows remote attackers to cause a denial of service via a crafted packet to TCP port 12401.,2011-12-27,Metasploit,cpe:2.3:a:7t:igss:9.0.0.11200:*:*:*:*:*:*:*,7T,Igss
CVE-2011-4051,0.0,,0.69095,CWE-287,"CEServer.exe in the CEServer component in the Remote Agent module in InduSoft Web Studio 6.1 and 7.0 does not require authentication, which allows remote attackers to execute arbitrary code via vectors related to creation of a file, loading a DLL, and process control.",2011-12-05,Metasploit,cpe:2.3:a:indusoft:web_studio:6.1:*:*:*:*:*:*:*;cpe:2.3:a:indusoft:web_studio:7.0:*:*:*:*:*:*:*,Indusoft,Web Studio
CVE-2011-4075,0.0,,0.51891,CWE-94,"The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby parameter (aka sortby variable) in a query_engine action to cmd.php, as exploited in the wild in October 2011.",2011-11-02,Metasploit,cpe:2.3:a:phpldapadmin_project:phpldapadmin:1.2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:phpldapadmin_project:phpldapadmin:1.2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:phpldapadmin_project:phpldapadmin:1.2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:phpldapadmin_project:phpldapadmin:1.2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:phpldapadmin_project:phpldapadmin:1.2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:phpldapadmin_project:phpldapadmin:1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:phpldapadmin_project:phpldapadmin:1.2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:phpldapadmin_project:phpldapadmin:1.2.1:*:*:*:*:*:*:*,Phpldapadmin Project,Phpldapadmin
CVE-2011-4135,0.0,,0.31861,CWE-22,"Multiple directory traversal vulnerabilities in lmgrd in Flexera FlexNet Publisher 11.10 (aka FlexNet License Server Manager) allow remote attackers to execute arbitrary code via vectors related to save, rename, and load operations on log files.  NOTE: this might overlap CVE-2011-1389.",2012-01-19,Metasploit,cpe:2.3:a:flexerasoftware:flexnet_publisher:11.10:*:*:*:*:*:*:*,Flexerasoftware,Flexnet Publisher
CVE-2011-4166,0.0,,0.61756,CWE-22,Directory traversal vulnerability in the MPAUploader.Uploader.1.UploadFiles method in HP Managed Printing Administration before 2.6.4 allows remote attackers to create arbitrary files via crafted form data.,2011-12-27,Metasploit,cpe:2.3:a:hp:managed_printing_administration:*:*:*:*:*:*:*:*,Hp,Managed Printing Administration
CVE-2011-4336,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.07652,CWE-79,"Tiki Wiki CMS Groupware 7.0 has XSS via the GET ""ajax"" parameter to snarf_ajax.php.",2020-01-15,Nuclei,cpe:2.3:a:tiki:tikiwiki_cms\/groupware:*:*:*:*:*:*:*:*,Tiki,Tikiwiki Cms/Groupware
CVE-2011-4350,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.16142,CWE-22,Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed. A remote authenticated user could use this flaw to obtain content of arbitrary local files via specially-crafted URL request.,2019-11-26,Metasploit,cpe:2.3:a:yaws:yaws:1.91:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2011-4404,0.0,,0.59726,CWE-16,"The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attackers to conduct directory traversal attacks and read arbitrary files via unspecified vectors, a related issue to CVE-2009-1523.",2011-11-19,Metasploit,cpe:2.3:a:vmware:vcenter_update_manager:4.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_update_manager:4.0:update_1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_update_manager:4.0:update_2:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_update_manager:4.0:update_3:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_update_manager:4.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_update_manager:4.1:update_1:*:*:*:*:*:*,Vmware,Vcenter Update Manager
CVE-2011-4451,0.0,,0.1417,NVD-CWE-noinfo,"libs/Wakka.class.php in WikkaWiki 1.3.1 and 1.3.2, when the spam_logging option is enabled, allows remote attackers to write arbitrary PHP code to the spamlog_path file via the User-Agent HTTP header in an addcomment request.  NOTE: the vendor disputes this issue because the rendering of the spamlog_path file never uses the PHP interpreter",2012-09-05,Metasploit,cpe:2.3:a:wikkawiki:wikkawiki:1.3.1:*:*:*:*:*:*:*;cpe:2.3:a:wikkawiki:wikkawiki:1.3.2:*:*:*:*:*:*:*,Wikkawiki,Wikkawiki
CVE-2011-4453,0.0,,0.52477,CWE-94,"The PageListSort function in scripts/pagelist.php in PmWiki 2.x before 2.2.35 allows remote attackers to execute arbitrary code via PHP sequences in a crafted order parameter in a pagelist directive, leading to unintended use of the PHP create_function function.",2011-12-22,Metasploit,cpe:2.3:a:pmwiki:pmwiki:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.0.10:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.0.11:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.0.12:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.0.13:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.0.6:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.0.7:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.0.8:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.0.9:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.0:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.10:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.11:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.12:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.13:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.14:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.15:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.16:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.17:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.18:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.19:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.20:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.21:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.22:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.23:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.24:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.25:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.26:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.27:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.2:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.3:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.4:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.5:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.6:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.7:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.8:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.1.9:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta10:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta11:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta12:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta13:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta14:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta15:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta16:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta17:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta18:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta19:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta1:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta20:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta21:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta22:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta23:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta24:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta25:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta26:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta27:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta28:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta29:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta2:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta30:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta31:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta32:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta33:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta34:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta35:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta36:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta37:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta38:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta39:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta3:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta40:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta41:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta42:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta43:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta44:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta45:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta46:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta47:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta48:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta49:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta4:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta50:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta51:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta52:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta53:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta54:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta55:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta56:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta57:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta58:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta59:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta5:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta60:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta61:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta62:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta63:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta64:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta65:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta66:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta67:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta68:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta6:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta7:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta8:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.0:beta9:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.10:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.11:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.12:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.13:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.14:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.15:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.16:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.17:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.18:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.19:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.1:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.20:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.21:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.22:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.23:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.24:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.25:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.26:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.27:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.28:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.29:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.2:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.30:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.32:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.33:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.34:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.3:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.4:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.5:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.6:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.7:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.8:*:*:*:*:*:*:*;cpe:2.3:a:pmwiki:pmwiki:2.2.9:*:*:*:*:*:*:*,Pmwiki,Pmwiki
CVE-2011-4496,0.0,,0.11058,CWE-119,Buffer overflow in Aviosoft DTV Player 1.0.1.2 allows remote attackers to execute arbitrary code via a crafted .plf (aka playlist) file.,2011-11-21,Metasploit,cpe:2.3:a:aviosoft:dtv_player:1.0.1.2:*:*:*:*:*:*:*,Aviosoft,Dtv Player
CVE-2011-4535,0.0,,0.27003,CWE-119,"Buffer overflow in TurboPower Abbrevia before 4.0, as used in ScadaTEC ScadaPhone 5.3.11.1230 and earlier, ScadaTEC ModbusTagServer 4.1.1.81 and earlier, and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted ZIP file.",2012-04-03,Metasploit,cpe:2.3:a:craig_peterson:turbopower_abbrevia:*:*:*:*:*:*:*:*;cpe:2.3:a:scadatec:modbustagserver:*:*:*:*:*:*:*:*;cpe:2.3:a:scadatec:scadaphone:*:*:*:*:*:*:*:*,Craig Peterson,Turbopower Abbrevia
CVE-2011-4542,0.0,,0.24119,CWE-89,Hastymail2 2.1.1 before RC2 allows remote attackers to execute arbitrary commands via the (1) rs or (2) rsargs[] parameter in a mailbox Drafts action to the default URI.,2011-11-30,Metasploit,cpe:2.3:a:hastymail:hastymail2:*:beta1:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:*:beta2:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:*:beta3:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:*:rc1:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:*:rc2:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:*:rc3:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:*:rc4:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:*:rc5:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:*:rc6:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:*:rc7:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:*:rc8:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:*:rc9:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:1.01:*:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:1.0:*:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:1.1:rc1:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:1.1:rc2:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:2.0:*:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:2.0:a1:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:2.0:a2:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:2.0:b1:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:2.0:b2:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:2.0:b3:*:*:*:*:*:*;cpe:2.3:a:hastymail:hastymail2:2.0:rc1:*:*:*:*:*:*,Hastymail,Hastymail2
CVE-2011-4618,0.0,,0.10083,CWE-79,Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.,2013-01-24,Nuclei,cpe:2.3:a:simplerealtytheme:advanced_text_widget_plugin:*:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*,Simplerealtytheme,Advanced Text Widget Plugin
CVE-2011-4624,0.0,,0.07062,CWE-79,Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.,2014-10-01,Nuclei,cpe:2.3:a:codeasily:grand_flagallery:*:*:*:*:*:wordpress:*:*,Codeasily,Grand Flagallery
CVE-2011-4640,0.0,,0.07323,CWE-22,Directory traversal vulnerability in logs-x.php in SpamTitan WebTitan before 3.60 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the fname parameter in a view action.,2012-10-08,Nuclei,cpe:2.3:a:spamtitan:webtitan:*:*:*:*:*:*:*:*,Spamtitan,Webtitan
CVE-2011-4642,0.0,,0.28928,CWE-352,"mappy.py in Splunk Web in Splunk 4.2.x before 4.2.5 does not properly restrict use of the mappy command to access Python classes, which allows remote authenticated administrators to execute arbitrary code by leveraging the sys module in a request to the search application, as demonstrated by a cross-site request forgery (CSRF) attack, aka SPL-45172.",2012-01-03,Metasploit,cpe:2.3:a:splunk:splunk:4.2.1:*:*:*:*:*:*:*;cpe:2.3:a:splunk:splunk:4.2.2:*:*:*:*:*:*:*;cpe:2.3:a:splunk:splunk:4.2.3:*:*:*:*:*:*:*;cpe:2.3:a:splunk:splunk:4.2.4:*:*:*:*:*:*:*;cpe:2.3:a:splunk:splunk:4.2:*:*:*:*:*:*:*,Splunk,Splunk
CVE-2011-4722,0.0,,0.57601,CWE-22,Directory traversal vulnerability in the TFTP Server 1.0.0.24 in Ipswitch WhatsUp Gold allows remote attackers to read arbitrary files via a .. (dot dot) in the Filename field of an RRQ operation.,2014-12-28,Metasploit,cpe:2.3:a:ipswitch:tftp_server:1.0.0.24:*:*:*:*:*:*:*,Ipswitch,Tftp Server
CVE-2011-4723,5.7,CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.03128,CWE-312,"The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information via unspecified vectors.",2011-12-20,CISA,cpe:2.3:h:dlink:dir-300:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-300_firmware:-:*:*:*:*:*:*:*,D-Link,Dir-300 Firmware
CVE-2011-4786,0.0,,0.40986,CWE-94,"A certain ActiveX control in HPTicketMgr.dll in HP Easy Printer Care Software 2.5 and earlier allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via unspecified vectors, a different vulnerability than CVE-2011-2404 and CVE-2011-4787.",2012-01-12,Metasploit,cpe:2.3:a:hp:easy_printer_care_software:*:*:*:*:*:*:*:*,Hp,Easy Printer Care Software
CVE-2011-4789,0.0,,0.64803,CWE-119,"Stack-based buffer overflow in magentservice.exe in the server in HP LoadRunner 11.00 before patch 4 allows remote attackers to execute arbitrary code via a crafted size value in a packet.  NOTE: it was originally reported that the affected product is HP Diagnostics Server, but HP states that ""the vulnerable product is actually HP LoadRunner.""",2012-01-13,Metasploit,cpe:2.3:a:hp:diagnostics:*:*:*:*:*:*:*:*,Hp,Diagnostics
CVE-2011-4804,0.0,,0.24299,CWE-22,Directory traversal vulnerability in the obSuggest (com_obsuggest) component before 1.8 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.,2011-12-14,Nuclei,cpe:2.3:a:foobla:com_obsuggest:*:*:*:*:*:*:*:*;cpe:2.3:a:foobla:com_obsuggest:1.5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:foobla:com_obsuggest:1.5.1.1.20090922:*:*:*:*:*:*:*;cpe:2.3:a:foobla:com_obsuggest:1.5.1.2:*:*:*:*:*:*:*;cpe:2.3:a:foobla:com_obsuggest:1.5.1.4:*:*:*:*:*:*:*;cpe:2.3:a:foobla:com_obsuggest:1.5.1.5:*:*:*:*:*:*:*;cpe:2.3:a:foobla:com_obsuggest:1.5.1.6:*:*:*:*:*:*:*;cpe:2.3:a:foobla:com_obsuggest:1.5.1.7:*:*:*:*:*:*:*;cpe:2.3:a:foobla:com_obsuggest:1.6.1:b7:*:*:*:*:*:*;cpe:2.3:a:foobla:com_obsuggest:1.6.1:b8:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Foobla,Com Obsuggest
CVE-2011-4825,0.0,,0.40905,CWE-94,"Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2.7.1, and possibly other products, allows remote attackers to inject arbitrary PHP code into data.php via crafted parameters.",2011-12-15,Metasploit,cpe:2.3:a:phpletter:ajax_file_and_image_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:phpletter:ajax_file_and_image_manager:0.5.5:*:*:*:*:*:*:*;cpe:2.3:a:phpletter:ajax_file_and_image_manager:0.5.7:*:*:*:*:*:*:*;cpe:2.3:a:phpletter:ajax_file_and_image_manager:0.5:*:*:*:*:*:*:*;cpe:2.3:a:phpletter:ajax_file_and_image_manager:0.6.12:*:*:*:*:*:*:*;cpe:2.3:a:phpletter:ajax_file_and_image_manager:0.6:*:*:*:*:*:*:*;cpe:2.3:a:phpletter:ajax_file_and_image_manager:0.7.10:*:*:*:*:*:*:*;cpe:2.3:a:phpletter:ajax_file_and_image_manager:0.7.8:*:*:*:*:*:*:*;cpe:2.3:a:phpletter:ajax_file_and_image_manager:0.8.24:*:*:*:*:*:*:*;cpe:2.3:a:phpletter:ajax_file_and_image_manager:0.8.8:*:*:*:*:*:*:*;cpe:2.3:a:phpletter:ajax_file_and_image_manager:0.8.9:*:*:*:*:*:*:*;cpe:2.3:a:phpletter:ajax_file_and_image_manager:0.8:*:*:*:*:*:*:*;cpe:2.3:a:phpletter:ajax_file_and_image_manager:0.9:*:*:*:*:*:*:*;cpe:2.3:a:phpletter:ajax_file_and_image_manager:1.0:beta1:*:*:*:*:*:*;cpe:2.3:a:phpletter:ajax_file_and_image_manager:1.0:beta2:*:*:*:*:*:*;cpe:2.3:a:phpletter:ajax_file_and_image_manager:1.0:rc1:*:*:*:*:*:*;cpe:2.3:a:phpletter:ajax_file_and_image_manager:1.0:rc2:*:*:*:*:*:*;cpe:2.3:a:phpletter:ajax_file_and_image_manager:1.0:rc3:*:*:*:*:*:*;cpe:2.3:a:phpletter:ajax_file_and_image_manager:1.0:rc4:*:*:*:*:*:*;cpe:2.3:a:phpletter:ajax_file_and_image_manager:1.0:rc5:*:*:*:*:*:*;cpe:2.3:a:phpmyfaq:phpmyfaq:2.6.0:*:*:*:*:*:*:*;cpe:2.3:a:phpmyfaq:phpmyfaq:2.6.10:*:*:*:*:*:*:*;cpe:2.3:a:phpmyfaq:phpmyfaq:2.6.11:*:*:*:*:*:*:*;cpe:2.3:a:phpmyfaq:phpmyfaq:2.6.12:*:*:*:*:*:*:*;cpe:2.3:a:phpmyfaq:phpmyfaq:2.6.13:*:*:*:*:*:*:*;cpe:2.3:a:phpmyfaq:phpmyfaq:2.6.14:*:*:*:*:*:*:*;cpe:2.3:a:phpmyfaq:phpmyfaq:2.6.15:*:*:*:*:*:*:*;cpe:2.3:a:phpmyfaq:phpmyfaq:2.6.16:*:*:*:*:*:*:*;cpe:2.3:a:phpmyfaq:phpmyfaq:2.6.17:*:*:*:*:*:*:*;cpe:2.3:a:phpmyfaq:phpmyfaq:2.6.18:*:*:*:*:*:*:*;cpe:2.3:a:phpmyfaq:phpmyfaq:2.6.1:*:*:*:*:*:*:*;cpe:2.3:a:phpmyfaq:phpmyfaq:2.6.2:*:*:*:*:*:*:*;cpe:2.3:a:phpmyfaq:phpmyfaq:2.6.3:*:*:*:*:*:*:*;cpe:2.3:a:phpmyfaq:phpmyfaq:2.6.4:*:*:*:*:*:*:*;cpe:2.3:a:phpmyfaq:phpmyfaq:2.6.5:*:*:*:*:*:*:*;cpe:2.3:a:phpmyfaq:phpmyfaq:2.6.6:*:*:*:*:*:*:*;cpe:2.3:a:phpmyfaq:phpmyfaq:2.6.7:*:*:*:*:*:*:*;cpe:2.3:a:phpmyfaq:phpmyfaq:2.6.8:*:*:*:*:*:*:*;cpe:2.3:a:phpmyfaq:phpmyfaq:2.6.9:*:*:*:*:*:*:*;cpe:2.3:a:phpmyfaq:phpmyfaq:2.7.0:*:*:*:*:*:*:*;cpe:2.3:a:tinymce:tinymce:*:*:*:*:*:*:*:*,Phpletter,Ajax File And Image Manager
CVE-2011-4828,0.0,,0.65485,CWE-94,"Unrestricted file upload vulnerability in includes/inline_image_upload.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in temp/.",2011-12-15,Metasploit,cpe:2.3:a:autosectools:v-cms:1.0:*:*:*:*:*:*:*,Autosectools,V-Cms
CVE-2011-4858,0.0,,0.80318,CWE-399,"Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.",2012-01-05,Metasploit,cpe:2.3:a:apache:tomcat:5.5.35:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.21:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.22:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.23:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.25:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.30:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.31:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.32:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.33:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.34:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:*,Apache,Tomcat
CVE-2011-4862,0.0,,0.95104,CWE-120,"Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.",2011-12-25,EPSS/Metasploit,cpe:2.3:a:gnu:inetutils:*:*:*:*:*:*:*:*;cpe:2.3:a:heimdal_project:heimdal:*:*:*:*:*:*:*:*;cpe:2.3:a:mit:krb5-appl:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:15:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:-:vmware:*:*;cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp1:*:*:*:*:*:*,Freebsd,Freebsd
CVE-2011-4885,0.0,,0.83911,CWE-20,"PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.",2011-12-30,Metasploit,cpe:2.3:a:php:php:*:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.0.0:beta1:*:*:*:*:*:*;cpe:2.3:a:php:php:5.0.0:beta2:*:*:*:*:*:*;cpe:2.3:a:php:php:5.0.0:beta3:*:*:*:*:*:*;cpe:2.3:a:php:php:5.0.0:beta4:*:*:*:*:*:*;cpe:2.3:a:php:php:5.0.0:rc1:*:*:*:*:*:*;cpe:2.3:a:php:php:5.0.0:rc2:*:*:*:*:*:*;cpe:2.3:a:php:php:5.0.0:rc3:*:*:*:*:*:*;cpe:2.3:a:php:php:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.0.4:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.0.5:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.1.1:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.1.2:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.1.3:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.1.4:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.1.5:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.1.6:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.2.0:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.2.10:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.2.11:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.2.12:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.2.14:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.2.15:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.2.16:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.2.17:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.2.1:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.2.2:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.2.3:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.2.4:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.2.5:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.2.6:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.2.7:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.2.8:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.2.9:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.3.0:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.3.1:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.3.2:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.3.3:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.3.4:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.3.5:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.3.6:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.3.7:*:*:*:*:*:*:*,Php,Php
CVE-2011-4908,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.55769,CWE-434,TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.,2020-02-12,Metasploit,cpe:2.3:a:tiny:tinybrowser:*:*:*:*:*:joomla\!:*:*,Tiny,Tinybrowser
CVE-2011-4926,0.0,,0.10911,CWE-79,Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.,2012-08-29,Nuclei,cpe:2.3:a:bueltge:adminimize:*:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:0.6.9:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:0.7.1:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:0.7.2:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:0.7.3:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:0.7.5:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:0.7.6:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:0.7.7:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:0.7.8:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:0.7.9:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:0.7:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:0.8.1:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:0.8:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.0:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.1:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.2:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.3:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.4.1:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.4.2:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.4.3-6:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.4.7:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.4:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.5.1:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.5.2:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.5.3-8:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.5:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.6.1:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.6.3:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.6.4:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.6.5:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.6.6-7:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.6.8:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.6.9:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.7.10:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.7.11:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.7.12:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.7.13:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.7.14:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.7.15:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.7.16:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.7.17:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.7.18:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.7.19:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.7.1:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.7.20:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.7.2:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.7.3:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.7.4:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.7.5:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.7.6:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.7.7:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.7.8:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.7.9:*:*:*:*:*:*:*;cpe:2.3:a:bueltge:adminimize:1.7:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*,Bueltge,Adminimize
CVE-2011-4929,0.0,,0.46401,NVD-CWE-noinfo,Unspecified vulnerability in the bazaar repository adapter in Redmine 0.9.x and 1.0.x before 1.0.5 allows remote attackers to execute arbitrary commands via unknown vectors.,2012-10-08,Metasploit,cpe:2.3:a:redmine:redmine:0.9.0:*:*:*:*:*:*:*;cpe:2.3:a:redmine:redmine:0.9.1:*:*:*:*:*:*:*;cpe:2.3:a:redmine:redmine:0.9.2:*:*:*:*:*:*:*;cpe:2.3:a:redmine:redmine:0.9.3:*:*:*:*:*:*:*;cpe:2.3:a:redmine:redmine:0.9.4:*:*:*:*:*:*:*;cpe:2.3:a:redmine:redmine:0.9.5:*:*:*:*:*:*:*;cpe:2.3:a:redmine:redmine:0.9.6:*:*:*:*:*:*:*;cpe:2.3:a:redmine:redmine:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:redmine:redmine:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:redmine:redmine:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:redmine:redmine:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:redmine:redmine:1.0.4:*:*:*:*:*:*:*,Redmine,Redmine
CVE-2011-4971,0.0,,0.22317,CWE-189,"Multiple integer signedness errors in the (1) process_bin_sasl_auth, (2) process_bin_complete_sasl_auth, (3) process_bin_update, and (4) process_bin_append_prepend functions in Memcached 1.4.5 and earlier allow remote attackers to cause a denial of service (crash) via a large body length value in a packet.",2013-12-12,Metasploit,cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*;cpe:2.3:a:memcached:memcached:1.2.7:*:*:*:*:*:*:*;cpe:2.3:a:memcached:memcached:1.2.8:*:*:*:*:*:*:*;cpe:2.3:a:memcached:memcached:1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:memcached:memcached:1.4.1:*:*:*:*:*:*:*;cpe:2.3:a:memcached:memcached:1.4.2:*:*:*:*:*:*:*;cpe:2.3:a:memcached:memcached:1.4.3:*:*:*:*:*:*:*;cpe:2.3:a:memcached:memcached:1.4.4:*:*:*:*:*:*:*,Memcached,Memcached
CVE-2011-5001,0.0,,0.64742,CWE-119,Stack-based buffer overflow in the CGenericScheduler::AddTask function in cmdHandlerRedAlertController.dll in CmdProcessor.exe in Trend Micro Control Manager 5.5 before Build 1613 allows remote attackers to execute arbitrary code via a crafted IPC packet to TCP port 20101.,2011-12-25,Metasploit,cpe:2.3:a:trend_micro:control_manager:*:*:*:*:*:*:*:*,Trend Micro,Control Manager
CVE-2011-5003,0.0,,0.62807,CWE-119,Stack-based buffer overflow in the Phonetic Indexer (AvidPhoneticIndexer.exe) in Avid Media Composer 5.5.3 and earlier allows remote attackers to execute arbitrary code via a long request to TCP port 4659.,2011-12-25,Metasploit,cpe:2.3:a:avid:media_composer:*:*:*:*:*:*:*:*,Avid,Media Composer
CVE-2011-5007,0.0,,0.72582,CWE-119,"Stack-based buffer overflow in the CmpWebServer component in 3S CoDeSys 3.4 SP4 Patch 2 and earlier, as used on the ABB AC500 PLC and possibly other products, allows remote attackers to execute arbitrary code via a long URI to TCP port 8080.",2011-12-25,Metasploit,cpe:2.3:a:3ssoftware:codesys:*:sp4:*:*:*:*:*:*,3Ssoftware,Codesys
CVE-2011-5010,0.0,,0.66378,CWE-264,"apps/a3/cfg_ethping.cgi in the Ctek SkyRouter 4200 and 4300 allows remote attackers to execute arbitrary commands via shell metacharacters in the PINGADDRESS parameter for a ""u"" action.",2011-12-25,Metasploit,cpe:2.3:h:ctekproducts:skyrouter:4200:*:*:*:*:*:*:*;cpe:2.3:h:ctekproducts:skyrouter:4300:*:*:*:*:*:*:*,Ctekproducts,Skyrouter
CVE-2011-5034,0.0,,0.81155,CWE-20,"Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.  NOTE: this might overlap CVE-2011-4461.",2011-12-30,Metasploit,cpe:2.3:a:apache:geronimo:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:geronimo:1.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:geronimo:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:geronimo:1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:geronimo:1.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:geronimo:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:geronimo:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:geronimo:2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:geronimo:2.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:geronimo:2.1.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:geronimo:2.1.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:geronimo:2.1.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:geronimo:2.1.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:geronimo:2.1.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:geronimo:2.1.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:geronimo:2.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:geronimo:2.2:*:*:*:*:*:*:*,Apache,Geronimo
CVE-2011-5035,0.0,,0.68914,CWE-20,"Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869.",2011-12-30,Metasploit,cpe:2.3:a:oracle:glassfish_server:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:glassfish_server:2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:glassfish_server:3.0.1:*:*:*:*:*:*:*,Oracle,Glassfish Server
CVE-2011-5052,0.0,,0.30074,CWE-119,Stack-based buffer overflow in CoCSoft Stream Down 6.8.0 allows remote web servers to execute arbitrary code via a long response to a download request.,2012-01-04,Metasploit,cpe:2.3:a:cocsoft:stream_down:6.8:*:*:*:*:*:*:*,Cocsoft,Stream Down
CVE-2011-5106,0.0,,0.10899,CWE-79,Cross-site scripting (XSS) vulnerability in edit-post.php in the Flexible Custom Post Type plugin before 0.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.,2012-08-23,Nuclei,cpe:2.3:a:fractalia:flexible_custom_post_type:0.1.3:*:*:*:*:*:*:*;cpe:2.3:a:fractalia:flexible_custom_post_type:0.1.4:*:*:*:*:*:*:*;cpe:2.3:a:fractalia:flexible_custom_post_type:0.1.5:*:*:*:*:*:*:*;cpe:2.3:a:fractalia:flexible_custom_post_type:0.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*,Fractalia,Flexible Custom Post Type
CVE-2011-5107,0.0,,0.08772,CWE-79,"Cross-site scripting (XSS) vulnerability in post_alert.php in Alert Before Your Post plugin, possibly 0.1.1 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the name parameter.",2012-08-23,Nuclei,cpe:2.3:a:wordpress:alert_before_you_post:*:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*,Wordpress,Alert Before You Post
CVE-2011-5124,0.0,,0.54648,CWE-119,"Stack-based buffer overflow in the BCAAA component before build 60258, as used by Blue Coat ProxySG 4.2.3 through 6.1 and ProxyOne, allows remote attackers to execute arbitrary code via a large packet to the synchronization port (16102/tcp).",2012-08-26,Metasploit,cpe:2.3:a:bluecoat:proxyone:*:*:*:*:*:*:*:*;cpe:2.3:a:bluecoat:proxysg:4.2.6:*:*:*:*:*:*:*;cpe:2.3:a:bluecoat:proxysg:4.3.2.3:*:*:*:*:*:*:*;cpe:2.3:a:bluecoat:proxysg:5.1.6.1:*:*:*:*:*:*:*;cpe:2.3:a:bluecoat:proxysg:5.1:*:*:*:*:*:*:*;cpe:2.3:a:bluecoat:proxysg:5.2.2.4:*:*:*:*:*:*:*;cpe:2.3:a:bluecoat:proxysg:5.2.5.2:*:*:*:*:*:*:*;cpe:2.3:a:bluecoat:proxysg:5.2:*:*:*:*:*:*:*;cpe:2.3:a:bluecoat:proxysg:5.3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:bluecoat:proxysg:5.3:*:*:*:*:*:*:*;cpe:2.3:a:bluecoat:proxysg:5.4.1.1:*:*:*:*:*:*:*;cpe:2.3:a:bluecoat:proxysg:5.4:*:*:*:*:*:*:*;cpe:2.3:h:bluecoat:proxysg:6:*:*:*:*:*:*:*,Bluecoat,Proxysg
CVE-2011-5130,0.0,,0.3655,CWE-94,"dev/less.php in Family Connections CMS (FCMS) 2.5.0 - 2.7.1, when register_globals is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the argv[1] parameter.",2012-08-30,Metasploit,cpe:2.3:a:haudenschilt:family_connections_cms:2.5.0:*:*:*:*:*:*:*;cpe:2.3:a:haudenschilt:family_connections_cms:2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:haudenschilt:family_connections_cms:2.5.2:*:*:*:*:*:*:*;cpe:2.3:a:haudenschilt:family_connections_cms:2.5.3:*:*:*:*:*:*:*;cpe:2.3:a:haudenschilt:family_connections_cms:2.5.4:*:*:*:*:*:*:*;cpe:2.3:a:haudenschilt:family_connections_cms:2.6.0:*:*:*:*:*:*:*;cpe:2.3:a:haudenschilt:family_connections_cms:2.7.0:*:*:*:*:*:*:*;cpe:2.3:a:haudenschilt:family_connections_cms:2.7.1:*:*:*:*:*:*:*,Haudenschilt,Family Connections Cms
CVE-2011-5164,0.0,,0.28582,CWE-119,Stack-based buffer overflow in VanDyke Software AbsoluteFTP 1.9.6 through 2.2.10 allows remote FTP servers to execute arbitrary code via a crafted file name in a LIST command response.,2012-09-15,Metasploit,cpe:2.3:a:vandyke:absoluteftp:1.9.6:*:*:*:*:*:*:*;cpe:2.3:a:vandyke:absoluteftp:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:vandyke:absoluteftp:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:vandyke:absoluteftp:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:vandyke:absoluteftp:2.2.10:*:*:*:*:*:*:*;cpe:2.3:a:vandyke:absoluteftp:2.2.1:*:*:*:*:*:*:*;cpe:2.3:a:vandyke:absoluteftp:2.2.2:*:*:*:*:*:*:*;cpe:2.3:a:vandyke:absoluteftp:2.2.3:*:*:*:*:*:*:*;cpe:2.3:a:vandyke:absoluteftp:2.2.4:*:*:*:*:*:*:*;cpe:2.3:a:vandyke:absoluteftp:2.2.5:*:*:*:*:*:*:*;cpe:2.3:a:vandyke:absoluteftp:2.2.6:*:*:*:*:*:*:*;cpe:2.3:a:vandyke:absoluteftp:2.2.7:*:*:*:*:*:*:*;cpe:2.3:a:vandyke:absoluteftp:2.2.8:*:*:*:*:*:*:*;cpe:2.3:a:vandyke:absoluteftp:2.2.9:*:*:*:*:*:*:*,Vandyke,Absoluteftp
CVE-2011-5165,0.0,,0.37001,CWE-119,"Stack-based buffer overflow in Free MP3 CD Ripper 1.1, 2.6 and earlier, when converting a file, allows user-assisted remote attackers to execute arbitrary code via a crafted .wav file.",2012-09-15,Metasploit,cpe:2.3:a:cleanersoft:free_mp3_cd_ripper:*:*:*:*:*:*:*:*;cpe:2.3:a:cleanersoft:free_mp3_cd_ripper:1.1:*:*:*:*:*:*:*;cpe:2.3:a:cleanersoft:free_mp3_cd_ripper:2.5:*:*:*:*:*:*:*,Cleanersoft,Free Mp3 Cd Ripper
CVE-2011-5170,0.0,,0.31968,CWE-119,Stack-based buffer overflow in Castillo Bueno Systems CCMPlayer 1.5 allows remote attackers to execute arbitrary code via a long track name in an m3u playlist.,2012-09-15,Metasploit,cpe:2.3:a:castillobueno:ccmplayer:1.5:*:*:*:*:*:*:*,Castillobueno,Ccmplayer
CVE-2011-5171,0.0,,0.45786,CWE-119,Multiple stack-based buffer overflows in CyberLink Power2Go 7 (build 196) and 8 (build 1031) allow remote attackers to execute arbitrary code via the (1) src and (2) name parameters in a p2g project file.,2012-09-15,Metasploit,cpe:2.3:a:cyberlink:power2go:7.0:*:*:*:*:*:*:*;cpe:2.3:a:cyberlink:power2go:8.0:*:*:*:*:*:*:*,Cyberlink,Power2Go
CVE-2011-5179,0.0,,0.08772,CWE-79,"Cross-site scripting (XSS) vulnerability in skysa-official/skysa.php in Skysa App Bar Integration plugin, possibly before 1.04, for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit parameter.",2012-09-20,Nuclei,cpe:2.3:a:skysa:skysa_app_bar_integration_plugin:*:*:*:*:*:*:*:*;cpe:2.3:a:skysa:skysa_app_bar_integration_plugin:1.01:*:*:*:*:*:*:*;cpe:2.3:a:skysa:skysa_app_bar_integration_plugin:1.02:*:*:*:*:*:*:*;cpe:2.3:a:skysa:skysa_app_bar_integration_plugin:1.0:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*,Skysa,Skysa App Bar Integration Plugin
CVE-2011-5181,0.0,,0.10428,CWE-79,Cross-site scripting (XSS) vulnerability in clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cdwidgetid parameter.  NOTE: some of these details are obtained from third party information.,2012-09-20,Nuclei,cpe:2.3:a:clickdesk:clickdesk_live_support-live_chat_plugin:2.0:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*,Clickdesk,Clickdesk Live Support-Live Chat Plugin
CVE-2011-5227,0.0,,0.76952,CWE-119,Stack-based buffer overflow in the Syslog service (nssyslogd.exe) in Enterasys Network Management Suite (NMS) before 4.1.0.80 allows remote attackers to execute arbitrary code via a long PRIO field in a message to UDP port 514.,2012-10-25,Metasploit,cpe:2.3:a:enterasys:netsight:*:*:*:*:*:*:*:*;cpe:2.3:h:enterasys:netsight:*:*:*:*:*:*:*:*,Enterasys,Netsight
CVE-2011-5252,0.0,,0.11927,CWE-20,"Open redirect vulnerability in Users/Account/LogOff in Orchard 1.0.x before 1.0.21, 1.1.x before 1.1.31, 1.2.x before 1.2.42, and 1.3.x before 1.3.10 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the ReturnUrl parameter.",2013-01-12,Nuclei,cpe:2.3:a:orchardproject:orchard:1.0.20:*:*:*:*:*:*:*;cpe:2.3:a:orchardproject:orchard:1.0:*:*:*:*:*:*:*;cpe:2.3:a:orchardproject:orchard:1.1.30:*:*:*:*:*:*:*;cpe:2.3:a:orchardproject:orchard:1.1:*:*:*:*:*:*:*;cpe:2.3:a:orchardproject:orchard:1.2.41:*:*:*:*:*:*:*;cpe:2.3:a:orchardproject:orchard:1.2:*:*:*:*:*:*:*;cpe:2.3:a:orchardproject:orchard:1.3.10:*:*:*:*:*:*:*;cpe:2.3:a:orchardproject:orchard:1.3.9:*:*:*:*:*:*:*;cpe:2.3:a:orchardproject:orchard:1.3:*:*:*:*:*:*:*,Orchardproject,Orchard
CVE-2011-5265,0.0,,0.09964,CWE-79,Cross-site scripting (XSS) vulnerability in cached_image.php in the Featurific For WordPress plugin 1.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the snum parameter.  NOTE: this has been disputed by a third party.,2013-02-12,Nuclei,cpe:2.3:a:featurific_for_wordpress_project:featurific-for-wordpress:1.6.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*,Featurific For Wordpress Project,Featurific-For-Wordpress
CVE-2012-0002,0.0,,0.74102,CWE-94,"The Remote Desktop Protocol (RDP) implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly process packets in memory, which allows remote attackers to execute arbitrary code by sending crafted RDP packets triggering access to an object that (1) was not properly initialized or (2) is deleted, aka ""Remote Desktop Protocol Vulnerability.""",2012-03-13,Metasploit,cpe:2.3:o:microsoft:windows_7:*:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:*:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:sp1:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:sp1:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*,Microsoft,Windows 7
CVE-2012-0003,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.69499,NVD-CWE-noinfo,"Unspecified vulnerability in winmm.dll in Windows Multimedia Library in Windows Media Player (WMP) in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows remote attackers to execute arbitrary code via a crafted MIDI file, aka ""MIDI Remote Code Execution Vulnerability.""",2012-01-10,Metasploit,cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:professional_x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:2005:sp3:media_center:*:*:*:*:*,Microsoft,Windows 7
CVE-2012-0013,0.0,,0.73753,NVD-CWE-Other,"Incomplete blacklist vulnerability in the Windows Packager configuration in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted ClickOnce application in a Microsoft Office document, related to .application files, aka ""Assembly Execution Vulnerability.""",2012-01-10,Metasploit,cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x32:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:professional_x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2012-0124,0.0,,0.62305,NVD-CWE-noinfo,Unspecified vulnerability in HP Data Protector Express (aka DPX) 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors.,2012-03-14,Metasploit,cpe:2.3:a:hp:data_protector_express:5.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:data_protector_express:6.0:*:*:*:*:*:*:*,Hp,Data Protector Express
CVE-2012-0151,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.8878,CWE-20,"The Authenticode Signature Verification function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview does not properly validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute arbitrary code via a modified file with additional content, aka ""WinVerifyTrust Signature Validation Vulnerability.""",2012-04-10,CISA,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2012-0158,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.99966,CWE-94,"The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers ""system state"" corruption, as exploited in the wild in April 2012, aka ""MSCOMCTL.OCX RCE Vulnerability.""",2012-04-10,CISA/EPSS/Metasploit,cpe:2.3:a:microsoft:biztalk_server:2002:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:commerce_server:2002:sp4:*:*:*:*:*:*;cpe:2.3:a:microsoft:commerce_server:2007:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:commerce_server_2009:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:commerce_server_2009:r2:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2010:-:*:*:*:*:x86:*;cpe:2.3:a:microsoft:office:2010:sp1:*:*:*:*:x86:*;cpe:2.3:a:microsoft:office_web_components:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server_2000:-:sp4:*:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server_2005:-:sp4:*:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server_2008:-:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server_2008:r2:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:visual_basic:6.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:*,Microsoft,Office
CVE-2012-0198,0.0,,0.37437,NVD-CWE-Other,Stack-based buffer overflow in the RunAndUploadFile method in the Isig.isigCtl.1 ActiveX control in IBM Tivoli Provisioning Manager Express for Software Distribution 4.1.1 allows remote attackers to execute arbitrary code via vectors related to an Asset Information file.,2012-03-06,Metasploit,cpe:2.3:a:ibm:tivoli_provisioning_manager_express_for_software_distribution:4.1.1:*:*:*:*:*:*:*,Ibm,Tivoli Provisioning Manager Express For Software Distribution
CVE-2012-0201,0.0,,0.36833,CWE-119,Stack-based buffer overflow in pcspref.dll in pcsws.exe in IBM Personal Communications 5.9.x before 5.9.8 and 6.0.x before 6.0.4 might allow remote attackers to execute arbitrary code via a long profile string in a WorkStation (aka .ws) file.,2012-03-02,Metasploit,cpe:2.3:a:ibm:personal_communications:5.9.7.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:personal_communications:5.9.7.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:personal_communications:6.0.3.0:*:*:*:*:*:*:*,Ibm,Personal Communications
CVE-2012-0202,0.0,,0.5485,CWE-119,Multiple stack-based buffer overflows in tm1admsd.exe in the Admin Server in IBM Cognos TM1 9.4.x and 9.5.x before 9.5.2 FP2 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via crafted data.,2012-05-04,Metasploit,cpe:2.3:a:ibm:cognos_tm1:9.4.1.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:cognos_tm1:9.4.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:cognos_tm1:9.5.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:cognos_tm1:9.5.2:*:*:*:*:*:*:*,Ibm,Cognos Tm1
CVE-2012-0209,0.0,,0.71897,CWE-94,"Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November 2011 and February 2012, contains an externally introduced modification (Trojan Horse) in templates/javascript/open_calendar.js, which allows remote attackers to execute arbitrary PHP code.",2012-09-25,Metasploit,cpe:2.3:a:horde:groupware:1.2.10:*:*:*:*:*:*:*;cpe:2.3:a:horde:groupware:1.2.10:*:webmail:*:*:*:*:*;cpe:2.3:a:horde:horde:3.3.12:*:*:*:*:*:*:*,Horde,Groupware
CVE-2012-0217,0.0,,0.37212,CWE-119,"The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application.  NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.",2012-06-12,Metasploit,cpe:2.3:a:citrix:xenserver:*:*:*:*:*:*:*:*;cpe:2.3:a:citrix:xenserver:6.0:*:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*;cpe:2.3:o:illumos:illumos:*:*:*:*:*:*:*:*;cpe:2.3:o:joyent:smartos:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:sp1:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:*:beta:*:*:*:*:*:*;cpe:2.3:o:sun:sunos:*:*:*:*:*:*:*:*;cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*;cpe:2.3:o:xen:xen:4.0.0:*:*:*:*:*:*:*;cpe:2.3:o:xen:xen:4.0.1:*:*:*:*:*:*:*;cpe:2.3:o:xen:xen:4.0.2:*:*:*:*:*:*:*;cpe:2.3:o:xen:xen:4.0.3:*:*:*:*:*:*:*;cpe:2.3:o:xen:xen:4.0.4:*:*:*:*:*:*:*;cpe:2.3:o:xen:xen:4.1.0:*:*:*:*:*:*:*;cpe:2.3:o:xen:xen:4.1.1:*:*:*:*:*:*:*,Freebsd,Freebsd
CVE-2012-0261,0.0,,0.73949,CWE-94,license.php in system-portal before 1.6.2 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the timestamp parameter for an install action.,2013-12-31,Metasploit,cpe:2.3:a:op5:monitor:*:*:*:*:*:*:*:*;cpe:2.3:a:op5:monitor:5.3.5:*:*:*:*:*:*:*;cpe:2.3:a:op5:monitor:5.4.0:*:*:*:*:*:*:*;cpe:2.3:a:op5:monitor:5.4.2:*:*:*:*:*:*:*;cpe:2.3:a:op5:monitor:5.5.0:*:*:*:*:*:*:*;cpe:2.3:a:op5:system-portal:*:*:*:*:*:*:*:*,Op5,Monitor
CVE-2012-0262,0.0,,0.72851,CWE-94,op5config/welcome in system-op5config before 2.0.3 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the password parameter.,2013-12-31,Metasploit,cpe:2.3:a:op5:monitor:*:*:*:*:*:*:*:*;cpe:2.3:a:op5:monitor:5.3.5:*:*:*:*:*:*:*;cpe:2.3:a:op5:monitor:5.4.0:*:*:*:*:*:*:*;cpe:2.3:a:op5:monitor:5.4.2:*:*:*:*:*:*:*;cpe:2.3:a:op5:monitor:5.5.0:*:*:*:*:*:*:*;cpe:2.3:a:op5:system-op5config:*:*:*:*:*:*:*:*,Op5,Monitor
CVE-2012-0266,0.0,,0.42093,CWE-119,"Multiple stack-based buffer overflows in the NTR ActiveX control before 2.0.4.8 allow remote attackers to execute arbitrary code via (1) a long bstrUrl parameter to the StartModule method, (2) a long bstrParams parameter to the Check method, a long bstrUrl parameter to the (3) Download or (4) DownloadModule method during construction of a .ntr pathname, or a long bstrUrl parameter to the (5) Download or (6) DownloadModule method during construction of a URL.",2012-01-15,Metasploit,cpe:2.3:a:ntrglobal:ntr_activex_control:*:*:*:*:*:*:*:*,Ntrglobal,Ntr Activex Control
CVE-2012-0267,0.0,,0.38975,CWE-20,The StopModule method in the NTR ActiveX control before 2.0.4.8 allows remote attackers to execute arbitrary code via a crafted lModule parameter that triggers use of an arbitrary memory address as a function pointer.,2012-01-15,Metasploit,cpe:2.3:a:ntrglobal:ntr_activex_control:*:*:*:*:*:*:*:*,Ntrglobal,Ntr Activex Control
CVE-2012-0270,0.0,,0.54671,CWE-119,Multiple stack-based buffer overflows in Csound before 5.16.6 allow remote attackers to execute arbitrary code via a crafted (1) hetro file to the getnum function in util/heti_main.c or (2) PVOC file to the getnum function in util/pv_import.c.,2014-02-17,Metasploit,cpe:2.3:a:csounds:csound:*:*:*:*:*:*:*:*;cpe:2.3:a:csounds:csound:5.12.4:*:*:*:*:*:*:*;cpe:2.3:a:csounds:csound:5.13.0:*:*:*:*:*:*:*;cpe:2.3:a:csounds:csound:5.13.1:*:*:*:*:*:*:*;cpe:2.3:a:csounds:csound:5.14.0:*:*:*:*:*:*:*;cpe:2.3:a:csounds:csound:5.14.1:*:*:*:*:*:*:*;cpe:2.3:a:csounds:csound:5.14.2:*:*:*:*:*:*:*;cpe:2.3:a:csounds:csound:5.15.0:*:*:*:*:*:*:*;cpe:2.3:a:csounds:csound:5.16:*:*:*:*:*:*:*,Csounds,Csound
CVE-2012-0284,0.0,,0.36317,CWE-119,Stack-based buffer overflow in the SetSource method in the Cisco Linksys PlayerPT ActiveX control 1.0.0.15 in PlayerPT.ocx on the Cisco WVC200 Wireless-G PTZ Internet video camera allows remote attackers to execute arbitrary code via a long URL in the first argument (aka the sURL argument).,2012-07-19,Metasploit,cpe:2.3:a:cisco:linksys_playerpt_activex_control:1.0.0.15:*:*:*:*:*:*:*;cpe:2.3:h:cisco:wvc200_wireless-g_ptz_internet_video_camera:*:*:*:*:*:*:*:*,Cisco,Wvc200 Wireless-G Ptz Internet Video Camera
CVE-2012-0297,0.0,,0.72596,CWE-264,"The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote attackers to execute arbitrary code by (1) injecting crafted data or (2) including crafted data.",2012-05-21,Metasploit,cpe:2.3:a:symantec:web_gateway:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:symantec:web_gateway:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:symantec:web_gateway:5.0:*:*:*:*:*:*:*,Symantec,Web Gateway
CVE-2012-0299,0.0,,0.64061,CWE-264,"The file-management scripts in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to upload arbitrary code to a designated pathname, and possibly execute this code, via unspecified vectors.",2012-05-21,Metasploit,cpe:2.3:a:symantec:web_gateway:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:symantec:web_gateway:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:symantec:web_gateway:5.0:*:*:*:*:*:*:*,Symantec,Web Gateway
CVE-2012-0391,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.75071,CWE-94,"The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.",2012-01-08,CISA/Metasploit,cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*,Apache,Struts
CVE-2012-0392,0.0,,0.96787,NVD-CWE-noinfo,"The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.",2012-01-08,EPSS/Nuclei,cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*,Apache,Struts
CVE-2012-0394,0.0,,0.74405,CWE-94,"The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors.  NOTE: the vendor characterizes this behavior as not ""a security vulnerability itself.",2012-01-08,Metasploit/Nuclei,cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*,Apache,Struts
CVE-2012-0419,0.0,,0.42466,CWE-22,Directory traversal vulnerability in the agent HTTP interfaces in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 allows remote attackers to read arbitrary files via directory traversal sequences in a request.,2012-09-28,Metasploit,cpe:2.3:a:novell:groupwise:2012:*:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise:8.00:hp1:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise:8.00:hp2:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise:8.00:hp3:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise:8.01:*:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise:8.01:hp:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise:8.02:*:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise:8.02:hp1:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise:8.02:hp2:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise:8.02:hp3:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise:8.0:*:*:*:*:*:*:*,Novell,Groupwise
CVE-2012-0432,0.0,,0.58702,CWE-119,Stack-based buffer overflow in the Novell NCP implementation in NetIQ eDirectory 8.8.7.x before 8.8.7.2 allows remote attackers to have an unspecified impact via unknown vectors.,2012-12-25,Metasploit,cpe:2.3:a:microfocus:edirectory:8.8.7.0:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:edirectory:8.8.7.1:*:*:*:*:*:*:*,Microfocus,Edirectory
CVE-2012-0439,0.0,,0.39183,CWE-94,An ActiveX control in gwcls1.dll in the client in Novell GroupWise 8.0 before 8.0.3 HP2 and 2012 before SP1 HP1 allows remote attackers to execute arbitrary code via (1) a pointer argument to the SetEngine method or (2) an XPItem pointer argument to an unspecified method.,2013-02-24,Metasploit,cpe:2.3:a:novell:groupwise:2012:*:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise:2012:sp1:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise:8.00:hp1:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise:8.00:hp2:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise:8.00:hp3:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise:8.01:*:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise:8.01:hp:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise:8.02:*:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise:8.02:hp1:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise:8.02:hp2:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise:8.02:hp3:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise:8.03:*:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise:8.03:hp1:*:*:*:*:*:*;cpe:2.3:a:novell:groupwise:8.0:*:*:*:*:*:*:*,Novell,Groupwise
CVE-2012-0500,0.0,,0.58974,NVD-CWE-noinfo,"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and JavaFX 2.0.2 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.",2012-02-15,Metasploit,cpe:2.3:a:oracle:javafx:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:javafx:1.2.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:javafx:1.2.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:javafx:1.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:javafx:1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:javafx:1.3.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:javafx:2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:*:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:*:update30:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update22:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update23:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update24:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update25:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update26:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update27:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update29:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_19:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_20:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_21:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*,Oracle,Jre
CVE-2012-0507,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98113,NVD-CWE-noinfo,"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency.  NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions.  NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.",2012-06-07,CISA/EPSS/Metasploit,cpe:2.3:a:oracle:jre:1.6.0:update22:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update23:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update24:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update25:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update26:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update27:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update29:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update30:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:-:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:-:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update10:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update17:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update18:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update19:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update20:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update21:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update22:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update23:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update24:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update25:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update26:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update27:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update28:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update29:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update31:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update33:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update7:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update8:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update9:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:-:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_19:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_20:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_21:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_java:10:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_java:11:sp1:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:vmware:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp1:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2:*:*:*:*:*:*,Debian,Debian Linux
CVE-2012-0518,4.7,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N,0.04664,CWE-601,"Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different vulnerability than CVE-2012-3175.",2012-10-16,CISA,cpe:2.3:a:oracle:fusion_middleware:10.1.4.3:*:*:*:*:*:*:*,Oracle,Fusion Middleware
CVE-2012-0549,0.0,,0.59413,NVD-CWE-noinfo,"Unspecified vulnerability in the Oracle AutoVue Office component in Oracle Supply Chain Products Suite 20.1.1 allows remote attackers to affect confidentiality, integrity, and availability, related to Desktop API.",2012-05-03,Metasploit,cpe:2.3:a:oracle:supply_chain_products_suite:20.1.1:*:*:*:*:*:*:*,Oracle,Supply Chain Products Suite
CVE-2012-0663,0.0,,0.28623,CWE-119,Multiple stack-based buffer overflows in Apple QuickTime before 7.7.2 on Windows allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TeXML file.,2012-05-16,Metasploit,cpe:2.3:a:apple:quicktime:*:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:5.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.4.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.6:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.2.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.3.1.70:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.3.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.5.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.5.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.6:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.7:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.8:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.9:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.60.92.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.62.14.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.64.17.73:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.65.17.80:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.66.71.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.67.75.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.68.75.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.69.80.9:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.7.0:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2012-0694,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.67256,CWE-20,"SugarCRM CE <= 6.3.1 contains scripts that use ""unserialize()"" with user controlled input which allows remote attackers to execute arbitrary PHP code.",2019-10-29,Metasploit,cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:community:*:*:*,Sugarcrm,Sugarcrm
CVE-2012-0708,0.0,,0.3095,CWE-119,"Heap-based buffer overflow in the Ole API in the CQOle ActiveX control in cqole.dll in IBM Rational ClearQuest 7.1.1 before 7.1.1.9, 7.1.2 before 7.1.2.6, and 8.0.0 before 8.0.0.2 allows remote attackers to execute arbitrary code via a crafted web page that leverages a RegisterSchemaRepoFromFileByDbSet function-prototype mismatch.",2012-04-22,Metasploit,cpe:2.3:a:ibm:rational_clearquest:7.1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:rational_clearquest:7.1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:rational_clearquest:7.1.1.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:rational_clearquest:7.1.1.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:rational_clearquest:7.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:rational_clearquest:7.1.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:rational_clearquest:7.1.2.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:rational_clearquest:7.1.2.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:rational_clearquest:7.1.2.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:rational_clearquest:7.1.2.5:*:*:*:*:*:*:*;cpe:2.3:a:ibm:rational_clearquest:7.1.2.6:*:*:*:*:*:*:*;cpe:2.3:a:ibm:rational_clearquest:7.1.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:rational_clearquest:8.0.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:rational_clearquest:8.0.0:*:*:*:*:*:*:*,Ibm,Rational Clearquest
CVE-2012-0754,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9203,CWE-787,"Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.",2012-02-16,CISA/Metasploit,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:google:android:*:*:*:*:*:*:*:*;cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:-:*,Apple,Mac Os X
CVE-2012-0767,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.06662,CWE-79,"Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka ""Universal XSS (UXSS),"" as exploited in the wild in February 2012.",2012-02-16,CISA,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:google:android:*:*:*:*:*:*:*:*;cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:-:*,Apple,Mac Os X
CVE-2012-0779,0.0,,0.85698,NVD-CWE-noinfo,"Adobe Flash Player before 10.3.183.19 and 11.x before 11.2.202.235 on Windows, Mac OS X, and Linux; before 11.1.111.9 on Android 2.x and 3.x; and before 11.1.115.8 on Android 4.x allows remote attackers to execute arbitrary code via a crafted file, related to an ""object confusion vulnerability,"" as exploited in the wild in May 2012.",2012-05-04,Metasploit,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:google:android:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2012-0896,0.0,,0.25224,CWE-22,Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter.,2012-01-20,Nuclei,cpe:2.3:a:count_per_day_project:count_per_day:2.15.1:*:*:*:*:*:*:*;cpe:2.3:a:count_per_day_project:count_per_day:2.15:*:*:*:*:*:*:*;cpe:2.3:a:count_per_day_project:count_per_day:2.16:*:*:*:*:*:*:*;cpe:2.3:a:count_per_day_project:count_per_day:2.2:*:*:*:*:*:*:*;cpe:2.3:a:tom_braider:count_per_day:*:*:*:*:*:*:*:*;cpe:2.3:a:tom_braider:count_per_day:1.0:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*,Count Per Day Project,Count Per Day
CVE-2012-0897,0.0,,0.52661,CWE-119,Stack-based buffer overflow in the JPEG2000 plugin in IrfanView PlugIns before 4.33 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment.,2012-01-20,Metasploit,cpe:2.3:a:irfanview:irfanview:*:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:1.70:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:1.75:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:1.80:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:1.85:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:1.90:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:1.95:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:1.97:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:1.98:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:1.98a:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:1.99:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.00:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.05:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.07:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.10:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.12:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.15:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.17:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.18:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.20:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.22:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.25:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.27:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.30:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.32:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.35:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.37:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.40:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.50:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.52:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.55:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.60:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.62:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.63:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.65:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.66:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.68:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.80:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.82:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.83:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.85:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.90:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.92:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.95:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.97:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:2.98:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.0.7:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.00:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.02:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.05:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.07:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.10:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.12:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.15:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.17:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.20:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.21:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.25:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.30:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.33:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.35:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.36:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.50:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.51:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.60:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.61:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.70:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.75:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.80:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.85:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.90:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.91:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.92:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.95:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.97:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.98:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:3.99:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:4.00:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:4.10:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:4.20:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:4.22:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:4.23:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:4.25:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:4.27:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:4.28:*:*:*:*:*:*:*;cpe:2.3:a:irfanview:irfanview:4.30:*:*:*:*:*:*:*,Irfanview,Irfanview
CVE-2012-0901,0.0,,0.07711,CWE-79,Cross-site scripting (XSS) vulnerability in yousaytoo.php in YouSayToo auto-publishing plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit parameter.,2012-01-20,Nuclei,cpe:2.3:a:attenzione:yousaytoo:1.0:*:*:*:*:*:*:*,Attenzione,Yousaytoo
CVE-2012-0911,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.62989,CWE-502,"TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to lib/banners/bannerlib.php; (2) printpages or (3) printstructures parameter to (a) tiki-print_multi_pages.php or (b) tiki-print_pages.php; or (4) sendpages, (5) sendstructures, or (6) sendarticles parameter to tiki-send_objects.php, which is not properly handled when processed by the unserialize function.",2012-07-12,Metasploit,cpe:2.3:a:tiki:tikiwiki_cms\/groupware:*:*:*:*:-:*:*:*;cpe:2.3:a:tiki:tikiwiki_cms\/groupware:*:*:*:*:lts:*:*:*,Tiki,Tikiwiki Cms/Groupware
CVE-2012-0938,0.0,,0.05837,CWE-89,"Multiple SQL injection vulnerabilities in TestLink 1.9.3, 1.8.5b, and earlier allow remote authenticated users with certain permissions to execute arbitrary SQL commands via the root_node parameter in the display_children function to (1) getrequirementnodes.php or (2) gettprojectnodes.php in lib/ajax/; the (3) cfield_id parameter in an edit action to lib/cfields/cfieldsEdit.php; the (4) id parameter in an edit action or (5) plan_id parameter in a create action to lib/plan/planMilestonesEdit.php; or the req_spec_id parameter to (6) reqImport.php or (7) in a create action to reqEdit.php in lib/requirements/.  NOTE: some of these details are obtained from third party information.",2014-08-14,Metasploit,cpe:2.3:a:testlink:testlink:1.8.5b:*:*:*:*:*:*:*;cpe:2.3:a:testlink:testlink:1.9.3:*:*:*:*:*:*:*,Testlink,Testlink
CVE-2012-0981,0.0,,0.11059,CWE-22,Directory traversal vulnerability in phpShowtime 2.0 allows remote attackers to list arbitrary directories and image files via a .. (dot dot) in the r parameter to index.php.  NOTE: Some of these details are obtained from third party information.,2012-02-02,Nuclei,cpe:2.3:a:kybernetika:phpshowtime:2.0:*:*:*:*:*:*:*,Kybernetika,Phpshowtime
CVE-2012-0991,0.0,,0.11261,CWE-22,"Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the formname parameter to (1) contrib/acog/print_form.php; or (2) load_form.php, (3) view_form.php, or (4) trend_form.php in interface/patient_file/encounter.",2012-02-07,Nuclei,cpe:2.3:a:openemr:openemr:4.1.0:*:*:*:*:*:*:*,Openemr,Openemr
CVE-2012-0996,0.0,,0.09794,CWE-22,Multiple directory traversal vulnerabilities in 11in1 1.2.1 stable 12-31-2011 allow remote attackers to read arbitrary files via a .. (dot dot) in the class parameter to (1) index.php or (2) admin/index.php.,2012-02-24,Nuclei,cpe:2.3:a:11in1:11in1:1.2.1:stable_12-31-2011:*:*:*:*:*:*,11In1,11In1
CVE-2012-10018,8.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L,0.01181,CWE-918,"The Mapplic and Mapplic Lite plugins for WordPress are vulnerable to Server-Side Request Forgery in versions up to, and including 6.1, 1.0 respectively. This makes it possible for attackers to forgery requests coming from a vulnerable site's server and ultimately perform an XSS attack if requesting an SVG file.",2024-10-16,Nuclei,cpe:2.3:a:mapplic:mapplic:*:*:*:*:-:wordpress:*:*;cpe:2.3:a:mapplic:mapplic:*:*:*:*:lite:wordpress:*:*,Mapplic,Mapplic
CVE-2012-10019,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02278,CWE-434,The Front End Editor plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the upload.php file in versions before 2.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.,2025-07-19,Metasploit,cpe:2.3:a:scribu:front-end_editor:*:*:*:*:*:wordpress:*:*,Scribu,Front-End Editor
CVE-2012-10020,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02868,CWE-434,"The FoxyPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadify.php file in versions up to, and including, 0.4.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.",2025-07-22,Metasploit,cpe:2.3:a:webmovementllc:foxypress:*:*:*:*:*:wordpress:*:*,Webmovementllc,Foxypress
CVE-2012-10021,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03086,CWE-121,A stack-based buffer overflow vulnerability exists in D-Link DIR-605L Wireless N300 Cloud Router firmware versions 1.12 and 1.13 via the getAuthCode() function. The flaw arises from unsafe usage of sprintf() when processing user-supplied CAPTCHA data via the FILECODE parameter in /goform/formLogin. A remote unauthenticated attacker can exploit this to execute arbitrary code with root privileges on the device.,2025-07-31,Metasploit,cpe:2.3:h:dlink:dir-605l:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-605l_firmware:*:*:*:*:*:*:*:*,D-Link,Dir-605L Firmware
CVE-2012-10022,0.0,,0.0035,CWE-269,Kloxo versions 6.1.12 and earlier contain two setuid root binaries—lxsuexec and lxrestart—that allow local privilege escalation from uid 48. The lxsuexec binary performs a uid check and permits execution of arbitrary commands as root if the invoking user matches uid 48. This flaw enables attackers with Apache-level access to escalate privileges to root without authentication.,2025-08-01,Metasploit,,,
CVE-2012-10023,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01731,CWE-121,"A stack-based buffer overflow vulnerability exists in FreeFloat FTP Server version 1.0.0. The server fails to properly validate input passed to the USER command, allowing remote attackers to overwrite memory and potentially execute arbitrary code. The flaw is triggered by sending an overly long username string, which overflows the buffer allocated for user authentication.",2025-08-05,Metasploit,cpe:2.3:a:freefloat:freefloat_ftp_server:1.0:*:*:*:*:*:*:*,Freefloat,Freefloat Ftp Server
CVE-2012-10024,0.0,,0.00858,CWE-22,"XBMC version 11.0 contains a path traversal vulnerability in its embedded HTTP server. When accessed via HTTP Basic Authentication, the server fails to properly sanitize URI input, allowing authenticated users to request files outside the intended document root. An attacker can exploit this flaw to read arbitrary files from the host filesystem, including sensitive configuration or credential files.",2025-08-05,Metasploit,,,
CVE-2012-10025,0.0,,0.01278,CWE-98,"The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnerability in core/actions/export.php. When the PHP configuration directive allow_url_include is enabled (default: Off), an unauthenticated attacker can exploit the acf_abspath POST parameter to include and execute arbitrary remote PHP code. This leads to remote code execution under the web server’s context, allowing full compromise of the host.",2025-08-05,Metasploit,,,
CVE-2012-10026,0.0,,0.01194,CWE-434,"The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint fails to properly validate and restrict uploaded file types, allowing remote attackers to upload malicious PHP scripts to a predictable temporary directory. Once uploaded, the attacker can execute the file via a direct HTTP GET request, resulting in remote code execution under the web server’s context.",2025-08-05,Metasploit,,,
CVE-2012-10027,0.0,,0.01303,CWE-434,"WP-Property plugin for WordPress up to and including version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party `uploadify.php` script. A remote attacker can upload arbitrary PHP files to a temporary directory without authentication, leading to remote code execution.",2025-08-05,Metasploit,,,
CVE-2012-10028,0.0,,0.00977,CWE-78,Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows authenticated users to execute arbitrary system commands via crafted POST requests to `surgeftpmgr.cgi`. This can lead to full remote code execution on the underlying system.,2025-08-05,Metasploit,,,
CVE-2012-10029,0.0,,0.02512,CWE-78,"Nagios XI Network Monitor prior to Graph Explorer component version 1.3 contains a command injection vulnerability in `visApi.php`. An authenticated user can inject system commands via unsanitized parameters such as `host`, resulting in remote code execution.",2025-08-05,Metasploit,,,
CVE-2012-10030,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01548,CWE-306,"FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbitrary files to sensitive system directories. The server accepts empty credentials, defaults user access to the root of the C:\ drive, and imposes no restrictions on file type or destination path. These conditions enable attackers to upload executable payloads and .mof files to locations such as system32 and wbem\mof, where Windows Management Instrumentation (WMI) automatically processes and executes them. This results in remote code execution with SYSTEM-level privileges, without requiring user interaction.",2025-08-05,Metasploit,cpe:2.3:a:freefloat:freefloat_ftp_server:1.0:*:*:*:*:*:*:*,Freefloat,Freefloat Ftp Server
CVE-2012-10031,0.0,,0.00824,CWE-121,"BlazeVideo HDTV Player Pro v6.6.0.3 is vulnerable to a stack-based buffer overflow due to improper handling of user-supplied input embedded in .plf playlist files. When parsing a crafted .plf file, the MediaPlayerCtrl.dll component invokes PathFindFileNameA() to extract a filename from a URL-like string. The returned value is then copied to a fixed-size stack buffer using an inline strcpy call without bounds checking. If the input exceeds the buffer size, this leads to a stack overflow and potential arbitrary code execution under the context of the user.",2025-08-05,Metasploit,,,
CVE-2012-10032,0.0,,0.0089,CWE-79,"Maxthon3 version 3.2.2 build 1000 and prior are vulnerable to cross context scripting (XCS) via the about:history page. The browser’s trusted zone improperly handles injected script content, allowing attackers to execute arbitrary JavaScript in a privileged context. This flaw enables modification of browser configuration and execution of arbitrary code through Maxthon’s exposed DOM APIs, including maxthon.program.Program.launch() and maxthon.io.writeDataURL(). Exploitation requires user interaction, typically by visiting a malicious webpage that triggers the injection.",2025-08-05,Metasploit,,,
CVE-2012-10033,0.0,,0.01186,CWE-78,"Narcissus is vulnerable to remote code execution via improper input handling in its image configuration workflow. Specifically, the backend.php script fails to sanitize the release parameter before passing it to the configure_image() function. This function invokes PHP’s passthru() with the unsanitized input, allowing attackers to inject arbitrary system commands. Exploitation occurs via a crafted POST request, resulting in command execution under the web server’s context.",2025-08-05,Metasploit,,,
CVE-2012-10034,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01331,CWE-22,"ClanSphere 2011.3 is vulnerable to a local file inclusion (LFI) flaw due to improper handling of the cs_lang cookie parameter. The application fails to sanitize user-supplied input, allowing attackers to traverse directories and read arbitrary files outside the web root. The vulnerability is further exacerbated by null byte injection (%00) to bypass file extension checks.",2025-08-05,Metasploit,cpe:2.3:a:csphere:clansphere:2011.3:*:*:*:*:*:*:*,Csphere,Clansphere
CVE-2012-10035,0.0,,0.01019,CWE-120,"Turbo FTP Server versions 1.30.823 and 1.30.826 contain a buffer overflow vulnerability in the handling of the PORT command. By sending a specially crafted payload, an unauthenticated remote attacker can overwrite memory structures and execute arbitrary code with SYSTEM privileges.",2025-08-05,Metasploit,,,
CVE-2012-10036,0.0,,0.01245,CWE-434,"Project Pier 0.8.8 and earlier contains an unauthenticated arbitrary file upload vulnerability in tools/upload_file.php. The upload handler fails to validate the file type or enforce authentication, allowing remote attackers to upload malicious PHP files directly into a web-accessible directory. The uploaded file is stored with a predictable suffix and can be executed by requesting its URL, resulting in remote code execution.",2025-08-08,Metasploit,,,
CVE-2012-10037,0.0,,0.01188,CWE-78,"PhpTax version 0.8 contains a remote code execution vulnerability in drawimage.php. The pfilez GET parameter is unsafely passed to the exec() function without sanitization. A remote attacker can inject arbitrary shell commands, leading to code execution under the web server's context. No authentication is required.",2025-08-11,Metasploit,,,
CVE-2012-10038,0.0,,0.01146,CWE-434,"Auxilium RateMyPet contains an unauthenticated arbitrary file upload vulnerability in upload_banners.php. The banner upload feature fails to validate file types or enforce authentication, allowing remote attackers to upload malicious PHP files. These files are stored in a web-accessible /banners/ directory and can be executed directly, resulting in remote code execution.",2025-08-11,Metasploit,,,
CVE-2012-10039,0.0,,0.02389,CWE-78,"ZEN Load Balancer versions 2.0 and 3.0-rc1 contain a command injection vulnerability in content2-2.cgi. The filelog parameter is passed directly into a backtick-delimited exec() call without sanitation. An authenticated attacker can inject arbitrary shell commands, resulting in remote code execution as the root user. ZEN Load Balancer is the predecessor of ZEVENET and SKUDONET. The affected versions (2.0 and 3.0-rc1) are no longer supported. SKUDONET CE is the current community-maintained successor.",2025-08-11,Metasploit,,,
CVE-2012-10040,0.0,,0.02414,CWE-78,"Openfiler v2.x contains a command injection vulnerability in the system.html page. The device parameter is used to instantiate a NetworkCard object, whose constructor in network.inc calls exec() with unsanitized input. An authenticated attacker can exploit this to execute arbitrary commands as the openfiler user. Due to misconfigured sudoers, the openfiler user can escalate privileges to root via sudo /bin/bash without a password.",2025-08-11,Metasploit,,,
CVE-2012-10041,0.0,,0.02848,CWE-78,"WAN Emulator v2.3 contains two unauthenticated command execution vulnerabilities. The result.php script calls shell_exec() with unsanitized input from the pc POST parameter, allowing remote attackers to execute arbitrary commands as the www-data user. The system also includes a SUID-root binary named dosu, which is vulnerable to command injection via its first argument. An attacker can exploit both flaws in sequence to achieve full remote code execution and escalate privileges to root.",2025-08-08,Metasploit,,,
CVE-2012-10042,0.0,,0.00971,CWE-434,"Sflog! CMS 1.0 contains an authenticated arbitrary file upload vulnerability in the blog management interface. The application ships with default credentials (admin:secret) and allows authenticated users to upload files via manage.php. The upload mechanism fails to validate file types, enabling attackers to upload a PHP backdoor into a web-accessible directory (blogs/download/uploads/). Once uploaded, the file can be executed remotely, resulting in full remote code execution.",2025-08-08,Metasploit,,,
CVE-2012-10043,0.0,,0.0035,CWE-121,"A stack-based buffer overflow vulnerability exists in ActFax Server version 4.32, specifically in the ""Import Users from File"" functionality of the client interface. The application fails to properly validate the length of tab-delimited fields in .exp files, leading to unsafe usage of strcpy() during CSV parsing. An attacker can exploit this vulnerability by crafting a malicious .exp file and importing it using the default character set ""ECMA-94 / Latin 1 (ISO 8859)"". Successful exploitation may result in arbitrary code execution, leading to full system compromise. User interaction is required to trigger the vulnerability.",2025-08-08,Metasploit,,,
CVE-2012-10044,0.0,,0.01307,CWE-434,"MobileCartly version 1.0 contains an arbitrary file creation vulnerability in the savepage.php script. The application fails to perform authentication or authorization checks before invoking file_put_contents() on attacker-controlled input. An unauthenticated attacker can exploit this flaw by sending crafted HTTP GET requests to savepage.php, specifying both the filename and content. This allows arbitrary file creation within the pages/ directory or any writable path on the server, allowing remote code execution.",2025-08-08,Metasploit,,,
CVE-2012-10045,0.0,,0.01141,CWE-434,"XODA version 0.4.5 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arbitrary PHP code on the server. The flaw resides in the upload functionality, which fails to properly validate or restrict uploaded file types. By crafting a multipart/form-data POST request, an attacker can upload a .php file directly into the web-accessible files/ directory and trigger its execution via a subsequent GET request.",2025-08-08,Metasploit,,,
CVE-2012-10046,0.0,,0.02929,CWE-78,"The E-Mail Security Virtual Appliance (ESVA) (tested on version ESVA_2057) contains an unauthenticated command injection vulnerability in the learn-msg.cgi script. The CGI handler fails to sanitize user-supplied input passed via the id parameter, allowing attackers to inject arbitrary shell commands. Exploitation requires no authentication and results in full command execution on the underlying system.",2025-08-08,Metasploit,,,
CVE-2012-10047,0.0,,0.00927,CWE-89,"Cyclope Employee Surveillance Solution versions 6.x are vulnerable to a SQL injection flaw in its login mechanism. The username parameter in the auth-login POST request is not properly sanitized, allowing attackers to inject arbitrary SQL statements. This can be leveraged to write and execute a malicious PHP file on disk, resulting in remote code execution under the SYSTEM user context.",2025-08-08,Metasploit,,,
CVE-2012-10048,0.0,,0.02598,CWE-22,"Zenoss Core 3.x contains a command injection vulnerability in the showDaemonXMLConfig endpoint. The daemon parameter is passed directly to a Popen() call in ZenossInfo.py without proper sanitation, allowing authenticated users to execute arbitrary commands on the server as the zenoss user.",2025-08-08,Metasploit,,,
CVE-2012-10049,0.0,,0.01141,CWE-434,"WebPageTest version 2.6 and earlier contains an arbitrary file upload vulnerability in the resultimage.php script. The application fails to validate or sanitize user-supplied input before saving uploaded files to a publicly accessible directory. This flaw allows remote attackers to upload and execute arbitrary PHP code, resulting in full remote code execution under the web server context.",2025-08-08,Metasploit,,,
CVE-2012-10050,0.0,,0.01303,CWE-434,"CuteFlow version 2.11.2 and earlier contains an arbitrary file upload vulnerability in the restart_circulation_values_write.php script. The application fails to validate or restrict uploaded file types, allowing unauthenticated attackers to upload arbitrary PHP files to the upload/___1/ directory. These files are then accessible via the web server, enabling remote code execution.",2025-08-08,Metasploit,,,
CVE-2012-10051,0.0,,0.00352,CWE-121,"Photodex ProShow Producer version 5.0.3256 contains a stack-based buffer overflow vulnerability in the handling of plugin load list files. When a specially crafted load file is placed in the installation directory, the application fails to properly validate its contents, leading to a buffer overflow when the file is parsed during startup. Exploitation requires local access to place the file and user interaction to launch the application.",2025-08-08,Metasploit,,,
CVE-2012-10052,0.0,,0.01145,CWE-434,"EGallery version 1.2 contains an unauthenticated arbitrary file upload vulnerability in the uploadify.php script. The application fails to validate file types or enforce authentication, allowing remote attackers to upload malicious PHP files directly into the web-accessible egallery/ directory. This results in full remote code execution under the web server context.",2025-08-08,Metasploit,,,
CVE-2012-10053,0.0,,0.01205,CWE-121,"Simple Web Server 2.2 rc2 contains a stack-based buffer overflow vulnerability in its handling of the Connection HTTP header. When a remote attacker sends an overly long string in this header, the server uses vsprintf() without proper bounds checking, leading to a buffer overflow on the stack. This flaw allows remote attackers to execute arbitrary code with the privileges of the web server process. The vulnerability is triggered before authentication.",2025-08-08,Metasploit,,,
CVE-2012-10054,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02801,CWE-22,"Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without authentication. By exploiting a path traversal flaw in the fileName parameter, attackers can write malicious ASPX scripts directly into the web-accessible /umbraco/ directory and execute them remotely.",2025-08-13,Metasploit,cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*,Umbraco,Umbraco Cms
CVE-2012-10055,0.0,,0.01643,CWE-134,"ComSndFTP FTP Server version 1.3.7 Beta contains a format string vulnerability in its handling of the USER command. By sending a specially crafted username containing format specifiers, a remote attacker can overwrite a hardcoded function pointer in memory (specifically WSACleanup from Ws2_32.dll). This allows the attacker to redirect execution flow and bypass DEP protections using a ROP chain, ultimately leading to arbitrary code execution. The vulnerability is exploitable without authentication and affects default configurations.",2025-08-13,Metasploit,,,
CVE-2012-10056,0.0,,0.00996,CWE-434,"PHP Volunteer Management System v1.0.2 contains an arbitrary file upload vulnerability in its document upload functionality. Authenticated users can upload files to the mods/documents/uploads/ directory without any restriction on file type or extension. Because this directory is publicly accessible and lacks execution controls, attackers can upload a malicious PHP payload and execute it remotely. The application ships with default credentials, making exploitation trivial. Once authenticated, the attacker can upload a PHP shell and trigger it via a direct GET request.",2025-08-13,Metasploit,,,
CVE-2012-10057,0.0,,0.00427,CWE-121,"Lattice Semiconductor ispVM System v18.0.2 contains a buffer overflow vulnerability in its handling of .xcf project files. When parsing the version attribute of the ispXCF XML tag, the application fails to properly validate input length, allowing a specially crafted file to overwrite memory on the stack. This can result in arbitrary code execution under the context of the user who opens the file. The vulnerability is triggered locally by opening a malicious .xcf file and does not require elevated privileges.",2025-08-13,Metasploit,,,
CVE-2012-10058,0.0,,0.01412,CWE-121,"RabidHamster R4 v1.25 contains a stack-based buffer overflow vulnerability due to unsafe use of sprintf() when logging malformed HTTP requests. A remote attacker can exploit this flaw by sending a specially crafted URI, resulting in arbitrary code execution under the context of the web server process.",2025-08-13,Metasploit,,,
CVE-2012-10059,0.0,,0.03102,CWE-78,"Dolibarr ERP/CRM versions <= 3.1.1 and <= 3.2.0 contain a post-authenticated OS command injection vulnerability in its database backup feature. The export.php script fails to sanitize the sql_compat parameter, allowing authenticated users to inject arbitrary system commands, resulting in remote code execution on the server.",2025-08-13,Metasploit,,,
CVE-2012-10060,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03018,CWE-121,"Sysax Multi Server versions prior to 5.55 contain a stack-based buffer overflow in its SSH service. When a remote attacker supplies an overly long username during authentication, the server copies the input to a fixed-size stack buffer without proper bounds checking. This allows remote code execution under the context of the service.",2025-08-13,Metasploit,cpe:2.3:a:sysax:multi_server:*:*:*:*:*:*:*:*,Sysax,Multi Server
CVE-2012-10061,0.0,,0.01249,CWE-22,"Sockso Music Host Server versions <= 1.5 are vulnerable to a path traversal flaw that allows unauthenticated remote attackers to read arbitrary files from the server’s filesystem. The vulnerability exists in the HTTP interface on port 4444, where the endpoint /file/ fails to properly sanitize user-supplied input. Attackers can traverse directories and access sensitive files outside the intended web root.",2025-08-20,Metasploit,,,
CVE-2012-10062,0.0,,0.01209,CWE-306,"A vulnerability in XAMPP, developed by Apache Friends, version 1.7.3's default WebDAV configuration allows remote authenticated attackers to upload and execute arbitrary PHP code. The WebDAV service, accessible via /webdav/, accepts HTTP PUT requests using default credentials. This permits attackers to upload a malicious PHP payload and trigger its execution via a subsequent GET request, resulting in remote code execution on the server.",2025-08-30,Metasploit,,,
CVE-2012-1153,0.0,,0.32413,NVD-CWE-Other,"Unrestricted file upload vulnerability in addons/uploadify/uploadify.php in appRain CMF 0.1.5 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the uploads directory.",2012-10-06,Metasploit,cpe:2.3:a:apprain:apprain:*:*:*:*:*:*:*:*;cpe:2.3:a:apprain:apprain:0.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apprain:apprain:0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apprain:apprain:0.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apprain:apprain:0.1.3:*:*:*:*:*:*:*;cpe:2.3:a:apprain:apprain:0.1.4:*:*:*:*:*:*:*,Apprain,Apprain
CVE-2012-1182,0.0,,0.74034,CWE-189,"The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call.",2012-04-10,Metasploit,cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.10:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.11:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.12:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.13:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.14:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.14:a:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.14a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.15:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.16:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.17:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.18:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.19:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.20:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.20:a:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.20:b:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.20a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.20b:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.21:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.21:a:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.21:b:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.21:c:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.21a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.21b:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.21c:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.22:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23:a:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23:b:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23:c:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23:d:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23b:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23c:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23d:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.24:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:a:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:b:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:c:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:pre1:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:pre2:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:rc1:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:rc2:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:rc3:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25b:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25c:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.26:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.26:a:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.26a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.27:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.27:a:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.28:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.28:a:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.29:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.2:a:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.2a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.30:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.31:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.32:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.33:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.34:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.35:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.36:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.37:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.4:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.4:rc1:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.5:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.6:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.7:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.8:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.9:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.10:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.11:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.12:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.13:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.14:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.15:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.2:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.3:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.4:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.5:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.6:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.7:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.8:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.9:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.10:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.11:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.12:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.13:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.14:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.15:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.16:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.2:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.3:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.4:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.5:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.6:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.7:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.8:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.9:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.10:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.11:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.12:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.13:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.14:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.1:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.2:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.3:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.4:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.5:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.6:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.7:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.8:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.9:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.10:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.11:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.12:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.13:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.2:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.3:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.4:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.5:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.6:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.7:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.8:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.9:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.1:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.2:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.3:*:*:*:*:*:*:*,Samba,Samba
CVE-2012-1195,0.0,,0.68399,CWE-264,"Unrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup web service in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension via a PutUpdateFileCore command in a RunAMTCommand SOAP request, then accessing the file via a direct request to the file in the web root.",2012-02-18,Metasploit,cpe:2.3:a:landesk:lenovo_thinkmanagement_console:9.0.3:*:*:*:*:*:*:*,Landesk,Lenovo Thinkmanagement Console
CVE-2012-1196,0.0,,0.55495,CWE-22,Directory traversal vulnerability in the VulCore web service (WSVulnerabilityCore/VulCore.asmx) in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to delete arbitrary files via a .. (dot dot) in the filename parameter in a SetTaskLogByFile SOAP request.,2012-02-18,Metasploit,cpe:2.3:a:landesk:lenovo_thinkmanagement_console:9.0.3:*:*:*:*:*:*:*,Landesk,Lenovo Thinkmanagement Console
CVE-2012-1226,0.0,,0.251,CWE-22,Multiple directory traversal vulnerabilities in Dolibarr CMS 3.2.0 Alpha allow remote attackers to read arbitrary files and possibly execute arbitrary code via a .. (dot dot) in the (1) file parameter to document.php or (2) backtopage parameter in a create action to comm/action/fiche.php.,2012-02-21,Nuclei,cpe:2.3:a:dolibarr:dolibarr_erp\/crm:3.2.0:alpha:*:*:*:*:*:*,Dolibarr,Dolibarr Erp/Crm
CVE-2012-1420,0.0,,0.97111,CWE-264,"The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, F-Prot Antivirus 4.6.2.117, Fortinet Antivirus 4.2.254.0, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, Panda Antivirus 10.0.2.7, and Rising Antivirus 22.83.00.03 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial \7fELF character sequence.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.",2012-03-21,EPSS,cpe:2.3:a:authentium:command_antivirus:5.2.11.5:*:*:*:*:*:*:*;cpe:2.3:a:cat:quick_heal:11.00:*:*:*:*:*:*:*;cpe:2.3:a:eset:nod32_antivirus:5795:*:*:*:*:*:*:*;cpe:2.3:a:f-prot:f-prot_antivirus:4.6.2.117:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortinet_antivirus:4.2.254.0:*:*:*:*:*:*:*;cpe:2.3:a:k7computing:antivirus:9.77.3565:*:*:*:*:*:*:*;cpe:2.3:a:kaspersky:kaspersky_anti-virus:7.0.0.125:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:security_essentials:2.0:*:*:*:*:*:*:*;cpe:2.3:a:norman:norman_antivirus_\&_antispyware:6.06.12:*:*:*:*:*:*:*;cpe:2.3:a:pandasecurity:panda_antivirus:10.0.2.7:*:*:*:*:*:*:*;cpe:2.3:a:rising-global:rising_antivirus:22.83.00.03:*:*:*:*:*:*:*,Authentium,Command Antivirus
CVE-2012-1430,0.0,,0.96091,CWE-264,"The ELF file parser in Bitdefender 7.2, Comodo Antivirus 7424, eSafe 7.0.17.0, F-Secure Anti-Virus 9.0.16160.0, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, nProtect Anti-Virus 2011-01-17.01, Sophos Anti-Virus 4.61.0, and Rising Antivirus 22.83.00.03 allows remote attackers to bypass malware detection via an ELF file with a \19\04\00\10 character sequence at a certain location.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations.",2012-03-21,EPSS,cpe:2.3:a:aladdin:esafe:7.0.17.0:*:*:*:*:*:*:*;cpe:2.3:a:bitdefender:bitdefender:7.2:*:*:*:*:*:*:*;cpe:2.3:a:comodo:comodo_antivirus:7424:*:*:*:*:*:*:*;cpe:2.3:a:f-secure:anti-virus:9.0.16160.0:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:gateway:2010.1c:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:scan_engine:5.400.0.1158:*:*:*:*:*:*:*;cpe:2.3:a:nprotect:nprotect_antivirus:2011-01-17.01:*:*:*:*:*:*:*;cpe:2.3:a:rising-global:rising_antivirus:22.83.00.03:*:*:*:*:*:*:*;cpe:2.3:a:sophos:sophos_anti-virus:4.61.0:*:*:*:*:*:*:*,Aladdin,Esafe
CVE-2012-1431,0.0,,0.96091,CWE-264,"The ELF file parser in Bitdefender 7.2, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, McAfee Gateway (formerly Webwasher) 2010.1C, nProtect Anti-Virus 2011-01-17.01, Sophos Anti-Virus 4.61.0, and Rising Antivirus 22.83.00.03 allows remote attackers to bypass malware detection via an ELF file with a \4a\46\49\46 character sequence at a certain location.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations.",2012-03-21,EPSS,cpe:2.3:a:aladdin:esafe:7.0.17.0:*:*:*:*:*:*:*;cpe:2.3:a:authentium:command_antivirus:5.2.11.5:*:*:*:*:*:*:*;cpe:2.3:a:bitdefender:bitdefender:7.2:*:*:*:*:*:*:*;cpe:2.3:a:comodo:comodo_antivirus:7424:*:*:*:*:*:*:*;cpe:2.3:a:f-prot:f-prot_antivirus:4.6.2.117:*:*:*:*:*:*:*;cpe:2.3:a:f-secure:f-secure_anti-virus:9.0.16160.0:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:gateway:2010.1c:*:*:*:*:*:*:*;cpe:2.3:a:nprotect:nprotect_antivirus:2011-01-17.01:*:*:*:*:*:*:*;cpe:2.3:a:rising-global:rising_antivirus:22.83.00.03:*:*:*:*:*:*:*;cpe:2.3:a:sophos:sophos_anti-virus:4.61.0:*:*:*:*:*:*:*,Aladdin,Esafe
CVE-2012-1442,0.0,,0.98952,CWE-264,"The ELF file parser in Quick Heal (aka Cat QuickHeal) 11.00, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, eSafe 7.0.17.0, Kaspersky Anti-Virus 7.0.0.125, F-Secure Anti-Virus 9.0.16160.0, Sophos Anti-Virus 4.61.0, Antiy Labs AVL SDK 2.0.3.7, Rising Antivirus 22.83.00.03, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified class field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations.",2012-03-21,EPSS,cpe:2.3:a:aladdin:esafe:7.0.17.0:*:*:*:*:*:*:*;cpe:2.3:a:antiy:avl_sdk:2.0.3.7:*:*:*:*:*:*:*;cpe:2.3:a:cat:quick_heal:11.00:*:*:*:*:*:*:*;cpe:2.3:a:f-secure:f-secure_anti-virus:9.0.16160.0:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortinet_antivirus:4.2.254.0:*:*:*:*:*:*:*;cpe:2.3:a:kaspersky:kaspersky_anti-virus:7.0.0.125:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:gateway:2010.1c:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:scan_engine:5.400.0.1158:*:*:*:*:*:*:*;cpe:2.3:a:pandasecurity:panda_antivirus:10.0.2.7:*:*:*:*:*:*:*;cpe:2.3:a:rising-global:rising_antivirus:22.83.00.03:*:*:*:*:*:*:*;cpe:2.3:a:sophos:sophos_anti-virus:4.61.0:*:*:*:*:*:*:*,Aladdin,Esafe
CVE-2012-1443,0.0,,0.99636,CWE-264,"The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVirus 21, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Command Antivirus 5.2.11.5, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Emsisoft Anti-Malware 5.1.0.1, PC Tools AntiVirus 7.0.3.5, F-Prot Antivirus 4.6.2.117, VirusBuster 13.6.151.0, Fortinet Antivirus 4.2.254.0, Antiy Labs AVL SDK 2.0.3.7, K7 AntiVirus 9.77.3565, Trend Micro HouseCall 9.120.0.1004, Kaspersky Anti-Virus 7.0.0.125, Jiangmin Antivirus 13.0.900, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, Sophos Anti-Virus 4.61.0, NOD32 Antivirus 5795, Avira AntiVir 7.11.1.163, Norman Antivirus 6.06.12, McAfee Anti-Virus Scanning Engine 5.400.0.1158, Panda Antivirus 10.0.2.7, McAfee Gateway (formerly Webwasher) 2010.1C, Trend Micro AntiVirus 9.120.0.1004, Comodo Antivirus 7424, Bitdefender 7.2, eSafe 7.0.17.0, F-Secure Anti-Virus 9.0.16160.0, nProtect Anti-Virus 2011-01-17.01, AhnLab V3 Internet Security 2011.01.18.00, AVG Anti-Virus 10.0.0.1190, avast! Antivirus 4.8.1351.0 and 5.0.677.0, and VBA32 3.12.14.2 allows user-assisted remote attackers to bypass malware detection via a RAR file with an initial MZ character sequence.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different RAR parser implementations.",2012-03-21,EPSS,cpe:2.3:a:ahnlab:v3_internet_security:2011.01.18.00:*:*:*:*:*:*:*;cpe:2.3:a:aladdin:esafe:7.0.17.0:*:*:*:*:*:*:*;cpe:2.3:a:alwil:avast_antivirus:4.8.1351.0:*:*:*:*:*:*:*;cpe:2.3:a:alwil:avast_antivirus:5.0.677.0:*:*:*:*:*:*:*;cpe:2.3:a:anti-virus:vba32:3.12.14.2:*:*:*:*:*:*:*;cpe:2.3:a:antiy:avl_sdk:2.0.3.7:*:*:*:*:*:*:*;cpe:2.3:a:authentium:command_antivirus:5.2.11.5:*:*:*:*:*:*:*;cpe:2.3:a:avg:avg_anti-virus:10.0.0.1190:*:*:*:*:*:*:*;cpe:2.3:a:avira:antivir:7.11.1.163:*:*:*:*:*:*:*;cpe:2.3:a:bitdefender:bitdefender:7.2:*:*:*:*:*:*:*;cpe:2.3:a:cat:quick_heal:11.00:*:*:*:*:*:*:*;cpe:2.3:a:clamav:clamav:0.96.4:*:*:*:*:*:*:*;cpe:2.3:a:comodo:comodo_antivirus:7424:*:*:*:*:*:*:*;cpe:2.3:a:emsisoft:anti-malware:5.1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:eset:nod32_antivirus:5795:*:*:*:*:*:*:*;cpe:2.3:a:f-prot:f-prot_antivirus:4.6.2.117:*:*:*:*:*:*:*;cpe:2.3:a:f-secure:f-secure_anti-virus:9.0.16160.0:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortinet_antivirus:4.2.254.0:*:*:*:*:*:*:*;cpe:2.3:a:gdata-software:g_data_antivirus:21:*:*:*:*:*:*:*;cpe:2.3:a:ikarus:ikarus_virus_utilities_t3_command_line_scanner:1.1.97.0:*:*:*:*:*:*:*;cpe:2.3:a:jiangmin:jiangmin_antivirus:13.0.900:*:*:*:*:*:*:*;cpe:2.3:a:k7computing:antivirus:9.77.3565:*:*:*:*:*:*:*;cpe:2.3:a:kaspersky:kaspersky_anti-virus:7.0.0.125:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:gateway:2010.1c:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:scan_engine:5.400.0.1158:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:security_essentials:2.0:*:*:*:*:*:*:*;cpe:2.3:a:norman:norman_antivirus_\&_antispyware:6.06.12:*:*:*:*:*:*:*;cpe:2.3:a:nprotect:nprotect_antivirus:2011-01-17.01:*:*:*:*:*:*:*;cpe:2.3:a:pandasecurity:panda_antivirus:10.0.2.7:*:*:*:*:*:*:*;cpe:2.3:a:pc_tools:pc_tools_antivirus:7.0.3.5:*:*:*:*:*:*:*;cpe:2.3:a:rising-global:rising_antivirus:22.83.00.03:*:*:*:*:*:*:*;cpe:2.3:a:sophos:sophos_anti-virus:4.61.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec:endpoint_protection:11.0:*:*:*:*:*:*:*;cpe:2.3:a:trendmicro:housecall:9.120.0.1004:*:*:*:*:*:*:*;cpe:2.3:a:trendmicro:trend_micro_antivirus:9.120.0.1004:*:*:*:*:*:*:*;cpe:2.3:a:virusbuster:virusbuster:13.6.151.0:*:*:*:*:*:*:*,Ahnlab,V3 Internet Security
CVE-2012-1446,0.0,,0.99734,CWE-264,"The ELF file parser in Quick Heal (aka Cat QuickHeal) 11.00, McAfee Anti-Virus Scanning Engine 5.400.0.1158, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Norman Antivirus 6.06.12, eSafe 7.0.17.0, Kaspersky Anti-Virus 7.0.0.125, McAfee Gateway (formerly Webwasher) 2010.1C, Sophos Anti-Virus 4.61.0, CA eTrust Vet Antivirus 36.1.8511, Antiy Labs AVL SDK 2.0.3.7, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified encoding field.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations.",2012-03-21,EPSS,cpe:2.3:a:aladdin:esafe:7.0.17.0:*:*:*:*:*:*:*;cpe:2.3:a:antiy:avl_sdk:2.0.3.7:*:*:*:*:*:*:*;cpe:2.3:a:ca:etrust_vet_antivirus:36.1.8511:*:*:*:*:*:*:*;cpe:2.3:a:cat:quick_heal:11.00:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortinet_antivirus:4.2.254.0:*:*:*:*:*:*:*;cpe:2.3:a:kaspersky:kaspersky_anti-virus:7.0.0.125:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:gateway:2010.1c:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:scan_engine:5.400.0.1158:*:*:*:*:*:*:*;cpe:2.3:a:norman:norman_antivirus_\&_antispyware:6.06.12:*:*:*:*:*:*:*;cpe:2.3:a:pandasecurity:panda_antivirus:10.0.2.7:*:*:*:*:*:*:*;cpe:2.3:a:pc_tools:pc_tools_antivirus:7.0.3.5:*:*:*:*:*:*:*;cpe:2.3:a:rising-global:rising_antivirus:22.83.00.03:*:*:*:*:*:*:*;cpe:2.3:a:sophos:sophos_anti-virus:4.61.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec:endpoint_protection:11.0:*:*:*:*:*:*:*,Aladdin,Esafe
CVE-2012-1453,0.0,,0.9771,CWE-264,"The CAB file parser in Dr.Web 5.0.2.03300, Trend Micro HouseCall 9.120.0.1004, Kaspersky Anti-Virus 7.0.0.125, Sophos Anti-Virus 4.61.0, Trend Micro AntiVirus 9.120.0.1004, McAfee Gateway (formerly Webwasher) 2010.1C, Emsisoft Anti-Malware 5.1.0.1, CA eTrust Vet Antivirus 36.1.8511, Antiy Labs AVL SDK 2.0.3.7, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, Rising Antivirus 22.83.00.03, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via a CAB file with a modified coffFiles field.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different CAB parser implementations.",2012-03-21,EPSS,cpe:2.3:a:antiy:avl_sdk:2.0.3.7:*:*:*:*:*:*:*;cpe:2.3:a:ca:etrust_vet_antivirus:36.1.8511:*:*:*:*:*:*:*;cpe:2.3:a:drweb:dr.web_antivirus:5.0.2.03300:*:*:*:*:*:*:*;cpe:2.3:a:emsisoft:anti-malware:5.1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortinet_antivirus:4.2.254.0:*:*:*:*:*:*:*;cpe:2.3:a:ikarus:ikarus_virus_utilities_t3_command_line_scanner:1.1.97.0:*:*:*:*:*:*:*;cpe:2.3:a:kaspersky:kaspersky_anti-virus:7.0.0.125:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:gateway:2010.1c:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:security_essentials:2.0:*:*:*:*:*:*:*;cpe:2.3:a:pandasecurity:panda_antivirus:10.0.2.7:*:*:*:*:*:*:*;cpe:2.3:a:rising-global:rising_antivirus:22.83.00.03:*:*:*:*:*:*:*;cpe:2.3:a:sophos:sophos_anti-virus:4.61.0:*:*:*:*:*:*:*;cpe:2.3:a:trendmicro:housecall:9.120.0.1004:*:*:*:*:*:*:*;cpe:2.3:a:trendmicro:trend_micro_antivirus:9.120.0.1004:*:*:*:*:*:*:*,Antiy,Avl Sdk
CVE-2012-1456,0.0,,0.99937,CWE-264,"The TAR file parser in AVG Anti-Virus 10.0.0.1190, Quick Heal (aka Cat QuickHeal) 11.00, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, Panda Antivirus 10.0.2.7, Rising Antivirus 22.83.00.03, Sophos Anti-Virus 4.61.0, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, and Trend Micro HouseCall 9.120.0.1004 allows remote attackers to bypass malware detection via a TAR file with an appended ZIP file.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.",2012-03-21,EPSS,cpe:2.3:a:aladdin:esafe:7.0.17.0:*:*:*:*:*:*:*;cpe:2.3:a:avg:avg_anti-virus:10.0.0.1190:*:*:*:*:*:*:*;cpe:2.3:a:cat:quick_heal:11.00:*:*:*:*:*:*:*;cpe:2.3:a:comodo:comodo_antivirus:7424:*:*:*:*:*:*:*;cpe:2.3:a:emsisoft:anti-malware:5.1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:eset:nod32_antivirus:5795:*:*:*:*:*:*:*;cpe:2.3:a:f-prot:f-prot_antivirus:4.6.2.117:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortinet_antivirus:4.2.254.0:*:*:*:*:*:*:*;cpe:2.3:a:ikarus:ikarus_virus_utilities_t3_command_line_scanner:1.1.97.0:*:*:*:*:*:*:*;cpe:2.3:a:jiangmin:jiangmin_antivirus:13.0.900:*:*:*:*:*:*:*;cpe:2.3:a:kaspersky:kaspersky_anti-virus:7.0.0.125:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:gateway:2010.1c:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:scan_engine:5.400.0.1158:*:*:*:*:*:*:*;cpe:2.3:a:norman:norman_antivirus_\&_antispyware:6.06.12:*:*:*:*:*:*:*;cpe:2.3:a:pandasecurity:panda_antivirus:10.0.2.7:*:*:*:*:*:*:*;cpe:2.3:a:rising-global:rising_antivirus:22.83.00.03:*:*:*:*:*:*:*;cpe:2.3:a:sophos:sophos_anti-virus:4.61.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec:endpoint_protection:11.0:*:*:*:*:*:*:*;cpe:2.3:a:trendmicro:housecall:9.120.0.1004:*:*:*:*:*:*:*;cpe:2.3:a:trendmicro:trend_micro_antivirus:9.120.0.1004:*:*:*:*:*:*:*,Aladdin,Esafe
CVE-2012-1457,0.0,,0.98293,CWE-264,"The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, G Data AntiVirus 21, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, Trend Micro HouseCall 9.120.0.1004, VBA32 3.12.14.2, and VirusBuster 13.6.151.0 allows remote attackers to bypass malware detection via a TAR archive entry with a length field that exceeds the total TAR file size.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.",2012-03-21,EPSS,cpe:2.3:a:aladdin:esafe:7.0.17.0:*:*:*:*:*:*:*;cpe:2.3:a:alwil:avast_antivirus:4.8.1351.0:*:*:*:*:*:*:*;cpe:2.3:a:alwil:avast_antivirus:5.0.677.0:*:*:*:*:*:*:*;cpe:2.3:a:anti-virus:vba32:3.12.14.2:*:*:*:*:*:*:*;cpe:2.3:a:antiy:avl_sdk:2.0.3.7:*:*:*:*:*:*:*;cpe:2.3:a:authentium:command_antivirus:5.2.11.5:*:*:*:*:*:*:*;cpe:2.3:a:avg:avg_anti-virus:10.0.0.1190:*:*:*:*:*:*:*;cpe:2.3:a:avira:antivir:7.11.1.163:*:*:*:*:*:*:*;cpe:2.3:a:bitdefender:bitdefender:7.2:*:*:*:*:*:*:*;cpe:2.3:a:cat:quick_heal:11.00:*:*:*:*:*:*:*;cpe:2.3:a:clamav:clamav:0.96.4:*:*:*:*:*:*:*;cpe:2.3:a:emsisoft:anti-malware:5.1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:eset:nod32_antivirus:5795:*:*:*:*:*:*:*;cpe:2.3:a:f-prot:f-prot_antivirus:4.6.2.117:*:*:*:*:*:*:*;cpe:2.3:a:gdata-software:g_data_antivirus:21:*:*:*:*:*:*:*;cpe:2.3:a:ikarus:ikarus_virus_utilities_t3_command_line_scanner:1.1.97.0:*:*:*:*:*:*:*;cpe:2.3:a:jiangmin:jiangmin_antivirus:13.0.900:*:*:*:*:*:*:*;cpe:2.3:a:k7computing:antivirus:9.77.3565:*:*:*:*:*:*:*;cpe:2.3:a:kaspersky:kaspersky_anti-virus:7.0.0.125:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:gateway:2010.1c:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:scan_engine:5.400.0.1158:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:security_essentials:2.0:*:*:*:*:*:*:*;cpe:2.3:a:norman:norman_antivirus_\&_antispyware:6.06.12:*:*:*:*:*:*:*;cpe:2.3:a:pc_tools:pc_tools_antivirus:7.0.3.5:*:*:*:*:*:*:*;cpe:2.3:a:rising-global:rising_antivirus:22.83.00.03:*:*:*:*:*:*:*;cpe:2.3:a:symantec:endpoint_protection:11.0:*:*:*:*:*:*:*;cpe:2.3:a:trendmicro:housecall:9.120.0.1004:*:*:*:*:*:*:*;cpe:2.3:a:trendmicro:trend_micro_antivirus:9.120.0.1004:*:*:*:*:*:*:*;cpe:2.3:a:virusbuster:virusbuster:13.6.151.0:*:*:*:*:*:*:*,Aladdin,Esafe
CVE-2012-1459,0.0,,0.99809,CWE-264,"The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, Fortinet Antivirus 4.2.254.0, G Data AntiVirus 21, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, nProtect Anti-Virus 2011-01-17.01, Panda Antivirus 10.0.2.7, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, Sophos Anti-Virus 4.61.0, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, Trend Micro HouseCall 9.120.0.1004, VBA32 3.12.14.2, and VirusBuster 13.6.151.0 allows remote attackers to bypass malware detection via a TAR archive entry with a length field corresponding to that entire entry, plus part of the header of the next entry.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.",2012-03-21,EPSS,cpe:2.3:a:ahnlab:v3_internet_security:2011.01.18.00:*:*:*:*:*:*:*;cpe:2.3:a:alwil:avast_antivirus:4.8.1351.0:*:*:*:*:*:*:*;cpe:2.3:a:alwil:avast_antivirus:5.0.677.0:*:*:*:*:*:*:*;cpe:2.3:a:anti-virus:vba32:3.12.14.2:*:*:*:*:*:*:*;cpe:2.3:a:antiy:avl_sdk:2.0.3.7:*:*:*:*:*:*:*;cpe:2.3:a:authentium:command_antivirus:5.2.11.5:*:*:*:*:*:*:*;cpe:2.3:a:avg:avg_anti-virus:10.0.0.1190:*:*:*:*:*:*:*;cpe:2.3:a:avira:antivir:7.11.1.163:*:*:*:*:*:*:*;cpe:2.3:a:bitdefender:bitdefender:7.2:*:*:*:*:*:*:*;cpe:2.3:a:cat:quick_heal:11.00:*:*:*:*:*:*:*;cpe:2.3:a:clamav:clamav:0.96.4:*:*:*:*:*:*:*;cpe:2.3:a:comodo:comodo_antivirus:7424:*:*:*:*:*:*:*;cpe:2.3:a:emsisoft:anti-malware:5.1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:eset:nod32_antivirus:5795:*:*:*:*:*:*:*;cpe:2.3:a:f-prot:f-prot_antivirus:4.6.2.117:*:*:*:*:*:*:*;cpe:2.3:a:f-secure:f-secure_anti-virus:9.0.16160.0:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortinet_antivirus:4.2.254.0:*:*:*:*:*:*:*;cpe:2.3:a:gdata-software:g_data_antivirus:21:*:*:*:*:*:*:*;cpe:2.3:a:ikarus:ikarus_virus_utilities_t3_command_line_scanner:1.1.97.0:*:*:*:*:*:*:*;cpe:2.3:a:jiangmin:jiangmin_antivirus:13.0.900:*:*:*:*:*:*:*;cpe:2.3:a:k7computing:antivirus:9.77.3565:*:*:*:*:*:*:*;cpe:2.3:a:kaspersky:kaspersky_anti-virus:7.0.0.125:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:gateway:2010.1c:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:scan_engine:5.400.0.1158:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:security_essentials:2.0:*:*:*:*:*:*:*;cpe:2.3:a:norman:norman_antivirus_\&_antispyware:6.06.12:*:*:*:*:*:*:*;cpe:2.3:a:nprotect:nprotect_antivirus:2011-01-17.01:*:*:*:*:*:*:*;cpe:2.3:a:pandasecurity:panda_antivirus:10.0.2.7:*:*:*:*:*:*:*;cpe:2.3:a:pc_tools:pc_tools_antivirus:7.0.3.5:*:*:*:*:*:*:*;cpe:2.3:a:rising-global:rising_antivirus:22.83.00.03:*:*:*:*:*:*:*;cpe:2.3:a:sophos:sophos_anti-virus:4.61.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec:endpoint_protection:11.0:*:*:*:*:*:*:*;cpe:2.3:a:trendmicro:housecall:9.120.0.1004:*:*:*:*:*:*:*;cpe:2.3:a:trendmicro:trend_micro_antivirus:9.120.0.1004:*:*:*:*:*:*:*;cpe:2.3:a:virusbuster:virusbuster:13.6.151.0:*:*:*:*:*:*:*,Ahnlab,V3 Internet Security
CVE-2012-1462,0.0,,0.97903,CWE-264,"The ZIP file parser in AhnLab V3 Internet Security 2011.01.18.00, AVG Anti-Virus 10.0.0.1190, Quick Heal (aka Cat QuickHeal) 11.00, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, Kaspersky Anti-Virus 7.0.0.125, Norman Antivirus 6.06.12, Sophos Anti-Virus 4.61.0, and AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11 allows remote attackers to bypass malware detection via a ZIP file containing an invalid block of data at the beginning.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ZIP parser implementations.",2012-03-21,EPSS,cpe:2.3:a:ahnlab:v3_internet_security:2011.01.18.00:*:*:*:*:*:*:*;cpe:2.3:a:aladdin:esafe:7.0.17.0:*:*:*:*:*:*:*;cpe:2.3:a:avg:avg_anti-virus:10.0.0.1190:*:*:*:*:*:*:*;cpe:2.3:a:cat:quick_heal:11.00:*:*:*:*:*:*:*;cpe:2.3:a:emsisoft:anti-malware:5.1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortinet_antivirus:4.2.254.0:*:*:*:*:*:*:*;cpe:2.3:a:ikarus:ikarus_virus_utilities_t3_command_line_scanner:1.1.97.0:*:*:*:*:*:*:*;cpe:2.3:a:jiangmin:jiangmin_antivirus:13.0.900:*:*:*:*:*:*:*;cpe:2.3:a:kaspersky:kaspersky_anti-virus:7.0.0.125:*:*:*:*:*:*:*;cpe:2.3:a:symantec:endpoint_protection:11.0:*:*:*:*:*:*:*,Ahnlab,V3 Internet Security
CVE-2012-1465,0.0,,0.2712,CWE-119,Stack-based buffer overflow in the HTTP Server in NetMechanica NetDecision before 4.6.1 allows remote attackers to cause a denial of service (application crash) via a long URL in an HTTP request.  NOTE: some of these details are obtained from third party information.,2012-03-19,Metasploit,cpe:2.3:a:netmechanica:netdecision:*:*:*:*:*:*:*:*,Netmechanica,Netdecision
CVE-2012-1493,0.0,,0.63078,CWE-255,"F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins via the PubkeyAuthentication option.",2012-07-09,Metasploit,cpe:2.3:a:f5:big-ip_application_security_manager:10.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:10.0.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:10.2.3:hf1:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:11.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:11.0.0:hf1:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:11.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:11.1.0:hf2:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:9.2.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:9.2.0:hf4:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:9.4.4:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:9.4.5:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:9.4.6:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:9.4.7:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:9.4.8:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:10.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:10.2.3:hf1:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:11.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:11.0.0:hf1:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:11.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:11.1.0:hf2:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:9.2.2:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:9.4.8:hf4:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:10.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:10.2.3:hf1:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:11.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:11.0.0:hf1:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:11.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:11.1.0:hf2:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:9.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:9.4.8:hf4:*:*:*:*:*:*;cpe:2.3:a:f5:enterprise_manager:*:*:virtual:*:*:*:*:*;cpe:2.3:a:f5:enterprise_manager:1.0:*:virtual:*:*:*:*:*;cpe:2.3:a:f5:enterprise_manager:2.0:*:virtual:*:*:*:*:*;cpe:2.3:a:f5:enterprise_manager:2.1.0:*:virtual:*:*:*:*:*;cpe:2.3:a:f5:enterprise_manager:2.1.0:hf1:virtual:*:*:*:*:*;cpe:2.3:a:f5:enterprise_manager:2.2.0:*:virtual:*:*:*:*:*;cpe:2.3:a:f5:enterprise_manager:2.3.0:*:virtual:*:*:*:*:*;cpe:2.3:a:f5:enterprise_manager:2.3.0:hf2:virtual:*:*:*:*:*;cpe:2.3:h:f5:big-ip_1000:*:*:*:*:*:*:*:*;cpe:2.3:h:f5:big-ip_11000:*:*:*:*:*:*:*:*;cpe:2.3:h:f5:big-ip_11050:*:*:*:*:*:*:*:*;cpe:2.3:h:f5:big-ip_1500:*:*:*:*:*:*:*:*;cpe:2.3:h:f5:big-ip_1600:*:*:*:*:*:*:*:*;cpe:2.3:h:f5:big-ip_2400:*:*:*:*:*:*:*:*;cpe:2.3:h:f5:big-ip_3400:*:*:*:*:*:*:*:*;cpe:2.3:h:f5:big-ip_3410:*:*:*:*:*:*:*:*;cpe:2.3:h:f5:big-ip_3600:*:*:*:*:*:*:*:*;cpe:2.3:h:f5:big-ip_3900:*:*:*:*:*:*:*:*;cpe:2.3:h:f5:big-ip_4100:*:*:*:*:*:*:*:*;cpe:2.3:h:f5:big-ip_5100:*:*:*:*:*:*:*:*;cpe:2.3:h:f5:big-ip_5110:*:*:*:*:*:*:*:*;cpe:2.3:h:f5:big-ip_6400:*:*:*:*:*:*:*:*;cpe:2.3:h:f5:big-ip_6800:*:*:*:*:*:*:*:*;cpe:2.3:h:f5:big-ip_6900:*:*:*:*:*:*:*:*;cpe:2.3:h:f5:big-ip_8400:*:*:*:*:*:*:*:*;cpe:2.3:h:f5:big-ip_8800:*:*:*:*:*:*:*:*;cpe:2.3:h:f5:big-ip_8900:*:*:*:*:*:*:*:*;cpe:2.3:h:f5:big-ip_8950:*:*:*:*:*:*:*:*;cpe:2.3:h:f5:enterprise_manager:*:*:*:*:*:*:*:*;cpe:2.3:h:f5:enterprise_manager:1.0:*:*:*:*:*:*:*;cpe:2.3:h:f5:enterprise_manager:2.0:*:*:*:*:*:*:*;cpe:2.3:h:f5:enterprise_manager:2.1.0:*:*:*:*:*:*:*;cpe:2.3:h:f5:enterprise_manager:2.1.0:hf1:*:*:*:*:*:*;cpe:2.3:h:f5:enterprise_manager:2.2.0:*:*:*:*:*:*:*;cpe:2.3:h:f5:enterprise_manager:2.3.0:*:*:*:*:*:*:*;cpe:2.3:h:f5:enterprise_manager:2.3.0:hf2:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:*:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:10.0.0:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:10.0.1:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:10.1.0:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:10.2.0:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:2.0:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:4.0:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:4.2:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:4.3:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:4.4:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:4.5.10:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:4.5.11:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:4.5.12:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:4.5.6:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:4.5.9:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:4.5:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:4.6.2:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:4.6:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.0.1:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.0.2:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.0.3:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.0.4:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.0.5:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.0:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.1.1:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.1.2:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.1.3:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.1:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.2.2:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.2.3:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.2.4:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.2.5:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.2:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.3.1:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.3:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.4.1:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.4.2:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.4.3:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.4.4:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.4.5:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.4.6:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.4.7:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.4.8:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.4:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.6.0:*:*:*:*:*:*:*;cpe:2.3:o:f5:tmos:9.6.1:*:*:*:*:*:*:*,F5,Tmos
CVE-2012-1495,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.79764,CWE-74,install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user_login parameter.,2020-01-27,Metasploit,cpe:2.3:a:webcalendar_project:webcalendar:*:*:*:*:*:*:*:*,Webcalendar Project,Webcalendar
CVE-2012-1533,0.0,,0.68532,NVD-CWE-noinfo,"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2012-3159.",2012-10-16,Metasploit,cpe:2.3:a:oracle:jdk:*:update35:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:*:update7:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update22:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update23:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update24:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update25:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update26:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update27:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update29:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update30:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update31:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update32:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update33:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update34:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update5:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update6:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:*:update35:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:*:update7:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update22:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update23:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update24:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update25:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update26:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update27:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update29:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update30:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update31:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update32:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update33:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update34:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0.200:update20:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0.210:update21:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update1:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update1_b06:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_19:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_19:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_20:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_21:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*,Oracle,Jdk
CVE-2012-1535,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.70384,CWE-20,"Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted SWF content, as exploited in the wild in August 2012 with SWF content in a Word document.",2012-08-15,CISA/Metasploit,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:*,Apple,Mac Os X
CVE-2012-1675,0.0,,0.77633,CWE-264,"The TNS Listener, as used in Oracle Database 11g 11.1.0.7, 11.2.0.2, and 11.2.0.3, and 10g 10.2.0.3, 10.2.0.4, and 10.2.0.5, as used in Oracle Fusion Middleware, Enterprise Manager, E-Business Suite, and possibly other products, allows remote attackers to execute arbitrary database commands by performing a remote registration of a database (1) instance or (2) service name that already exists, then conducting a man-in-the-middle (MITM) attack to hijack database connections, aka ""TNS Poison.""",2012-05-08,Metasploit,cpe:2.3:a:oracle:database_server:10.2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_server:10.2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_server:10.2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_server:11.1.0.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_server:11.2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_server:11.2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database_server:11.2.0.4:*:*:*:*:*:*:*,Oracle,Database Server
CVE-2012-1710,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.11636,NVD-CWE-noinfo,"Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Designer, a different vulnerability than CVE-2012-1709.",2012-05-03,CISA,cpe:2.3:a:oracle:fusion_middleware:10.1.3.5:*:*:*:*:*:*:*,Oracle,Fusion Middleware
CVE-2012-1723,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.93688,NVD-CWE-noinfo,"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.",2012-06-16,CISA/Metasploit,cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:-:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update10:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update11:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update12:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update13:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update14:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update15:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update16:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update17:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update18:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update19:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update20:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update21:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update22:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update23:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update24:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update25:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update26:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update27:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update28:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update29:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update30:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update31:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update32:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update33:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update34:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update35:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:-:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update10:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update11:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update12:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update13:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update14:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update15:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update16:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update17:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update18:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update19:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update20:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update21:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update22:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update23:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update24:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update25:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update26:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update27:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update29:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update30:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update31:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update32:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update32_b31:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update32_b32:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:-:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:-:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update10:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update11:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update12:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update13:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update14:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update15:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update16:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update17:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update18:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update19:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update20:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update21:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update22:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update23:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update24:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update25:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update26:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update27:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update28:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update29:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update30:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update31:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update32:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update33:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update34:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update35:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:-:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update10:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update11:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update12:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update13:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update14:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update15:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update16:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update17:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update18:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update19:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update20:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update21:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update22:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update23:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update24:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update25:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update26:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update27:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update29:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update30:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update31:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update32:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:-:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*;cpe:2.3:a:redhat:icedtea6:*:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*,Redhat,Enterprise Linux Desktop
CVE-2012-1775,0.0,,0.44244,CWE-119,Stack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote attackers to execute arbitrary code via a crafted MMS:// stream.,2012-03-19,Metasploit,cpe:2.3:a:videolan:vlc_media_player:*:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.1.99a:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.1.99b:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.1.99c:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.1.99d:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.1.99e:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.1.99f:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.1.99g:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.1.99h:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.1.99i:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.50:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.60:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.61:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.62:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.63:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.70:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.71:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.72:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.73:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.80:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.81:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.82:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.83:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.90:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.91:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.2.92:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.3.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.3.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.4.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.4.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.4.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.4.3-ac3:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.4.3:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.4.4:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.4.5:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.4.6:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.5.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.5.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.5.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.5.3:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.6.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.6.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.6.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.7.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.7.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.7.1a:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.7.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.7.2:test2:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.7.2:test3:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.1337:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.4:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.4:test2:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.4a:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.5:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.5:test3:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.5:test4:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.6:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.6a:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.6b:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.6c:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.6d:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.6e:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.6f:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.6g:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.6h:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.8.6i:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.10:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.3:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.4:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.5:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.6:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.7:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.8:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.8a:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.9:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9.9a:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:0.9:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.0:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.10.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.10:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.11:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.13:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.3:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.4.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.4:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.5:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.6.1:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.6:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.7:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.8:*:*:*:*:*:*:*;cpe:2.3:a:videolan:vlc_media_player:1.1.9:*:*:*:*:*:*:*,Videolan,Vlc Media Player
CVE-2012-1803,0.0,,0.49395,CWE-310,"RuggedCom Rugged Operating System (ROS) 3.10.x and earlier has a factory account with a password derived from the MAC Address field in the banner, which makes it easier for remote attackers to obtain access by performing a calculation on this address value, and then establishing a (1) TELNET, (2) remote shell (aka rsh), or (3) serial-console session.",2012-04-28,Metasploit,cpe:2.3:o:siemens:ruggedcom_rugged_operating_system:*:*:*:*:*:*:*:*,Siemens,Ruggedcom Rugged Operating System
CVE-2012-1823,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99998,CWE-77,"sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.",2012-05-11,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:php:php:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:application_stack:2.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:gluster_storage_server_for_on-premise:2.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:storage:2.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:storage_for_public_cloud:2.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:b.11.23:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:b.11.31:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:5.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:5.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:5.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:vmware:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2012-1835,0.0,,0.08946,CWE-79,"Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to app/view/agenda-widget-form.php; (2) args, (3) title, (4) before_title, or (5) after_title parameter to app/view/agenda-widget.php; (6) button_value parameter to app/view/box_publish_button.php; or (7) msg parameter to /app/view/save_successful.php.",2012-08-14,Nuclei,cpe:2.3:a:timely:all-in-one_event_calendar:1.4:*:*:*:*:*:*:*;cpe:2.3:a:timely:all-in-one_event_calendar:1.5:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*,Timely,All-In-One Event Calendar
CVE-2012-1854,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.21028,NVD-CWE-Other,"Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka ""Visual Basic for Applications Insecure Library Loading Vulnerability,"" as exploited in the wild in July 2012.",2012-07-10,CISA,cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2010:-:*:*:*:*:x64:*;cpe:2.3:a:microsoft:office:2010:-:*:*:*:*:x86:*;cpe:2.3:a:microsoft:office:2010:sp1:*:*:*:*:x64:*;cpe:2.3:a:microsoft:office:2010:sp1:*:*:*:*:x86:*;cpe:2.3:a:microsoft:visual_basic_for_applications:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:visual_basic_for_applications_sdk:*:*:*:*:*:*:*:*,Microsoft,Office
CVE-2012-1856,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.72119,NVD-CWE-noinfo,"The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Server 2000 SP4, SQL Server 2005 SP4, SQL Server 2008 SP2, SP3, R2, R2 SP1, and R2 SP2, Commerce Server 2002 SP4, Commerce Server 2007 SP2, Commerce Server 2009 Gold and R2, Host Integration Server 2004 SP1, Visual FoxPro 8.0 SP1, Visual FoxPro 9.0 SP2, and Visual Basic 6.0 Runtime allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption, aka ""MSCOMCTL.OCX RCE Vulnerability.""",2012-08-15,CISA,cpe:2.3:a:microsoft:commerce_server:2002:sp4:*:*:*:*:*:*;cpe:2.3:a:microsoft:commerce_server:2007:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:commerce_server:2009:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:commerce_server:2009:r2:*:*:*:*:*:*;cpe:2.3:a:microsoft:host_integration_server:2004:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2010:sp1:x86:*:*:*:*:*;cpe:2.3:a:microsoft:office_web_components:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server:2000:sp4:*:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server:2000:sp4:analysis_services:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server:2005:sp3:express_advanced_services:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server:2005:sp4:*:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server:2008:r2_sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server:2008:r2_sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server:2008:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server:2008:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:visual_basic:6.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:*,Microsoft,Commerce Server
CVE-2012-1875,0.0,,0.61655,CWE-94,"Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka ""Same ID Property Remote Code Execution Vulnerability.""",2012-06-12,Metasploit,cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:*:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:sp1:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*,Microsoft,Windows 7
CVE-2012-1876,0.0,,0.64962,CWE-94,"Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access a nonexistent object, leading to a heap-based buffer overflow, aka ""Col Element Remote Code Execution Vulnerability,"" as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.",2012-06-12,Metasploit,cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:*:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:sp1:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*,Microsoft,Windows 2003 Server
CVE-2012-1889,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.83638,CWE-787,"Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.",2012-06-13,CISA/Metasploit,cpe:2.3:a:microsoft:expression_web:2:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:expression_web:sp1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:groove:2007:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:groove:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:groove_server:2007:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:groove_server:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_compatibility_pack:-:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_word_viewer:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2007:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:xml_core_services:3.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:xml_core_services:4.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:xml_core_services:5.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:xml_core_services:6.0:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2012-2019,0.0,,0.64685,NVD-CWE-noinfo,"Unspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1325.",2012-07-11,Metasploit,cpe:2.3:a:hp:operations_agent:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:operations_agent:7.36:*:*:*:*:*:*:*;cpe:2.3:a:hp:operations_agent:8.51.102:*:*:*:*:*:*:*;cpe:2.3:a:hp:operations_agent:8.51:*:*:*:*:*:*:*;cpe:2.3:a:hp:operations_agent:8.52:*:*:*:*:*:*:*;cpe:2.3:a:hp:operations_agent:8.53:*:*:*:*:*:*:*;cpe:2.3:a:hp:operations_agent:8.60.005:*:*:*:*:*:*:*;cpe:2.3:a:hp:operations_agent:8.60.006:*:*:*:*:*:*:*;cpe:2.3:a:hp:operations_agent:8.60.007:*:*:*:*:*:*:*;cpe:2.3:a:hp:operations_agent:8.60.008:*:*:*:*:*:*:*;cpe:2.3:a:hp:operations_agent:8.60.501:*:*:*:*:*:*:*;cpe:2.3:a:hp:operations_agent:8.60.7:*:*:*:*:*:*:*;cpe:2.3:a:hp:operations_agent:8.60:*:*:*:*:*:*:*,Hp,Operations Agent
CVE-2012-2020,0.0,,0.64685,NVD-CWE-noinfo,"Unspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1326.",2012-07-11,Metasploit,cpe:2.3:a:hp:operations_agent:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:operations_agent:7.36:*:*:*:*:*:*:*;cpe:2.3:a:hp:operations_agent:8.51.102:*:*:*:*:*:*:*;cpe:2.3:a:hp:operations_agent:8.51:*:*:*:*:*:*:*;cpe:2.3:a:hp:operations_agent:8.52:*:*:*:*:*:*:*;cpe:2.3:a:hp:operations_agent:8.53:*:*:*:*:*:*:*;cpe:2.3:a:hp:operations_agent:8.60.005:*:*:*:*:*:*:*;cpe:2.3:a:hp:operations_agent:8.60.006:*:*:*:*:*:*:*;cpe:2.3:a:hp:operations_agent:8.60.007:*:*:*:*:*:*:*;cpe:2.3:a:hp:operations_agent:8.60.008:*:*:*:*:*:*:*;cpe:2.3:a:hp:operations_agent:8.60.501:*:*:*:*:*:*:*;cpe:2.3:a:hp:operations_agent:8.60.7:*:*:*:*:*:*:*;cpe:2.3:a:hp:operations_agent:8.60:*:*:*:*:*:*:*,Hp,Operations Agent
CVE-2012-2034,7.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.078,CWE-119,"Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2037.",2012-06-09,CISA,cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:google:android:*:*:*:*:*:*:*:*;cpe:2.3:o:google:android:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*,Apple,Macos
CVE-2012-2122,0.0,,0.96188,CWE-287,"sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.",2012-06-26,EPSS/Metasploit/Nuclei,cpe:2.3:a:mariadb:mariadb:5.1.41:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.1.42:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.1.44:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.1.47:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.1.49:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.1.50:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.1.51:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.1.53:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.1.55:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.1.60:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.1.61:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.2.0:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.2.10:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.2.11:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.2.1:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.2.2:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.2.3:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.2.4:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.2.5:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.2.6:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.2.7:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.2.8:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.2.9:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.3.0:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.3.1:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.3.2:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.3.3:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.3.4:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.3.5:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.3.6:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.5.20:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.5.21:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:5.5.22:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.51:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.52:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.52:sp1:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.53:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.54:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.55:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.56:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.57:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.58:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.59:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.60:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.1.61:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.5.10:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.5.11:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.5.12:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.5.13:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.5.14:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.5.15:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.5.16:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.5.17:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.5.18:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.5.19:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.5.20:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.5.21:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.6.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.6.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.6.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.6.5:*:*:*:*:*:*:*,Oracle,Mysql
CVE-2012-2174,0.0,,0.38291,CWE-94,The URL handler in IBM Lotus Notes 8.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a crafted notes:// URL.,2012-06-20,Metasploit,cpe:2.3:a:ibm:lotus_notes:8.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.0.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.0.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.0.2.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.0.2.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.0.2.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.0.2.5:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.0.2.6:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.0.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.1.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.1.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.1.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.1.5:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.2.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.2.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.3.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_notes:8.5:*:*:*:*:*:*:*,Ibm,Lotus Notes
CVE-2012-2175,0.0,,0.29436,CWE-119,Buffer overflow in the Attachment_Times method in a certain ActiveX control in dwa85W.dll in IBM Lotus iNotes 8.5.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a long argument.,2012-06-20,Metasploit,cpe:2.3:a:ibm:lotus_inotes:8.5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_inotes:8.5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_inotes:8.5.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_inotes:8.5.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_inotes:8.5.1.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_inotes:8.5.1.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_inotes:8.5.1.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_inotes:8.5.1.5:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_inotes:8.5.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_inotes:8.5.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_inotes:8.5.2.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_inotes:8.5.2.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_inotes:8.5.3.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_inotes:8.5.3.1:*:*:*:*:*:*:*,Ibm,Lotus Inotes
CVE-2012-2176,0.0,,0.31173,CWE-119,Multiple stack-based buffer overflows in a certain ActiveX control in qp2.cab in IBM Lotus Quickr 8.2 before 8.2.0.27-002a for Domino allow remote attackers to execute arbitrary code via a long argument to the (1) Attachment_Times or (2) Import_Times method.,2012-05-25,Metasploit,cpe:2.3:a:ibm:lotus_quickr:8.2:*:*:*:*:*:*:*,Ibm,Lotus Quickr
CVE-2012-2215,0.0,,0.2826,CWE-22,Directory traversal vulnerability in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to read arbitrary files via an opcode 0x21 request.,2012-04-09,Metasploit,cpe:2.3:a:novell:zenworks_configuration_management:11.1:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_configuration_management:11.1a:*:*:*:*:*:*:*,Novell,Zenworks Configuration Management
CVE-2012-2288,0.0,,0.3312,CWE-134,"Format string vulnerability in the nsrd RPC service in EMC NetWorker 7.6.3 and 7.6.4 before 7.6.4.1, and 8.0 before 8.0.0.1, allows remote attackers to execute arbitrary code via format string specifiers in a message.",2012-09-04,Metasploit,cpe:2.3:a:emc:networker:7.6.3:*:*:*:*:*:*:*;cpe:2.3:a:emc:networker:7.6.4:*:*:*:*:*:*:*;cpe:2.3:a:emc:networker:8.0:*:*:*:*:*:*:*,Emc,Networker
CVE-2012-2329,0.0,,0.62649,CWE-119,Buffer overflow in the apache_request_headers function in sapi/cgi/cgi_main.c in PHP 5.4.x before 5.4.3 allows remote attackers to cause a denial of service (application crash) via a long string in the header of an HTTP request.,2012-05-11,Metasploit,cpe:2.3:a:php:php:5.4.0:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.4.1:*:*:*:*:*:*:*;cpe:2.3:a:php:php:5.4.2:*:*:*:*:*:*:*,Php,Php
CVE-2012-2371,0.0,,0.12905,CWE-79,Cross-site scripting (XSS) vulnerability in index.php in the WP-FaceThumb plugin 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pagination_wp_facethumb parameter.,2012-08-13,Nuclei,cpe:2.3:a:mnt-tech:wp-facethumb:0.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*,Mnt-Tech,Wp-Facethumb
CVE-2012-2515,0.0,,0.27595,CWE-119,"Multiple stack-based buffer overflows in the KeyHelp.KeyCtrl.1 ActiveX control in KeyHelp.ocx 1.2.312 in KeyWorks KeyHelp Module (aka the HTML Help component), as used in EMC Documentum ApplicationXtender Desktop 5.4; EMC Captiva Quickscan Pro 4.6 SP1; GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; GE Intelligent Platforms Proficy HMI/SCADA iFIX 5.0 and 5.1; GE Intelligent Platforms Proficy Pulse 1.0; GE Intelligent Platforms Proficy Batch Execution 5.6; GE Intelligent Platforms SI7 I/O Driver 7.20 through 7.42; and other products, allow remote attackers to execute arbitrary code via a long string in the second argument to the (1) JumpMappedID or (2) JumpURL method.",2012-07-05,Metasploit,cpe:2.3:a:emc:captiva_quickscan_pro:4.6:sp1:*:*:*:*:*:*;cpe:2.3:a:emc:documentum_applicationxtender_desktop:5.4:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_proficy_batch_execution:5.6:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_proficy_historian:3.1:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_proficy_historian:3.5:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_proficy_historian:4.0:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_proficy_historian:4.5:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_ifix:5.0:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_ifix:5.1:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_proficy_pulse:1.0:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_si7_i\/o_driver:7.20:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_si7_i\/o_driver:7.42:*:*:*:*:*:*:*,Emc,Captiva Quickscan Pro
CVE-2012-2516,0.0,,0.39711,CWE-78,"An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy HMI/SCADA iFIX 5.0 and 5.1; Proficy Pulse 1.0; Proficy Batch Execution 5.6; SI7 I/O Driver 7.20 through 7.42; and other products, allows remote attackers to execute arbitrary commands via crafted input, related to a ""command injection vulnerability.""",2012-07-05,Metasploit,cpe:2.3:a:ge:intelligent_platforms_proficy_batch_execution:5.6:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_proficy_historian:3.1:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_proficy_historian:3.5:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_proficy_historian:4.0:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_proficy_historian:4.5:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_ifix:5.0:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_ifix:5.1:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_proficy_pulse:1.0:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_si7_i\/o_driver:7.20:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_si7_i\/o_driver:7.42:*:*:*:*:*:*:*,Ge,Intelligent Platforms Proficy Batch Execution
CVE-2012-2539,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.53159,CWE-787,"Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, aka ""Word RTF 'listoverridecount' Remote Code Execution Vulnerability.""",2012-12-12,CISA,cpe:2.3:a:microsoft:office_compatibility_pack:-:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_web_apps:2010:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_word_viewer:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2010:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2007:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2010:sp1:*:*:*:*:*:*,Microsoft,Office Compatibility Pack
CVE-2012-2576,0.0,,0.59146,CWE-89,"SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2, SolarWinds Storage Profiler before 5.1.2, and SolarWinds Backup Profiler before 5.1.2 allows remote attackers to execute arbitrary SQL commands via the loginName field.",2017-12-20,Metasploit,cpe:2.3:a:solarwinds:backup_profiler:*:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:storage_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:storage_profiler:*:*:*:*:*:*:*:*,Solarwinds,Backup Profiler
CVE-2012-2611,0.0,,0.41919,CWE-20,"The DiagTraceR3Info function in the Dialog processor in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2, when a certain Developer Trace configuration is enabled, allows remote attackers to execute arbitrary code via a crafted SAP Diag packet.",2012-05-15,Metasploit,cpe:2.3:a:sap:netweaver:7.0:ehp1:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver:7.0:ehp2:*:*:*:*:*:*,Sap,Netweaver
CVE-2012-2626,0.0,,0.44458,CWE-287,"cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not require token authentication, which allows remote attackers to add administrative accounts via a userprefs action.",2012-07-31,Metasploit,cpe:2.3:a:sonicwall:scrutinizer:*:*:*:*:*:*:*:*,Sonicwall,Scrutinizer
CVE-2012-2686,0.0,,0.39593,CWE-310,crypto/evp/e_aes_cbc_hmac_sha1.c in the AES-NI functionality in the TLS 1.1 and 1.2 implementations in OpenSSL 1.0.1 before 1.0.1d allows remote attackers to cause a denial of service (application crash) via crafted CBC data.,2013-02-08,Metasploit,cpe:2.3:a:openssl:openssl:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1a:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1b:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1c:*:*:*:*:*:*:*,Openssl,Openssl
CVE-2012-2763,0.0,,0.81722,CWE-120,"Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allows remote attackers to execute arbitrary code via a long string in a command to the script-fu server.",2012-07-12,Metasploit,cpe:2.3:a:gimp:gimp:*:*:*:*:*:*:*:*,Gimp,Gimp
CVE-2012-2915,0.0,,0.29465,CWE-119,Stack-based buffer overflow in Lattice Semiconductor PAC-Designer 6.2.1344 allows remote attackers to execute arbitrary code via a long string in a Value tag in a SymbolicSchematicData definition tag in PAC Design (.pac) file.,2012-05-21,Metasploit,cpe:2.3:a:lattice_semiconductor:pac-designer:6.2.1344:*:*:*:*:*:*:*,Lattice Semiconductor,Pac-Designer
CVE-2012-2926,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H,0.66578,NVD-CWE-noinfo,"Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3 before 2.3.7, and 2.4 before 2.4.1 do not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.",2012-05-22,Metasploit,cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:confluence:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*,Atlassian,Bamboo
CVE-2012-2953,0.0,,0.67389,CWE-78,The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to execute arbitrary commands via crafted input to application scripts.,2012-07-23,Metasploit,cpe:2.3:a:symantec:web_gateway:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:symantec:web_gateway:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:symantec:web_gateway:5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:symantec:web_gateway:5.0:*:*:*:*:*:*:*,Symantec,Web Gateway
CVE-2012-2962,0.0,,0.66828,CWE-89,SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2 allows remote authenticated users to execute arbitrary SQL commands via the q parameter.,2012-07-30,Metasploit,cpe:2.3:a:sonicwall:scrutinizer:*:*:*:*:*:*:*:*,Sonicwall,Scrutinizer
CVE-2012-2982,0.0,,0.62181,NVD-CWE-Other,"file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname, as demonstrated by a | (pipe) character.",2012-09-11,Metasploit,cpe:2.3:a:gentoo:webmin:*:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.140:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.150:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.160:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.170:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.180:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.200:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.210:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.220:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.230:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.240:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.260:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.270:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.280:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.290:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.300:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.310:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.320:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.330:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.340:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.370:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.380:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.390:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.400:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.410:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.420:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.430:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.440:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.450:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.470:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.480:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.500:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.510:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.520:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.530:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.550:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.560:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.570:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.580:*:*:*:*:*:*:*,Gentoo,Webmin
CVE-2012-2983,0.0,,0.20456,CWE-287,"file/edit_html.cgi in Webmin 1.590 and earlier does not perform an authorization check before showing a file's unedited contents, which allows remote attackers to read arbitrary files via the file field.",2012-09-11,Metasploit,cpe:2.3:a:gentoo:webmin:*:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.140:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.150:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.160:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.170:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.180:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.200:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.210:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.220:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.230:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.240:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.260:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.270:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.280:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.290:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.300:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.310:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.320:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.330:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.340:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.370:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.380:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.390:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.400:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.410:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.420:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.430:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.440:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.450:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.470:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.480:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.500:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.510:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.520:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.530:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.550:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.560:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.570:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:webmin:1.580:*:*:*:*:*:*:*,Gentoo,Webmin
CVE-2012-3001,0.0,,0.2731,CWE-78,"Mutiny Standard before 4.5-1.12 allows remote attackers to execute arbitrary commands via the network-interface menu, related to a ""command injection vulnerability.""",2012-10-22,Metasploit,cpe:2.3:a:mutiny:standard:*:*:*:*:*:*:*:*;cpe:2.3:a:mutiny:standard:4.4-1.12:*:*:*:*:*:*:*;cpe:2.3:a:mutiny:standard:4.5-1.03:*:*:*:*:*:*:*;cpe:2.3:a:mutiny:standard:4.5-1.05:*:*:*:*:*:*:*;cpe:2.3:a:mutiny:standard:4.5-1.07:*:*:*:*:*:*:*,Mutiny,Standard
CVE-2012-3152,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.98695,NVD-CWE-noinfo,"Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Report Server Component.  NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the URLPARAMETER functionality allows remote attackers to read and upload arbitrary files to reports/rwservlet, and that this issue occurs in earlier versions.  NOTE: this can be leveraged with CVE-2012-3153 to execute arbitrary code by uploading a .jsp file.",2012-10-16,CISA/EPSS/Metasploit,cpe:2.3:a:oracle:fusion_middleware:11.1.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:fusion_middleware:11.1.1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:fusion_middleware:11.1.2.0:*:*:*:*:*:*:*,Oracle,Fusion Middleware
CVE-2012-3153,0.0,,0.9822,NVD-CWE-noinfo,"Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet.  NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the PARSEQUERY function allows remote attackers to obtain database credentials via reports/rwservlet/parsequery, and that this issue occurs in earlier versions.  NOTE: this can be leveraged with CVE-2012-3152 to execute arbitrary code by uploading a .jsp file.",2012-10-16,EPSS/Metasploit/Nuclei,cpe:2.3:a:oracle:fusion_middleware:11.1.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:fusion_middleware:11.1.1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:fusion_middleware:11.1.2.0:*:*:*:*:*:*:*,Oracle,Fusion Middleware
CVE-2012-3260,0.0,,0.40225,NVD-CWE-noinfo,"Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1462.",2012-09-25,Metasploit,cpe:2.3:a:hp:sitescope:11.10:*:*:*:*:*:*:*;cpe:2.3:a:hp:sitescope:11.11:*:*:*:*:*:*:*;cpe:2.3:a:hp:sitescope:11.12:*:*:*:*:*:*:*,Hp,Sitescope
CVE-2012-3261,0.0,,0.40225,NVD-CWE-noinfo,"Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1463.",2012-09-25,Metasploit,cpe:2.3:a:hp:sitescope:11.10:*:*:*:*:*:*:*;cpe:2.3:a:hp:sitescope:11.11:*:*:*:*:*:*:*;cpe:2.3:a:hp:sitescope:11.12:*:*:*:*:*:*:*,Hp,Sitescope
CVE-2012-3274,0.0,,0.61762,CWE-119,Stack-based buffer overflow in uam.exe in the User Access Manager (UAM) component in HP Intelligent Management Center (IMC) before 5.1 E0101P01 allows remote attackers to execute arbitrary code via vectors related to log data.,2012-12-06,Metasploit,cpe:2.3:a:hp:intelligent_management_center:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101h03:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101h04:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101l01:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101l02:*:*:*:*:*:*,Hp,Intelligent Management Center
CVE-2012-3399,0.0,,0.65321,CWE-20,Config/diff.php in Basilic 1.5.14 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter.,2012-07-12,Metasploit,cpe:2.3:a:artis.imag:basilic:1.5.14:*:*:*:*:*:*:*,Artis.Imag,Basilic
CVE-2012-3485,0.0,,0.03776,CWE-20,"Tunnelblick 3.3beta20 and earlier relies on argv[0] to determine the name of an appropriate (1) kernel module pathname or (2) executable file pathname, which allows local users to gain privileges via an execl system call.",2012-08-26,Metasploit,cpe:2.3:a:google:tunnelblick:*:*:*:*:*:*:*:*,Google,Tunnelblick
CVE-2012-3569,0.0,,0.47719,CWE-134,"Format string vulnerability in VMware OVF Tool 2.1 on Windows, as used in VMware Workstation 8.x before 8.0.5, VMware Player 4.x before 4.0.5, and other products, allows user-assisted remote attackers to execute arbitrary code via a crafted OVF file.",2012-11-14,Metasploit,cpe:2.3:a:vmware:ovf_tool:2.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:player:4.0.0.18997:*:*:*:*:*:*:*;cpe:2.3:a:vmware:player:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:player:4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:player:4.0.3:*:*:*:*:*:*:*;cpe:2.3:a:vmware:player:4.0.4:*:*:*:*:*:*:*;cpe:2.3:a:vmware:player:4.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workstation:8.0.0.18997:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workstation:8.0.1.27038:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workstation:8.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workstation:8.0.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workstation:8.0.3:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workstation:8.0.4:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workstation:8.0:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2012-3579,0.0,,0.40211,CWE-264,"Symantec Messaging Gateway (SMG) before 10.0 has a default password for an unspecified account, which makes it easier for remote attackers to obtain privileged access via an SSH session.",2012-08-29,Metasploit,cpe:2.3:a:symantec:messaging_gateway:*:*:*:*:*:*:*:*;cpe:2.3:a:symantec:messaging_gateway:9.5.1:*:*:*:*:*:*:*;cpe:2.3:a:symantec:messaging_gateway:9.5.2:*:*:*:*:*:*:*;cpe:2.3:a:symantec:messaging_gateway:9.5.3:*:*:*:*:*:*:*;cpe:2.3:a:symantec:messaging_gateway:9.5:*:*:*:*:*:*:*,Symantec,Messaging Gateway
CVE-2012-3752,0.0,,0.36014,CWE-119,Multiple buffer overflows in Apple QuickTime before 7.7.3 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted style element in a QuickTime TeXML file.,2012-11-09,Metasploit,cpe:2.3:a:apple:quicktime:*:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:5.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.4.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.6:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.2.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.3.1.70:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.3.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.5.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.5.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.6:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.7:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.8:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.9:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.7.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.7.1:*:*:*:*:*:*:*,Apple,Quicktime
CVE-2012-3753,0.0,,0.35078,CWE-119,Buffer overflow in the plugin in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MIME type.,2012-11-09,Metasploit,cpe:2.3:a:apple:quicktime:*:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:5.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.4.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.6:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.2.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.3.1.70:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.3.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.5.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.5.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.6:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.7:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.8:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.9:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.7.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.7.1:*:*:*:*:*:*:*,Apple,Quicktime
CVE-2012-3811,0.0,,0.62876,NVD-CWE-Other,Unrestricted file upload vulnerability in ImageUpload.ashx in the Wallboard application in Avaya IP Office Customer Call Reporter 7.0 before 7.0.5.8 Q1 2012 Maintenance Release and 8.0 before 8.0.9.13 Q1 2012 Maintenance Release allows remote attackers to execute arbitrary code by uploading an executable file and then accessing it via a direct request.,2012-07-03,Metasploit,cpe:2.3:a:avaya:ip_office_customer_call_reporter:7.0:*:*:*:*:*:*:*;cpe:2.3:a:avaya:ip_office_customer_call_reporter:8.0:*:*:*:*:*:*:*,Avaya,Ip Office Customer Call Reporter
CVE-2012-3815,0.0,,0.4434,CWE-119,Buffer overflow in RunTime.exe in Sielco Sistemi Winlog Pro SCADA before 2.07.18 and Winlog Lite SCADA before 2.07.18 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 46824.  NOTE: some of these details are obtained from third party information.,2012-06-27,Metasploit,cpe:2.3:a:sielcosistemi:winlog_lite:*:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.00:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.03:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.04:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.06:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.09:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.10:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.12:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.13:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.14:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.18:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.21:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.24:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.25:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.28:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.40:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.46:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.50:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.60:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.73:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.86:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.07.00:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.07.01:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.07.08:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.07.09:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.07.11:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:*:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.00:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.03:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.04:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.06:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.09:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.10:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.12:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.13:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.14:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.18:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.21:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.24:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.25:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.28:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.40:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.46:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.50:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.60:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.73:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.86:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.07.00:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.07.01:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.07.08:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.07.09:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.07.11:*:*:*:*:*:*:*,Sielcosistemi,Winlog Lite
CVE-2012-3951,0.0,,0.51995,CWE-89,"The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default password of admin for the (1) scrutinizer and (2) scrutremote accounts, which allows remote attackers to execute arbitrary SQL commands via a TCP session.",2012-07-31,Metasploit,cpe:2.3:a:sonicwall:scrutinizer:*:*:*:*:*:*:*:*,Sonicwall,Scrutinizer
CVE-2012-3993,0.0,,0.42609,CWE-269,"The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 does not properly interact with failures of InstallTrigger methods, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site, related to an ""XrayWrapper pollution"" issue.",2012-10-10,Metasploit,cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.0:preview_release:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.4.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.5:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:1.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:10.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:10.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:10.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:10.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:10.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:10.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:10.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:10.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:11.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:12.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:12.0:beta6:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:13.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:13.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:14.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:14.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:15.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.15:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.16:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.17:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.18:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.19:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.20:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:2.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.15:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.16:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.17:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.15:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.15:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.16:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.17:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.18:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.19:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.20:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.21:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.22:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.23:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.24:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.25:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:3.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:beta10:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:beta11:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:beta12:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:beta4:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:beta5:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:beta6:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:beta7:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:beta8:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:4.0:beta9:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:5.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:6.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:7.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:8.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:8.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:9.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:9.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:*:beta6:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:alpha_1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:alpha_2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:alpha_3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:beta_1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:beta_2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:rc1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:rc2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.10.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.10:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.10:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.10:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.11:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.11:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.11:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.11:beta4:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.11:beta5:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.11:beta6:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.12.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.12:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.12:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.12:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.12:beta4:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.12:beta5:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.12:beta6:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.13:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.13:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.13:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.13:beta4:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.13:beta5:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.1:alpha1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.1:alpha2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.1:alpha3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.1:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.1:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.1:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.1:rc1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.1:rc2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.2:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.2:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.2:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.3.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.3.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.3:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.3:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.3:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.4.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.4:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.4:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.4:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.5:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.5:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.5:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.5:beta4:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.6.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.6:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.6:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.6:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.6:beta4:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.7.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.7.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.7:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.7:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.7:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.7:beta4:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.7:beta5:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.8:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.8:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.8:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.8:beta4:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.8:beta5:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.8:beta6:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.9.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.9:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.9:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.9:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.9:beta4:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.0.5:beta:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.5:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.7.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:1.7.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:10.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:10.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:10.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:10.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:10.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:11.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:11.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:12.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:12.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:13.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:13.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:14.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:15.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.15:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.16:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.17:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.18:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.19:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.20:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.21:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.22:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.23:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:2.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.15:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.16:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.17:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:3.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:5.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:6.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:7.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:8.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:9.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:9.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird_esr:10.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird_esr:10.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird_esr:10.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird_esr:10.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird_esr:10.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird_esr:10.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird_esr:10.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird_esr:10.0:*:*:*:*:*:*:*,Mozilla,Firefox
CVE-2012-4031,0.0,,0.52267,CWE-22,Multiple directory traversal vulnerabilities in src/acloglogin.php in Wangkongbao CNS-1000 and 1100 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) lang or (2) langid cookie to port 85.,2012-07-17,Metasploit,cpe:2.3:h:wangkongbao:cns-1000:*:*:*:*:*:*:*:*;cpe:2.3:h:wangkongbao:cns-1100:*:*:*:*:*:*:*:*,Wangkongbao,Cns-1000
CVE-2012-4032,0.0,,0.10311,CWE-20,Open redirect vulnerability in the login page in WebsitePanel before 1.2.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in ReturnUrl to Default.aspx.,2012-07-17,Nuclei,cpe:2.3:a:websitepanel:websitepanel:*:*:*:*:*:*:*:*;cpe:2.3:a:websitepanel:websitepanel:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:websitepanel:websitepanel:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:websitepanel:websitepanel:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:websitepanel:websitepanel:1.1.0:*:*:*:*:*:*:*;cpe:2.3:a:websitepanel:websitepanel:1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:websitepanel:websitepanel:1.2.0:*:*:*:*:*:*:*,Websitepanel,Websitepanel
CVE-2012-4177,0.0,,0.5802,CWE-78,The web browser plugin for Ubisoft Uplay PC before 2.0.4 allows remote attackers to execute arbitrary programs via the -orbit_exe_path command line argument.,2012-08-07,Metasploit,cpe:2.3:a:ubi:uplay_pc:*:*:*:*:*:*:*:*;cpe:2.3:a:ubi:uplay_pc:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ubi:uplay_pc:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:ubi:uplay_pc:2.0:*:*:*:*:*:*:*,Ubi,Uplay Pc
CVE-2012-4242,0.0,,0.08857,CWE-79,Cross-site scripting (XSS) vulnerability in the MF Gig Calendar plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the calendar page.,2012-10-01,Nuclei,cpe:2.3:a:mf_gig_calendar_project:mf_gig_calendar:0.9.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*,Mf Gig Calendar Project,Mf Gig Calendar
CVE-2012-4253,0.0,,0.08465,CWE-22,"Multiple directory traversal vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) language parameter to learn/cubemail/install.php or (2) f parameter learn/cubemail/filemanagement.php, or execute arbitrary local files via a .. (dot dot) in the (3) config parameter to learn/cubemail/menu.php.",2012-08-13,Nuclei,cpe:2.3:a:mysqldumper:mysqldumper:1.24.4:*:*:*:*:*:*:*,Mysqldumper,Mysqldumper
CVE-2012-4273,0.0,,0.0578,CWE-79,Cross-site scripting (XSS) vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xing-url parameter.,2012-08-13,Nuclei,cpe:2.3:a:ppfeufer:2-click-social-media-buttons:*:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.10:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.11:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.11:r1:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.11:r2:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.12:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.13:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.14:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.15:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.16:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.17:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.18.1:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.18:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.19.1:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.19:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.1:-:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.20:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.21.1:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.21:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.22:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.23.1:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.23:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.24.1:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.24:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.25:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.26:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.27.1:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.27:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.28:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.29:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.2:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.30:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.31.1:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.31.2:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.31.3:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.32.1:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.32.2:*:*:*:*:*:*:*;cpe:2.3:a:ppfeufer:2-click-social-media-buttons:0.3:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*,Ppfeufer,2-Click-Social-Media-Buttons
CVE-2012-4284,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.69523,NVD-CWE-Other,"A Privilege Escalation vulnerability exists in Viscosity 1.4.1 on Mac OS X due to a path name validation issue in the setuid-set ViscosityHelper binary, which could let a remote malicious user execute arbitrary code",2020-01-10,Metasploit,cpe:2.3:a:sparklabs:viscosity:1.4.1:*:*:*:*:macos:*:*,Sparklabs,Viscosity
CVE-2012-4333,0.0,,0.60447,CWE-119,Multiple stack-based buffer overflows in the BackupToAvi method in the (1) UMS_Ctrl 1.5.1.1 and (2) UMS_Ctrl_STW 2.0.1.0 ActiveX controls in Samsung NET-i viewer 1.37.120316 allow remote attackers to execute arbitrary code via a long string in the fname parameter.  NOTE: some of these details are obtained from third party information.,2012-08-14,Metasploit,cpe:2.3:a:samsung:net-i_viewer:1.37.120316:*:*:*:*:*:*:*,Samsung,Net-I Viewer
CVE-2012-4347,0.0,,0.5883,CWE-22,Multiple directory traversal vulnerabilities in the management console in Symantec Messaging Gateway (SMG) 9.5.x allow remote authenticated users to read arbitrary files via a .. (dot dot) in the (1) logFile parameter in a logs action to brightmail/export or (2) localBackupFileSelection parameter in an APPLIANCE restoreSource action to brightmail/admin/restore/download.do.,2012-12-05,Metasploit,cpe:2.3:a:symantec:messaging_gateway:9.5.1:*:*:*:*:*:*:*;cpe:2.3:a:symantec:messaging_gateway:9.5.2:*:*:*:*:*:*:*;cpe:2.3:a:symantec:messaging_gateway:9.5.3:*:*:*:*:*:*:*;cpe:2.3:a:symantec:messaging_gateway:9.5.4:*:*:*:*:*:*:*;cpe:2.3:a:symantec:messaging_gateway:9.5:*:*:*:*:*:*:*,Symantec,Messaging Gateway
CVE-2012-4356,0.0,,0.27488,CWE-22,"Multiple directory traversal vulnerabilities in Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 allow remote attackers to read arbitrary files via port-46824 TCP packets specifying a file-open operation with opcode 0x78 and a .. (dot dot) in a pathname, followed by a file-read operation with opcode (1) 0x96, (2) 0x97, or (3) 0x98.",2012-08-19,Metasploit,cpe:2.3:a:sielcosistemi:winlog_lite:*:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.00:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.03:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.04:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.06:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.09:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.10:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.12:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.13:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.14:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.18:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.21:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.24:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.25:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.28:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.40:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.46:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.50:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.60:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.73:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.06.86:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.07.00:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.07.01:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.07.08:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.07.09:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.07.11:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_lite:2.07.14:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:*:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.00:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.03:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.04:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.06:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.09:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.10:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.12:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.13:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.14:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.18:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.21:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.24:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.25:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.28:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.40:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.46:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.50:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.60:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.73:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.06.86:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.07.00:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.07.01:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.07.08:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.07.09:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.07.11:*:*:*:*:*:*:*;cpe:2.3:a:sielcosistemi:winlog_pro:2.07.14:*:*:*:*:*:*:*,Sielcosistemi,Winlog Pro
CVE-2012-4361,0.0,,0.47799,CWE-78,lhn/public/network/ping in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the second parameter.,2012-08-20,Metasploit,cpe:2.3:a:hp:san\/iq:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:san\/iq:8.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:san\/iq:8.1:*:*:*:*:*:*:*;cpe:2.3:a:hp:san\/iq:8.5:*:*:*:*:*:*:*;cpe:2.3:h:hp:virtual_san_appliance:-:*:*:*:*:*:*:*,Hp,Virtual San Appliance
CVE-2012-4547,0.0,,0.05796,CWE-79,Unspecified vulnerability in awredir.pl in AWStats before 7.1 has unknown impact and attack vectors.,2012-10-31,Nuclei,cpe:2.3:a:laurent_destailleur:awstats:*:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:1.0:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:2.1:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:2.23:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:2.24:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:3.0:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:3.1:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:3.2:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:4.0:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:4.1:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:5.0:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:5.1:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:5.2:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:5.3:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:5.4:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:5.5:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:5.6:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:5.7:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:5.8:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:5.9:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:6.0:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:6.1:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:6.2:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:6.3:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:6.4:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:6.5:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:6.6:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:6.7:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:6.8:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:6.95:*:*:*:*:*:*:*;cpe:2.3:a:laurent_destailleur:awstats:6.9:*:*:*:*:*:*:*,Laurent Destailleur,Awstats
CVE-2012-4554,0.0,,0.15812,CWE-264,The OpenID module in Drupal 7.x before 7.16 allows remote OpenID servers to read arbitrary files via a crafted DOCTYPE declaration in an XRDS file.,2012-11-11,Metasploit,cpe:2.3:a:drupal:drupal:7.0:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:alpha1:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:alpha2:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:alpha3:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:alpha4:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:alpha5:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:alpha6:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:alpha7:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:beta1:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:beta2:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:beta3:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:dev:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:rc1:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:rc2:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:rc3:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:rc4:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.10:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.11:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.12:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.13:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.14:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.15:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.1:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.2:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.3:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.4:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.5:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.6:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.7:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.8:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.9:*:*:*:*:*:*:*,Drupal,Drupal
CVE-2012-4598,0.0,,0.29384,NVD-CWE-noinfo,"An unspecified ActiveX control in McAfee Virtual Technician (MVT) before 6.4, and ePO-MVT, allows remote attackers to execute arbitrary code or cause a denial of service (Internet Explorer crash) via a crafted web site.",2012-08-22,Metasploit,cpe:2.3:a:mcafee:epo_mcafee_virtual_technician:*:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:epo_mcafee_virtual_technician:1.0.4.0:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:epo_mcafee_virtual_technician:1.0:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:mcafee_virtual_technician:*:*:*:*:*:*:*:*,Mcafee,Mcafee Virtual Technician
CVE-2012-4681,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98536,NVD-CWE-Other,"Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using ""reflection with a trusted immediate caller"" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.",2012-08-28,CISA/EPSS/Metasploit,cpe:2.3:a:oracle:jdk:1.6.0:-:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update10:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update11:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update12:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update13:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update14:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update15:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update16:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update17:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update18:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update19:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update20:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update21:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update22:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update23:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update24:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update25:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update26:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update27:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update29:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update30:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update31:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update32:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update33:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update34:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update4:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update5:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update6:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update7:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update8:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update9:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:-:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update5:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update6:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:-:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update10:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update11:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update12:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update13:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update14:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update15:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update16:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update17:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update18:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update19:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update20:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update21:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update22:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update23:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update24:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update25:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update26:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update27:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update29:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update30:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update31:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update32:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update33:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update34:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update4:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update5:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update6:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update7:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update9:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:-:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*,Redhat,Enterprise Linux Desktop
CVE-2012-4705,0.0,,0.65668,CWE-22,Directory traversal vulnerability in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via vectors involving a crafted pathname.,2013-02-24,Metasploit,cpe:2.3:a:3s-software:codesys_gateway-server:*:*:*:*:*:*:*:*;cpe:2.3:a:3s-software:codesys_gateway-server:2.3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:3s-software:codesys_gateway-server:2.3.5.2:*:*:*:*:*:*:*;cpe:2.3:a:3s-software:codesys_gateway-server:2.3.5.3:*:*:*:*:*:*:*;cpe:2.3:a:3s-software:codesys_gateway-server:2.3.6.0:*:*:*:*:*:*:*;cpe:2.3:a:3s-software:codesys_gateway-server:2.3.7.0:*:*:*:*:*:*:*;cpe:2.3:a:3s-software:codesys_gateway-server:2.3.8.0:*:*:*:*:*:*:*;cpe:2.3:a:3s-software:codesys_gateway-server:2.3.8.1:*:*:*:*:*:*:*;cpe:2.3:a:3s-software:codesys_gateway-server:2.3.8.2:*:*:*:*:*:*:*;cpe:2.3:a:3s-software:codesys_gateway-server:2.3.9.18:*:*:*:*:*:*:*;cpe:2.3:a:3s-software:codesys_gateway-server:2.3.9.19:*:*:*:*:*:*:*;cpe:2.3:a:3s-software:codesys_gateway-server:2.3.9.1:*:*:*:*:*:*:*;cpe:2.3:a:3s-software:codesys_gateway-server:2.3.9.2:*:*:*:*:*:*:*;cpe:2.3:a:3s-software:codesys_gateway-server:2.3.9.3:*:*:*:*:*:*:*;cpe:2.3:a:3s-software:codesys_gateway-server:2.3.9.4:*:*:*:*:*:*:*;cpe:2.3:a:3s-software:codesys_gateway-server:2.3.9.5:*:*:*:*:*:*:*;cpe:2.3:a:3s-software:codesys_gateway-server:2.3.9:*:*:*:*:*:*:*,3S-Software,Codesys Gateway-Server
CVE-2012-4711,0.0,,0.61492,CWE-119,"Buffer overflow in kingMess.exe 65.20.2003.10300 in WellinTech KingView 6.52, kingMess.exe 65.20.2003.10400 in KingView 6.53, and kingMess.exe 65.50.2011.18049 in KingView 6.55 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted packet.",2013-02-15,Metasploit,cpe:2.3:a:wellintech:kingview:6.52:*:*:*:*:*:*:*;cpe:2.3:a:wellintech:kingview:6.53:*:*:*:*:*:*:*;cpe:2.3:a:wellintech:kingview:6.55:*:*:*:*:*:*:*,Wellintech,Kingview
CVE-2012-4768,0.0,,0.10456,CWE-79,Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI.,2014-09-04,Nuclei,cpe:2.3:a:mikejolley:download_monitor:3.3.5.7:*:*:*:*:wordpress:*:*,Mikejolley,Download Monitor
CVE-2012-4792,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.78823,CWE-416,"Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and exploited in the wild in December 2012.",2012-12-30,CISA/Metasploit,cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:r2:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:-:r2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows Server 2003
CVE-2012-4869,0.0,,0.70252,CWE-94,"The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary commands via the callmenum parameter in a c action.",2012-09-06,Metasploit,cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*;cpe:2.3:a:sangoma:freepbx:2.9:*:*:*:*:*:*:*,Sangoma,Freepbx
CVE-2012-4876,0.0,,0.71177,CWE-119,Stack-based buffer overflow in the UltraMJCam ActiveX Control in TRENDnet SecurView TV-IP121WN Wireless Internet Camera allows remote attackers to execute arbitrary code via a long string to the OpenFileDlg method.,2012-09-06,Metasploit,cpe:2.3:a:trendnet:securview_wireless_internet_camera_activex_control:1.1.52.18:*:*:*:*:*:*:*;cpe:2.3:h:trendnet:securview_wireless_internet_camera:tv-ip121wn:*:*:*:*:*:*:*,Trendnet,Securview Wireless Internet Camera
CVE-2012-4878,0.0,,0.08761,CWE-22,Absolute path traversal vulnerability in controlcenter.php in FlatnuX CMS 2011 08.09.2 allows remote administrators to read arbitrary files via a full pathname in the dir parameter in a contents/Files action.,2012-09-06,Nuclei,cpe:2.3:a:flatnux:flatnux:2011-08-09-2:*:*:*:*:*:*:*,Flatnux,Flatnux
CVE-2012-4889,0.0,,0.07718,CWE-79,"Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Firewall Analyzer 7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) subTab or (2) tab parameter to createAnomaly.do; (3) url, (4) subTab, or (5) tab parameter to mindex.do; (6) tab parameter to index2.do; or (7) port parameter to syslogViewer.do.",2012-09-10,Nuclei,cpe:2.3:a:manageengine:firewall_analyzer:7.2:*:*:*:*:*:*:*,Manageengine,Firewall Analyzer
CVE-2012-4914,0.0,,0.28391,CWE-119,Stack-based buffer overflow in the reader in CoolPDF 3.0.2.256 allows remote attackers to execute arbitrary code via a PDF document with a crafted stream.,2013-01-26,Metasploit,cpe:2.3:a:coolpdf:coolpdf:3.0.2.256:*:*:*:*:*:*:*,Coolpdf,Coolpdf
CVE-2012-4915,0.0,,0.50017,CWE-22,Directory traversal vulnerability in the Google Doc Embedder plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to libs/pdf.php.,2014-05-29,Metasploit,cpe:2.3:a:davistribe:google_doc_embedder:*:*:*:*:*:*:*:*;cpe:2.3:a:davistribe:google_doc_embedder:2.0:*:*:*:*:*:*:*;cpe:2.3:a:davistribe:google_doc_embedder:2.1:*:*:*:*:*:*:*;cpe:2.3:a:davistribe:google_doc_embedder:2.2.1:*:*:*:*:*:*:*;cpe:2.3:a:davistribe:google_doc_embedder:2.2.2:*:*:*:*:*:*:*;cpe:2.3:a:davistribe:google_doc_embedder:2.2.3:*:*:*:*:*:*:*;cpe:2.3:a:davistribe:google_doc_embedder:2.2:*:*:*:*:*:*:*;cpe:2.3:a:davistribe:google_doc_embedder:2.3:*:*:*:*:*:*:*;cpe:2.3:a:davistribe:google_doc_embedder:2.4.1:*:*:*:*:*:*:*;cpe:2.3:a:davistribe:google_doc_embedder:2.4.2:*:*:*:*:*:*:*;cpe:2.3:a:davistribe:google_doc_embedder:2.4.3:*:*:*:*:*:*:*;cpe:2.3:a:davistribe:google_doc_embedder:2.4.4:*:*:*:*:*:*:*;cpe:2.3:a:davistribe:google_doc_embedder:2.4.5:*:*:*:*:*:*:*;cpe:2.3:a:davistribe:google_doc_embedder:2.4.6:*:*:*:*:*:*:*;cpe:2.3:a:davistribe:google_doc_embedder:2.4:*:*:*:*:*:*:*;cpe:2.3:a:davistribe:google_doc_embedder:2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:davistribe:google_doc_embedder:2.5.2:*:*:*:*:*:*:*;cpe:2.3:a:davistribe:google_doc_embedder:2.5:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*,Davistribe,Google Doc Embedder
CVE-2012-4924,0.0,,0.36345,CWE-119,Buffer overflow in the CxDbgPrint function in the ipswcom.dll ActiveX component 1.0.0.1 for ASUS Net4Switch 1.0.0020 allows remote attackers to execute arbitrary code via a long parameter to the Alert method.,2012-09-15,Metasploit,cpe:2.3:a:asus:ipswcom_activex_component:1.0.0.1:*:*:*:*:*:*:*;cpe:2.3:a:asus:net4switch:1.0.0020:*:*:*:*:*:*:*,Asus,Ipswcom Activex Component
CVE-2012-4933,0.0,,0.44012,CWE-255,"The rtrlet web application in the Web Console in Novell ZENworks Asset Management (ZAM) 7.5 uses a hard-coded username of Ivanhoe and a hard-coded password of Scott for the (1) GetFile_Password and (2) GetConfigInfo_Password operations, which allows remote attackers to obtain sensitive information via a crafted rtrlet/rtr request for the HandleMaintenanceCalls function.",2012-10-20,Metasploit,cpe:2.3:a:novell:zenworks_asset_management:7.5:*:*:*:*:*:*:*,Novell,Zenworks Asset Management
CVE-2012-4940,0.0,,0.83632,CWE-22,"Multiple directory traversal vulnerabilities in the View Log Files component in Axigen Free Mail Server allow remote attackers to read or delete arbitrary files via a .. (dot dot) in (1) the fileName parameter in a download action to source/loggin/page_log_dwn_file.hsp, or the fileName parameter in (2) an edit action or (3) a delete action to the default URI.",2012-10-31,Metasploit/Nuclei,cpe:2.3:a:gecad:axigen_free_mail_server:-:*:*:*:*:*:*:*,Gecad,Axigen Free Mail Server
CVE-2012-4956,0.0,,0.3772,CWE-119,Heap-based buffer overflow in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to execute arbitrary code via a large number of VOL elements in an SRS record.,2012-11-18,Metasploit,cpe:2.3:a:novell:file_reporter:1.0.2:*:*:*:*:*:*:*,Novell,File Reporter
CVE-2012-4957,0.0,,0.6762,CWE-22,Absolute path traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbitrary files via a /FSF/CMD request with a full pathname in a PATH element of an SRS record.,2012-11-18,Metasploit,cpe:2.3:a:novell:file_reporter:1.0.2:*:*:*:*:*:*:*,Novell,File Reporter
CVE-2012-4958,0.0,,0.73514,CWE-22,Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbitrary files via a 126 /FSF/CMD request with a .. (dot dot) in a FILE element of an FSFUI record.,2012-11-18,Metasploit,cpe:2.3:a:novell:file_reporter:1.0.2:*:*:*:*:*:*:*,Novell,File Reporter
CVE-2012-4959,0.0,,0.71194,CWE-22,Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to upload and execute files via a 130 /FSF/CMD request with a .. (dot dot) in a FILE element of an FSFUI record.,2012-11-18,Metasploit,cpe:2.3:a:novell:file_reporter:1.0.2:*:*:*:*:*:*:*,Novell,File Reporter
CVE-2012-4969,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.81716,CWE-416,"Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in September 2012.",2012-09-18,CISA/Metasploit,cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:-:*;cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_7:-:-:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows Server 2003
CVE-2012-4982,0.0,,0.08907,CWE-20,Open redirect vulnerability in assets/login on the Forescout CounterACT NAC device before 7.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the a parameter.,2012-12-05,Nuclei,cpe:2.3:a:forescout:counteract:6.3.4.10:*:*:*:*:*:*:*,Forescout,Counteract
CVE-2012-5002,0.0,,0.31157,CWE-119,"Stack-based buffer overflow in SR10 FTP server (SR10.exe) 1.1.0.6 in Ricoh DC Software DL-10 4.5.0.1, when the Log file name option is enabled, allows remote attackers to execute arbitrary code via a long USER FTP command.",2012-09-19,Metasploit,cpe:2.3:a:ricoh:dl-10:4.5.0.1:*:*:*:*:*:*:*;cpe:2.3:h:ricoh:sr10_ftp_server:1.1.0.6:*:*:*:*:*:*:*,Ricoh,Sr10 Ftp Server
CVE-2012-5054,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.21194,CWE-190,Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments.,2012-09-24,CISA,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*,Adobe,Flash Player
CVE-2012-5076,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.91013,NVD-CWE-Other,"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JAX-WS.",2012-10-16,CISA/Metasploit,cpe:2.3:a:oracle:jre:1.7.0:-:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update7:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*,Suse,Linux Enterprise Desktop
CVE-2012-5081,0.0,,0.45113,NVD-CWE-noinfo,"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect availability, related to JSSE.",2012-10-16,Metasploit,cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:*:update35:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:*:update36:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:*:update7:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update22:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update23:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update24:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update25:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update26:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update27:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update29:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update30:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update31:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update32:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update33:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update34:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update5:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update6:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:*:update35:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:*:update36:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:*:update7:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update22:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update23:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update24:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update25:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update26:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update27:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update29:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update30:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update31:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update32:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update33:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update34:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_10:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_11:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_12:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_13:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_14:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_15:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_16:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_17:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_18:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_19:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_1:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_22:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_23:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_25:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_26:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_27:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_28:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_29:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_2:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_30:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_31:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_32:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_33:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_34:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_35:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_36:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_37:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_3:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_4:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_5:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_6:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_7:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_8:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.4.2_9:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update10:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update11:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update11_b03:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update12:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update13:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update14:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update15:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update16:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update17:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update18:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update19:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update1:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update20:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update21:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update22:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update23:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update24:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update25:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update26:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update27:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update28:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update29:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update31:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update33:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update3:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update4:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update5:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update6:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update7:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update7_b03:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update8:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update9:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0.200:update20:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0.210:update21:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update1:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update1_b06:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_19:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_10:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_11:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_12:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_13:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_14:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_15:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_16:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_17:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_18:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_19:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_1:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_20:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_21:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_22:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_23:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_24:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_25:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_26:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_27:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_28:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_29:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_2:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_30:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_31:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_32:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_33:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_34:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_35:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_36:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_37:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_3:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_4:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_5:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_6:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_7:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_8:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.4.2_9:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update10:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update17:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update18:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update19:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update20:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update21:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update22:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update23:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update24:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update25:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update26:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update27:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update28:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update29:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update31:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update33:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update7:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update8:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update9:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_19:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_20:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_21:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*,Oracle,Jdk
CVE-2012-5088,0.0,,0.78696,NVD-CWE-noinfo,"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.",2012-10-16,Metasploit,cpe:2.3:a:oracle:jdk:*:update7:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update5:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update6:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:*:update7:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*,Oracle,Jre
CVE-2012-5159,0.0,,0.74515,CWE-94,"phpMyAdmin 3.5.2.2, as distributed by the cdnetworks-kr-1 mirror during an unspecified time frame in 2012, contains an externally introduced modification (Trojan Horse) in server_sync.php, which allows remote attackers to execute arbitrary PHP code via an eval injection attack.",2012-09-25,Metasploit,cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.2:*:*:*:*:*:*:*,Phpmyadmin,Phpmyadmin
CVE-2012-5192,0.0,,0.52477,CWE-22,"Directory traversal vulnerability in gmap/view_overlay.php in Bitweaver 2.8.1 and earlier allows remote attackers to read arbitrary files via ""''%2F"" (dot dot encoded slash) sequences in the overlay_type parameter.",2014-01-28,Metasploit,cpe:2.3:a:bitweaver:bitweaver:*:*:*:*:*:*:*:*;cpe:2.3:a:bitweaver:bitweaver:1.1.1_beta:*:*:*:*:*:*:*;cpe:2.3:a:bitweaver:bitweaver:1.1:*:*:*:*:*:*:*;cpe:2.3:a:bitweaver:bitweaver:1.2.1:*:*:*:*:*:*:*;cpe:2.3:a:bitweaver:bitweaver:1.3.1:*:*:*:*:*:*:*;cpe:2.3:a:bitweaver:bitweaver:1.3:*:*:*:*:*:*:*;cpe:2.3:a:bitweaver:bitweaver:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:bitweaver:bitweaver:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:bitweaver:bitweaver:2.5:*:*:*:*:*:*:*;cpe:2.3:a:bitweaver:bitweaver:2.6:*:*:*:*:*:*:*;cpe:2.3:a:bitweaver:bitweaver:2.7:*:*:*:*:*:*:*,Bitweaver,Bitweaver
CVE-2012-5201,0.0,,0.63744,NVD-CWE-noinfo,"Unspecified vulnerability in HP Intelligent Management Center (iMC) and Intelligent Management Center for Automated Network Manager (ANM) before 5.2 E0401 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1611.",2013-03-09,Metasploit,cpe:2.3:a:hp:intelligent_management_center:*:e0202:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:*:e0202:enterprise:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101h03:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101h04:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101l01:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101l02:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.1:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.1:e0101p01:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center_for_automated_network_manager:*:e0202:*:*:*:*:*:*,Hp,Intelligent Management Center
CVE-2012-5202,0.0,,0.21014,NVD-CWE-noinfo,"Unspecified vulnerability in HP Intelligent Management Center (iMC) and Intelligent Management Center for Automated Network Manager (ANM) before 5.2 E0401 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown vectors, aka ZDI-CAN-1612.",2013-03-09,Metasploit,cpe:2.3:a:hp:intelligent_management_center:*:e0202:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:*:e0202:enterprise:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101h03:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101h04:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101l01:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101l02:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.1:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.1:e0101p01:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center_for_automated_network_manager:*:e0202:*:*:*:*:*:*,Hp,Intelligent Management Center
CVE-2012-5203,0.0,,0.21014,NVD-CWE-noinfo,"Unspecified vulnerability in HP Intelligent Management Center (iMC) and Intelligent Management Center for Automated Network Manager (ANM) before 5.2 E0401 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown vectors, aka ZDI-CAN-1613.",2013-03-09,Metasploit,cpe:2.3:a:hp:intelligent_management_center:*:e0202:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:*:e0202:enterprise:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101h03:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101h04:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101l01:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101l02:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.1:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.1:e0101p01:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center_for_automated_network_manager:*:e0202:*:*:*:*:*:*,Hp,Intelligent Management Center For Automated Network Manager
CVE-2012-5204,0.0,,0.18464,NVD-CWE-noinfo,"Unspecified vulnerability in HP Intelligent Management Center (iMC) and Intelligent Management Center for Automated Network Manager (ANM) before 5.2 E0401 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown vectors, aka ZDI-CAN-1614.",2013-03-09,Metasploit,cpe:2.3:a:hp:intelligent_management_center:*:e0202:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:*:e0202:enterprise:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101h03:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101h04:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101l01:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101l02:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.1:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.1:e0101p01:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center_for_automated_network_manager:*:e0202:*:*:*:*:*:*,Hp,Intelligent Management Center
CVE-2012-5223,0.0,,0.40533,CWE-94,"The proc_deutf function in includes/functions_vbseocp_abstract.php in vBSEO 3.5.0, 3.5.1, 3.5.2, 3.6.0, and earlier allows remote attackers to insert and execute arbitrary PHP code via ""complex curly syntax"" in the char_repl parameter, which is inserted into a regular expression that is processed by the preg_replace function with the eval switch.",2012-10-01,Metasploit,cpe:2.3:a:crawlability:vbseo:*:*:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:2.1.0:*:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:2.3.0:*:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:2.4.0:*:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:2.4.5:*:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.0.0:rc2:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.0.0:rc3:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.0.0:rc4:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.0.0:rc5:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.0.0:rc6:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.2.0:rc4:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.2.0:rc5:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.2.0:rc7:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.2.0:rc8:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.3.0:*:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.3.0:rc1:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.3.0:rc2:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.5.0:*:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.5.0:beta1:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.5.0:beta2:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.5.0:rc1:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.5.0:rc2:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.5.0:rc3:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.5.2:*:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.6.0:beta1:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.6.0:rc1:*:*:*:*:*:*;cpe:2.3:a:crawlability:vbseo:3.6.0:rc2:*:*:*:*:*:*,Crawlability,Vbseo
CVE-2012-5321,0.0,,0.1375,CWE-20,"tiki-featured_link.php in TikiWiki CMS/Groupware 8.3 allows remote attackers to load arbitrary web site pages into frames and conduct phishing attacks via the url parameter, aka ""frame injection.""",2012-10-08,Nuclei,cpe:2.3:a:tiki:tikiwiki_cms\/groupware:8.3:*:*:*:*:*:*:*,Tiki,Tikiwiki Cms/Groupware
CVE-2012-5357,0.0,,0.67776,CWE-19,"Ektron Content Management System (CMS) before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges via crafted XSL data.",2017-10-30,Metasploit,cpe:2.3:a:ektron:ektron_content_management_system:*:sp4:*:*:*:*:*:*,Ektron,Ektron Content Management System
CVE-2012-5519,0.0,,0.02128,CWE-264,"CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.",2012-11-20,Metasploit,cpe:2.3:a:apple:cups:1.4.4:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2012-5525,0.0,,0.016,NVD-CWE-noinfo,The get_page_from_gfn hypercall function in Xen 4.2 allows local PV guest OS administrators to cause a denial of service (crash) via a crafted GFN that triggers a buffer over-read.,2012-12-13,Metasploit,cpe:2.3:o:xen:xen:4.2.0:*:*:*:*:*:*:*,Xen,Xen
CVE-2012-5613,0.0,,0.31664,CWE-16,"MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging the FILE privilege to create files as the MySQL administrator. NOTE: the vendor disputes this issue, stating that this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation. NOTE: it could be argued that this should not be included in CVE because it is a configuration issue.",2012-12-03,Metasploit,cpe:2.3:a:mariadb:mariadb:5.5.28a:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql:5.5.19:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2012-5687,0.0,,0.68716,CWE-22,Directory traversal vulnerability in the web-based management feature on the TP-LINK TL-WR841N router with firmware 3.13.9 build 120201 Rel.54965n and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to the help/ URI.,2012-11-01,Metasploit,cpe:2.3:h:tp-link:tl-wr841n:-:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:tl-wr841n_firmware:*:*:*:*:*:*:*:*,TP-Link,Tl-Wr841N Firmware
CVE-2012-5691,0.0,,0.52703,CWE-119,Buffer overflow in RealNetworks RealPlayer before 16.0.0.282 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to execute arbitrary code via a crafted RealMedia file.,2012-12-19,Metasploit,cpe:2.3:a:realnetworks:realplayer:*:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:10.5:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.0.2.1744:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.0.2.2315:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.1.3:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11_build_6.0.14.748:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:12.0.0.1444:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:12.0.0.1548:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:14.0.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:14.0.1.609:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:14.0.1:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:14.0.2:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:14.0.3:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:14.0.4:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:14.0.5:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:15.0.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:15.0.4.43:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:15.0.4:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:15.0.5.109:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:15.0.6.14:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:15.02.71:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:4:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:5:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:6:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:7:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:8:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.1.3:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.1.4:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.1.5:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer_sp:1.1:*:*:*:*:*:*:*,Realnetworks,Realplayer
CVE-2012-5692,0.0,,0.26049,NVD-CWE-noinfo,Unspecified vulnerability in admin/sources/base/core.php in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has unknown impact and remote attack vectors.,2012-10-31,Metasploit,cpe:2.3:a:invisioncommunity:invision_power_board:3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:invisioncommunity:invision_power_board:3.3.0:*:*:*:*:*:*:*;cpe:2.3:a:invisionpower:invision_power_board:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:invisionpower:invision_power_board:3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:invisionpower:invision_power_board:3.1.3:*:*:*:*:*:*:*;cpe:2.3:a:invisionpower:invision_power_board:3.1.4:*:*:*:*:*:*:*;cpe:2.3:a:invisionpower:invision_power_board:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:invisionpower:invision_power_board:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:invisionpower:invision_power_board:3.2.2:*:*:*:*:*:*:*,Invisioncommunity,Invision Power Board
CVE-2012-5896,0.0,,0.69387,NVD-CWE-Other,"The Annotation Objects Extension ActiveX control in AnnotateX.dll in Quest InTrust 10.4.0.853 and earlier does not properly implement the Add method, which allows remote attackers to execute arbitrary code via a memory address in the first argument, related to an ""uninitialized pointer.""",2012-11-17,Metasploit,cpe:2.3:a:quest:intrust:*:*:*:*:*:*:*:*;cpe:2.3:a:quest:intrust:10.1:*:*:*:*:*:*:*;cpe:2.3:a:quest:intrust:10.2.5:*:*:*:*:*:*:*;cpe:2.3:a:quest:intrust:10.3:*:*:*:*:*:*:*;cpe:2.3:a:quest:intrust:10.4:*:*:*:*:*:*:*,Quest,Intrust
CVE-2012-5913,0.0,,0.08693,CWE-79,Cross-site scripting (XSS) vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter to wp-login.php.,2012-11-17,Nuclei,cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*;cpe:2.3:a:wordpress_integrator_project:wordpress_integrator:1.32:*:*:*:*:*:*:*,Wordpress Integrator Project,Wordpress Integrator
CVE-2012-5932,0.0,,0.6275,CWE-94,Eval injection vulnerability in the ldapagnt_eval function in ldapagnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote attackers to execute arbitrary Perl code via a crafted application/x-amf request.,2012-12-24,Metasploit,cpe:2.3:a:microfocus:privileged_user_manager:2.3.0:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:privileged_user_manager:2.3.1:*:*:*:*:*:*:*,Microfocus,Privileged User Manager
CVE-2012-5946,0.0,,0.33782,CWE-119,Buffer overflow in the c1sizer ActiveX control in C1sizer.ocx in IBM SPSS SamplePower 3.0 before FP1 allows remote attackers to execute arbitrary code via a long TabCaption string.,2013-04-30,Metasploit,cpe:2.3:a:ibm:spss_samplepower:3.0.0.0:*:*:*:*:*:*:*,Ibm,Spss Samplepower
CVE-2012-5958,0.0,,0.82807,CWE-119,"Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) before 1.6.18 allows remote attackers to execute arbitrary code via a UDP packet with a crafted string that is not properly handled after a certain pointer subtraction.",2013-01-31,Metasploit,cpe:2.3:a:libupnp_project:libupnp:*:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.4.1:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.4.2:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.4.3:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.4.4:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.4.5:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.4.6:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.4.7:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.6.10:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.6.11:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.6.12:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.6.13:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.6.14:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.6.15:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.6.16:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.6.1:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.6.2:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.6.3:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.6.4:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.6.5:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.6.6:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.6.7:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.6.8:*:*:*:*:*:*:*;cpe:2.3:a:libupnp_project:libupnp:1.6.9:*:*:*:*:*:*:*,Libupnp Project,Libupnp
CVE-2012-5959,0.0,,0.75796,CWE-119,"Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) before 1.6.18 allows remote attackers to execute arbitrary code via a long UDN (aka uuid) field within a string that contains a :: (colon colon) in a UDP packet.",2013-01-31,Metasploit,cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:*:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.4.1:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.4.2:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.4.3:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.4.4:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.4.5:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.4.6:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.4.7:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.10:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.11:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.12:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.13:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.14:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.15:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.16:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.1:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.2:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.3:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.4:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.5:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.6:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.7:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.8:*:*:*:*:*:*:*;cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.9:*:*:*:*:*:*:*,Portable Sdk For Upnp Project,Portable Sdk For Upnp
CVE-2012-5975,0.0,,0.35874,CWE-287,"The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6.2.5, and 6.3.0 through 6.3.2 on UNIX and Linux, when old-style password authentication is enabled, allows remote attackers to bypass authentication via a crafted session involving entry of blank passwords, as demonstrated by a root login session from a modified OpenSSH client with an added input_userauth_passwd_changereq call in sshconnect2.c.",2012-12-04,Metasploit,cpe:2.3:a:ssh:tectia_server:6.0.10:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.0.11:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.0.12:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.0.13:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.0.14:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.0.17:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.0.18:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.0.19:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.0.20.:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.0.4:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.0.5:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.0.6:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.0.7:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.0.8:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.0.9:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.1.12:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.1.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.1.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.1.4:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.1.5:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.1.6:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.1.7:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.1.8:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.1.9:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.2.2:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.2.3:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.2.4:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.2.5:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.3.0:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.3.1:*:*:*:*:*:*:*;cpe:2.3:a:ssh:tectia_server:6.3.2:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2012-6066,0.0,,0.39513,CWE-287,"freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demonstrated by an OpenSSH client with modified versions of ssh.c and sshconnect2.c.",2012-12-04,Metasploit,cpe:2.3:a:freesshd:freesshd:*:*:*:*:*:*:*:*;cpe:2.3:a:freesshd:freesshd:1.2.1:*:*:*:*:*:*:*;cpe:2.3:a:freesshd:freesshd:1.2.2:*:*:*:*:*:*:*,Freesshd,Freesshd
CVE-2012-6081,0.0,,0.30566,NVD-CWE-Other,"Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as exploited in the wild in July 2012.",2013-01-03,Metasploit,cpe:2.3:a:moinmo:moinmoin:*:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:0.10:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:0.11:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:0.1:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:0.2:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:0.3:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:0.4:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:0.5:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:0.6:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:0.7:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:0.8:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:0.9:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.0:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.1:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.2.1:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.2.2:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.2.3:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.2.4:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.2:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.3.1:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.3.2:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.3.3:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.3.4:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.3.5:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.3.5:rc1:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.4:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.5.0:beta1:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.5.0:beta2:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.5.0:beta3:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.5.0:beta4:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.5.0:beta5:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.5.0:beta6:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.5.0:rc1:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.5.1:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.5.2:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.5.3:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.5.3:rc1:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.5.3:rc2:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.5.4:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.5.5:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.5.5:a:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.5.5:rc1:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.5.5a:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.5.6:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.5.7:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.5.8:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.6.0:beta1:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.6.0:beta2:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.6.0:rc1:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.6.0:rc2:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.6.1:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.6.2:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.6.3:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.6.4:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.7.0:beta1:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.7.0:beta2:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.7.0:rc1:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.7.0:rc2:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.7.0:rc3:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.7.1:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.7.2:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.7.3:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.8.0:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.8.1:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.8.2:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.8.3:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.8.4:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.8.6:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.8.7:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.8.8:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.9.1:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.9.2:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.9.3:*:*:*:*:*:*:*;cpe:2.3:a:moinmo:moinmoin:1.9.4:*:*:*:*:*:*:*,Moinmo,Moinmoin
CVE-2012-6096,0.0,,0.6645,CWE-119,"Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2, 1.7.x before 1.7.4, and 1.8.x before 1.8.4, might allow remote attackers to execute arbitrary code via a long (1) host_name variable (host parameter) or (2) svc_description variable.",2013-01-22,Metasploit,cpe:2.3:a:icinga:icinga:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:icinga:icinga:1.6.1:*:*:*:*:*:*:*;cpe:2.3:a:icinga:icinga:1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:icinga:icinga:1.7.1:*:*:*:*:*:*:*;cpe:2.3:a:icinga:icinga:1.7.2:*:*:*:*:*:*:*;cpe:2.3:a:icinga:icinga:1.7.3:*:*:*:*:*:*:*;cpe:2.3:a:icinga:icinga:1.8.0:*:*:*:*:*:*:*;cpe:2.3:a:icinga:icinga:1.8.1:*:*:*:*:*:*:*;cpe:2.3:a:icinga:icinga:1.8.2:*:*:*:*:*:*:*;cpe:2.3:a:icinga:icinga:1.8.3:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:*:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0.4:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0.5:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0.6:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:alpha1:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:alpha2:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:alpha3:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:alpha4:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:alpha5:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:beta1:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:beta2:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:beta3:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:beta4:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:beta5:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:beta6:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:beta7:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:rc1:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:rc2:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.0:rc3:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.2.2:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.2.3:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.4.0:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.4.1:*:*:*:*:*:*:*;cpe:2.3:a:nagios:nagios:3.4.2:*:*:*:*:*:*:*,Nagios,Nagios
CVE-2012-6274,0.0,,0.46868,CWE-287,"BigAntSoft BigAnt IM Message Server does not require authentication for file uploading, which allows remote attackers to create arbitrary files under AntServer\DocData\Public via unspecified vectors.",2013-02-24,Metasploit,cpe:2.3:a:bigantsoft:bigant_im_message_server:-:*:*:*:*:*:*:*,Bigantsoft,Bigant Im Message Server
CVE-2012-6275,0.0,,0.46498,CWE-119,Multiple stack-based buffer overflows in AntDS.exe in BigAntSoft BigAnt IM Message Server allow remote attackers to have an unspecified impact via (1) the filename header in an SCH request or (2) the userid component in a DUPF request.,2013-02-24,Metasploit,cpe:2.3:a:bigantsoft:bigant_im_message_server:-:*:*:*:*:*:*:*,Bigantsoft,Bigant Im Message Server
CVE-2012-6301,0.0,,0.06448,CWE-20,The Browser application in Android 4.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted market: URI in the SRC attribute of an IFRAME element.,2012-12-10,Metasploit,cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*,Google,Android
CVE-2012-6329,0.0,,0.62202,CWE-94,"The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket notation, which allows context-dependent attackers to execute arbitrary commands via crafted input to an application that accepts translation strings from users, as demonstrated by the TWiki application before 5.1.3, and the Foswiki application 1.0.x through 1.0.10 and 1.1.x through 1.1.6.",2013-01-04,Metasploit,cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.10.0:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.10.0:rc1:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.10.0:rc2:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.10.1:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.10.1:rc1:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.10.1:rc2:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.10:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.11.0:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.11.1:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.11.2:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.11.3:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.11.4:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.11.5:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.12.0:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.12.0:rc0:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.12.0:rc1:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.12.0:rc2:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.12.0:rc3:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.12.0:rc4:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.12.0:rc5:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.12.1:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.12.1:rc1:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.12.1:rc2:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.12.2:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.12.2:rc1:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.12.3:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.12.3:rc1:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.12.3:rc2:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.12.3:rc3:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.13.0:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.13.10:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.13.11:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.13.1:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.13.2:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.13.3:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.13.4:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.13.5:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.13.6:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.13.7:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.13.8:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.13.9:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.14.0:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.14.0:rc1:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.14.0:rc2:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.14.0:rc3:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.14.1:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.14.2:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.14.3:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.16.0:*:*:*:*:*:*:*;cpe:2.3:a:perl:perl:5.16.1:*:*:*:*:*:*:*,Perl,Perl
CVE-2012-6499,0.0,,0.10557,CWE-20,Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect_to parameter.,2013-01-12,Nuclei,cpe:2.3:a:age_verification_project:age_verification:*:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*,Age Verification Project,Age Verification
CVE-2012-6530,0.0,,0.46074,CWE-119,"Stack-based buffer overflow in Sysax Multi Server before 5.52, when HTTP is enabled, allows remote authenticated users with the create folder permission to execute arbitrary code via a crafted request.",2013-01-31,Metasploit,cpe:2.3:a:sysax:multi_server:*:*:*:*:*:*:*:*;cpe:2.3:a:sysax:multi_server:4.3:*:*:*:*:*:*:*;cpe:2.3:a:sysax:multi_server:4.5:*:*:*:*:*:*:*,Sysax,Multi Server
CVE-2012-6554,0.0,,0.16701,CWE-20,"functions/html_to_text.php in the Chat module before 1.5.2 for activeCollab allows remote authenticated users to execute arbitrary PHP code via the message[message_text] parameter to chat/add_messag, which is not properly handled when executing the preg_replace function with the eval switch.",2013-05-23,Metasploit,cpe:2.3:a:a51dev:activecollab_chat_module:1.0:*:*:*:*:*:*:*;cpe:2.3:a:a51dev:activecollab_chat_module:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:a51dev:activecollab_chat_module:1.1:*:*:*:*:*:*:*;cpe:2.3:a:a51dev:activecollab_chat_module:1.2:*:*:*:*:*:*:*;cpe:2.3:a:a51dev:activecollab_chat_module:1.3.2:*:*:*:*:*:*:*;cpe:2.3:a:a51dev:activecollab_chat_module:1.3:*:*:*:*:*:*:*;cpe:2.3:a:a51dev:activecollab_chat_module:1.4.1:*:*:*:*:*:*:*;cpe:2.3:a:a51dev:activecollab_chat_module:1.4:*:*:*:*:*:*:*;cpe:2.3:a:a51dev:activecollab_chat_module:1.5.1:*:*:*:*:*:*:*;cpe:2.3:a:a51dev:activecollab_chat_module:1.5:*:*:*:*:*:*:*,A51Dev,Activecollab Chat Module
CVE-2012-6610,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.1088,CWE-78,Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote authenticated users to execute arbitrary commands as demonstrated by a ; (semicolon) to the ping command feature.,2020-01-28,Metasploit,cpe:2.3:a:polycom:hdx_video_end_points:*:*:*:*:*:*:*:*;cpe:2.3:a:polycom:uc_apl:*:*:*:*:*:*:*:*;cpe:2.3:h:polycom:hdx_8000:-:*:*:*:*:*:*:*,Polycom,Hdx 8000
CVE-2012-6636,0.0,,0.4136,CWE-264,"The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote attackers to execute arbitrary methods of Java objects by using the Java Reflection API within crafted JavaScript code that is loaded into the WebView component in an application targeted to API level 16 or earlier, a related issue to CVE-2013-4710.",2014-03-03,Metasploit,cpe:2.3:a:google:android_api:*:*:*:*:*:*:*:*;cpe:2.3:a:google:android_api:1.0:*:*:*:*:*:*:*;cpe:2.3:a:google:android_api:10.0:*:*:*:*:*:*:*;cpe:2.3:a:google:android_api:11.0:*:*:*:*:*:*:*;cpe:2.3:a:google:android_api:12.0:*:*:*:*:*:*:*;cpe:2.3:a:google:android_api:13.0:*:*:*:*:*:*:*;cpe:2.3:a:google:android_api:14.0:*:*:*:*:*:*:*;cpe:2.3:a:google:android_api:15.0:*:*:*:*:*:*:*;cpe:2.3:a:google:android_api:2.0:*:*:*:*:*:*:*;cpe:2.3:a:google:android_api:3.0:*:*:*:*:*:*:*;cpe:2.3:a:google:android_api:4.0:*:*:*:*:*:*:*;cpe:2.3:a:google:android_api:5.0:*:*:*:*:*:*:*;cpe:2.3:a:google:android_api:6.0:*:*:*:*:*:*:*;cpe:2.3:a:google:android_api:7.0:*:*:*:*:*:*:*;cpe:2.3:a:google:android_api:8.0:*:*:*:*:*:*:*;cpe:2.3:a:google:android_api:9.0:*:*:*:*:*:*:*,Google,Android Api
CVE-2012-6663,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.09493,CWE-522,General Electric D20ME devices are not properly configured and reveal plaintext passwords.,2020-01-23,Metasploit,cpe:2.3:h:ge:d200:-:*:*:*:*:*:*:*;cpe:2.3:h:ge:d20me:-:*:*:*:*:*:*:*;cpe:2.3:o:ge:d200_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:ge:d20me_firmware:-:*:*:*:*:*:*:*,Ge,D20Me Firmware
CVE-2012-6664,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.29539,CWE-22,Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to read or write arbitrary files via a .. (dot dot) in the (1) get or (2) put commands.,2024-06-21,Metasploit,,,
CVE-2012-6710,0.0,,0.24972,CWE-287,ext_find_user in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password[]= (aka an empty array) in an action=login request to index.php.,2018-10-07,Metasploit,cpe:2.3:a:extplorer:extplorer:*:*:*:*:*:*:*:*,Extplorer,Extplorer
CVE-2013-0008,0.0,,0.17089,CWE-264,"win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle window broadcast messages, which allows local users to gain privileges via a crafted application, aka ""Win32k Improper Message Handling Vulnerability.""",2013-01-09,Metasploit,cpe:2.3:o:microsoft:windows_7:*:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:*:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:sp1:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:-:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:-:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*,Microsoft,Windows Vista
CVE-2013-0025,0.0,,0.55765,CWE-399,"Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka ""Internet Explorer SLayoutRun Use After Free Vulnerability.""",2013-02-13,Metasploit,cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*,Microsoft,Internet Explorer
CVE-2013-0074,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.81868,NVD-CWE-noinfo,"Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka ""Silverlight Double Dereference Vulnerability.""",2013-03-13,CISA/Metasploit,cpe:2.3:a:microsoft:silverlight:*:*:*:*:*:*:*:*,Microsoft,Silverlight
CVE-2013-0108,0.0,,0.26639,CWE-94,"An ActiveX control in HscRemoteDeploy.dll in Honeywell Enterprise Buildings Integrator (EBI) R310, R400.2, R410.1, and R410.2; SymmetrE R310, R410.1, and R410.2; ComfortPoint Open Manager (aka CPO-M) Station R100; and HMIWeb Browser client packages allows remote attackers to execute arbitrary code via a crafted HTML document.",2013-02-24,Metasploit,cpe:2.3:a:honeywell:comfortpoint_open_manager_station:r100:*:*:*:*:*:*:*;cpe:2.3:a:honeywell:enterprise_buildings_integrator:r310:*:*:*:*:*:*:*;cpe:2.3:a:honeywell:enterprise_buildings_integrator:r400.2:*:*:*:*:*:*:*;cpe:2.3:a:honeywell:enterprise_buildings_integrator:r410.1:*:*:*:*:*:*:*;cpe:2.3:a:honeywell:enterprise_buildings_integrator:r410.2:*:*:*:*:*:*:*;cpe:2.3:a:honeywell:symmetre:r310:*:*:*:*:*:*:*;cpe:2.3:a:honeywell:symmetre:r400.2:*:*:*:*:*:*:*;cpe:2.3:a:honeywell:symmetre:r410.1:*:*:*:*:*:*:*,Honeywell,Enterprise Buildings Integrator
CVE-2013-0109,0.0,,0.04472,CWE-119,"The NVIDIA driver before 307.78, and Release 310 before 311.00, in the NVIDIA Display Driver service on Windows does not properly handle exceptions, which allows local users to gain privileges or cause a denial of service (memory overwrite) via a crafted application.",2013-04-08,Metasploit,cpe:2.3:a:nvidia:display_driver:*:-:*:*:*:windows:*:*;cpe:2.3:a:nvidia:display_driver:310.00:-:*:*:*:windows:*:*,Nvidia,Display Driver
CVE-2013-0136,0.0,,0.40338,CWE-22,"Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read arbitrary files, or cause a denial of service (file deletion or renaming) via (1) the uploadPath parameter in an UPLOAD operation; the paths[] parameter in a (2) DELETE, (3) CUT, or (4) COPY operation; or the newPath parameter in a (5) CUT or (6) COPY operation.",2013-06-01,Metasploit,cpe:2.3:a:mutiny:mutiny:*:*:*:*:*:*:*:*;cpe:2.3:a:mutiny:mutiny:5.0-1.00:*:*:*:*:*:*:*;cpe:2.3:a:mutiny:mutiny_virtual_appliance:-:*:*:*:*:*:*:*;cpe:2.3:h:mutiny:mutiny_appliance:-:*:*:*:*:*:*:*,Mutiny,Mutiny Appliance
CVE-2013-0156,0.0,,0.99449,CWE-20,"active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.",2013-01-13,EPSS/Metasploit,cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2013-0209,0.0,,0.45201,CWE-287,"lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.",2013-01-23,Metasploit,cpe:2.3:a:sixapart:movable_type:4.21:*:*:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.22:*:*:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.23:*:*:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.24:*:*:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.25:*:*:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.261:*:*:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.26:*:*:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.27:*:*:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.28:*:*:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.28:*:enterprise:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.28:*:open_source:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.291:*:*:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.291:*:enterprise:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.291:*:open_source:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.292:*:*:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.292:*:enterprise:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.292:*:open_source:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.29:*:*:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.29:*:enterprise:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.29:*:open_source:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.31:*:*:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.32:*:*:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.33:*:*:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.34:*:*:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.35:*:*:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.361:*:*:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.361:*:open_source:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.36:*:*:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.36:*:open_source:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.37:*:*:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.37:*:open_source:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.38:*:*:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:4.38:*:open_source:*:*:*:*:*,Sixapart,Movable Type
CVE-2013-0229,0.0,,0.76396,NVD-CWE-noinfo,The ProcessSSDPRequest function in minissdp.c in the SSDP handler in MiniUPnP MiniUPnPd before 1.4 allows remote attackers to cause a denial of service (service crash) via a crafted request that triggers a buffer over-read.,2013-01-31,Metasploit,cpe:2.3:a:miniupnp_project:miniupnpd:*:*:*:*:*:*:*:*;cpe:2.3:a:miniupnp_project:miniupnpd:1.0:*:*:*:*:*:*:*;cpe:2.3:a:miniupnp_project:miniupnpd:1.1:*:*:*:*:*:*:*;cpe:2.3:a:miniupnp_project:miniupnpd:1.2:*:*:*:*:*:*:*,Miniupnp Project,Miniupnpd
CVE-2013-0230,0.0,,0.69151,CWE-119,Stack-based buffer overflow in the ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP MiniUPnPd 1.0 allows remote attackers to execute arbitrary code via a long quoted method.,2013-01-31,Metasploit,cpe:2.3:a:miniupnp_project:miniupnpd:1.0:*:*:*:*:*:*:*,Miniupnp Project,Miniupnpd
CVE-2013-0232,0.0,,0.47895,NVD-CWE-noinfo,"includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the setDeviceStatusX10 function.",2013-03-20,Metasploit,cpe:2.3:a:zoneminder:zoneminder:1.24.0:*:*:*:*:*:*:*;cpe:2.3:a:zoneminder:zoneminder:1.24.1:*:*:*:*:*:*:*;cpe:2.3:a:zoneminder:zoneminder:1.24.2:*:*:*:*:*:*:*;cpe:2.3:a:zoneminder:zoneminder:1.24.3:*:*:*:*:*:*:*;cpe:2.3:a:zoneminder:zoneminder:1.24.4:*:*:*:*:*:*:*;cpe:2.3:a:zoneminder:zoneminder:1.25.0:*:*:*:*:*:*:*,Zoneminder,Zoneminder
CVE-2013-0233,0.0,,0.14126,CWE-399,"Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.",2013-04-25,Metasploit,cpe:2.3:a:plataformatec:devise:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:plataformatec:devise:1.5.1:*:*:*:*:*:*:*;cpe:2.3:a:plataformatec:devise:1.5.2:*:*:*:*:*:*:*;cpe:2.3:a:plataformatec:devise:1.5.3:*:*:*:*:*:*:*;cpe:2.3:a:plataformatec:devise:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:plataformatec:devise:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:plataformatec:devise:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:plataformatec:devise:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:plataformatec:devise:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:plataformatec:devise:2.1.0:*:*:*:*:*:*:*;cpe:2.3:a:plataformatec:devise:2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:plataformatec:devise:2.1.2:*:*:*:*:*:*:*;cpe:2.3:a:plataformatec:devise:2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:plataformatec:devise:2.2.1:*:*:*:*:*:*:*;cpe:2.3:a:plataformatec:devise:2.2.2:*:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*,Opensuse,Opensuse
CVE-2013-0235,0.0,,0.28857,NVD-CWE-Other,"The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.",2013-07-08,Metasploit,cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:0.71:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.0:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.2.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.2.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.2.3:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.2.4:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.2.5:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.2.5:a:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.3.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.3.3:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.3:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.5.1.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.5.1.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.5.1.3:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.5.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.5.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.5:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:1.6.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.0.10:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.0.11:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.0.6:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.0.7:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.0.8:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.0.9:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.0:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.1.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.1.3:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.2.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.2.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.2.3:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.3.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.3.3:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.3:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.5:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.6.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.6.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.6.3:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.6.5:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.6:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.7.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.7:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.8.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.8.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.8.3:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.8.4:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.8.4:a:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.8.5.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.8.5.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.8.5:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.8.6:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.8:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.9.1.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.9.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.9.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:2.9:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.3.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.3.3:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.3:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.4.0:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.4.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.4.2:*:*:*:*:*:*:*,Wordpress,Wordpress
CVE-2013-0333,0.0,,0.95327,NVD-CWE-Other,"lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.",2013-01-30,EPSS/Metasploit,cpe:2.3:a:rubyonrails:rails:2.3.0:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:2.3.10:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:2.3.11:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:2.3.12:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:2.3.13:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:2.3.14:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:2.3.15:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:2.3.2:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:2.3.3:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:2.3.4:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:2.3.9:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.16:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.17:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.18:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.19:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:*,Rubyonrails,Rails
CVE-2013-0422,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97612,NVD-CWE-Other,"Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflection API, as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE: some parties have mapped the recursive Reflection API issue to CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose details are not public as of 20130114.  CVE-2013-0422 covers both the JMX/MBean and Reflection API issues.  NOTE: it was originally reported that Java 6 was also vulnerable, but the reporter has retracted this claim, stating that Java 6 is not exploitable because the relevant code is called in a way that does not bypass security checks.  NOTE: as of 20130114, a reliable third party has claimed that the findClass/MBeanInstantiator vector was not fixed in Oracle Java 7 Update 11.  If there is still a vulnerable condition, then a separate CVE identifier might be created for the unfixed issue.",2013-01-10,CISA/EPSS/Metasploit,cpe:2.3:a:oracle:jdk:1.7.0:-:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update10:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update5:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update6:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update7:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update9:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:-:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update10:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update7:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update9:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2013-0431,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.89987,NVD-CWE-Other,"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka ""Issue 52,"" a different vulnerability than CVE-2013-1490.",2013-01-31,CISA/Metasploit,cpe:2.3:a:oracle:jre:1.7.0:-:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update10:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update11:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update7:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update9:*:*:*:*:*:*;cpe:2.3:a:oracle:openjdk:7:-:*:*:*:*:*:*,Oracle,Jre
CVE-2013-0625,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.93797,CWE-287,"Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013.",2013-01-09,CISA,cpe:2.3:a:adobe:coldfusion:9.0.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:9.0.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:9.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:opengroup:unix:-:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2013-0629,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.65902,NVD-CWE-noinfo,"Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspecified vectors, as exploited in the wild in January 2013.",2013-01-09,CISA,cpe:2.3:a:adobe:coldfusion:10.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:9.0.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:9.0.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:9.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:opengroup:unix:-:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2013-0631,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.65867,NVD-CWE-noinfo,"Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in January 2013.",2013-01-09,CISA,cpe:2.3:a:adobe:coldfusion:9.0.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:9.0.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:9.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:opengroup:unix:-:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2013-0632,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.93691,CWE-276,"administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.",2013-01-17,CISA/Metasploit,cpe:2.3:a:adobe:coldfusion:10.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:9.0.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:9.0.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:9.0:*:*:*:*:*:*:*,Adobe,Coldfusion
CVE-2013-0634,0.0,,0.77597,CWE-119,"Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10.3.183.51 and 11.x before 11.2.202.262 on Linux, before 11.1.111.32 on Android 2.x and 3.x, and before 11.1.115.37 on Android 4.x allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, as exploited in the wild in February 2013.",2013-02-08,Metasploit,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:google:android:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2013-0640,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.86979,CWE-787,"Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document, as exploited in the wild in February 2013.",2013-02-14,CISA,cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:5.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*,Apple,Mac Os X
CVE-2013-0641,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.32449,CWE-120,"Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in the wild in February 2013.",2013-02-14,CISA,cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:5.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*,Apple,Mac Os X
CVE-2013-0643,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.10533,NVD-CWE-noinfo,"The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.",2013-02-27,CISA,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:5.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*,Apple,Mac Os X
CVE-2013-0648,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.11094,NVD-CWE-noinfo,"Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.",2013-02-27,CISA,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:5.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*,Apple,Mac Os X
CVE-2013-0653,0.0,,0.19111,CWE-22,"Directory traversal vulnerability in substitute.bcl in the WebView CimWeb subsystem in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to read arbitrary files via a crafted packet.",2013-01-27,Metasploit,cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_cimplicity:4.01:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_cimplicity:7.5:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_cimplicity:8.0:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_proficy_process_systems_with_cimplicity:-:*:*:*:*:*:*:*;cpe:2.3:h:ge:intelligent_platforms_proficy_process_systems:-:*:*:*:*:*:*:*,Ge,Intelligent Platforms Proficy Process Systems
CVE-2013-0680,0.0,,0.18768,CWE-119,"Stack-based buffer overflow in the web server in Cogent Real-Time Systems Cogent DataHub before 7.3.0, OPC DataHub before 6.4.22, Cascade DataHub before 6.4.22 on Windows, and DataHub QuickTrend before 7.3.0 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long HTTP header.",2013-04-05,Metasploit,cpe:2.3:a:cogentdatahub:cascade_datahub:*:*:*:*:*:*:*:*;cpe:2.3:a:cogentdatahub:cascade_datahub:6.4.20:*:*:*:*:*:*:*;cpe:2.3:a:cogentdatahub:cogent_datahub:*:*:*:*:*:*:*:*;cpe:2.3:a:cogentdatahub:cogent_datahub:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cogentdatahub:cogent_datahub:7.0:*:*:*:*:*:*:*;cpe:2.3:a:cogentdatahub:cogent_datahub:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:cogentdatahub:cogent_datahub:7.1.1.63:*:*:*:*:*:*:*;cpe:2.3:a:cogentdatahub:cogent_datahub:7.1.1:*:*:*:*:*:*:*;cpe:2.3:a:cogentdatahub:cogent_datahub:7.1.2:*:*:*:*:*:*:*;cpe:2.3:a:cogentdatahub:datahub_quicktrend:*:*:*:*:*:*:*:*;cpe:2.3:a:cogentdatahub:opc_datahub:*:*:*:*:*:*:*:*;cpe:2.3:a:cogentdatahub:opc_datahub:6.4.20:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2013-0726,0.0,,0.27975,CWE-119,Stack-based buffer overflow in the ERM_convert_to_correct_webpath function in ermapper_u.dll in ERDAS ER Viewer before 13.00.0001 allows remote attackers to execute arbitrary code via a crafted pathname in an ERS file.,2013-05-05,Metasploit,cpe:2.3:a:hexagon:erdas_er_viewer:*:*:*:*:*:*:*:*,Hexagon,Erdas Er Viewer
CVE-2013-0753,0.0,,0.51324,CWE-416,"Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via crafted web content.",2013-01-13,Metasploit,cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:5.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:vmware:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2:*:*:*:*:*:*,Opensuse,Opensuse
CVE-2013-0757,0.0,,0.60859,CWE-20,"The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not prevent modifications to the prototype of an object, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by referencing Object.prototype.__proto__ in a crafted HTML document.",2013-01-13,Metasploit,cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:vmware:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2:*:*:*:*:*:*,Opensuse,Opensuse
CVE-2013-0758,0.0,,0.73364,CWE-94,"Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging improper interaction between plugin objects and SVG elements.",2013-01-13,Metasploit,cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:5.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:vmware:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2:*:*:*:*:*:*,Opensuse,Opensuse
CVE-2013-0803,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.74977,CWE-434,"A PHP File Upload Vulnerability exists in PolarBear CMS 2.5 via upload.php, which could let a malicious user execute arbitrary code.",2020-02-11,Metasploit,cpe:2.3:a:polarbear_cms_project:polarbear_cms:2.5:*:*:*:*:*:*:*,Polarbear Cms Project,Polarbear Cms
CVE-2013-0810,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.59885,CWE-94,"Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, and Windows Server 2008 SP2 allow remote attackers to execute arbitrary code via a crafted screensaver in a theme file, aka ""Windows Theme File Remote Code Execution Vulnerability.""",2013-09-11,Metasploit,cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*,Microsoft,Windows Server 2003
CVE-2013-0928,0.0,,0.34468,CWE-78,"The NetWorker command processor in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execute arbitrary commands via a DCP ""run command"" operation.",2013-01-21,Metasploit,cpe:2.3:a:emc:alphastor:4.0:*:*:*:*:*:*:*,Emc,Alphastor
CVE-2013-10032,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02484,CWE-306,"An authenticated remote code execution vulnerability exists in GetSimpleCMS version 3.2.1. The application’s upload.php endpoint allows authenticated users to upload arbitrary files without proper validation of MIME types or extensions. By uploading a .pht file containing PHP code, an attacker can bypass blacklist-based restrictions and place executable code within the web root. A crafted request using a polyglot or disguised extension allows the attacker to execute the payload by accessing the file directly via the web server. This vulnerability exists due to the use of a blacklist for filtering file types instead of a whitelist.",2025-07-25,Metasploit,cpe:2.3:a:get-simple:getsimplecms:3.2.1:*:*:*:*:*:*:*,Get-Simple,Getsimplecms
CVE-2013-10033,0.0,,0.01261,CWE-89,"An unauthenticated SQL injection vulnerability exists in Kimai version 0.9.2.x via the db_restore.php endpoint. The flaw allows attackers to inject arbitrary SQL queries into the dates[] POST parameter, enabling file write via INTO OUTFILE under specific environmental conditions. This can lead to remote code execution by writing a PHP payload to the web-accessible temporary directory. The vulnerability has been confirmed in versions including 0.9.2.beta, 0.9.2.1294.beta, and 0.9.2.1306-3.",2025-07-31,Metasploit,,,
CVE-2013-10034,0.0,,0.01838,CWE-434,"An unrestricted file upload vulnerability exists in Kaseya KServer versions prior to 6.3.0.2. The uploadImage.asp endpoint allows unauthenticated users to upload files to arbitrary paths via a crafted filename parameter in a multipart/form-data POST request. Due to the lack of authentication and input sanitation, an attacker can upload a file with an .asp extension to a web-accessible directory, which can then be invoked to execute arbitrary code with the privileges of the IUSR account. The vulnerability enables remote code execution without prior authentication and was resolved in version 6.3.0.2 by removing the vulnerable uploadImage.asp endpoint.",2025-07-31,Metasploit,,,
CVE-2013-10035,0.0,,0.01456,CWE-94,"A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin. An authenticated user can execute arbitrary PHP code via multiple endpoints, including appFolderAjax.php, casesStartPage_Ajax.php, and cases_SchedulerGetPlugins.php, by supplying crafted POST requests to parameters such as action and params. These endpoints fail to validate user input and directly invoke PHP functions like system() with user-supplied parameters, enabling remote code execution. The vulnerability affects both Linux and Windows installations and is present in default configurations of versions including 2.0.23 through 2.5.1. The vulnerable skin cannot be removed through the web interface, and exploitation requires only valid user credentials.",2025-07-31,Metasploit,,,
CVE-2013-10036,0.0,,0.00433,CWE-121,"A stack-based buffer overflow vulnerability exists in Beetel Connection Manager version PCW_BTLINDV1.0.0B04 when parsing the UserName parameter in the NetConfig.ini configuration file. A crafted .ini file containing an overly long UserName value can overwrite the Structured Exception Handler (SEH), leading to arbitrary code execution when the application processes the file.",2025-07-31,Metasploit,,,
CVE-2013-10037,0.0,,0.09615,CWE-78,"An OS command injection vulnerability exists in WebTester version 5.x via the install2.php installation script. The parameters cpusername, cppassword, and cpdomain are passed directly to shell commands without sanitization. A remote unauthenticated attacker can exploit this flaw by sending a crafted HTTP POST request, resulting in arbitrary command execution on the underlying system with web server privileges.",2025-07-31,Metasploit,,,
CVE-2013-10038,0.0,,0.01281,CWE-434,"An unauthenticated arbitrary file upload vulnerability exists in FlashChat versions 6.0.2 and 6.0.4 through 6.0.8. The upload.php endpoint fails to properly validate file types and authentication, allowing attackers to upload malicious PHP scripts. Once uploaded, these scripts can be executed remotely, resulting in arbitrary code execution as the web server user.",2025-07-31,Metasploit,,,
CVE-2013-10039,0.0,,0.03268,CWE-78,A command injection vulnerability exists in GestioIP 3.0 commit ac67be and earlier in ip_checkhost.cgi. Crafted input to the 'ip' parameter allows attackers to execute arbitrary shell commands on the server via embedded base64-encoded payloads. Authentication may be required depending on deployment configuration.,2025-07-31,Metasploit,,,
CVE-2013-10040,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02591,CWE-434,"ClipBucket version 2.6 and earlier contains a critical vulnerability in the ofc_upload_image.php script located at /admin_area/charts/ofc-library/. This endpoint allows unauthenticated users to upload arbitrary files, including executable PHP scripts. Once uploaded, the attacker can access the file via a predictable path and trigger remote code execution.",2025-07-31,Metasploit,cpe:2.3:a:clip-bucket:clipbucket:*:*:*:*:*:*:*:*,Clip-Bucket,Clipbucket
CVE-2013-10042,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01712,CWE-121,"A stack-based buffer overflow vulnerability exists in freeFTPd version 1.0.10 and earlier in the handling of the FTP PASS command. When an attacker sends a specially crafted password string, the application fails to validate input length, resulting in memory corruption. This can lead to denial of service or arbitrary code execution. Exploitation requires the anonymous user account to be enabled.",2025-07-31,Metasploit,cpe:2.3:a:freeftpd:freeftpd:*:*:*:*:*:*:*:*,Freeftpd,Freeftpd
CVE-2013-10043,0.0,,0.01587,CWE-89,"A vulnerability exists in OAstium VoIP PBX astium-confweb-2.1-25399 and earlier, where improper input validation in the logon.php script allows an attacker to bypass authentication via SQL injection. Once authenticated as an administrator, the attacker can upload arbitrary PHP code through the importcompany field in import.php, resulting in remote code execution. The malicious payload is injected into /usr/local/astium/web/php/config.php and executed with root privileges by triggering a configuration reload via sudo /sbin/service astcfgd reload. Successful exploitation leads to full system compromise.",2025-07-31,Metasploit,,,
CVE-2013-10044,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01339,CWE-89,"An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to extract administrator credentials and subsequently escalate privileges. Once elevated, the attacker can exploit an unrestricted file upload flaw to achieve remote code execution, resulting in full compromise of the application and its host system.",2025-08-01,Metasploit,cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*,Open-Emr,Openemr
CVE-2013-10046,0.0,,0.00461,CWE-22,"A local privilege escalation vulnerability exists in Agnitum Outpost Internet Security 8.1 that allows an unprivileged user to execute arbitrary code with SYSTEM privileges. The flaw resides in the acs.exe component, which exposes a named pipe that accepts unauthenticated commands. By exploiting a directory traversal weakness in the pipe protocol, an attacker can instruct the service to load a malicious DLL from a user-controlled location. The DLL is then executed in the context of the privileged service.",2025-08-01,Metasploit,,,
CVE-2013-10047,0.0,,0.01032,CWE-434,"An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote attackers to upload arbitrary files to the server’s filesystem. By abusing the upload handler and crafting a traversal path, an attacker can place a malicious .exe in system32, followed by a .mof file in the WMI directory. This triggers execution of the payload with SYSTEM privileges via the Windows Management Instrumentation service. The exploit is only viable on Windows versions prior to Vista.",2025-08-01,Metasploit,,,
CVE-2013-10048,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.12099,CWE-78,"An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 (firmware ≤ 2.13 and ≤ 2.14b01, respectively)—due to improper input handling in the unauthenticated command.php endpoint. By sending specially crafted POST requests, a remote attacker can execute arbitrary shell commands with root privileges, allowing full takeover of the device. This includes launching services such as Telnet, exfiltrating credentials, modifying system configuration, and disrupting availability. The flaw stems from the lack of authentication and inadequate sanitation of the cmd parameter.",2025-08-01,Metasploit,cpe:2.3:h:dlink:dir-300:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-600:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-600_firmware:*:*:*:*:*:*:*:*,D-Link,Dir-300 Firmware
CVE-2013-10049,0.0,,0.01968,CWE-78,"An OS command injection vulnerability exists in multiple Raidsonic NAS devices—specifically tested on IB-NAS5220 and IB-NAS4220—via the unauthenticated timeHandler.cgi endpoint exposed through the web interface. The CGI script fails to properly sanitize user-supplied input in the timeZone parameter of a POST request, allowing remote attackers to inject arbitrary shell commands.",2025-08-01,Metasploit,,,
CVE-2013-10050,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.09637,CWE-78,"An OS command injection vulnerability exists in multiple D-Link routers (confirmed on DIR-300 rev A v1.05 and DIR-615 rev D v4.13) via the authenticated tools_vct.xgi CGI endpoint. The web interface fails to properly sanitize user-supplied input in the pingIp parameter, allowing attackers with valid credentials to inject arbitrary shell commands. Exploitation enables full device compromise, including spawning a telnet daemon and establishing a root shell. The vulnerability is present in firmware versions that expose tools_vct.xgi and use the Mathopd/1.5p6 web server. No vendor patch is available, and affected models are end-of-life.",2025-08-01,Metasploit,cpe:2.3:h:dlink:dir-300:a:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-615:d:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-615_firmware:*:*:*:*:*:*:*:*,D-Link,Dir-300 Firmware
CVE-2013-10051,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01977,CWE-95,"A remote PHP code execution vulnerability exists in InstantCMS version 1.6 and earlier due to unsafe use of eval() within the search view handler. Specifically, user-supplied input passed via the look parameter is concatenated into a PHP expression and executed without proper sanitation. A remote attacker can exploit this flaw by sending a crafted HTTP GET request with a base64-encoded payload in the Cmd header, resulting in arbitrary PHP code execution within the context of the web server.",2025-08-01,Metasploit,cpe:2.3:a:instantcms:instantcms:*:*:*:*:*:*:*:*,Instantcms,Instantcms
CVE-2013-10052,0.0,,0.00265,CWE-269,"ZPanel includes a helper binary named zsudo, intended to allow restricted privilege escalation for administrative tasks. However, when misconfigured in /etc/sudoers, zsudo can be invoked by low-privileged users to execute arbitrary commands as root. This flaw enables local attackers with shell access to escalate privileges by writing a payload to a writable directory and executing it via zsudo. The vulnerability is particularly impactful in post-exploitation scenarios following web server compromise, where the attacker inherits access to zsudo.",2025-08-04,Metasploit,,,
CVE-2013-10053,0.0,,0.0108,CWE-78,"A remote command execution vulnerability exists in ZPanel version 10.0.0.2 in its htpasswd module. When creating .htaccess files, the inHTUsername field is passed unsanitized to a system() call that invokes the system’s htpasswd binary. By injecting shell metacharacters into the username field, an authenticated attacker can execute arbitrary system commands. Exploitation requires a valid ZPanel account—such as one in the default Users, Resellers, or Administrators groups—but no elevated privileges.",2025-08-01,Metasploit,,,
CVE-2013-10054,0.0,,0.01282,CWE-434,"An unauthenticated arbitrary file upload vulnerability exists in LibrettoCMS version 1.1.7 (and possibly earlier) contains an unauthenticated arbitrary file upload vulnerability in its File Manager plugin. The upload handler located at adm/ui/js/ckeditor/plugins/pgrfilemanager/php/upload.php fails to properly validate file extensions, allowing attackers to upload files with misleading extensions and subsequently rename them to executable .php scripts. This enables remote code execution on the server without authentication.",2025-08-04,Metasploit,,,
CVE-2013-10055,0.0,,0.01079,CWE-434,"An unauthenticated arbitrary file upload vulnerability exists in Havalite CMS version 1.1.7 (and possibly earlier) in the upload.php script. The application fails to enforce proper file extension validation and authentication checks, allowing remote attackers to upload malicious PHP files via a crafted multipart/form-data POST request. Once uploaded, the attacker can access the file directly under havalite/tmp/files/, resulting in remote code execution.",2025-08-01,Metasploit,,,
CVE-2013-10057,0.0,,0.01173,CWE-94,"A stack-based buffer overflow vulnerability exists in Synactis PDF In-The-Box ActiveX control (PDF_IN_1.ocx), specifically the ConnectToSynactis method. When a long string is passed to this method—intended to populate the ldCmdLine argument of a WinExec call—a strcpy operation overwrites a saved TRegistry class pointer on the stack. This allows remote attackers to execute arbitrary code in the context of the user by enticing them to visit a malicious webpage that instantiates the vulnerable ActiveX control. The vulnerability was discovered via its use in third-party software such as Logic Print 2013.",2025-08-01,Metasploit,,,
CVE-2013-10058,0.0,,0.03025,CWE-78,"An authenticated OS command injection vulnerability exists in various Linksys router models (tested on WRT160Nv2) running firmware version v2.0.03 via the apply.cgi endpoint. The web interface fails to properly sanitize user-supplied input passed to the ping_size parameter during diagnostic operations. An attacker with valid credentials can inject arbitrary shell commands, enabling remote code execution.",2025-08-01,Metasploit,,,
CVE-2013-10059,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.1911,CWE-78,"An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm endpoint. The web interface fails to sanitize input passed from the ping_ipaddr parameter to the tools_vct.htm diagnostic interface, allowing attackers to inject arbitrary shell commands using backtick encapsulation. With default credentials, an attacker can exploit this blind injection vector to execute arbitrary commands.",2025-08-01,Metasploit,cpe:2.3:h:dlink:dir-615h:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-615h_firmware:*:*:*:*:*:*:*:*,D-Link,Dir-615H Firmware
CVE-2013-10060,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.04547,CWE-78,An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN2200B model) firmware versions 1.0.0.36 and prior via the pppoe.cgi endpoint. A remote attacker with valid credentials can execute arbitrary commands via crafted input to the pppoe_username parameter. This flaw allows full compromise of the device and may persist across reboots unless configuration is restored.,2025-08-01,Metasploit,cpe:2.3:h:netgear:dgn2200b:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:dgn2200b_firmware:*:*:*:*:*:*:*:*,Netgear,Dgn2200B Firmware
CVE-2013-10061,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.04391,CWE-78,"An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN1000B model firmware versions 1.1.00.24 and 1.1.00.45) via the TimeToLive parameter in the setup.cgi endpoint. The vulnerability arises from improper input neutralization, enabling command injection through crafted POST requests. This flaw enables remote attackers to deploy payloads or manipulate system state post-authentication.",2025-08-01,Metasploit,cpe:2.3:h:netgear:dgn1000b:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:dgn1000b_firmware:1.1.00.24:*:*:*:*:*:*:*;cpe:2.3:o:netgear:dgn1000b_firmware:1.1.00.45:*:*:*:*:*:*:*,Netgear,Dgn1000B Firmware
CVE-2013-10062,0.0,,0.01402,CWE-22,"A directory traversal vulnerability exists in Linksys router's web interface (tested on the E1500 model firmware versions 1.0.00, 1.0.04, and 1.0.05), specifically in the /apply.cgi endpoint. Authenticated attackers can exploit the next_page POST parameter to access arbitrary files outside the intended web root by injecting traversal sequences. This allows exposure of sensitive system files and configuration data.",2025-08-01,Metasploit,,,
CVE-2013-10063,0.0,,0.00892,CWE-22,A path traversal vulnerability exists in the Netgear SPH200D Skype phone firmware versions <= 1.0.4.80 in its embedded web server. Authenticated attackers can exploit crafted GET requests to access arbitrary files outside the web root by injecting traversal sequences. This can expose sensitive system files and configuration data.,2025-08-01,Metasploit,,,
CVE-2013-10064,0.0,,0.01044,CWE-121,"A stack-based buffer overflow vulnerability exists in ActFax Server version 5.01. The server's RAW protocol interface fails to safely process user-supplied data in @F506 fax header fields due to insecure usage of strcpy. Remote attackers can exploit this vulnerability by sending specially crafted @F506 fields, potentially leading to arbitrary code execution. Successful exploitation requires network access to TCP port 4559 and does not require authentication.",2025-08-05,Metasploit,,,
CVE-2013-10065,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.01141,CWE-248,"A denial-of-service vulnerability exists in Sysax Multi-Server version 6.10 via its SSH daemon. A specially crafted SSH key exchange packet can trigger a crash in the service, resulting in loss of availability. The flaw is triggered during the handling of malformed key exchange data, including a non-standard byte (\x28) in place of the expected SSH protocol delimiter.",2025-08-05,Metasploit,cpe:2.3:a:sysax:multi_server:6.10:*:*:*:*:*:*:*,Sysax,Multi Server
CVE-2013-10066,0.0,,0.01154,CWE-434,An unauthenticated arbitrary file upload vulnerability exists in Kordil EDMS v2.2.60rc3. The application exposes an upload endpoint (users_add.php) that allows attackers to upload files to the /userpictures/ directory without authentication. This flaw enables remote code execution by uploading a PHP payload and invoking it via a direct HTTP request.,2025-08-05,Metasploit,,,
CVE-2013-10067,0.0,,0.01029,CWE-434,"Glossword versions 1.8.8 through 1.8.12 contain an authenticated arbitrary file upload vulnerability. When deployed as a standalone application, the administrative interface (gw_admin.php) allows users with administrator privileges to upload files to the gw_temp/a/ directory. Due to insufficient validation of file type and path, attackers can upload and execute PHP payloads, resulting in remote code execution.",2025-08-05,Metasploit,,,
CVE-2013-10068,0.0,,0.00972,CWE-121,"Foxit Reader versions through 5.4.5.0114, including the bundled Foxit Reader Plugin 2.2.1.530, contains a stack-based buffer overflow vulnerability in the npFoxitReaderPlugin.dll module. When a PDF file is loaded from a remote host, an overly long query string in the URL can overflow a buffer, allowing remote attackers to execute arbitrary code.",2025-08-05,Metasploit,,,
CVE-2013-10069,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.11859,CWE-78,"The web interface of multiple D-Link routers, including DIR-600 rev B (≤2.14b01) and DIR-300 rev B (≤2.13), contains an unauthenticated OS command injection vulnerability in command.php, which improperly handles the cmd POST parameter. A remote attacker can exploit this flaw without authentication to spawn a Telnet service on a specified port, enabling persistent interactive shell access as root.",2025-08-05,Metasploit,cpe:2.3:h:dlink:dir-300:b:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-600:b:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-600_firmware:*:*:*:*:*:*:*:*,D-Link,Dir-600 Firmware
CVE-2013-10070,0.0,,0.01454,CWE-95,"PHP-Charts v1.0 contains a PHP code execution vulnerability in wizard/url.php, where user-supplied GET parameter names are passed directly to eval() without sanitization. A remote attacker can exploit this flaw by crafting a request that injects arbitrary PHP code, resulting in command execution under the web server's context. The vulnerability allows unauthenticated attackers to execute system-level commands via base64-encoded payloads embedded in parameter names, leading to full compromise of the host system.",2025-08-05,Metasploit,,,
CVE-2013-1017,0.0,,0.32553,CWE-119,Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted dref atoms in a movie file.,2013-05-24,Metasploit,cpe:2.3:a:apple:quicktime:*:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:5.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.4.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:6.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.1.6:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.2.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.3.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.3.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.4.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.5.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.5.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.6:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.7:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.8:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.6.9:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.7.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.7.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:quicktime:7.7.2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2013-1080,0.0,,0.77049,CWE-287,"The web server in Novell ZENworks Configuration Management (ZCM) 10.3 and 11.2 before 11.2.4 does not properly perform authentication for zenworks/jsp/index.jsp, which allows remote attackers to conduct directory traversal attacks, and consequently upload and execute arbitrary programs, via a request to TCP port 443.",2013-03-29,Metasploit,cpe:2.3:a:novell:zenworks_configuration_management:10.3:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_configuration_management:11.2:*:*:*:*:*:*:*,Novell,Zenworks Configuration Management
CVE-2013-1081,0.0,,0.68079,CWE-22,Directory traversal vulnerability in MDM.php in Novell ZENworks Mobile Management (ZMM) 2.6.1 and 2.7.0 allows remote attackers to include and execute arbitrary local files via the language parameter.,2013-03-11,Metasploit,cpe:2.3:a:novell:zenworks_mobile_management:2.6.1:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_mobile_management:2.7.0:*:*:*:*:*:*:*,Novell,Zenworks Mobile Management
CVE-2013-1300,0.0,,0.1218,CWE-264,"win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle objects in memory, which allows local users to gain privileges via a crafted application, aka ""Win32k Memory Allocation Vulnerability.""",2013-07-10,Metasploit,cpe:2.3:o:microsoft:windows_7:*:sp1:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:sp1:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:-:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:-:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:itanium:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*,Microsoft,Windows 7
CVE-2013-1331,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.81877,CWE-120,"Buffer overflow in Microsoft Office 2003 SP3 and Office 2011 for Mac allows remote attackers to execute arbitrary code via crafted PNG data in an Office document, leading to improper memory allocation, aka ""Office Buffer Overflow Vulnerability.""",2013-06-12,CISA,cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2011:*:*:*:*:macos:*:*,Microsoft,Office
CVE-2013-1347,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.77889,CWE-416,"Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly allocated or (2) is deleted, as exploited in the wild in May 2013.",2013-05-05,CISA/Metasploit,cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2013-1349,0.0,,0.23322,CWE-94,Eval injection vulnerability in ajax.php in openSIS 4.5 through 5.2 allows remote attackers to execute arbitrary PHP code via the modname parameter.,2013-12-09,Metasploit,cpe:2.3:a:os4ed:opensis:4.5:*:*:*:*:*:*:*;cpe:2.3:a:os4ed:opensis:4.6:*:*:*:*:*:*:*;cpe:2.3:a:os4ed:opensis:4.7:*:*:*:*:*:*:*;cpe:2.3:a:os4ed:opensis:4.8.1:*:*:*:*:*:*:*;cpe:2.3:a:os4ed:opensis:4.8:*:*:*:*:*:*:*;cpe:2.3:a:os4ed:opensis:4.9:*:*:*:*:*:*:*;cpe:2.3:a:os4ed:opensis:5.0:*:*:*:*:*:*:*;cpe:2.3:a:os4ed:opensis:5.1:*:*:*:*:*:*:*;cpe:2.3:a:os4ed:opensis:5.2:*:*:*:*:*:*:*,Os4Ed,Opensis
CVE-2013-1359,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.89402,CWE-287,"An Authentication Bypass Vulnerability exists in DELL SonicWALL Analyzer 7.0, Global Management System (GMS) 4.1, 5.0, 5.1, 6.0, and 7.0; Universal Management Appliance (UMA) 5.1, 6.0, and 7.0 and ViewPoint 4.1, 5.0, 5.1, and 6.0 via the skipSessionCheck parameter to the UMA interface (/appliance/), which could let a remote malicious user obtain access to the root account.",2020-02-11,Metasploit,cpe:2.3:a:sonicwall:analyzer:7.0:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:global_management_system:4.1:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:global_management_system:5.0:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:global_management_system:5.1:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:global_management_system:6.0:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:global_management_system:7.0:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:universal_management_appliance:5.1:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:universal_management_appliance:6.0:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:universal_management_appliance:7.0:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:viewpoint:4.1:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:viewpoint:5.0:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:viewpoint:6.0:*:*:*:*:*:*:*,Sonicwall,Analyzer
CVE-2013-1362,0.0,,0.65724,CWE-20,"Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote attackers to execute arbitrary shell commands via ""$()"" shell metacharacters, which are processed by bash.",2013-07-09,Metasploit,cpe:2.3:a:nagios:remote_plug_in_executor:*:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:1.3:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:1.4:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:1.5:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:1.6:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:1.7:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:1.8:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:1.9:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:2.0:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:2.0b1:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:2.0b2:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:2.0b3:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:2.0b4:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:2.0b5:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:2.10:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:2.11:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:2.12:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:2.3:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:2.4:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:2.5.2:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:2.5:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:2.6:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:2.7.1:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:2.7:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:2.8.1:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:2.8:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:2.8b1:*:*:*:*:*:*:*;cpe:2.3:a:nagios:remote_plug_in_executor:2.9:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*,Opensuse,Opensuse
CVE-2013-1391,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.76109,CWE-287,"Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR systems allows a remote attacker to retrieve the device configuration.",2019-10-30,Metasploit,cpe:2.3:h:capturecctv:cdr_0410ve:-:*:*:*:*:*:*:*;cpe:2.3:h:capturecctv:cdr_0820vde:-:*:*:*:*:*:*:*;cpe:2.3:h:hachi:hv-04rd_pro:-:*:*:*:*:*:*:*;cpe:2.3:h:hachi:hv-08rd_pro:-:*:*:*:*:*:*:*;cpe:2.3:h:huntcctv:dr6-704a4h:-:*:*:*:*:*:*:*;cpe:2.3:h:huntcctv:dr6-708a4h:-:*:*:*:*:*:*:*;cpe:2.3:h:huntcctv:dr6-7316a4h:-:*:*:*:*:*:*:*;cpe:2.3:h:huntcctv:dr6-7316a4hl:-:*:*:*:*:*:*:*;cpe:2.3:h:huntcctv:dvr-04ch:-:*:*:*:*:*:*:*;cpe:2.3:h:huntcctv:dvr-04nc:-:*:*:*:*:*:*:*;cpe:2.3:h:huntcctv:dvr-08ch:-:*:*:*:*:*:*:*;cpe:2.3:h:huntcctv:dvr-08nc:-:*:*:*:*:*:*:*;cpe:2.3:h:huntcctv:dvr-16ch:-:*:*:*:*:*:*:*;cpe:2.3:h:huntcctv:hdr-04kd:-:*:*:*:*:*:*:*;cpe:2.3:h:huntcctv:hdr-08kd:-:*:*:*:*:*:*:*;cpe:2.3:h:novuscctv:nv-dvr1204:-:*:*:*:*:*:*:*;cpe:2.3:h:novuscctv:nv-dvr1208:-:*:*:*:*:*:*:*;cpe:2.3:h:novuscctv:nv-dvr1216:-:*:*:*:*:*:*:*;cpe:2.3:h:vsp:tw-dvr604:-:*:*:*:*:*:*:*;cpe:2.3:h:vsp:tw-dvr616:-:*:*:*:*:*:*:*;cpe:2.3:o:capturecctv:cdr_0410ve_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:capturecctv:cdr_0820vde_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hachi:hv-04rd_pro_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hachi:hv-08rd_pro_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:huntcctv:dr6-704a4h_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:huntcctv:dr6-708a4h_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:huntcctv:dr6-7316a4h_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:huntcctv:dr6-7316a4hl_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:huntcctv:dvr-04ch_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:huntcctv:dvr-04nc_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:huntcctv:dvr-08ch_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:huntcctv:dvr-08nc_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:huntcctv:dvr-16ch_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:huntcctv:hdr-04kd_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:huntcctv:hdr-08kd_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:novuscctv:nv-dvr1204_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:novuscctv:nv-dvr1208_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:novuscctv:nv-dvr1216_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:vsp:tw-dvr604_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:vsp:tw-dvr616_firmware:-:*:*:*:*:*:*:*,Huntcctv,Dvr-04Ch Firmware
CVE-2013-1412,0.0,,0.40465,CWE-94,"DataLife Engine (DLE) 9.7 allows remote attackers to execute arbitrary PHP code via the catlist[] parameter to engine/preview.php, which is used in a preg_replace function call with an e modifier.",2014-06-02,Metasploit,cpe:2.3:a:dleviet:datalife_engine:9.7:*:*:*:*:*:*:*,Dleviet,Datalife Engine
CVE-2013-1428,0.0,,0.60679,CWE-119,Stack-based buffer overflow in the receive_tcppacket function in net_packet.c in tinc before 1.0.21 and 1.1 before 1.1pre7 allows remote authenticated peers to cause a denial of service (crash) or possibly execute arbitrary code via a large TCP packet.,2013-04-26,Metasploit,cpe:2.3:a:tinc-vpn:tinc:*:*:*:*:*:*:*:*;cpe:2.3:a:tinc-vpn:tinc:*:pre6:*:*:*:*:*:*;cpe:2.3:a:tinc-vpn:tinc:1.0.17:*:*:*:*:*:*:*;cpe:2.3:a:tinc-vpn:tinc:1.0.18:*:*:*:*:*:*:*;cpe:2.3:a:tinc-vpn:tinc:1.0.19:*:*:*:*:*:*:*;cpe:2.3:a:tinc-vpn:tinc:1.1:pre3:*:*:*:*:*:*;cpe:2.3:a:tinc-vpn:tinc:1.1:pre4:*:*:*:*:*:*;cpe:2.3:a:tinc-vpn:tinc:1.1:pre5:*:*:*:*:*:*,Tinc-Vpn,Tinc
CVE-2013-1488,0.0,,0.87227,CWE-94,"The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving reflection, Libraries, ""improper toString calls,"" and the JDBC driver manager, as demonstrated by James Forshaw during a Pwn2Own competition at CanSecWest 2013.",2013-03-08,Metasploit,cpe:2.3:a:oracle:jdk:1.7.0:update17:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update17:*:*:*:*:*:*,Oracle,Jdk
CVE-2013-1493,0.0,,0.86151,CWE-119,"The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (crash) via an image with crafted raster parameters, which triggers (1) an out-of-bounds read or (2) memory corruption in the JVM, as exploited in the wild in February 2013.",2013-03-05,Metasploit,cpe:2.3:a:oracle:jdk:*:update15:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:*:update40:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:*:update41:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update36:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.5.0:update38:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update22:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update23:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update24:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update25:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update26:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update27:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update29:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update30:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update31:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update32:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update33:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update34:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update35:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update37:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update38:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update39:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update10:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update11:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update13:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update5:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update6:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update7:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update9:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:*:update15:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:*:update40:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:*:update41:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update36:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update38:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update22:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update23:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update24:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update25:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update26:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update27:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update29:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update30:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update31:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update32:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update33:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update34:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update35:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update37:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update38:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update39:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update10:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update11:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update13:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update7:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update9:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update10:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update11:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update11_b03:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update12:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update13:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update14:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update15:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update16:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update17:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update18:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update19:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update1:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update20:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update21:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update22:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update23:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update24:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update25:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update26:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update27:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update28:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update29:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update31:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update33:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update3:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update4:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update5:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update6:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update7:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update7_b03:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update8:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.5.0:update9:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update1:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update1_b06:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_19:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_20:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_21:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jdk:1.6.0:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update10:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update17:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update18:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update19:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update20:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update21:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update22:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update23:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update24:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update25:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update26:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update27:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update28:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update29:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update31:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update33:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update7:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update8:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update9:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_19:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_20:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_21:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_9:*:*:*:*:*:*,Oracle,Jre
CVE-2013-1559,0.0,,0.58817,NVD-CWE-noinfo,Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 and 11.1.1.6.0 allows remote authenticated users to affect availability via unknown vectors related to Content Server.,2013-04-17,Metasploit,cpe:2.3:a:oracle:fusion_middleware:10.1.3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:fusion_middleware:11.1.1.6.0:*:*:*:*:*:*:*,Oracle,Fusion Middleware
CVE-2013-1662,0.0,,0.04638,CWE-264,"vmware-mount in VMware Workstation 8.x and 9.x and VMware Player 4.x and 5.x, on systems based on Debian GNU/Linux, allows host OS users to gain host OS privileges via a crafted lsb_release binary in a directory in the PATH, related to use of the popen library function.",2013-08-24,Metasploit,cpe:2.3:a:vmware:player:4.0.0.18997:*:*:*:*:*:*:*;cpe:2.3:a:vmware:player:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:player:4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:player:4.0.3:*:*:*:*:*:*:*;cpe:2.3:a:vmware:player:4.0.4:*:*:*:*:*:*:*;cpe:2.3:a:vmware:player:4.0.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:player:4.0.6:*:*:*:*:*:*:*;cpe:2.3:a:vmware:player:4.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:player:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:player:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:player:5.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workstation:8.0.0.18997:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workstation:8.0.1.27038:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workstation:8.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workstation:8.0.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workstation:8.0.3:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workstation:8.0.4:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workstation:8.0.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workstation:8.0.6:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workstation:8.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workstation:9.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workstation:9.0.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workstation:9.0:*:*:*:*:*:*:*,Vmware,Workstation
CVE-2013-1675,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.06696,CWE-665,"Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.",2013-05-16,CISA,cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:gluster_storage_server_for_on-premise:2.1:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:5.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:5.0_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.0_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:5.9_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:6.4_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:5.0_ppc:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:5.9_ppc:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:6.4_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus_from_rhui:5.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus_from_rhui:6.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2013-1690,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.69021,CWE-119,"Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.",2013-06-26,CISA/Metasploit,cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:gluster_storage_server_for_on-premise:2.0:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:5.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:ltss:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:ltss:vmware:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:vmware:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2013-1710,0.0,,0.40118,CWE-20,"The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 allows remote attackers to execute arbitrary JavaScript code or conduct cross-site scripting (XSS) attacks via vectors related to Certificate Request Message Format (CRMF) request generation.",2013-08-07,Metasploit,cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:17.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:17.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:17.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:17.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:17.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:17.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:17.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:17.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:19.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:19.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:19.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:20.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:20.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:21.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:*:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:alpha_1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:alpha_2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:alpha_3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:beta_1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:beta_2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:rc1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.0:rc2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.10.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.10:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.10:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.10:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.10:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.11:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.11:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.11:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.11:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.11:beta4:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.11:beta5:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.11:beta6:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.12.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.12:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.12:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.12:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.12:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.12:beta4:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.12:beta5:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.12:beta6:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.13.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.13.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.13:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.13:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.13:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.13:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.13:beta4:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.13:beta5:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.13:beta6:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.14:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.14:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.14:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.14:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.14:beta4:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.14:beta5:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.15.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.15.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.15:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.15:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.15:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.15:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.15:beta4:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.15:beta5:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.15:beta6:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.16.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.16.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.16:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.16:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.16:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.16:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.16:beta4:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.16:beta5:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.17.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.17:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.17:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.17:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.17:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.17:beta4:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.18:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.18:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.18:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.18:beta4:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.19:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.19:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.19:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.1:alpha1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.1:alpha2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.1:alpha3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.1:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.1:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.1:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.1:rc1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.1:rc2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.20:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.20:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.2:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.2:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.2:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.3.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.3.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.3:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.3:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.3:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.4.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.4:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.4:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.4:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.5:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.5:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.5:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.5:beta4:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.6.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.6:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.6:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.6:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.6:beta4:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.7.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.7.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.7:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.7:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.7:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.7:beta4:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.7:beta5:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.8:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.8:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.8:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.8:beta4:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.8:beta5:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.8:beta6:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.9.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.9:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.9:beta1:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.9:beta2:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.9:beta3:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.9:beta4:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:17.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:17.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:17.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:17.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:17.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:17.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:17.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird_esr:17.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird_esr:17.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird_esr:17.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird_esr:17.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird_esr:17.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird_esr:17.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird_esr:17.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird_esr:17.0:*:*:*:*:*:*:*,Mozilla,Seamonkey
CVE-2013-1775,0.0,,0.03176,CWE-264,sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch.,2013-03-05,Metasploit,cpe:2.3:a:todd_miller:sudo:1.6.1:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.6.2:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.6.2p3:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.6.3:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.6.3_p7:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.6.4:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.6.4p2:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.6.5:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.6.6:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.6.7:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.6.7p5:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.6.8:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.6.8p12:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.6.9:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.6.9p20:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.6.9p21:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.6.9p22:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.6.9p23:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.6:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.10:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.10p1:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.10p2:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.10p3:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.10p4:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.10p5:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.10p6:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.1:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.2:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.2p1:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.2p2:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.2p3:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.2p4:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.2p5:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.2p6:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.2p7:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.3b1:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.4:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.4p1:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.4p2:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.4p3:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.4p4:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.4p5:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.4p6:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.5:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.6:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.6p1:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.6p2:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.7:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.8:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.8p1:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.8p2:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.9:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.7.9p1:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.0:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.1:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.1p1:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.1p2:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.2:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.3:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.3p1:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.3p2:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.4:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.4p1:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.4p2:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.4p3:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.4p4:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.4p5:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.5:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.5p1:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.5p2:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.5p3:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.6:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.6p1:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.6p2:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.6p3:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.6p4:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.6p5:*:*:*:*:*:*:*;cpe:2.3:a:todd_miller:sudo:1.8.6p6:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2013-1814,0.0,,0.73822,CWE-200,"The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.",2013-03-14,Metasploit,cpe:2.3:a:apache:rave:0.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:rave:0.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:rave:0.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:rave:0.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:rave:0.15:*:*:*:*:*:*:*;cpe:2.3:a:apache:rave:0.16:*:*:*:*:*:*:*;cpe:2.3:a:apache:rave:0.17:*:*:*:*:*:*:*;cpe:2.3:a:apache:rave:0.18:*:*:*:*:*:*:*;cpe:2.3:a:apache:rave:0.19:*:*:*:*:*:*:*;cpe:2.3:a:apache:rave:0.20:*:*:*:*:*:*:*,Apache,Rave
CVE-2013-1892,0.0,,0.44543,CWE-20,"MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service (invalid memory access and server crash) or execute arbitrary code via a crafted memory address in the first argument.",2013-10-01,Metasploit,cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*;cpe:2.3:a:mongodb:mongodb:1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:mongodb:mongodb:1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:mongodb:mongodb:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:mongodb:mongodb:1.8.0:*:*:*:*:*:*:*;cpe:2.3:a:mongodb:mongodb:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:mongodb:mongodb:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mongodb:mongodb:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:mongodb:mongodb:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:mongodb:mongodb:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mongodb:mongodb:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:mongodb:mongodb:2.0.6:*:*:*:*:*:*:*;cpe:2.3:a:mongodb:mongodb:2.0.7:*:*:*:*:*:*:*;cpe:2.3:a:mongodb:mongodb:2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:mongodb:mongodb:2.2.1:*:*:*:*:*:*:*;cpe:2.3:a:mongodb:mongodb:2.2.2:*:*:*:*:*:*:*;cpe:2.3:a:mongodb:mongodb:2.2.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_mrg:2.3:*:*:*:*:*:*:*,Redhat,Enterprise Mrg
CVE-2013-1899,0.0,,0.54312,CWE-94,"Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to cause a denial of service (file corruption), and allows remote authenticated users to modify configuration settings and execute arbitrary code, via a connection request using a database name that begins with a ""-"" (hyphen).",2013-04-04,Metasploit,cpe:2.3:a:postgresql:postgresql:9.0.10:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.0.11:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.0.12:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.0.1:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.0.2:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.0.3:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.0.4:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.0.5:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.0.6:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.0.7:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.0.8:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.0.9:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.0:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.1.1:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.1.2:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.1.3:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.1.4:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.1.5:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.1.6:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.1.7:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.1.8:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.1:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.2.1:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.2.2:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.2.3:*:*:*:*:*:*:*;cpe:2.3:a:postgresql:postgresql:9.2:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:8.04:-:lts:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2013-1965,0.0,,0.93813,CWE-94,"Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.",2013-07-10,Nuclei,cpe:2.3:a:apache:struts2-showcase:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*,Apache,Struts
CVE-2013-1966,0.0,,0.71767,CWE-94,Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.,2013-07-10,Metasploit,cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*,Apache,Struts
CVE-2013-2010,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.73862,CWE-74,WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability,2020-02-12,Metasploit,cpe:2.3:a:automattic:wp_super_cache:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:boldgrid:w3_total_cache:*:*:*:*:*:wordpress:*:*,Automattic,Wp Super Cache
CVE-2013-2028,0.0,,0.87475,CWE-787,"The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a chunked Transfer-Encoding request with a large chunk size, which triggers an integer signedness error and a stack-based buffer overflow.",2013-07-20,Metasploit,cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2013-2050,0.0,,0.15659,CWE-89,SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0 Management Engine (CFME) 5.1 and ManageIQ Enterprise Virtualization Manager 5.0 and earlier allows remote authenticated users to execute arbitrary SQL commands via the profile[] parameter in an explorer action.,2014-01-11,Metasploit,cpe:2.3:a:redhat:cloudforms_management_engine:5.1:*:*:*:*:*:*:*;cpe:2.3:a:redhat:manageiq_enterprise_virtualization_manager:*:*:*:*:*:*:*:*,Redhat,Cloudforms Management Engine
CVE-2013-2068,0.0,,0.58624,CWE-22,"Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the filename parameter to the (1) log, (2) upload, or (3) linuxpkgs method.",2013-09-28,Metasploit,cpe:2.3:a:redhat:cloudforms_management_engine:5.1:*:*:*:*:*:*:*,Redhat,Cloudforms Management Engine
CVE-2013-2094,8.4,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.47709,CWE-189,"The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.",2013-05-14,CISA,cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2013-2097,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.26047,NVD-CWE-noinfo,ZPanel through 10.1.0 has Remote Command Execution,2020-02-12,Metasploit,cpe:2.3:a:zpanel_project:zpanel:10.1.0:*:*:*:*:*:*:*,Zpanel Project,Zpanel
CVE-2013-2113,0.0,,0.20934,CWE-264,The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role.,2013-07-31,Metasploit,cpe:2.3:a:redhat:openstack:3.0:*:*:*:*:*:*:*;cpe:2.3:a:theforeman:foreman:*:rc1:*:*:*:*:*:*;cpe:2.3:a:theforeman:foreman:1.1:*:*:*:*:*:*:*,Redhat,Openstack
CVE-2013-2115,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.72778,CWE-94,Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.,2013-07-10,Metasploit,cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*,Apache,Struts
CVE-2013-2121,0.0,,0.24782,CWE-94,Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name attribute.,2013-07-31,Metasploit,cpe:2.3:a:redhat:openstack:3.0:*:*:*:*:*:*:*;cpe:2.3:a:theforeman:foreman:*:rc1:*:*:*:*:*:*;cpe:2.3:a:theforeman:foreman:1.1:*:*:*:*:*:*:*,Redhat,Openstack
CVE-2013-2143,0.0,,0.48221,CWE-20,"The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which allows remote authenticated users to gain privileges by setting a user account to an administrator account.",2014-04-17,Metasploit,cpe:2.3:a:redhat:network_satellite:-:*:*:*:*:*:*:*;cpe:2.3:a:theforeman:katello:*:*:*:*:*:*:*:*,Redhat,Network Satellite
CVE-2013-2171,0.0,,0.06942,CWE-264,"The vm_map_lookup function in sys/vm/vm_map.c in the mmap implementation in the kernel in FreeBSD 9.0 through 9.1-RELEASE-p4 does not properly determine whether a task should have write access to a memory location, which allows local users to bypass filesystem write permissions and consequently gain privileges via a crafted application that leverages read permissions, and makes mmap and ptrace system calls.",2013-07-02,Metasploit,cpe:2.3:o:freebsd:freebsd:9.0:*:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:9.1:*:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:9.1:p4:*:*:*:*:*:*,Freebsd,Freebsd
CVE-2013-2248,0.0,,0.94654,CWE-20,Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix.,2013-07-20,Nuclei,cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:*,Apache,Struts
CVE-2013-2251,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99998,CWE-74,"Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.",2013-07-20,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:archiva:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:archiva:1.2.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:archiva:1.2:-:*:*:*:*:*:*;cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*;cpe:2.3:a:fujitsu:interstage_business_process_manager_analytics:12.0:*:*:*:*:*:*:*;cpe:2.3:a:fujitsu:interstage_business_process_manager_analytics:12.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:siebel_apps_-_e-billing:6.2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:oracle:solaris:11:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:*:*:*:*:*:*:*:*,Microsoft,Windows Server 2003
CVE-2013-2287,0.0,,0.09239,CWE-79,Multiple cross-site scripting (XSS) vulnerabilities in views/notify.php in the Uploader plugin 1.0.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) notify or (2) blog parameter.,2014-04-04,Nuclei,cpe:2.3:a:roberta_bramski:uploader:1.0.4:*:*:*:*:*:*:*,Roberta Bramski,Uploader
CVE-2013-2333,0.0,,0.89809,NVD-CWE-noinfo,"Unspecified vulnerability in HP Storage Data Protector 6.20, 6.21, 7.00, and 7.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1680.",2013-06-06,Metasploit,cpe:2.3:a:hp:storage_data_protector:6.20:-:*:*:*:hp-ux:*:*;cpe:2.3:a:hp:storage_data_protector:6.20:-:*:*:*:redhat_enterprise_linux:*:*;cpe:2.3:a:hp:storage_data_protector:6.20:-:*:*:*:sunos:*:*;cpe:2.3:a:hp:storage_data_protector:6.20:-:*:*:*:suse_linux:*:*;cpe:2.3:a:hp:storage_data_protector:6.20:-:*:*:*:windows_server_2003:*:*;cpe:2.3:a:hp:storage_data_protector:6.20:-:*:*:*:windows_server_2008:*:*;cpe:2.3:a:hp:storage_data_protector:6.21:-:*:*:*:hp-ux:*:*;cpe:2.3:a:hp:storage_data_protector:6.21:-:*:*:*:redhat_enterprise_linux:*:*;cpe:2.3:a:hp:storage_data_protector:6.21:-:*:*:*:sunos:*:*;cpe:2.3:a:hp:storage_data_protector:6.21:-:*:*:*:suse_linux:*:*;cpe:2.3:a:hp:storage_data_protector:6.21:-:*:*:*:windows_server_2003:*:*;cpe:2.3:a:hp:storage_data_protector:6.21:-:*:*:*:windows_server_2008:*:*;cpe:2.3:a:hp:storage_data_protector:7.00:-:*:*:*:hp-ux:*:*;cpe:2.3:a:hp:storage_data_protector:7.00:-:*:*:*:redhat_enterprise_linux:*:*;cpe:2.3:a:hp:storage_data_protector:7.00:-:*:*:*:suse_linux:*:*;cpe:2.3:a:hp:storage_data_protector:7.00:-:*:*:*:windows_server_2003:*:*;cpe:2.3:a:hp:storage_data_protector:7.00:-:*:*:*:windows_server_2008:*:*;cpe:2.3:a:hp:storage_data_protector:7.01:-:*:*:*:hp-ux:*:*;cpe:2.3:a:hp:storage_data_protector:7.01:-:*:*:*:redhat_enterprise_linux:*:*;cpe:2.3:a:hp:storage_data_protector:7.01:-:*:*:*:suse_linux:*:*;cpe:2.3:a:hp:storage_data_protector:7.01:-:*:*:*:windows_server_2003:*:*;cpe:2.3:a:hp:storage_data_protector:7.01:-:*:*:*:windows_server_2008:*:*,Hp,Storage Data Protector
CVE-2013-2343,0.0,,0.61813,NVD-CWE-noinfo,"Unspecified vulnerability on the HP LeftHand Virtual SAN Appliance hydra with software before 10.0 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1510.",2013-07-02,Metasploit,cpe:2.3:a:hp:lefthand_p4000_virtual_san_appliance:-:*:*:*:*:*:*:*;cpe:2.3:a:hp:lefthand_virtual_san_appliance_hydra:-:*:*:*:*:*:*:*;cpe:2.3:a:hp:lefthand_virtual_san_appliance_hydra_software:*:*:*:*:*:*:*:*,Hp,Lefthand P4000 Virtual San Appliance
CVE-2013-2347,0.0,,0.66409,NVD-CWE-noinfo,"The Backup Client Service (OmniInet.exe) in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary commands or cause a denial of service via a crafted EXEC_BAR packet to TCP port 5555, aka ZDI-CAN-1885.",2014-01-04,Metasploit,cpe:2.3:a:hp:storage_data_protector:6.20:-:*:*:*:hp-ux:*:*;cpe:2.3:a:hp:storage_data_protector:6.20:-:*:*:*:redhat_enterprise_linux:*:*;cpe:2.3:a:hp:storage_data_protector:6.20:-:*:*:*:solaris:*:*;cpe:2.3:a:hp:storage_data_protector:6.20:-:*:*:*:windows_server_2003:*:*;cpe:2.3:a:hp:storage_data_protector:6.20:-:*:*:*:windows_server_2008:*:*;cpe:2.3:a:hp:storage_data_protector:6.21:-:*:*:*:hp-ux:*:*;cpe:2.3:a:hp:storage_data_protector:6.21:-:*:*:*:redhat_enterprise_linux:*:*;cpe:2.3:a:hp:storage_data_protector:6.21:-:*:*:*:solaris:*:*;cpe:2.3:a:hp:storage_data_protector:6.21:-:*:*:*:windows_server_2003:*:*;cpe:2.3:a:hp:storage_data_protector:6.21:-:*:*:*:windows_server_2008:*:*,Hp,Storage Data Protector
CVE-2013-2367,0.0,,0.68895,NVD-CWE-noinfo,"Multiple unspecified vulnerabilities in HP SiteScope 11.20 and 11.21, when SOAP is used, allow remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1678.",2013-07-31,Metasploit,cpe:2.3:a:hp:sitescope:11.20:*:*:*:*:*:*:*;cpe:2.3:a:hp:sitescope:11.21:*:*:*:*:*:*:*,Hp,Sitescope
CVE-2013-2370,0.0,,0.62764,NVD-CWE-noinfo,"Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1671.",2013-07-29,Metasploit,cpe:2.3:a:hp:loadrunner:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:11.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:11.50:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:9.0.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:9.50.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:9.51:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:9.52:*:*:*:*:*:*:*,Hp,Loadrunner
CVE-2013-2423,3.7,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N,0.85333,NVD-CWE-noinfo,"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot.  NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.",2013-04-17,CISA/Metasploit,cpe:2.3:a:oracle:jre:1.7.0:-:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update10:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update11:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update13:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update15:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update7:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update9:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2013-2460,0.0,,0.70248,NVD-CWE-noinfo,"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to ""insufficient access checks"" in the tracing component.",2013-06-18,Metasploit,cpe:2.3:a:oracle:jdk:*:update21:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update10:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update11:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update13:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update15:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update17:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update5:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update6:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update7:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update9:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:*:update21:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update10:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update11:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update13:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update15:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update17:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update7:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update9:*:*:*:*:*:*,Oracle,Jre
CVE-2013-2465,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98704,NVD-CWE-noinfo,"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to ""Incorrect image channel verification"" in 2D.",2013-06-18,CISA/EPSS/Metasploit,cpe:2.3:a:oracle:jre:1.5.0:-:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update36:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update38:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update39:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update40:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update41:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update45:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:-:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update22:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update23:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update24:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update25:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update26:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update27:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update29:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update30:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update31:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update32:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update33:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update34:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update35:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update37:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update38:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update39:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update41:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update43:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update45:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:-:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update10:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update11:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update13:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update15:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update17:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update21:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update5:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update6:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update7:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update9:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update10:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update17:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update18:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update19:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update20:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update21:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update22:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update23:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update24:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update25:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update26:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update27:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update28:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update29:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update2:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update31:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update33:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update7:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update8:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.5.0:update9:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_13:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_14:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_15:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_16:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_17:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_18:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_19:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_20:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_21:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*;cpe:2.3:a:sun:jre:1.6.0:update_9:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_java:10:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_java:11:sp2:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_java:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:vmware:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3:*:*:*:*:*:*,Suse,Linux Enterprise Desktop
CVE-2013-2492,0.0,,0.42166,CWE-119,"Stack-based buffer overflow in Firebird 2.1.3 through 2.1.5 before 18514, and 2.5.1 through 2.5.3 before 26623, on Windows allows remote attackers to execute arbitrary code via a crafted packet to TCP port 3050, related to a missing size check during extraction of a group number from CNCT information.",2013-03-15,Metasploit,cpe:2.3:a:firebirdsql:firebird:2.1.3:*:*:*:*:*:*:*;cpe:2.3:a:firebirdsql:firebird:2.1.4:*:*:*:*:*:*:*;cpe:2.3:a:firebirdsql:firebird:2.1.5:*:*:*:*:*:*:*;cpe:2.3:a:firebirdsql:firebird:2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:firebirdsql:firebird:2.5.2:*:*:*:*:*:*:*;cpe:2.3:a:firebirdsql:firebird:2.5.3:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2013-2551,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.74096,CWE-416,"Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013, aka ""Internet Explorer Use After Free Vulnerability,"" a different vulnerability than CVE-2013-1308 and CVE-2013-1309.",2013-03-11,CISA/Metasploit,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:-:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows Server 2003
CVE-2013-2566,5.9,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N,0.84424,CWE-326,"The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext.",2013-03-15,Metasploit,cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_application_session_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:http_server:11.1.1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:http_server:11.1.1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:http_server:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:http_server:12.2.1.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:http_server:12.2.1.2.0:*:*:*:*:*:*:*;cpe:2.3:h:fujitsu:m10-1:-:*:*:*:*:*:*:*;cpe:2.3:h:fujitsu:m10-4:-:*:*:*:*:*:*:*;cpe:2.3:h:fujitsu:m10-4s:-:*:*:*:*:*:*:*;cpe:2.3:h:fujitsu:sparc_enterprise_m3000:-:*:*:*:*:*:*:*;cpe:2.3:h:fujitsu:sparc_enterprise_m4000:-:*:*:*:*:*:*:*;cpe:2.3:h:fujitsu:sparc_enterprise_m5000:-:*:*:*:*:*:*:*;cpe:2.3:h:fujitsu:sparc_enterprise_m8000:-:*:*:*:*:*:*:*;cpe:2.3:h:fujitsu:sparc_enterprise_m9000:-:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*;cpe:2.3:o:fujitsu:m10-1_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:fujitsu:m10-4_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:fujitsu:m10-4s_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:fujitsu:sparc_enterprise_m3000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:fujitsu:sparc_enterprise_m4000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:fujitsu:sparc_enterprise_m5000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:fujitsu:sparc_enterprise_m8000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:fujitsu:sparc_enterprise_m9000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:oracle:integrated_lights_out_manager_firmware:*:*:*:*:*:*:*:*,Oracle,Integrated Lights Out Manager Firmware
CVE-2013-2578,0.0,,0.73713,CWE-78,"cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6 allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the ServerName parameter and (2) other unspecified parameters.",2013-10-11,Metasploit,cpe:2.3:h:tp-link:tl-sc3130:-:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:tl-sc3130g:-:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:tl-sc3171:-:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:tl-sc3171g:-:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:lm_firmware:*:*:*:*:*:*:*:*,TP-Link,Lm Firmware
CVE-2013-2596,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03373,CWE-190,"Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.",2013-04-13,CISA,cpe:2.3:h:motorola:atrix_hd:-:*:*:*:*:*:*:*;cpe:2.3:h:motorola:razr_hd:-:*:*:*:*:*:*:*;cpe:2.3:h:motorola:razr_m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:msm8960:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:motorola:android:4.1.2:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2013-2597,8.4,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01516,NVD-CWE-Other,"Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via an application that leverages /dev/msm_acdb access and provides a large size value in an ioctl argument.",2014-08-31,CISA,cpe:2.3:o:codeaurora:android-msm:2.6.29:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.22:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.23:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.24:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.25:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.26:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.27:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.28:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.29:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.30:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.31:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.32:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.33:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.35:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.36:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.37:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.38:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.39:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.40:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.41:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.42:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.43:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.44:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.45:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.46:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.47:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.48:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.49:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.50:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.51:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.52:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10.53:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.10:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.12.10:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.12.11:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.12.12:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.12.13:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.12.14:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.12.15:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.12.16:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.12.17:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.12.18:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.12.19:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.12.20:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.12.21:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.12.22:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.12.23:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.12.24:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.12.25:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.12.26:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.12.3:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.12.4:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.12.5:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.12.6:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.12.7:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.12.8:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.12.9:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.13.10:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.13.11:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.13.1:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.13.2:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.13.3:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.13.4:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.13.5:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.13.6:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.13.7:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.13.8:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.13.9:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.13:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.13:rc1:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.13:rc2:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.13:rc3:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.13:rc4:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.13:rc5:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.13:rc6:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.13:rc7:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.13:rc8:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14.10:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14.11:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14.12:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14.13:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14.14:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14.15:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14.16:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14.1:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14.2:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14.3:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14.4:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14.5:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14.6:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14.7:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14.8:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14.9:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14:rc1:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14:rc2:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14:rc3:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14:rc4:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14:rc5:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14:rc6:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14:rc7:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.14:rc8:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.15.10:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.15.1:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.15.2:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.15.3:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.15.4:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.15.5:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.15.6:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.15.7:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.15.8:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.15.9:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.15:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.15:rc1:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.15:rc2:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.15:rc3:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.15:rc4:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.15:rc5:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.15:rc6:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.15:rc7:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.15:rc8:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.16.1:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.16:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.16:rc1:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.16:rc2:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.16:rc3:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.16:rc4:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.16:rc5:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.16:rc6:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.16:rc7:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.17:rc1:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.2.54:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.2.55:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.2.56:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.2.57:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.2.58:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.2.59:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.2.60:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.2.61:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.2.62:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.100:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.101:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.102:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.103:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.72:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.73:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.74:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.75:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.76:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.77:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.78:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.79:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.80:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.81:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.82:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.83:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.84:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.85:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.86:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.87:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.88:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.89:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.90:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.91:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.92:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.93:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.94:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.95:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.96:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.97:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.98:*:*:*:*:*:*:*;cpe:2.3:o:codeaurora:android-msm:3.4.99:*:*:*:*:*:*:*,Codeaurora,Android-Msm
CVE-2013-2621,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.10692,CWE-601,Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websites via a crafted URL.,2020-02-03,Nuclei,cpe:2.3:a:telaen_project:telaen:*:*:*:*:*:*:*:*,Telaen Project,Telaen
CVE-2013-2641,0.0,,0.7099,CWE-22,Directory traversal vulnerability in patience.cgi in Sophos Web Appliance before 3.7.8.2 allows remote attackers to read arbitrary files via the id parameter.,2014-03-18,Metasploit,cpe:2.3:h:sophos:web_appliance:-:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:*:*:*:*:*:*:*:*,Sophos,Web Appliance Firmware
CVE-2013-2729,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.66555,CWE-190,"Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-2727.",2013-05-16,CISA,cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:5.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*,Suse,Linux Enterprise Desktop
CVE-2013-2730,0.0,,0.78757,CWE-119,"Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-2733.",2013-05-16,Metasploit,cpe:2.3:a:adobe:acrobat:10.0.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:10.0.1:-:pro:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:10.0.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:10.0.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:10.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:10.0:-:pro:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:10.1.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:10.1.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:10.1.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:10.1.4:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:10.1.5:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:10.1.6:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:10.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:11.0.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:11.0.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:11.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.0:-:pro:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.1.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.1.1:-:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.1.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.1.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.1.3:-:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.1:-:pro:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.2:-:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.3.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.3.1:-:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.3.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.3.2:-:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.3.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.3.4:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.3.4:-:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.3:-:pro:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.4.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.4.1:-:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.4.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.4.2:-:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.4.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.4.3:-:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.4.4:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.4.4:-:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.4.5:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.4.5:-:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.4.6:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.4.6:-:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.4.7:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.4:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.5.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.5.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.5.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.5.4:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat:9.5:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:10.0.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:10.0.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:10.0.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:10.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:10.1.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:10.1.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:10.1.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:10.1.4:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:10.1.5:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:10.1.6:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:10.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:11.0.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:11.0.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:11.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.1.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.1.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.1.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.3.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.3.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.3.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.3.4:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.4.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.4.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.4.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.4.4:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.4.5:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.4.6:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.4.7:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.4:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.5.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.5.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.5.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.5.4:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:9.5:*:*:*:*:*:*:*,Adobe,Acrobat Reader
CVE-2013-2751,0.0,,0.71599,CWE-94,"Eval injection vulnerability in frontview/lib/np_handler.pl in the FrontView web interface in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4.2.x before 4.2.24 allows remote attackers to execute arbitrary Perl code via a crafted request, related to the ""forgot password workflow.""",2013-12-12,Metasploit,cpe:2.3:o:netgear:raidiator:*:*:*:*:*:readynas:*:*,Netgear,Raidiator
CVE-2013-2827,0.0,,0.49235,CWE-94,"An unspecified ActiveX control in WellinTech KingSCADA before 3.1.2, KingAlarm&Event before 3.1, and KingGraphic before 3.1.2 allows remote attackers to download arbitrary DLL code onto a client machine and execute this code via the ProjectURL property value.",2014-01-15,Metasploit,cpe:2.3:a:wellintech:kingalarm\&event:*:*:*:*:*:*:*:*;cpe:2.3:a:wellintech:kinggraphic:*:*:*:*:*:*:*:*;cpe:2.3:a:wellintech:kingscada:*:*:*:*:*:*:*:*,Wellintech,Kingalarm&Event
CVE-2013-3163,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.70676,CWE-787,"Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka ""Internet Explorer Memory Corruption Vulnerability,"" a different vulnerability than CVE-2013-3144 and CVE-2013-3151.",2013-07-10,CISA/Metasploit,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:-:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2013-3182,0.0,,0.95888,CWE-119,"The Windows NAT Driver (aka winnat) service in Microsoft Windows Server 2012 does not properly validate memory addresses during the processing of ICMP packets, which allows remote attackers to cause a denial of service (memory corruption and system hang) via crafted packets, aka ""Windows NAT Denial of Service Vulnerability.""",2013-08-14,EPSS,cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*,Microsoft,Windows Server 2012
CVE-2013-3184,0.0,,0.58427,CWE-119,"Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka ""Internet Explorer Memory Corruption Vulnerability.""",2013-08-14,Metasploit,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*,Microsoft,Internet Explorer
CVE-2013-3205,0.0,,0.66277,CWE-119,"Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka ""Internet Explorer Memory Corruption Vulnerability.""",2013-09-11,Metasploit,cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*,Microsoft,Internet Explorer
CVE-2013-3214,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.84535,CWE-74,vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'.,2020-01-28,Metasploit,cpe:2.3:a:vtiger:vtiger_crm:*:*:*:*:*:*:*:*,Vtiger,Vtiger Crm
CVE-2013-3215,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.68849,CWE-287,vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession function.,2020-01-29,Metasploit,cpe:2.3:a:vtiger:vtiger_crm:*:*:*:*:*:*:*:*,Vtiger,Vtiger Crm
CVE-2013-3238,0.0,,0.28851,NVD-CWE-noinfo,"phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\x00 sequence, which is not properly handled before making a preg_replace function call within the ""Replace table prefix"" feature.",2013-04-26,Metasploit,cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.1.0:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.0:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.1:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.2:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.3.0:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.4:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.5:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.6:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:rc1:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8:rc1:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*,Phpmyadmin,Phpmyadmin
CVE-2013-3248,0.0,,0.18483,NVD-CWE-Other,"Untrusted search path vulnerability in Corel PDF Fusion 1.11 allows local users to gain privileges via a Trojan horse wintab32.dll file in the current working directory, as demonstrated by a directory that contains a .pdf or .xps file.",2013-10-03,Metasploit,cpe:2.3:a:corel:pdf_fusion:1.11:*:*:*:*:*:*:*,Corel,Pdf Fusion
CVE-2013-3319,0.0,,0.20346,CWE-200,The GetComputerSystem method in the HostControl service in SAP Netweaver 7.03 allows remote attackers to obtain sensitive information via a crafted SOAP request to TCP port 1128.,2013-08-16,Metasploit,cpe:2.3:a:sap:netweaver:7.03:*:*:*:*:*:*:*,Sap,Netweaver
CVE-2013-3336,0.0,,0.74265,NVD-CWE-noinfo,"Unspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files via unknown vectors.",2013-05-09,Metasploit,cpe:2.3:a:adobe:coldfusion:10.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:9.0.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:9.0.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:9.0:*:*:*:*:*:*:*,Adobe,Coldfusion
CVE-2013-3346,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.78581,CWE-787,"Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-2718, CVE-2013-2719, CVE-2013-2720, CVE-2013-2721, CVE-2013-2722, CVE-2013-2723, CVE-2013-2725, CVE-2013-2726, CVE-2013-2731, CVE-2013-2732, CVE-2013-2734, CVE-2013-2735, CVE-2013-2736, CVE-2013-3337, CVE-2013-3338, CVE-2013-3339, CVE-2013-3340, and CVE-2013-3341.",2013-08-30,CISA/Metasploit,cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*,Adobe,Acrobat
CVE-2013-3482,0.0,,0.31514,CWE-119,Stack-based buffer overflow in the rf_report_error function in ermapper_u.dll in Intergraph ERDAS ER Viewer before 13.0.1.1301 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a long string in an ERS file.,2014-01-19,Metasploit,cpe:2.3:a:hexagon:erdas_er_viewer:*:*:*:*:*:*:*:*;cpe:2.3:a:hexagon:erdas_er_viewer:11.04:*:*:*:*:*:*:*;cpe:2.3:a:hexagon:erdas_er_viewer:13.00.0001:*:*:*:*:*:*:*,Hexagon,Erdas Er Viewer
CVE-2013-3502,0.0,,0.53706,CWE-255,"monarch_scan.cgi in the MONARCH component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands, and consequently obtain sensitive information, by leveraging a JOSSO SSO cookie.",2013-05-08,Metasploit,cpe:2.3:a:gwos:groundwork_monitor:6.7.0:-:enterprise:*:*:*:*:*,Gwos,Groundwork Monitor
CVE-2013-3520,0.0,,0.5564,CWE-94,"VMware vCenter Chargeback Manager (aka CBM) before 2.5.1 does not proper handle uploads, which allows remote attackers to execute arbitrary code via unspecified vectors.",2013-06-17,Metasploit,cpe:2.3:a:vmware:vcenter_chargeback_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_chargeback_manager:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_chargeback_manager:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_chargeback_manager:1.6.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_chargeback_manager:1.6.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_chargeback_manager:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_chargeback_manager:2.0.1:*:*:*:*:*:*:*,Vmware,Vcenter Chargeback Manager
CVE-2013-3522,0.0,,0.27084,CWE-89,"SQL injection vulnerability in index.php/ajax/api/reputation/vote in vBulletin 5.0.0 Beta 11, 5.0.0 Beta 28, and earlier allows remote authenticated users to execute arbitrary SQL commands via the nodeid parameter.",2013-05-10,Metasploit,cpe:2.3:a:vbulletin:vbulletin:5.0.0:beta_11:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.0.0:beta_28:*:*:*:*:*:*,Vbulletin,Vbulletin
CVE-2013-3526,0.0,,0.13939,CWE-79,"Cross-site scripting (XSS) vulnerability in js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the aoid parameter.",2013-05-10,Nuclei,cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:1.1.0:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:1.1.3:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:1.6.1:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:1.8.0:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:2.1.0:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:2.2.1:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:2.3.0:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:2.4.0:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:2.4.1:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:2.5.0:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:2.5.2:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:2.6.0:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:2.7.0:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:2.7.1:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:2.8.0:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:2.8.1:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:2.8.2:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:2.9.0:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:2.9.1:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:3.3.0:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:wptrafficanalyzer:trafficanalyzer:3.3.2:*:*:*:*:*:*:*,Wptrafficanalyzer,Trafficanalyzer
CVE-2013-3563,0.0,,0.48222,CWE-119,Stack-based buffer overflow in db_netserver in Lianja SQL Server before 1.0.0RC5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted string to TCP port 8001.,2013-07-04,Metasploit,cpe:2.3:a:lianja:lianja_sql_server:*:rc5.1:*:*:*:*:*:*,Lianja,Lianja Sql Server
CVE-2013-3568,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.25129,CWE-352,Cross-site request forgery (CSRF) vulnerability in Cisco Linksys WRT110 allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors.,2020-02-06,Metasploit,cpe:2.3:h:cisco:linksys_wrt110:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:linksys_wrt110_firmware:-:*:*:*:*:*:*:*,Cisco,Linksys Wrt110 Firmware
CVE-2013-3576,0.0,,0.66592,CWE-78,ginkgosnmp.inc in HP System Management Homepage (SMH) allows remote authenticated users to execute arbitrary commands via shell metacharacters in the PATH_INFO to smhutil/snmpchp.php.en.,2013-06-14,Metasploit,cpe:2.3:a:hp:system_management_homepage:*:*:*:*:*:*:*:*,Hp,System Management Homepage
CVE-2013-3591,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.43103,CWE-434,vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution Vulnerability,2020-02-07,Metasploit,cpe:2.3:a:vtiger:vtiger_crm:5.3.0:-:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:5.4.0:-:*:*:*:*:*:*,Vtiger,Vtiger Crm
CVE-2013-3617,0.0,,0.21074,CWE-264,"The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an external entity declaration in conjunction with an entity reference to /ws/dal/ADUser or other /ws/dal/XXX interfaces, related to an XML External Entity (XXE) issue.",2013-11-02,Metasploit,cpe:2.3:a:openbravo:openbravo_erp:*:*:*:*:*:*:*:*;cpe:2.3:a:openbravo:openbravo_erp:2.40:*:*:*:*:*:*:*;cpe:2.3:a:openbravo:openbravo_erp:2.50:*:*:*:*:*:*:*,Openbravo,Openbravo Erp
CVE-2013-3619,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09688,CWE-798,Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT_X9_317 and firmware for Supermicro X8 generation motherboards before SMT X8 312 contain harcoded private encryption keys for the (1) Lighttpd web server SSL interface and the (2) Dropbear SSH daemon.,2020-01-02,Metasploit,cpe:2.3:h:citrix:netscaler:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:netscaler_sd-wan:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:netscaler_sdx:-:*:*:*:*:*:*:*;cpe:2.3:h:supermicro:sh7757:-:*:*:*:*:*:*:*;cpe:2.3:h:supermicro:sh7758:-:*:*:*:*:*:*:*;cpe:2.3:o:citrix:netscaler_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:citrix:netscaler_sd-wan_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:citrix:netscaler_sdx_firmware:10:*:*:*:*:*:*:*;cpe:2.3:o:supermicro:smt_x8_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:supermicro:smt_x9_firmware:*:*:*:*:*:*:*:*,Supermicro,Smt X9 Firmware
CVE-2013-3623,0.0,,0.71929,CWE-119,Multiple stack-based buffer overflows in cgi/close_window.cgi in the web interface in the Intelligent Platform Management Interface (IPMI) with firmware before 3.15 (SMT_X9_315) on Supermicro X9 generation motherboards allow remote attackers to execute arbitrary code via the (1) sess_sid or (2) ACT parameter.,2013-12-10,Metasploit,cpe:2.3:o:supermicro:intelligent_platform_management_firmware:*:-:-:*:-:-:x9_generation_motherboards:*;cpe:2.3:o:supermicro:intelligent_platform_management_firmware:2.24:-:-:*:-:-:x9_generation_motherboards:*,Supermicro,Intelligent Platform Management Firmware
CVE-2013-3628,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.67463,CWE-74,Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability,2020-02-07,Metasploit,cpe:2.3:a:zabbix:zabbix:2.0.9:-:*:*:*:*:*:*,Zabbix,Zabbix
CVE-2013-3629,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.43103,NVD-CWE-Other,ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution,2020-02-07,Metasploit,cpe:2.3:a:ispconfig:ispconfig:3.0.5.2:*:*:*:*:*:*:*,Ispconfig,Ispconfig
CVE-2013-3630,0.0,,0.42566,CWE-94,Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor.,2013-11-01,Metasploit,cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.2.1:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.3.1:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.3.2:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.3.3:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.3.4:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.4.1:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.4.2:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.4.3:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.4.4:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.4.5:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.5.0:beta:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.5.1:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.5.2:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.5.3:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.5:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.6.1:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.6.2:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.6.3:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.6.4:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.6.5:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.6.6:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.6.7:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.6.8:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.7.1:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.7.2:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.7.3:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.7.4:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.7.5:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.7.6:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.8.10:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.8.11:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.8.12:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.8.13:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.8.14:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.8.1:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.8.2:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.8.3:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.8.4:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.8.5:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.8.6:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.8.7:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.8.8:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.8.9:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.9.10:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.9.11:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.9.12:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.9.13:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.9.14:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.9.15:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.9.16:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.9.17:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.9.18:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.9.1:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.9.2:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.9.3:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.9.4:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.9.5:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.9.6:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.9.7:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.9.8:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:1.9.9:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.0.6:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.0.7:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.0.8:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.0.9:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.1.0:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.1.10:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.1.2:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.1.3:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.1.4:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.1.5:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.1.6:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.1.7:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.1.8:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.1.9:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.2.10:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.2.11:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.2.1:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.2.2:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.2.3:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.2.4:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.2.5:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.2.6:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.2.7:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.2.8:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.2.9:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.3.0:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.3.2:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.3.3:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.3.4:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.3.5:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.3.6:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.3.7:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.3.8:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.4.0:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.4.1:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.4.2:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.4.3:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.4.4:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.4.5:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.5.0:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.5.1:*:*:*:*:*:*:*,Moodle,Moodle
CVE-2013-3631,0.0,,0.13729,CWE-94,"NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code via a request to exec.php, aka the ""Advanced | Execute Command"" feature.  NOTE: this issue might not be a vulnerability, since it appears to be part of legitimate, intentionally-exposed functionality by the developer and is allowed within the intended security policy.",2013-11-02,Metasploit,cpe:2.3:a:nas4free:nas4free:*:*:*:*:*:*:*:*;cpe:2.3:a:nas4free:nas4free:9.1.0.1.798:*:*:*:*:*:*:*,Nas4Free,Nas4Free
CVE-2013-3632,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.56838,CWE-264,The Cron service in rpc.php in OpenMediaVault allows remote authenticated users to execute cron jobs as arbitrary users and execute arbitrary commands via the username parameter.,2014-09-29,Metasploit,cpe:2.3:a:openmediavault:openmediavault:-:*:*:*:*:*:*:*,Openmediavault,Openmediavault
CVE-2013-3660,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.39578,CWE-119,"The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 does not properly initialize a pointer for the next object in a certain list, which allows local users to obtain write access to the PATHRECORD chain, and consequently gain privileges, by triggering excessive consumption of paged memory and then making many FlattenPath function calls, aka ""Win32k Read AV Vulnerability.""",2013-05-24,CISA/Metasploit,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2013-3763,0.0,,0.5984,NVD-CWE-noinfo,"Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 7.4.0 and 7.5.1.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2013-3764.",2013-07-17,Metasploit,cpe:2.3:a:oracle:fusion_middleware:7.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:fusion_middleware:7.5.1.1:*:*:*:*:*:*:*,Oracle,Fusion Middleware
CVE-2013-3827,0.0,,0.32441,NVD-CWE-noinfo,"Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, and 12.1.2.0.0; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors related to Java Server Faces or Web Container.",2013-10-16,Nuclei,cpe:2.3:a:oracle:fusion_middleware:10.3.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:fusion_middleware:11.1.2.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:fusion_middleware:11.1.2.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:fusion_middleware:12.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:fusion_middleware:12.1.2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:fusion_middleware:2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:fusion_middleware:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:fusion_middleware:3.1.2:*:*:*:*:*:*:*,Oracle,Fusion Middleware
CVE-2013-3843,0.0,,0.20179,CWE-119,Stack-based buffer overflow in the mk_request_header_process function in mk_request.c in Monkey HTTP Daemon (monkeyd) before 1.2.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTTP header.,2014-06-13,Metasploit,cpe:2.3:a:monkey-project:monkey:*:*:*:*:*:*:*:*,Monkey-Project,Monkey
CVE-2013-3881,0.0,,0.14835,CWE-399,"win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges via a crafted application, aka ""Win32k NULL Page Vulnerability.""",2013-10-09,Metasploit,cpe:2.3:o:microsoft:windows_7:*:sp1:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:sp1:x86:*:*:*:*:*,Microsoft,Windows 7
CVE-2013-3893,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.8593,CWE-416,"Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings, as demonstrated by use of an ms-help: URL that triggers loading of hxds.dll.",2013-09-18,CISA/Metasploit,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:developer-preview:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:release-preview:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*,Microsoft,Internet Explorer
CVE-2013-3896,5.5,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.6961,NVD-CWE-noinfo,"Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application, aka ""Silverlight Vulnerability.""",2013-10-09,CISA/Metasploit,cpe:2.3:a:microsoft:silverlight:*:*:*:*:*:*:*:*,Microsoft,Silverlight
CVE-2013-3897,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.77462,CWE-416,"Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JavaScript code that uses the onpropertychange event handler, as exploited in the wild in September and October 2013, aka ""Internet Explorer Memory Corruption Vulnerability.""",2013-10-09,CISA/Metasploit,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows Server 2003
CVE-2013-3900,5.5,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N,0.44647,CWE-347,"Why is Microsoft republishing a CVE from 2013?
We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Windows 10 and Windows 11. While the format is different from the original CVE published in 2013, except for clarifications about how to configure the EnableCertPaddingCheck registry value, the information herein remains unchanged from the original text published on December 10, 2013,
Microsoft does not plan to enforce the stricter verification behavior as a default functionality on supported releases of Microsoft Windows. This behavior remains available as an opt-in feature via reg key setting, and is available on supported editions of Windows released since December 10, 2013. This includes all currently supported versions of Windows 10 and Windows 11. The supporting code for this reg key was incorporated at the time of release for Windows 10 and Windows 11, so no security update is required; however, the reg key must be set. See the Security Updates table for the list of affected software.
Vulnerability Description
A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for portable executable (PE) files. An anonymous attacker could exploit the vulnerability by modifying an existing signed executable file to leverage unverified portions of the file in such a way as to add malicious code to the file without invalidating the signature. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Exploitation of this vulnerability requires that a user or application run or install a specially crafted, signed PE file. An attacker could modify an... See more at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900",2013-12-11,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_21h2:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_21h2:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_24h2:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_24h2:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2013-3906,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.84971,CWE-94,"GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.",2013-11-06,CISA/Metasploit,cpe:2.3:a:microsoft:excel_viewer:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:lync:2010:*:*:*:attendee:*:*:*;cpe:2.3:a:microsoft:lync:2013:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2010:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:powerpoint_viewer:2010:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:powerpoint_viewer:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:word_viewer:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows Server 2008
CVE-2013-3918,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.73872,CWE-787,"The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted web page that is accessed by Internet Explorer, as exploited in the wild in November 2013, aka ""InformationCardSigninHelper Vulnerability.""",2013-11-12,CISA/Metasploit,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:sp2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2013-3928,0.0,,0.37328,CWE-119,Stack-based buffer overflow in the ReadFile function in flt_BMP.dll in Chasys Draw IES before 4.11.02 allows remote attackers to execute arbitrary code via crafted biPlanes and biBitCount fields in a BMP file.,2014-03-11,Metasploit,cpe:2.3:a:jpchacha:chasys_draw_ies:*:*:*:*:*:*:*:*;cpe:2.3:a:jpchacha:chasys_draw_ies:4.00.01:*:*:*:*:*:*:*;cpe:2.3:a:jpchacha:chasys_draw_ies:4.01.01:*:*:*:*:*:*:*;cpe:2.3:a:jpchacha:chasys_draw_ies:4.02.01:*:*:*:*:*:*:*;cpe:2.3:a:jpchacha:chasys_draw_ies:4.03.02:*:*:*:*:*:*:*;cpe:2.3:a:jpchacha:chasys_draw_ies:4.04.01:*:*:*:*:*:*:*;cpe:2.3:a:jpchacha:chasys_draw_ies:4.06.02:*:*:*:*:*:*:*,Jpchacha,Chasys Draw Ies
CVE-2013-3956,0.0,,0.07799,CWE-264,"The NICM.SYS kernel driver 3.1.11.0 in Novell Client 4.91 SP5 on Windows XP and Windows Server 2003; Novell Client 2 SP2 on Windows Vista and Windows Server 2008; and Novell Client 2 SP3 on Windows Server 2008 R2, Windows 7, Windows 8, and Windows Server 2012 allows local users to gain privileges via a crafted 0x143B6B IOCTL call.",2013-07-31,Metasploit,cpe:2.3:a:novell:client:2.0:sp2:*:*:*:*:*:*;cpe:2.3:a:novell:client:2.0:sp3:*:*:*:*:*:*;cpe:2.3:a:novell:client:4.91:sp5:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:-:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:-:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:*:*:*:*:*:*:*:*,Microsoft,Windows 2003 Server
CVE-2013-3975,0.0,,0.13151,NVD-CWE-noinfo,"Unspecified vulnerability in the Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to discover user names, full names, and e-mail addresses via a search.",2014-05-26,Metasploit,cpe:2.3:a:ibm:sametime:8.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.0.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.0.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.0.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.5.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.5.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.5.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.5.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:9.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:9.0.0.1:*:*:*:*:*:*:*,Ibm,Sametime
CVE-2013-3977,0.0,,0.09048,CWE-287,The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to determine which meeting rooms are owned by a user by leveraging knowledge of valid user names.,2014-05-26,Metasploit,cpe:2.3:a:ibm:sametime:8.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.0.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.0.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.0.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.5.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.5.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.5.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.5.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:9.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:9.0.0.1:*:*:*:*:*:*:*,Ibm,Sametime
CVE-2013-3982,0.0,,0.13151,CWE-200,The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to obtain unspecified installation information and technical data via a request to a public page.,2014-05-26,Metasploit,cpe:2.3:a:ibm:sametime:8.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.0.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.0.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.0.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.5.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.5.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.5.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:8.5.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:9.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sametime:9.0.0.1:*:*:*:*:*:*:*,Ibm,Sametime
CVE-2013-3986,0.0,,0.09279,CWE-119,IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote attackers to cause a denial of service (WebPlayer Firefox extension crash) via a crafted Audio Visual (AV) session.,2013-11-08,Metasploit,cpe:2.3:a:ibm:lotus_sametime:8.5.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:lotus_sametime:8.5.2:*:*:*:*:*:*:*,Ibm,Lotus Sametime
CVE-2013-3993,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.05236,CWE-22,"IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted data or code, via crafted parameters in unspecified API calls.",2014-07-07,CISA,cpe:2.3:a:ibm:infosphere_biginsights:*:*:*:*:*:*:*:*,Ibm,Infosphere Biginsights
CVE-2013-4011,0.0,,0.02846,NVD-CWE-noinfo,"Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, allow local users to gain privileges via vectors involving (1) arp.ib or (2) ibstat.",2013-07-18,Metasploit,cpe:2.3:o:ibm:aix:6.1:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:7.1:*:*:*:*:*:*:*;cpe:2.3:o:ibm:vios:2.2.2.2:fp-26_sp-02:*:*:*:*:*:*,Ibm,Aix
CVE-2013-4074,0.0,,0.60643,CWE-189,"The dissect_capwap_data function in epan/dissectors/packet-capwap.c in the CAPWAP dissector in Wireshark 1.6.x before 1.6.16 and 1.8.x before 1.8.8 incorrectly uses a -1 data value to represent an error condition, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.",2013-06-09,Metasploit,cpe:2.3:a:wireshark:wireshark:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.6.10:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.6.11:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.6.12:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.6.13:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.6.14:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.6.15:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.6.1:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.6.2:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.6.3:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.6.4:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.6.5:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.6.6:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.6.7:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.6.8:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.6.9:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.8.0:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.8.1:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.8.2:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.8.3:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.8.4:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.8.5:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.8.6:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.8.7:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2013-4117,0.0,,0.12974,CWE-79,Cross-site scripting (XSS) vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ID parameter.,2013-07-16,Nuclei,cpe:2.3:a:anshul_sharma:category-grid-view-gallery:2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*,Anshul Sharma,Category-Grid-View-Gallery
CVE-2013-4124,0.0,,0.69008,CWE-189,"Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x before 3.5.22, 3.6.x before 3.6.17, and 4.x before 4.0.8 allows remote attackers to cause a denial of service (memory consumption) via a malformed packet.",2013-08-06,Metasploit,cpe:2.3:a:samba:samba:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.10:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.11:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.12:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.13:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.14:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.14:a:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.14a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.15:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.16:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.17:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.18:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.19:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.20:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.20:a:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.20:b:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.20a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.20b:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.21:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.21:a:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.21:b:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.21:c:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.21a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.21b:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.21c:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.22:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23:a:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23:b:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23:c:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23:d:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23b:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23c:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.23d:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.24:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:a:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:b:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:c:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:pre1:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:pre2:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:rc1:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:rc2:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25:rc3:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25b:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.25c:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.26:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.26:a:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.26a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.27:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.27:a:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.28:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.28:a:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.29:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.2:a:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.2a:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.30:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.31:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.32:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.33:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.34:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.35:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.36:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.37:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.4:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.4:rc1:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.5:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.6:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.7:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.8:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.0.9:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.10:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.11:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.12:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.13:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.14:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.15:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.2:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.3:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.4:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.5:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.6:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.7:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.8:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.2.9:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.10:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.11:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.12:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.13:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.14:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.15:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.16:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.2:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.3:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.4:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.5:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.6:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.7:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.8:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.3.9:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.10:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.11:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.12:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.13:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.14:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.15:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.16:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.17:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.1:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.2:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.3:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.4:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.5:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.6:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.7:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.8:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.4.9:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.10:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.11:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.12:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.13:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.14:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.15:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.16:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.17:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.18:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.19:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.20:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.21:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.2:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.10:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.11:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.12:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.13:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.14:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.15:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.16:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.1:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.2:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.3:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.4:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.5:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.6:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.7:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.8:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.9:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.3:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.4:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.5:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.6:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.7:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:18:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:5:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2013-4164,0.0,,0.34968,CWE-119,"Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse.",2013-11-23,Metasploit,cpe:2.3:a:ruby-lang:ruby:1.8:*:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.9.1:*:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.9.2:*:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:1.9:*:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ruby-lang:ruby:2.1:preview1:*:*:*:*:*:*,Ruby-Lang,Ruby
CVE-2013-4211,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.70653,CWE-94,"A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, which could let a remote malicious user execute arbitrary PHP code",2020-02-14,Metasploit,cpe:2.3:a:openx:openx:2.8.10:*:*:*:*:*:*:*,Openx,Openx
CVE-2013-4212,0.0,,0.81068,CWE-94,"Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol, which uses a subclass of UIAction, aka ""OGNL Injection.""",2013-12-07,Metasploit,cpe:2.3:a:apache:roller:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:roller:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:roller:4.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:roller:5.0:*:*:*:*:*:*:*,Apache,Roller
CVE-2013-4341,0.0,,0.21862,CWE-79,"Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 allow remote attackers to inject arbitrary web script or HTML via a crafted blog link within an RSS feed.",2013-09-16,Metasploit,cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.3.0:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.3.2:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.3.3:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.3.4:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.3.5:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.3.6:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.3.7:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.3.8:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.4.0:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.4.1:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.4.2:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.4.3:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.4.4:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.4.5:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.5.0:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:2.5.1:*:*:*:*:*:*:*,Moodle,Moodle
CVE-2013-4450,0.0,,0.3722,CWE-20,The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.,2013-10-21,Metasploit,cpe:2.3:a:nodejs:nodejs:0.10.0:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.10.10:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.10.11:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.10.12:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.10.13:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.10.14:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.10.15:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.10.16:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.10.17:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.10.18:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.10.19:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.10.1:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.10.20:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.10.2:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.10.3:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.10.4:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.10.5:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.10.6:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.10.7:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.10.8:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.10.9:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.0:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.10:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.11:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.12:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.13:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.14:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.15:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.16:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.17:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.18:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.19:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.1:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.20:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.21:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.22:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.23:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.24:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.25:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.2:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.3:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.4:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.5:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.6:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.7:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.8:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:nodejs:0.8.9:*:*:*:*:*:*:*,Nodejs,Nodejs
CVE-2013-4467,0.0,,0.32773,CWE-89,"Multiple SQL injection vulnerabilities in the agent interface (agc/) in VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allow (1) remote attackers to execute arbitrary SQL commands via the campaign variable in SCRIPT_multirecording_AJAX.php, (2) remote authenticated users to execute arbitrary SQL commands via the server_ip parameter to manager_send.php, or (3) other unspecified vectors.  NOTE: some of these details are obtained from third party information.",2014-03-11,Metasploit,cpe:2.3:a:vicidial:vicidial:*:-:*:*:*:*:*:*;cpe:2.3:a:vicidial:vicidial:2.7:rc1:*:*:*:*:*:*;cpe:2.3:a:vicidial:vicidial:2.8:403a:*:*:*:*:*:*,Vicidial,Vicidial
CVE-2013-4468,0.0,,0.31756,NVD-CWE-Other,"VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in the extension parameter in an OriginateVDRelogin action to manager_send.php.",2014-05-14,Metasploit,cpe:2.3:a:vicidial:vicidial:*:403a:*:*:*:*:*:*;cpe:2.3:a:vicidial:vicidial:2.7:-:*:*:*:*:*:*;cpe:2.3:a:vicidial:vicidial:2.7:rc1:*:*:*:*:*:*,Vicidial,Vicidial
CVE-2013-4490,0.0,,0.42139,NVD-CWE-Other,"The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands via shell metacharacters in the public key.",2014-05-13,Metasploit,cpe:2.3:a:gitlab:gitlab-shell:*:*:*:*:*:*:*:*;cpe:2.3:a:gitlab:gitlab-shell:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:gitlab:gitlab-shell:1.1.0:*:*:*:*:*:*:*;cpe:2.3:a:gitlab:gitlab-shell:1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:gitlab:gitlab-shell:1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:gitlab:gitlab-shell:1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:gitlab:gitlab-shell:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:gitlab:gitlab-shell:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:gitlab:gitlab-shell:1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:gitlab:gitlab-shell:1.7.1:*:*:*:*:*:*:*;cpe:2.3:a:gitlab:gitlab:5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:gitlab:gitlab:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:gitlab:gitlab:5.1.0:*:*:*:*:*:*:*;cpe:2.3:a:gitlab:gitlab:5.2.0:*:*:*:*:*:*:*;cpe:2.3:a:gitlab:gitlab:5.3.0:*:*:*:*:*:*:*;cpe:2.3:a:gitlab:gitlab:5.4.0:*:*:*:*:*:*:*;cpe:2.3:a:gitlab:gitlab:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:gitlab:gitlab:6.1.0:*:*:*:*:*:*:*;cpe:2.3:a:gitlab:gitlab:6.2.0:*:*:*:*:*:*:*;cpe:2.3:a:gitlab:gitlab:6.2.1:*:*:*:*:*:*:*;cpe:2.3:a:gitlab:gitlab:6.2.2:*:*:*:*:*:*:*,Gitlab,Gitlab
CVE-2013-4557,0.0,,0.25287,CWE-94,"The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers to execute arbitrary PHP via the connect parameter.",2013-11-18,Metasploit,cpe:2.3:a:spip:spip:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:spip:spip:3.0.10:*:*:*:*:*:*:*;cpe:2.3:a:spip:spip:3.0.11:*:*:*:*:*:*:*;cpe:2.3:a:spip:spip:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:spip:spip:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:spip:spip:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:spip:spip:3.0.4:*:*:*:*:*:*:*;cpe:2.3:a:spip:spip:3.0.5:*:*:*:*:*:*:*;cpe:2.3:a:spip:spip:3.0.6:*:*:*:*:*:*:*;cpe:2.3:a:spip:spip:3.0.7:*:*:*:*:*:*:*;cpe:2.3:a:spip:spip:3.0.8:*:*:*:*:*:*:*;cpe:2.3:a:spip:spip:3.0.9:*:*:*:*:*:*:*,Spip,Spip
CVE-2013-4614,0.0,,0.02846,CWE-255,"English/pages_MacUS/wls_set_content.html on the Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers shows the Wi-Fi PSK passphrase in cleartext, which allows physically proximate attackers to obtain sensitive information by reading the screen of an unattended workstation.",2013-06-21,Metasploit,cpe:2.3:h:canon:mg3100_printer:-:*:*:*:*:*:*:*;cpe:2.3:h:canon:mg5300_printer:-:*:*:*:*:*:*:*;cpe:2.3:h:canon:mg6100_printer:-:*:*:*:*:*:*:*;cpe:2.3:h:canon:mp340_printer:-:*:*:*:*:*:*:*;cpe:2.3:h:canon:mp495_printer:-:*:*:*:*:*:*:*;cpe:2.3:h:canon:mx870_printer:-:*:*:*:*:*:*:*;cpe:2.3:h:canon:mx890_printer:-:*:*:*:*:*:*:*;cpe:2.3:h:canon:mx920_printer:-:*:*:*:*:*:*:*;cpe:2.3:h:canon:mx922_printer:-:*:*:*:*:*:*:*,Canon,Mg3100 Printer
CVE-2013-4615,0.0,,0.15641,CWE-20,"The Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers allow remote attackers to cause a denial of service (device hang) via a crafted LAN_TXT24 parameter to English/pages_MacUS/cgi_lan.cgi followed by a direct request to English/pages_MacUS/lan_set_content.html.  NOTE: the vendor has apparently responded by stating ""Canon believes that its printers will not have to deal with unauthorized access to the network from an external location as long as the printers are used in a secured environment.""",2013-06-21,Metasploit,cpe:2.3:h:canon:mg3100_printer:-:*:*:*:*:*:*:*;cpe:2.3:h:canon:mg5300_printer:-:*:*:*:*:*:*:*;cpe:2.3:h:canon:mg6100_printer:-:*:*:*:*:*:*:*;cpe:2.3:h:canon:mp340_printer:-:*:*:*:*:*:*:*;cpe:2.3:h:canon:mp495_printer:-:*:*:*:*:*:*:*;cpe:2.3:h:canon:mx870_printer:-:*:*:*:*:*:*:*;cpe:2.3:h:canon:mx890_printer:-:*:*:*:*:*:*:*;cpe:2.3:h:canon:mx920_printer:-:*:*:*:*:*:*:*;cpe:2.3:h:canon:mx922_printer:-:*:*:*:*:*:*:*,Canon,Mg3100 Printer
CVE-2013-4625,0.0,,0.11102,CWE-79,Cross-site scripting (XSS) vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the package parameter.,2013-08-09,Nuclei,cpe:2.3:a:cory_lamle:duplicator:*:*:*:*:*:*:*:*;cpe:2.3:a:cory_lamle:duplicator:0.4.2:*:*:*:*:*:*:*;cpe:2.3:a:cory_lamle:duplicator:0.4.3:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*,Cory Lamle,Duplicator
CVE-2013-4660,0.0,,0.17186,CWE-20,"The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation.",2013-06-28,Metasploit,cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:*:*:*;cpe:2.3:a:nodeca:js-yaml:0.2.0:*:*:*:*:*:*:*;cpe:2.3:a:nodeca:js-yaml:0.2.1:*:*:*:*:*:*:*;cpe:2.3:a:nodeca:js-yaml:0.2.2:*:*:*:*:*:*:*;cpe:2.3:a:nodeca:js-yaml:0.3.0:*:*:*:*:*:*:*;cpe:2.3:a:nodeca:js-yaml:0.3.1:*:*:*:*:*:*:*;cpe:2.3:a:nodeca:js-yaml:0.3.2:*:*:*:*:*:*:*;cpe:2.3:a:nodeca:js-yaml:0.3.3:*:*:*:*:*:*:*;cpe:2.3:a:nodeca:js-yaml:0.3.4:*:*:*:*:*:*:*;cpe:2.3:a:nodeca:js-yaml:0.3.5:*:*:*:*:*:*:*;cpe:2.3:a:nodeca:js-yaml:0.3.6:*:*:*:*:*:*:*;cpe:2.3:a:nodeca:js-yaml:0.3.7:*:*:*:*:*:*:*;cpe:2.3:a:nodeca:js-yaml:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:nodeca:js-yaml:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:nodeca:js-yaml:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:nodeca:js-yaml:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:nodeca:js-yaml:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:nodeca:js-yaml:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:nodeca:js-yaml:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:nodeca:js-yaml:2.0.3:*:*:*:*:*:*:*,Nodeca,Js-Yaml
CVE-2013-4710,0.0,,0.42623,CWE-20,"Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, which allows remote attackers to execute arbitrary methods of Java objects or cause a denial of service (reboot) via a crafted web page, as demonstrated by use of the WebView.addJavascriptInterface method, a related issue to CVE-2012-6636.",2014-03-03,Metasploit,cpe:2.3:o:google:android:3.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:3.1:*:*:*:*:*:*:*;cpe:2.3:o:google:android:3.2.1:*:*:*:*:*:*:*;cpe:2.3:o:google:android:3.2.2:*:*:*:*:*:*:*;cpe:2.3:o:google:android:3.2.4:*:*:*:*:*:*:*;cpe:2.3:o:google:android:3.2.6:*:*:*:*:*:*:*;cpe:2.3:o:google:android:3.2:*:*:*:*:*:*:*;cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*;cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*;cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*;cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*;cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*;cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*,Google,Android
CVE-2013-4730,0.0,,0.67228,CWE-119,Buffer overflow in PCMan's FTP Server 2.0.7 allows remote attackers to execute arbitrary code via a long string in a USER command.,2014-05-15,Metasploit,cpe:2.3:a:pcman\'s_ftp_server_project:pcman\'s_ftp_server:2.0.7:*:*:*:*:*:*:*,Pcman'S Ftp Server Project,Pcman'S Ftp Server
CVE-2013-4782,0.0,,0.26016,CWE-287,The Supermicro BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password.,2013-07-08,Metasploit,cpe:2.3:h:supermicro:bmc:*:*:*:*:*:*:*:*,Supermicro,Bmc
CVE-2013-4786,0.0,,0.81802,CWE-255,"The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC.",2013-07-08,Metasploit,cpe:2.3:a:intel:intelligent_platform_management_interface:2.0:*:*:*:*:*:*:*;cpe:2.3:o:oracle:fujitsu_m10_firmware:*:*:*:*:*:*:*:*,Oracle,Fujitsu M10 Firmware
CVE-2013-4798,0.0,,0.67723,NVD-CWE-noinfo,"Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1705.",2013-07-29,Metasploit,cpe:2.3:a:hp:loadrunner:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:11.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:11.50:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:9.0.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:9.50.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:9.51:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:9.52:*:*:*:*:*:*:*,Hp,Loadrunner
CVE-2013-4800,0.0,,0.39303,NVD-CWE-noinfo,"Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1735.",2013-07-29,Metasploit,cpe:2.3:a:hp:loadrunner:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:11.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:11.50:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:9.0.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:9.50.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:9.51:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:9.52:*:*:*:*:*:*:*,Hp,Loadrunner
CVE-2013-4810,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.79003,CWE-94,"HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplicate of CVE-2007-1036, CVE-2010-0738, and/or CVE-2012-0874.",2013-09-16,CISA,cpe:2.3:a:hp:application_lifecycle_management:-:*:*:*:*:*:*:*;cpe:2.3:a:hp:procurve_manager:3.20:*:*:*:-:*:*:*;cpe:2.3:a:hp:procurve_manager:3.20:*:*:*:plus:*:*:*;cpe:2.3:a:hp:procurve_manager:4.0:*:*:*:-:*:*:*;cpe:2.3:a:hp:procurve_manager:4.0:*:*:*:plus:*:*:*,Hp,Application Lifecycle Management
CVE-2013-4811,0.0,,0.71293,CWE-20,"UpdateDomainControllerServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the adCert argument, which allows remote attackers to upload .jsp files and consequently execute arbitrary code via unspecified vectors, aka ZDI-CAN-1743.",2013-09-16,Metasploit,cpe:2.3:a:hp:identity_driven_manager:4.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:procurve_manager:3.20:*:*:*:*:*:*:*;cpe:2.3:a:hp:procurve_manager:4.0:*:*:*:*:*:*:*,Hp,Identity Driven Manager
CVE-2013-4812,0.0,,0.51903,CWE-20,"UpdateCertificatesServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the fileName argument, which allows remote attackers to upload .jsp files and consequently execute arbitrary code via unspecified vectors, aka ZDI-CAN-1743.",2013-09-16,Metasploit,cpe:2.3:a:hp:identity_driven_manager:4.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:procurve_manager:3.20:*:*:*:*:*:*:*;cpe:2.3:a:hp:procurve_manager:4.0:*:*:*:*:*:*:*,Hp,Identity Driven Manager
CVE-2013-4822,0.0,,0.62617,NVD-CWE-noinfo,"Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Branch Intelligent Management System Software Module (aka BIMS) allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1606.",2013-10-13,Metasploit,cpe:2.3:a:hp:imc_branch_intelligent_management_system_software_module:5.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:imc_branch_intelligent_management_system_software_module:5.1:*:*:*:*:*:*:*;cpe:2.3:a:hp:imc_branch_intelligent_management_system_software_module:5.2:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101h03:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101h04:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101l01:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101l02:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.1:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.1:e0101p01:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.2:*:*:*:*:*:*:*,Hp,Imc Branch Intelligent Management System Software Module
CVE-2013-4823,0.0,,0.37541,NVD-CWE-noinfo,"Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Branch Intelligent Management System Software Module (aka BIMS) allows remote attackers to obtain sensitive information via unknown vectors, aka ZDI-CAN-1607.",2013-10-13,Metasploit,cpe:2.3:a:hp:imc_branch_intelligent_management_system_software_module:5.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:imc_branch_intelligent_management_system_software_module:5.1:*:*:*:*:*:*:*;cpe:2.3:a:hp:imc_branch_intelligent_management_system_software_module:5.2:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101h03:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101h04:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101l01:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.0:e0101l02:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.1:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.1:e0101p01:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:5.2:*:*:*:*:*:*:*,Hp,Intelligent Management Center
CVE-2013-4824,0.0,,0.23927,CWE-287,"Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Service Operation Management Software Module allows remote attackers to bypass authentication via unknown vectors, aka ZDI-CAN-1644.",2013-10-13,Metasploit,cpe:2.3:a:hp:imc_service_operation_management_software_module:-:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:*:*:*:*:*:*:*:*,Hp,Imc Service Operation Management Software Module
CVE-2013-4826,0.0,,0.31556,CWE-200,"Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Service Operation Management Software Module allows remote attackers to obtain sensitive information via unknown vectors, aka ZDI-CAN-1647.",2013-10-13,Metasploit,cpe:2.3:a:hp:imc_service_operation_management_software_module:-:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:*:*:*:*:*:*:*:*,Hp,Imc Service Operation Management Software Module
CVE-2013-4835,0.0,,0.71003,NVD-CWE-noinfo,"The APISiteScopeImpl SOAP service in HP SiteScope 10.1x and 11.x before 11.22 allows remote attackers to bypass authentication and execute arbitrary code via a direct request to the issueSiebelCmd method, aka ZDI-CAN-1765.",2013-11-04,Metasploit,cpe:2.3:a:hp:sitescope:10.11:*:*:*:*:*:*:*;cpe:2.3:a:hp:sitescope:10.13:*:*:*:*:*:*:*;cpe:2.3:a:hp:sitescope:11.01:*:*:*:*:*:*:*;cpe:2.3:a:hp:sitescope:11.10:*:*:*:*:*:*:*;cpe:2.3:a:hp:sitescope:11.11:*:*:*:*:*:*:*;cpe:2.3:a:hp:sitescope:11.12:*:*:*:*:*:*:*;cpe:2.3:a:hp:sitescope:11.1:*:*:*:*:*:*:*;cpe:2.3:a:hp:sitescope:11.20:*:*:*:*:*:*:*;cpe:2.3:a:hp:sitescope:11.21:*:*:*:*:*:*:*,Hp,Sitescope
CVE-2013-4837,0.0,,0.62617,NVD-CWE-noinfo,"Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1832.",2013-11-04,Metasploit,cpe:2.3:a:hp:loadrunner:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:11.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:11.50:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:9.0.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:9.50.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:9.51:*:*:*:*:*:*:*;cpe:2.3:a:hp:loadrunner:9.52:*:*:*:*:*:*:*,Hp,Loadrunner
CVE-2013-4982,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.13117,CWE-287,AVTECH AVN801 DVR has a security bypass via the administration login captcha,2019-12-27,Nuclei,cpe:2.3:h:avtech:avn801_dvr:-:*:*:*:*:*:*:*;cpe:2.3:o:avtech:avn801_dvr_firmware:1017-1003-1009-1003:*:*:*:*:*:*:*,Avtech,Avn801 Dvr Firmware
CVE-2013-4983,0.0,,0.90133,CWE-78,The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to end-user/index.php.,2013-09-10,Metasploit,cpe:2.3:a:sophos:web_appliance_firmware:3.7.8:*:*:*:*:*:*:*;cpe:2.3:h:sophos:web_appliance:-:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.0.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.0.1.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.0.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.0.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.0.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.0.4:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.0.5.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.0.5:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.1.0.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.1.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.1.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.1.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.1.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.1.4:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.2.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.2.2.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.2.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.2.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.2.4:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.2.5:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.2.6:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.2.7:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.3.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.4:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.5.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.5:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.6.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.6:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.3.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.4:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.5:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.6:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.7:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.8:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.1.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.1.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.4:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.5:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.6:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.1.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.2.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.2.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.2.4.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.2.4.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.4.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.4.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.4:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.4:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.5:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.6:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.7:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.8.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.8.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.8.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.8.1:*:*:*:*:*:*:*,Sophos,Web Appliance Firmware
CVE-2013-4984,0.0,,0.08128,CWE-78,The close_connections function in /opt/cma/bin/clear_keys.pl in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows local users to gain privileges via shell metacharacters in the second argument.,2013-09-10,Metasploit,cpe:2.3:a:sophos:web_appliance:*:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.0.4:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.0.5.1:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.0.5:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.1.3:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.1.4:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.2.2.1:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.2.2:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.2.3:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.2.4:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.2.5:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.2.6:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.2.7:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.3.0:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.3.2:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.3.3:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.3.4:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.3.5:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.3.6.1:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.3.6:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.4.0:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.4.1:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.4.2:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.4.3.1:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.4.3:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.4.4:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.4.5:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.4.6:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.4.7:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.4.8:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.5.0:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.5.1.1:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.5.1.2:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.5.2:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.5.3:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.5.4:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.5.5:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.5.6:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.6.1.1:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.6.1:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.6.2.1:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.6.2.3:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.6.2.4.0:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.6.2.4.1:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.6.2:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.6.3:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.6.4.1:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.6.4.2:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.6.4:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.7.0:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.7.1:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.7.2:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.7.3:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.7.4:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.7.5:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.7.6:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.7.7:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.7.8.1:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.7.8.2:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.7.8:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.8.0:*:*:*:*:*:*:*;cpe:2.3:a:sophos:web_appliance:3.8.1:*:*:*:*:*:*:*,Sophos,Web Appliance
CVE-2013-4988,0.0,,0.66998,CWE-119,Stack-based buffer overflow in IcoFX 2.5 and earlier allows remote attackers to execute arbitrary code via a long idCount value in an ICONDIR structure in an ICO file.  NOTE: some of these details are obtained from third party information.,2013-12-13,Metasploit,cpe:2.3:a:icofx:icofx:*:*:*:*:*:*:*:*;cpe:2.3:a:icofx:icofx:1.6.1:*:*:*:*:*:*:*;cpe:2.3:a:icofx:icofx:1.6.2:*:*:*:*:*:*:*;cpe:2.3:a:icofx:icofx:1.6.3:*:*:*:*:*:*:*;cpe:2.3:a:icofx:icofx:1.6.4:*:*:*:*:*:*:*;cpe:2.3:a:icofx:icofx:1.6:*:*:*:*:*:*:*;cpe:2.3:a:icofx:icofx:2.0:*:*:*:*:*:*:*;cpe:2.3:a:icofx:icofx:2.1:*:*:*:*:*:*:*;cpe:2.3:a:icofx:icofx:2.2:*:*:*:*:*:*:*;cpe:2.3:a:icofx:icofx:2.3:*:*:*:*:*:*:*;cpe:2.3:a:icofx:icofx:2.4:*:*:*:*:*:*:*,Icofx,Icofx
CVE-2013-5014,0.0,,0.67573,NVD-CWE-Other,"The management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before 11.0.7405.1424 and 12.1 before 12.1.4023.4080, and Symantec Protection Center Small Business Edition 12.x before 12.1.4023.4080, allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",2014-02-14,Metasploit,cpe:2.3:a:symantec:endpoint_protection_manager:11.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec:endpoint_protection_manager:12.1.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec:endpoint_protection_manager:12.1.1:*:*:*:*:*:*:*;cpe:2.3:a:symantec:endpoint_protection_manager:12.1.2:*:*:*:*:*:*:*;cpe:2.3:a:symantec:endpoint_protection_manager:12.1.3:*:*:*:*:*:*:*;cpe:2.3:a:symantec:protection_center:12.0:*:*:*:small_business:*:*:*,Symantec,Endpoint Protection Manager
CVE-2013-5015,0.0,,0.28759,CWE-89,"SQL injection vulnerability in the management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before 11.0.7405.1424 and 12.1 before 12.1.4023.4080, and Symantec Protection Center Small Business Edition 12.x before 12.1.4023.4080, allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.",2014-02-14,Metasploit,cpe:2.3:a:symantec:endpoint_protection_manager:11.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec:endpoint_protection_manager:12.1.0:*:*:*:*:*:*:*;cpe:2.3:a:symantec:endpoint_protection_manager:12.1.1:*:*:*:*:*:*:*;cpe:2.3:a:symantec:endpoint_protection_manager:12.1.2:*:*:*:*:*:*:*;cpe:2.3:a:symantec:endpoint_protection_manager:12.1.3:*:*:*:*:*:*:*;cpe:2.3:a:symantec:protection_center:12.0:*:*:*:small_business:*:*:*,Symantec,Endpoint Protection Manager
CVE-2013-5019,0.0,,0.64393,CWE-119,Stack-based buffer overflow in Ultra Mini HTTPD 1.21 allows remote attackers to execute arbitrary code via a long resource name in an HTTP request.,2013-07-31,Metasploit,cpe:2.3:a:vector:ultra_mini_httpd:1.21:*:*:*:*:*:*:*,Vector,Ultra Mini Httpd
CVE-2013-5036,0.0,,0.46182,CWE-94,The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the (1) namespace parameter to the deobfuscation function or (2) sourcemap parameter to the sourcemap function in app/controllers/api/v1_controller.rb.,2014-05-27,Metasploit,cpe:2.3:a:squash:square_squash:-:*:*:*:*:*:*:*,Squash,Square Squash
CVE-2013-5045,0.0,,0.17385,CWE-20,"Microsoft Internet Explorer 10 and 11 allows local users to bypass the Protected Mode protection mechanism, and consequently gain privileges, by leveraging the ability to execute sandboxed code, aka ""Internet Explorer Elevation of Privilege Vulnerability.""",2013-12-11,Metasploit,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*,Microsoft,Internet Explorer
CVE-2013-5065,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.34893,NVD-CWE-noinfo,"NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.",2013-11-28,CISA/Metasploit,cpe:2.3:o:microsoft:windows_2003_server:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows 2003 Server
CVE-2013-5093,0.0,,0.38668,CWE-94,"The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.",2013-09-27,Metasploit,cpe:2.3:a:graphite_project:graphite:0.9.10:*:*:*:*:*:*:*;cpe:2.3:a:graphite_project:graphite:0.9.5:*:*:*:*:*:*:*;cpe:2.3:a:graphite_project:graphite:0.9.6:*:*:*:*:*:*:*;cpe:2.3:a:graphite_project:graphite:0.9.7:*:*:*:*:*:*:*;cpe:2.3:a:graphite_project:graphite:0.9.8:*:*:*:*:*:*:*;cpe:2.3:a:graphite_project:graphite:0.9.9:*:*:*:*:*:*:*,Graphite Project,Graphite
CVE-2013-5211,0.0,,0.97755,CWE-20,"The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in December 2013.",2014-01-02,EPSS/Metasploit,cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:-:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p0:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p10:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p11:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p12:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p13:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p14:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p15:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p16:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p17:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p18:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p19:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p20:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p21:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p22:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p23:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p24:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p25:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p2:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p3:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p4:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p5:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p6:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p7:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p8:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.7:p9:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:*,Opensuse,Opensuse
CVE-2013-5223,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.33567,CWE-79,"Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpServer1 parameter to sntpcfg.cgi, username parameter to (2) ddnsmngr.cmd or (3) todmngr.tod, (4) TodUrlAdd parameter to urlfilter.cmd, (5) appName parameter to scprttrg.cmd, (6) fltName in an add action or (7) rmLst parameter in a remove action to scoutflt.cmd, (8) groupName parameter to portmapcfg.cmd, (9) snmpRoCommunity parameter to snmpconfig.cgi, (10) fltName parameter to scinflt.cmd, (11) PolicyName in an add action or (12) rmLst parameter in a remove action to prmngr.cmd, (13) ippName parameter to ippcfg.cmd, (14) smbNetBiosName or (15) smbDirName parameter to samba.cgi, or (16) wlSsid parameter to wlcfg.wl.",2013-11-19,CISA,cpe:2.3:h:dlink:dsl-2760u:e1:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dsl-2760u_firmware:*:*:*:*:*:*:*:*,D-Link,Dsl-2760U Firmware
CVE-2013-5331,0.0,,0.72495,CWE-94,"Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2.202.332 on Linux, Adobe AIR before 3.9.0.1380, Adobe AIR SDK before 3.9.0.1380, and Adobe AIR SDK & Compiler before 3.9.0.1380 allow remote attackers to execute arbitrary code via crafted .swf content that leverages an unspecified ""type confusion,"" as exploited in the wild in December 2013.",2013-12-11,Metasploit,cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2013-5447,0.0,,0.34035,CWE-119,Stack-based buffer overflow in IBM Forms Viewer 4.x before 4.0.0.3 and 8.x before 8.0.1.1 allows remote attackers to execute arbitrary code via an XFDL form with a long fontname value.,2013-12-10,Metasploit,cpe:2.3:a:ibm:forms_viewer:4.0.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:forms_viewer:4.0.0.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:forms_viewer:4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:forms_viewer:8.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:forms_viewer:8.0.1:*:*:*:*:*:*:*,Ibm,Forms Viewer
CVE-2013-5486,0.0,,0.75962,CWE-78,"Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to write arbitrary files via the chartid parameter, aka Bug IDs CSCue77035 and CSCue77036.  NOTE: this can be leveraged to execute arbitrary commands by using the JBoss autodeploy functionality.",2013-09-23,Metasploit,cpe:2.3:a:cisco:prime_data_center_network_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_data_center_network_manager:4.1\(2\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_data_center_network_manager:4.1\(3\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_data_center_network_manager:4.1\(4\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_data_center_network_manager:4.1\(5\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_data_center_network_manager:4.2\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_data_center_network_manager:4.2\(3\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_data_center_network_manager:5.0\(2\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_data_center_network_manager:5.0\(3\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_data_center_network_manager:5.1\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_data_center_network_manager:5.1\(2\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_data_center_network_manager:5.1\(3u\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_data_center_network_manager:5.2\(2\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_data_center_network_manager:5.2\(2a\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_data_center_network_manager:5.2\(2b\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_data_center_network_manager:5.2\(2c\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_data_center_network_manager:5.2\(2e\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_data_center_network_manager:6.1\(1a\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_data_center_network_manager:6.1\(1b\):*:*:*:*:*:*:*,Cisco,Prime Data Center Network Manager
CVE-2013-5528,0.0,,0.23309,CWE-22,"Directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via directory traversal sequences in an unspecified input string, aka Bug ID CSCui78815.",2013-10-11,Nuclei,cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:*:*:*:*,Cisco,Unified Communications Manager
CVE-2013-5576,0.0,,0.48191,CWE-20,"administrator/components/com_media/helpers/media.php in the media manager in Joomla! 2.5.x before 2.5.14 and 3.x before 3.1.5 allows remote authenticated users or remote attackers to bypass intended access restrictions and upload files with dangerous extensions via a filename with a trailing . (dot), as exploited in the wild in August 2013.",2013-10-09,Metasploit,cpe:2.3:a:joomla:joomla\!:2.5.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.10:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.11:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.12:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.13:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.4:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.5:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.6:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.7:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.8:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.9:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.0.4:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.4:*:*:*:*:*:*:*,Joomla,Joomla!
CVE-2013-5696,0.0,,0.07855,CWE-352,"inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and (1) perform a SQL injection via an Etape_4 action or (2) execute arbitrary PHP code via an update_1 action.",2013-09-23,Metasploit,cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.20:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.21:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.30:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.31:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.40:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.41:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.42:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.51:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.51a:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.5:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.5:rc1:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.5:rc2:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.65:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.65:rc1:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.65:rc2:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.68.1:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.68.2:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.68.3:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.68:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.68:rc1:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.68:rc2:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.68:rc3:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.6:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.6:rc1:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.6:rc2:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.6:rc3:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.70.1:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.70.2:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.70:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.70:rc1:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.70:rc2:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.70:rc3:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.71.1:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.71.1:rc1:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.71.1:rc2:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.71.1:rc3:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.71.2:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.71.3:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.71.4:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.71.5:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.71.6:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.71:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.72.1:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.72.2:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.72.3:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.72.4:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.72:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.72:rc1:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.72:rc2:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.72:rc3:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.78.1:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.78.2:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.78.3:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.78.4:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.78.5:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.78:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.80.1:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.80.2:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.80.3:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.80.4:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.80.5:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.80.61:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.80.6:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.80.7:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.80:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.83.1:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.83.2:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.83.31:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.83.3:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.83.4:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.83.5:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.83.6:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.83.7:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.83.8:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.83.91:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.83.9:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.83:*:*:*:*:*:*:*;cpe:2.3:a:glpi-project:glpi:0.84:*:*:*:*:*:*:*,Glpi-Project,Glpi
CVE-2013-5743,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.79988,CWE-89,"Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7.",2019-12-11,Metasploit,cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*,Zabbix,Zabbix
CVE-2013-5795,0.0,,0.59494,NVD-CWE-noinfo,"Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0, 7.3.1, 12.2.1, 12.2.2, and 12.2.3 allows remote attackers to affect confidentiality via unknown vectors related to DM Others.",2014-01-15,Metasploit,cpe:2.3:a:oracle:supply_chain_products_suite:7.2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:supply_chain_products_suite_sql-server:12.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:supply_chain_products_suite_sql-server:12.2.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:supply_chain_products_suite_sql-server:12.2.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:supply_chain_products_suite_sql-server:7.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:supply_chain_products_suite_sql-server:7.3.1:*:*:*:*:*:*:*,Oracle,Supply Chain Products Suite
CVE-2013-5877,0.0,,0.54975,NVD-CWE-noinfo,"Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0, 7.3.1, 12.2.0, and 12.2.1 allows remote attackers to affect confidentiality via unknown vectors related to DM Others.",2014-01-15,Metasploit,cpe:2.3:a:oracle:supply_chain_products_suite:7.2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:supply_chain_products_suite_sql-server:12.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:supply_chain_products_suite_sql-server:12.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:supply_chain_products_suite_sql-server:7.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:supply_chain_products_suite_sql-server:7.3.1:*:*:*:*:*:*:*,Oracle,Supply Chain Products Suite
CVE-2013-5880,0.0,,0.59558,NVD-CWE-noinfo,"Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 12.2.0, 12.2.1, and 12.2.2 allows remote attackers to affect confidentiality via unknown vectors related to DM Others.",2014-01-15,Metasploit,cpe:2.3:a:oracle:supply_chain_products_suite:12.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:supply_chain_products_suite:12.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:supply_chain_products_suite:12.2.2:*:*:*:*:*:*:*,Oracle,Supply Chain Products Suite
CVE-2013-5967,0.0,,0.19022,CWE-89,"Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 4.3 and earlier allow remote attackers to execute arbitrary SQL commands via the date_from parameter to (1) radar-iso27001-potential.php, (2) radar-iso27001-A12IS_acquisition-pot.php, (3) radar-iso27001-A11AccessControl-pot.php, (4) radar-iso27001-A10Com_OP_Mgnt-pot.php, or (5) radar-pci-potential.php in RadarReport/.",2013-10-09,Metasploit,cpe:2.3:a:alienvault:open_source_security_information_management:*:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:2.1.2:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:2.1.5-1:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:2.1.5-2:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:2.1.5-3:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:2.1.5:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:2.1:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:3.1.10:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:3.1.12:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:3.1.9:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:3.1:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.0.3:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.0.4:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.1.3:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.1:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.2.2:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.2.3:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.2:*:*:*:*:*:*:*,Alienvault,Open Source Security Information Management
CVE-2013-5979,0.0,,0.18267,CWE-22,Directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x before 1.4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the p parameter to index.php.,2013-10-02,Nuclei,cpe:2.3:a:xibosignage:xibo:1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:xibosignage:xibo:1.2.0:rc1:*:*:*:*:*:*;cpe:2.3:a:xibosignage:xibo:1.2.0:rc2:*:*:*:*:*:*;cpe:2.3:a:xibosignage:xibo:1.2.1:*:*:*:*:*:*:*;cpe:2.3:a:xibosignage:xibo:1.2.2:*:*:*:*:*:*:*;cpe:2.3:a:xibosignage:xibo:1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:xibosignage:xibo:1.4.0:rc1:*:*:*:*:*:*;cpe:2.3:a:xibosignage:xibo:1.4.1:*:*:*:*:*:*:*,Xibosignage,Xibo
CVE-2013-6031,0.0,,0.06129,CWE-287,"The Huawei E355 adapter with firmware 21.157.37.01.910 does not require authentication for API pages, which allows remote attackers to change passwords and settings, or obtain sensitive information, via a direct request to (1) api/wlan/security-settings, (2) api/device/information, (3) api/wlan/basic-settings, (4) api/wlan/mac-filter, (5) api/monitoring/status, or (6) api/dhcp/settings.",2014-03-11,Metasploit,cpe:2.3:h:huawei:e355:-:*:*:*:*:*:*:*;cpe:2.3:o:huawei:e355_firmware:21.157.37.01.910:*:*:*:*:*:*:*,Huawei,E355 Firmware
CVE-2013-6117,0.0,,0.70713,CWE-287,"Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.",2014-07-11,Metasploit,cpe:2.3:o:dahuasecurity:dvr_firmware:2.608.0000.0:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:dvr_firmware:2.608.gv00.0:*:*:*:*:*:*:*,Dahuasecurity,Dvr Firmware
CVE-2013-6129,0.0,,0.51887,CWE-264,"The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldata[password], htmldata[confirmpassword], and htmldata[email] parameters, as exploited in the wild in October 2013.",2013-10-19,Metasploit,cpe:2.3:a:vbulletin:vbulletin:4.1:*:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.0.0:*:*:*:*:*:*:*,Vbulletin,Vbulletin
CVE-2013-6194,0.0,,0.65924,NVD-CWE-noinfo,"Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1905.",2014-01-04,Metasploit,cpe:2.3:a:hp:storage_data_protector:6.20:-:*:*:*:hp-ux:*:*;cpe:2.3:a:hp:storage_data_protector:6.20:-:*:*:*:redhat_enterprise_linux:*:*;cpe:2.3:a:hp:storage_data_protector:6.20:-:*:*:*:solaris:*:*;cpe:2.3:a:hp:storage_data_protector:6.20:-:*:*:*:windows_server_2003:*:*;cpe:2.3:a:hp:storage_data_protector:6.20:-:*:*:*:windows_server_2008:*:*;cpe:2.3:a:hp:storage_data_protector:6.21:-:*:*:*:hp-ux:*:*;cpe:2.3:a:hp:storage_data_protector:6.21:-:*:*:*:redhat_enterprise_linux:*:*;cpe:2.3:a:hp:storage_data_protector:6.21:-:*:*:*:solaris:*:*;cpe:2.3:a:hp:storage_data_protector:6.21:-:*:*:*:windows_server_2003:*:*;cpe:2.3:a:hp:storage_data_protector:6.21:-:*:*:*:windows_server_2008:*:*,Hp,Storage Data Protector
CVE-2013-6221,0.0,,0.77935,CWE-22,"Directory traversal vulnerability in CommunicationServlet in HP Service Virtualization 3.x before 3.50.1, when the AutoPass license server is enabled, allows remote attackers to create arbitrary files and consequently execute arbitrary code via unspecified vectors, aka ZDI-CAN-2031.",2014-06-18,Metasploit,cpe:2.3:a:hp:service_virtualization:3.0:*:*:*:*:*:*:*,Hp,Service Virtualization
CVE-2013-6271,0.0,,0.0803,CWE-264,Android 4.0 through 4.3 allows attackers to bypass intended access restrictions and remove device locks via a crafted application that invokes the updateUnlockMethodAndFinish method in the com.android.settings.ChooseLockGeneric class with the PASSWORD_QUALITY_UNSPECIFIED option.,2013-12-14,Metasploit,cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*;cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*;cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*;cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*;cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*;cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*;cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*;cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*;cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*;cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*,Google,Android
CVE-2013-6281,0.0,,0.0522,CWE-79,"Cross-site scripting (XSS) vulnerability in codebase/spreadsheet.php in the Spreadsheet (dhtmlxSpreadsheet) plugin 2.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ""page"" parameter.",2013-10-25,Nuclei,cpe:2.3:a:dhtmlx:dhtmlxspreadsheet:2.0:-:*:*:*:wordpress:*:*,Dhtmlx,Dhtmlxspreadsheet
CVE-2013-6282,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.39711,CWE-20,"The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.",2013-11-20,CISA/Metasploit,cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2013-6414,0.0,,0.207,CWE-20,actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.,2013-12-07,Metasploit,cpe:2.3:a:rubyonrails:rails:*:-:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.16:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.17:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.18:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.19:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.20:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.10:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.5:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.6:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.7:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.8:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.1.9:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.2.10:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.2.11:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.2.12:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.2.13:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.2.13:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.2.13:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.2.7:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.2.8:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:3.2.9:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.0:-:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.0:beta:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.0:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.0:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.1:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:ruby_on_rails:3.1.11:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.15:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.15:rc2:*:*:*:*:*:*,Rubyonrails,Rails
CVE-2013-6785,4.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N,0.04356,CWE-22,Directory traversal vulnerability in url_redirect.cgi in Supermicro IPMI before SMT_X9_315 allows authenticated attackers to read arbitrary files via the url_name parameter.,2020-01-23,Metasploit,cpe:2.3:a:supermicro:intelligent_platform_management_interface:*:*:*:*:*:*:*:*,Supermicro,Intelligent Platform Management Interface
CVE-2013-6829,0.0,,0.78343,CWE-94,admin/confnetworking.html in PineApp Mail-SeCure allows remote attackers to execute arbitrary commands via shell metacharacters in the pinghost parameter during a ping operation.,2013-11-20,Metasploit,cpe:2.3:a:pineapp:mail-secure:-:*:*:*:*:*:*:*,Pineapp,Mail-Secure
CVE-2013-6935,0.0,,0.32351,CWE-119,Buffer overflow in VideoCharge Software Watermark Master 2.2.23 allows remote attackers to execute arbitrary code via a long string in the SourcePath value in a .wcf file.,2013-12-04,Metasploit,cpe:2.3:a:videocharge:watermark_master:2.2.23:*:*:*:*:*:*:*,Videocharge,Watermark Master
CVE-2013-6955,0.0,,0.84571,CWE-264,"webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header.",2014-01-09,Metasploit,cpe:2.3:o:synology:diskstation_manager:4.0:*:*:*:*:*:*:*;cpe:2.3:o:synology:diskstation_manager:4.2:*:*:*:*:*:*:*;cpe:2.3:o:synology:diskstation_manager:4.3-3810:*:*:*:*:*:*:*;cpe:2.3:o:synology:diskstation_manager:4.3:*:*:*:*:*:*:*,Synology,Diskstation Manager
CVE-2013-7091,0.0,,0.86196,CWE-22,"Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a ..  (dot dot) in the skin parameter.  NOTE: this can be leveraged to execute arbitrary code by obtaining LDAP credentials and accessing the service/admin/soap API.",2013-12-13,Metasploit/Nuclei,cpe:2.3:a:synacor:zimbra_collaboration_suite:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:6.0.10:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:6.0.12:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:6.0.13:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:6.0.14:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:6.0.15:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:6.0.16:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:6.0.3:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:6.0.4:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:6.0.5:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:6.0.6:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:6.0.7:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:6.0.8:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:6.0.9:*:*:*:*:*:*:*,Synacor,Zimbra Collaboration Suite
CVE-2013-7102,0.0,,0.14802,CWE-20,"Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php in lib/admin/ in the OptimizePress theme before 1.61 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images_comingsoon, images_lncthumbs, or images_optbuttons in wp-content/uploads/optpress/, as exploited in the wild in November 2013.",2013-12-23,Metasploit,cpe:2.3:a:optimizepress:optimizepress:*:-:-:*:-:wordpress:*:*,Optimizepress,Optimizepress
CVE-2013-7240,0.0,,0.19641,CWE-22,Directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dew_file parameter.,2014-01-03,Nuclei,cpe:2.3:a:westerndeal:advanced_dewplayer:1.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*,Westerndeal,Advanced Dewplayer
CVE-2013-7260,0.0,,0.66885,CWE-119,"Multiple stack-based buffer overflows in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.1738, allow remote attackers to execute arbitrary code via a long (1) version number or (2) encoding declaration in the XML declaration of an RMP file, a different issue than CVE-2013-6877.",2014-01-03,Metasploit,cpe:2.3:a:realnetworks:realplayer:*:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:10.0:10.0.0.305:mac:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:10.0:10.0.0.331:mac:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:10.0:10.0.0.352:mac:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:10.1:10.0.0.396:mac:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:10.1:10.0.0.412:mac:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:10.1:10.0.0._481:mac:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:10.5:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.0.2.1744:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.0.2.2315:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.1.3:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:11_build_6.0.14.748:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:12.0.0.1444:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:12.0.0.1548:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:12.0.0.1701:*:mac:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:12.0.1.1737:-:-:*:-:macos:*:*;cpe:2.3:a:realnetworks:realplayer:14.0.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:14.0.1.609:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:14.0.1:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:14.0.2:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:14.0.3:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:14.0.4:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:14.0.5:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:15.0.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:15.0.4.43:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:15.0.4:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:15.0.5.109:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:15.0.6.14:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:15.02.71:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:16.0.0.282:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:16.0.0:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:16.0.1.18:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:16.0.2.32:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:16.0.3.51:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:2.1.2:*:enterprise:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:2.1.3:*:enterprise:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:2.1.4:*:enterprise:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:4:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:5:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:6:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:7:*:*:*:*:*:*:*;cpe:2.3:a:realnetworks:realplayer:8:*:*:*:*:*:*:*,Realnetworks,Realplayer
CVE-2013-7285,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.84362,CWE-78,"Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.",2019-05-15,Nuclei,cpe:2.3:a:apache:activemq:5.15.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*;cpe:2.3:a:xstream:xstream:1.4.10:*:*:*:*:*:*:*,Oracle,Endeca Information Discovery Studio
CVE-2013-7331,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L,0.58023,CWE-209,"The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a res:// URL, and exploited in the wild in February 2014.",2014-02-26,CISA/Metasploit,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows Server 2003
CVE-2013-7389,0.0,,0.27753,CWE-79,"Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev. A1) with firmware before 1.04B11 allow remote attackers to inject arbitrary web script or HTML via the (1) deviceid parameter to parentalcontrols/bind.php, (2) RESULT parameter to info.php, or (3) receiver parameter to bsc_sms_send.php.",2014-07-07,Metasploit,cpe:2.3:h:dlink:dir-645:a1:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-645_firmware:*:b08:*:*:*:*:*:*,D-Link,Dir-645 Firmware
CVE-2013-7390,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.74528,CWE-434,"Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attackers to execute arbitrary code by uploading a file with a jsp extension, then accessing it via a direct request to the file in the webroot.",2020-01-27,Metasploit,cpe:2.3:a:zohocorp:manageengine_desktop_central:*:*:*:*:*:*:*:*,Zohocorp,Manageengine Desktop Central
CVE-2013-7409,0.0,,0.67936,CWE-119,Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .m3u (playlist) file.,2014-10-30,Metasploit,cpe:2.3:a:allplayer:allplayer:*:*:*:*:*:*:*:*;cpe:2.3:a:allplayer:allplayer:5.6.2:*:*:*:*:*:*:*;cpe:2.3:a:allplayer:allplayer:5.7.0:*:*:*:*:*:*:*,Allplayer,Allplayer
CVE-2014-0038,0.0,,0.35451,CWE-20,"The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.",2014-02-06,Metasploit,cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2014-0050,0.0,,0.83175,CWE-264,"MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.",2014-04-01,Metasploit,cpe:2.3:a:apache:commons_fileupload:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:commons_fileupload:1.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:commons_fileupload:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:commons_fileupload:1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:commons_fileupload:1.2.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:commons_fileupload:1.2.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:commons_fileupload:1.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.48:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.49:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_applications:12.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_applications:12.0in:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_applications:13.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_applications:13.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_applications:13.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_applications:13.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_applications:13.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_applications:14.0:*:*:*:*:*:*:*,Oracle,Retail Applications
CVE-2014-0094,0.0,,0.99614,NVD-CWE-noinfo,"The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to ""manipulate"" the ClassLoader via the class parameter, which is passed to the getClass method.",2014-03-11,EPSS/Metasploit,cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*,Apache,Struts
CVE-2014-0112,0.0,,0.98094,CWE-264,"ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to ""manipulate"" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.",2014-04-29,EPSS/Metasploit,cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*,Apache,Struts
CVE-2014-0114,0.0,,0.96121,CWE-20,"Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to ""manipulate"" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.",2014-04-30,EPSS/Metasploit,cpe:2.3:a:apache:commons_beanutils:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:1.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:1.1:b1:*:*:*:*:*:*;cpe:2.3:a:apache:struts:1.1:b2:*:*:*:*:*:*;cpe:2.3:a:apache:struts:1.1:b3:*:*:*:*:*:*;cpe:2.3:a:apache:struts:1.1:rc1:*:*:*:*:*:*;cpe:2.3:a:apache:struts:1.1:rc2:*:*:*:*:*:*;cpe:2.3:a:apache:struts:1.2.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:1.2.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:1.2.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:1.2.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:1.2.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:1.2.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:1.3.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:1.3.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:1.3.8:*:*:*:*:*:*:*,Apache,Commons Beanutils
CVE-2014-0130,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.53703,CWE-22,"Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.",2014-05-07,CISA,cpe:2.3:a:redhat:subscription_asset_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*,Redhat,Enterprise Linux Server
CVE-2014-0160,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.99999,CWE-125,"The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.",2014-04-07,CISA/EPSS/Metasploit,cpe:2.3:a:broadcom:symantec_messaging_gateway:10.6.0:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:symantec_messaging_gateway:10.6.1:*:*:*:*:*:*:*;cpe:2.3:a:filezilla-project:filezilla_server:*:*:*:*:*:*:*:*;cpe:2.3:a:mitel:micollab:6.0:*:*:*:*:*:*:*;cpe:2.3:a:mitel:micollab:7.0:*:*:*:*:*:*:*;cpe:2.3:a:mitel:micollab:7.1:*:*:*:*:*:*:*;cpe:2.3:a:mitel:micollab:7.2:*:*:*:*:*:*:*;cpe:2.3:a:mitel:micollab:7.3.0.104:*:*:*:*:*:*:*;cpe:2.3:a:mitel:micollab:7.3:*:*:*:*:*:*:*;cpe:2.3:a:mitel:mivoice:1.1.2.5:*:*:*:*:lync:*:*;cpe:2.3:a:mitel:mivoice:1.1.3.3:*:*:*:*:skype_for_business:*:*;cpe:2.3:a:mitel:mivoice:1.2.0.11:*:*:*:*:skype_for_business:*:*;cpe:2.3:a:mitel:mivoice:1.3.2.2:*:*:*:*:skype_for_business:*:*;cpe:2.3:a:mitel:mivoice:1.4.0.102:*:*:*:*:skype_for_business:*:*;cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:gluster_storage:2.1:*:*:*:*:*:*:*;cpe:2.3:a:redhat:storage:2.1:*:*:*:*:*:*:*;cpe:2.3:a:redhat:virtualization:6.0:*:*:*:*:*:*:*;cpe:2.3:a:siemens:elan-8.2:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:wincc_open_architecture:3.12:*:*:*:*:*:*:*;cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*;cpe:2.3:h:intellian:v100:-:*:*:*:*:*:*:*;cpe:2.3:h:intellian:v60:-:*:*:*:*:*:*:*;cpe:2.3:h:ricon:s9922l:1.0:*:*:*:*:*:*:*;cpe:2.3:h:siemens:application_processing_engine:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:cp_1543-1:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_s7-1500:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_s7-1500t:-:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*;cpe:2.3:o:intellian:v100_firmware:1.20:*:*:*:*:*:*:*;cpe:2.3:o:intellian:v100_firmware:1.21:*:*:*:*:*:*:*;cpe:2.3:o:intellian:v100_firmware:1.24:*:*:*:*:*:*:*;cpe:2.3:o:intellian:v60_firmware:1.15:*:*:*:*:*:*:*;cpe:2.3:o:intellian:v60_firmware:1.25:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:ricon:s9922l_firmware:16.10.3\(3794\):*:*:*:*:*:*:*;cpe:2.3:o:siemens:application_processing_engine_firmware:2.0:*:*:*:*:*:*:*;cpe:2.3:o:siemens:cp_1543-1_firmware:1.1:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_s7-1500_firmware:1.5:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_s7-1500t_firmware:1.5:*:*:*:*:*:*:*,Siemens,Application Processing Engine Firmware
CVE-2014-0195,0.0,,0.99977,CWE-120,"The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.",2014-06-05,EPSS/Metasploit,cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*,Opensuse,Leap
CVE-2014-0196,5.5,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H,0.22475,CWE-362,"The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the ""LECHO & !OPOST"" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.",2014-05-07,CISA,cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_wan_optimization_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_application_delivery_controller:4.5.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_centralized_management:4.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_cloud:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_cloud_and_orchestration:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_device:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_security:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:enterprise_manager:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:enterprise_manager:3.1.1:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*;cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:2.6.31:-:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:2.6.31:rc3:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:2.6.31:rc4:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:2.6.31:rc5:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:2.6.31:rc6:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:2.6.31:rc7:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:2.6.31:rc8:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:2.6.31:rc9:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:6.3:*:*:*:*:*:*:*;cpe:2.3:o:suse:suse_linux_enterprise_desktop:11:sp3:*:*:*:-:*:*;cpe:2.3:o:suse:suse_linux_enterprise_high_availability_extension:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:suse_linux_enterprise_server:11:sp3:*:*:*:-:*:*;cpe:2.3:o:suse:suse_linux_enterprise_server:11:sp3:*:*:*:vmware:*:*,Linux,Linux Kernel
CVE-2014-0224,7.4,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N,0.95326,CWE-326,"OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the ""CCS Injection"" vulnerability.",2014-06-05,EPSS/Metasploit,cpe:2.3:a:filezilla-project:filezilla_server:*:*:*:*:*:*:*:*;cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*;cpe:2.3:a:python:python:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.2.3:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.2.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_web_server:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:redhat:storage:2.1:*:*:*:*:*:*:*;cpe:2.3:h:siemens:application_processing_engine:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:cp1543-1:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:rox:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:s7-1500:-:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:siemens:application_processing_engine_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:cp1543-1_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:rox_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:s7-1500_firmware:*:*:*:*:*:*:*:*,Siemens,Application Processing Engine Firmware
CVE-2014-0257,0.0,,0.69686,CWE-20,"Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it is safe to execute a method, which allows remote attackers to execute arbitrary code via (1) a crafted web site or (2) a crafted .NET Framework application that exposes a COM server endpoint, aka ""Type Traversal Vulnerability.""",2014-02-12,Metasploit,cpe:2.3:a:microsoft:.net_framework:1.0:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.0:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.5.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.5:*:*:*:*:*:*:*,Microsoft,.Net Framework
CVE-2014-0307,0.0,,0.72239,CWE-119,"Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a certain sequence of manipulations of a TextRange element, aka ""Internet Explorer Memory Corruption Vulnerability.""",2014-03-12,Metasploit,cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*,Microsoft,Internet Explorer
CVE-2014-0322,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.85239,CWE-416,"Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.",2014-02-14,CISA/Metasploit,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:*:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2014-0476,0.0,,0.03828,CWE-20,"The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable.  NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.",2014-10-25,Metasploit,cpe:2.3:a:chkrootkit:chkrootkit:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:10.04:*:lts:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:lts:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*,Canonical,Ubuntu Linux
CVE-2014-0496,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.40243,CWE-416,Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors.,2014-01-15,CISA,cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2014-0497,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99883,CWE-191,"Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.",2014-02-05,CISA/EPSS/Metasploit,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:google:chrome_os:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2014-0502,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.24204,CWE-415,"Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.",2014-02-21,CISA,cpe:2.3:a:adobe:adobe_air:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air_sdk:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:google:android:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*,Apple,Mac Os X
CVE-2014-0514,0.0,,0.72189,CWE-264,"The Adobe Reader Mobile application before 11.2 for Android does not properly restrict use of JavaScript, which allows remote attackers to execute arbitrary code via a crafted PDF document, a related issue to CVE-2012-6636.",2014-04-15,Metasploit,cpe:2.3:a:adobe:adobe_reader:*:*:*:*:*:android:*:*;cpe:2.3:a:adobe:adobe_reader:11.1.0:*:*:*:*:android:*:*,Adobe,Adobe Reader
CVE-2014-0515,0.0,,0.94569,CWE-119,"Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and before 11.2.202.356 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in April 2014.",2014-04-29,Metasploit,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2014-0546,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.2233,NVD-CWE-noinfo,"Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context, via unspecified vectors.",2014-08-12,CISA,cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2014-0556,0.0,,0.84298,CWE-119,"Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0559.",2014-09-10,Metasploit,cpe:2.3:a:adobe:adobe_air:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air:13.0.0.111:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air:13.0.0.83:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air:14.0.0.110:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air:14.0.0.137:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air_sdk:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air_sdk:13.0.0.111:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air_sdk:13.0.0.83:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air_sdk:14.0.0.110:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air_sdk:14.0.0.137:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.223:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.228:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.233:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.235:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.236:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.238:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.243:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.251:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.258:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.261:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.262:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.270:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.273:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.275:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.280:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.285:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.291:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.297:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.310:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.332:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.335:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.336:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.341:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.346:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.350:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.356:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.359:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.378:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.394:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:13.0.0.182:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:13.0.0.201:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:13.0.0.206:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:13.0.0.214:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:13.0.0.223:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:13.0.0.231:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.125:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.145:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.176:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.179:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.144:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:google:android:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2014-0569,0.0,,0.90208,CWE-190,"Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allows attackers to execute arbitrary code via unspecified vectors.",2014-10-15,Metasploit,cpe:2.3:a:adobe:air_desktop_runtime:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer_10:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer_11:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:extended_support:*:*:*;cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:google:android:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:evergreen:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2014-0644,0.0,,0.53342,CWE-200,"EMC Cloud Tiering Appliance (CTA) 10 through SP1 allows remote attackers to read arbitrary files via an api/login request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, as demonstrated by reading the /etc/shadow file.",2014-04-17,Metasploit,cpe:2.3:a:emc:cloud_tiering_appliance_software:10.0:-:*:*:*:*:*:*;cpe:2.3:a:emc:cloud_tiering_appliance_software:10.0:sp1:*:*:*:*:*:*;cpe:2.3:h:emc:cloud_tiering_appliance:-:*:*:*:*:*:*:*,Emc,Cloud Tiering Appliance
CVE-2014-0659,0.0,,0.73825,CWE-78,"The Cisco WAP4410N access point with firmware through 2.0.6.1, WRVS4400N router with firmware 1.x through 1.1.13 and 2.x through 2.0.2.1, and RVS4000 router with firmware through 2.0.3.2 allow remote attackers to read credential and configuration data, and execute arbitrary commands, via requests to the test interface on TCP port 32764, aka Bug IDs CSCum37566, CSCum43693, CSCum43700, and CSCum43685.",2014-01-12,Metasploit,cpe:2.3:h:cisco:rvs4000:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:wap4410n:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:wrvs4400n:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rvs4000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rvs4000_firmware:1.3.2.0:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rvs4000_firmware:1.3.3.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rvs4000_firmware:2.0.0.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rvs4000_firmware:2.0.2.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:wap4410n_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:wap4410n_firmware:2.0.2.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:wap4410n_firmware:2.0.3.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:wap4410n_firmware:2.0.4.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:wrvs4400n_firmware:1.1.03:*:*:*:*:*:*:*;cpe:2.3:o:cisco:wrvs4400n_firmware:1.1.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:wrvs4400n_firmware:2.0.1.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:wrvs4400n_firmware:2.0.2.1:*:*:*:*:*:*:*,Cisco,Rvs4000 Firmware
CVE-2014-0750,0.0,,0.70223,CWE-22,"Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted HTTP request, aka ZDI-CAN-1622.",2014-01-25,Metasploit,cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\%2fscada_cimplicity:*:sim24:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_cimplicity:4.01:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_cimplicity:7.5:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_cimplicity:8.0:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_cimplicity:8.1:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_cimplicity:8.2:*:*:*:*:*:*:*;cpe:2.3:a:ge:intelligent_platforms_proficy_process_systems_with_cimplicity:-:*:*:*:*:*:*:*,Ge,Intelligent Platforms Proficy Hmi%2Fscada Cimplicity
CVE-2014-0763,0.0,,0.19243,CWE-89,"An attacker using SQL injection may use arguments to construct queries 
without proper sanitization. The DBVisitor.dll is exposed through SOAP 
interfaces, and the exposed functions are vulnerable to SOAP injection. 
This may allow unexpected SQL action and access to records in the table 
of the software database or execution of arbitrary code.",2014-04-12,Metasploit,cpe:2.3:a:advantech:advantech_webaccess:*:*:*:*:*:*:*:*;cpe:2.3:a:advantech:advantech_webaccess:5.0:*:*:*:*:*:*:*;cpe:2.3:a:advantech:advantech_webaccess:6.0:*:*:*:*:*:*:*;cpe:2.3:a:advantech:advantech_webaccess:7.0:*:*:*:*:*:*:*,Advantech,Advantech Webaccess
CVE-2014-0780,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.74548,CWE-22,"Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.",2014-04-25,CISA,cpe:2.3:a:indusoft:web_studio:7.1:-:*:*:*:*:*:*;cpe:2.3:a:indusoft:web_studio:7.1:sp1:*:*:*:*:*:*;cpe:2.3:a:indusoft:web_studio:7.1:sp2:*:*:*:*:*:*,Indusoft,Web Studio
CVE-2014-0781,0.0,,0.25359,CWE-122,Heap-based buffer overflow in BKCLogSvr.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via crafted UDP packets.,2014-03-14,Metasploit,cpe:2.3:a:yokogawa:centum_cs_3000:*:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.01:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.02:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.03:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.04:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.05:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.06:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.07:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.08.50:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.08.70:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.08:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.09:*:*:*:*:*:*:*,Yokogawa,Centum Cs 3000
CVE-2014-0782,0.0,,0.56839,CWE-121,"Stack-based buffer overflow in BKESimmgr.exe in the Expanded Test Functions package in Yokogawa CENTUM CS 1000, CENTUM CS 3000 Entry Class R3.09.50 and earlier, CENTUM VP R5.03.00 and earlier, CENTUM VP Entry Class R5.03.00 and earlier, Exaopc R3.71.02 and earlier, B/M9000CS R5.05.01 and earlier, and B/M9000 VP R7.03.01 and earlier allows remote attackers to execute arbitrary code via a crafted packet.",2014-05-16,Metasploit,cpe:2.3:a:yokogawa:b\/m9000_vp_software:*:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:b\/m9000cs_software:*:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_1000_software:-:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000_entry_class_software:*:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000_software:*:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_vp_entry_class_software:*:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_vp_software:*:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:exaopc:*:*:*:*:*:*:*:*;cpe:2.3:h:yokogawa:b\/m9000_vp:-:*:*:*:*:*:*:*;cpe:2.3:h:yokogawa:b\/m9000cs:-:*:*:*:*:*:*:*;cpe:2.3:h:yokogawa:centum_cs_1000:-:*:*:*:*:*:*:*;cpe:2.3:h:yokogawa:centum_cs_3000:-:*:*:*:*:*:*:*;cpe:2.3:h:yokogawa:centum_cs_3000_entry_class:-:*:*:*:*:*:*:*;cpe:2.3:h:yokogawa:centum_vp:-:*:*:*:*:*:*:*;cpe:2.3:h:yokogawa:centum_vp_entry_class:-:*:*:*:*:*:*:*,Yokogawa,B/M9000Cs
CVE-2014-0783,0.0,,0.68359,CWE-121,Stack-based buffer overflow in BKHOdeq.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via a crafted TCP packet.,2014-03-14,Metasploit,cpe:2.3:a:yokogawa:centum_cs_3000:*:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.01:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.02:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.03:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.04:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.05:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.06:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.07:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.08.50:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.08.70:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.08:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.09:*:*:*:*:*:*:*,Yokogawa,Centum Cs 3000
CVE-2014-0784,0.0,,0.36035,CWE-121,Stack-based buffer overflow in BKBCopyD.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via a crafted TCP packet.,2014-03-14,Metasploit,cpe:2.3:a:yokogawa:centum_cs_3000:*:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.01:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.02:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.03:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.04:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.05:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.06:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.07:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.08.50:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.08.70:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.08:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.09:*:*:*:*:*:*:*,Yokogawa,Centum Cs 3000
CVE-2014-0980,0.0,,0.40359,CWE-119,Buffer overflow in Poster Software PUBLISH-iT 3.6d allows remote attackers to execute arbitrary code via a crafted PUI file.,2014-02-11,Metasploit,cpe:2.3:a:poster_software:publish_it:3.6d:*:*:*:*:*:*:*,Poster Software,Publish It
CVE-2014-0983,0.0,,0.08195,CWE-399,"Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchVertexAttrib2dARB function, (6) CR_VERTEXATTRIB2FARB_OPCODE to the crServerDispatchVertexAttrib2fARB function, (7) CR_VERTEXATTRIB2SARB_OPCODE to the crServerDispatchVertexAttrib2sARB function, (8) CR_VERTEXATTRIB3DARB_OPCODE to the crServerDispatchVertexAttrib3dARB function, (9) CR_VERTEXATTRIB3FARB_OPCODE to the crServerDispatchVertexAttrib3fARB function, (10) CR_VERTEXATTRIB3SARB_OPCODE to the crServerDispatchVertexAttrib3sARB function, (11) CR_VERTEXATTRIB4DARB_OPCODE to the crServerDispatchVertexAttrib4dARB function, (12) CR_VERTEXATTRIB4FARB_OPCODE to the crServerDispatchVertexAttrib4fARB function, and (13) CR_VERTEXATTRIB4SARB_OPCODE to the crServerDispatchVertexAttrib4sARB function.",2014-03-31,Metasploit,cpe:2.3:a:oracle:vm_virtualbox:4.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.2.10:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.2.12:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.2.14:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.2.16:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.2.18:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.2.20:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.2.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.2.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.2.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.2.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.3.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.3.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.3.6:*:*:*:*:*:*:*,Oracle,Vm Virtualbox
CVE-2014-100002,0.0,,0.59859,CWE-22,Directory traversal vulnerability in ManageEngine SupportCenter Plus 7.9 before 7917 allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the attach parameter to WorkOrder.do in the file attachment for a new ticket.,2015-01-13,Metasploit,cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:*:7916:*:*:*:*:*:*,Zohocorp,Manageengine Supportcenter Plus
CVE-2014-100004,0.0,,0.02016,CWE-79,Cross-site scripting (XSS) vulnerability in Sitecore CMS before 7.0 Update-4 (rev. 140120) allows remote attackers to inject arbitrary web script or HTML via the xmlcontrol parameter to the default URI.  NOTE: some of these details are obtained from third party information.,2015-01-13,Nuclei,cpe:2.3:a:sitecore:cms:*:3:*:*:*:*:*:*,Sitecore,Cms
CVE-2014-100005,8.0,CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.47071,CWE-352,"Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account or (2) enable remote management via a crafted configuration module to hedwig.cgi, (3) activate new configuration settings via a SETCFG,SAVE,ACTIVATE action to pigwidgeon.cgi, or (4) send a ping via a ping action to diagnostic.php.",2015-01-13,CISA/Metasploit,cpe:2.3:h:dlink:dir-600:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-600_firmware:*:*:*:*:*:*:*:*,D-Link,Dir-600 Firmware
CVE-2014-100015,0.0,,0.57367,CWE-22,Directory traversal vulnerability in pdmwService.exe in SolidWorks Workgroup PDM 2014 allows remote attackers to write to arbitrary files via a .. (dot dot) in the filename in a file upload.,2015-01-13,Metasploit,cpe:2.3:a:solidworks:product_data_management:2014:*:*:*:*:*:*:*,Solidworks,Product Data Management
CVE-2014-10021,0.0,,0.59968,NVD-CWE-Other,"Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in server/php/.",2015-01-13,Metasploit,cpe:2.3:a:wpsymposiumpro:wp_symposium:14.11:*:*:*:*:wordpress:*:*,Wpsymposiumpro,Wp Symposium
CVE-2014-10037,0.0,,0.19386,CWE-22,Directory traversal vulnerability in DomPHP 0.83 and earlier allows remote attackers to have unspecified impact via a .. (dot dot) in the url parameter to photoalbum/index.php.,2015-01-13,Nuclei,cpe:2.3:a:domphp:domphp:*:*:*:*:*:*:*:*,Domphp,Domphp
CVE-2014-1203,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.15647,CWE-77,The get_login_ip_config_file function in Eyou Mail System before 3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to admin/domain/ip_login_set/d_ip_login_get.php.,2017-10-24,Nuclei,cpe:2.3:a:eyou:eyou:*:*:*:*:*:*:*:*,Eyou,Eyou
CVE-2014-125113,0.0,,0.01033,CWE-306,"An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance version 5.0 - 5.3, 5.4 prior to 5.4.76849, and 5.5 prior to 5.5.90547 in the download_agent.php endpoint. An attacker can upload arbitrary PHP files to a temporary web-accessible directory, which are later executed through inclusion in backend code that loads files under attacker-controlled paths.",2025-08-05,Metasploit,,,
CVE-2014-125114,0.0,,0.00619,CWE-20,"A stack-based buffer overflow vulnerability exists in i-Ftp version 2.20 due to improper handling of the Time attribute within Schedule.xml. By placing a specially crafted Schedule.xml file in the i-Ftp application directory, a remote attacker can trigger a buffer overflow during scheduled download parsing, potentially leading to arbitrary code execution or a crash.",2025-07-25,Metasploit,,,
CVE-2014-125115,0.0,,0.01717,CWE-89,"An unauthenticated SQL injection vulnerability exists in Pandora FMS version 5.0 SP2 and earlier. The mobile/index.php endpoint fails to properly sanitize user input in the loginhash_data parameter, allowing attackers to extract administrator credentials or active session tokens via crafted requests. This occurs because input is directly concatenated into an SQL query without adequate validation, enabling SQL injection. After authentication is bypassed, a second vulnerability in the File Manager component permits arbitrary PHP file uploads. The file upload functionality does not enforce MIME-type or file extension restrictions, allowing authenticated users to upload web shells into a publicly accessible directory and achieve remote code execution.",2025-07-25,Metasploit,,,
CVE-2014-125116,0.0,,0.01601,CWE-306,"A remote code execution vulnerability exists in HybridAuth versions 2.0.9 through 2.2.2 due to insecure use of the install.php installation script. The script remains accessible after deployment and fails to sanitize input before writing to the application’s config.php file. An unauthenticated attacker can inject arbitrary PHP code into config.php, which is later executed when the file is loaded. This allows attackers to achieve remote code execution on the server. Exploitation of this issue will overwrite the existing configuration, rendering the application non-functional.",2025-07-25,Metasploit,,,
CVE-2014-125117,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05031,CWE-20,"A stack-based buffer overflow vulnerability in the my_cgi.cgi component of certain D-Link devices, including the DSP-W215 version 1.02, can be exploited via a specially crafted HTTP POST request to the /common/info.cgi endpoint. This flaw enables an unauthenticated attacker to achieve remote code execution with system-level privileges.",2025-07-25,Metasploit,cpe:2.3:h:dlink:dsp-w215:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dsp-w215_firmware:1.02:*:*:*:*:*:*:*,D-Link,Dsp-W215 Firmware
CVE-2014-125118,0.0,,0.03257,CWE-78,"A command injection vulnerability exists in the eScan Web Management Console version 5.5-2. The application fails to properly sanitize the 'pass' parameter when processing login requests to login.php, allowing an authenticated attacker with a valid username to inject arbitrary commands via a specially crafted password value. Successful exploitation results in remote code execution. Privilege escalation to root is possible by abusing the runasroot utility with mwconf-level privileges.",2025-07-25,Metasploit,,,
CVE-2014-125119,0.0,,0.01495,CWE-20,"A filename spoofing vulnerability exists in WinRAR when opening specially crafted ZIP archives. The issue arises due to inconsistencies between the Central Directory and Local File Header entries in ZIP files. When viewed in WinRAR, the file name from the Central Directory is displayed to the user, while the file from the Local File Header is extracted and executed. An attacker can leverage this flaw to spoof filenames and trick users into executing malicious payloads under the guise of harmless files, potentially leading to remote code execution.",2025-07-25,Metasploit,,,
CVE-2014-125121,0.0,,0.00853,CWE-732,"Array Networks vAPV (version 8.3.2.17) and vxAG (version 9.2.0.34) appliances are affected by a privilege escalation vulnerability caused by a combination of hardcoded SSH credentials (or SSH private key) and insecure permissions on a startup script. The devices ship with a default SSH login or a hardcoded DSA private key, allowing an attacker to authenticate remotely with limited privileges.


Once authenticated, an attacker can overwrite the world-writable /ca/bin/monitor.sh script with arbitrary commands. Since this script is executed with elevated privileges through the backend binary, enabling the debug monitor via backend -c ""debug monitor on"" triggers execution of the attacker's payload as root. This allows full system compromise.",2025-07-31,Metasploit,,,
CVE-2014-125122,0.0,,0.00759,CWE-121,"A stack-based buffer overflow vulnerability exists in the tmUnblock.cgi endpoint of the Linksys WRT120N wireless router. The vulnerability is triggered by sending a specially crafted HTTP POST request with an overly long TM_Block_URL parameter to the endpoint. By exploiting this flaw, an unauthenticated remote attacker can overwrite memory in a controlled manner, enabling them to temporarily reset the administrator password of the device to a blank value. This grants unauthorized access to the router’s web management interface without requiring valid credentials.",2025-07-31,Metasploit,,,
CVE-2014-125123,0.0,,0.00696,CWE-89,"An unauthenticated SQL injection vulnerability exists in the Kloxo web hosting control panel (developed by LXCenter) prior to version 6.1.12. The flaw resides in the login-name parameter passed to lbin/webcommand.php, which fails to properly sanitize input, allowing an attacker to extract the administrator’s password from the backend database. After recovering valid credentials, the attacker can authenticate to the Kloxo control panel and leverage the Command Center feature (display.php) to execute arbitrary operating system commands as root on the underlying host system. This vulnerability was reported to be exploited in the wild in January 2014.",2025-07-31,Metasploit,,,
CVE-2014-125124,0.0,,0.0148,CWE-78,"An unauthenticated remote command execution vulnerability exists in Pandora FMS versions up to and including 5.0RC1 via the Anyterm web interface, which listens on TCP port 8023. The anyterm-module endpoint accepts unsanitized user input via the p parameter and directly injects it into a shell command, allowing arbitrary command execution as the pandora user. In certain versions (notably 4.1 and 5.0RC1), the pandora user can elevate privileges to root without a password using a chain involving the artica user account. This account is typically installed without a password and is configured to run sudo without authentication. Therefore, full system compromise is possible without any credentials.",2025-07-31,Metasploit,,,
CVE-2014-125125,0.0,,0.02016,CWE-22,"A path traversal vulnerability exists in A10 Networks AX Loadbalancer versions 2.6.1-GR1-P5, 2.7.0, and earlier. The vulnerability resides in the handling of the filename parameter in the /xml/downloads endpoint, which fails to properly sanitize user input. An unauthenticated attacker can exploit this flaw by sending crafted HTTP requests containing directory traversal sequences to read arbitrary files outside the intended directory. The files returned by the vulnerable endpoint are deleted from the system after retrieval. This can lead to unauthorized disclosure of sensitive information such as SSL certificates and private keys, as well as unintended file deletion.",2025-07-31,Metasploit,,,
CVE-2014-125126,0.0,,0.01219,CWE-306,"An unrestricted file upload vulnerability exists in Simple E-Document versions 3.0 to 3.1 that allows an unauthenticated attacker to bypass authentication by sending a specific cookie header (access=3) with HTTP requests. The application’s upload mechanism fails to restrict file types and does not validate or sanitize user-supplied input, allowing attackers to upload malicious .php scripts. Authentication can be bypassed entirely by supplying a specially crafted cookie (access=3), granting access to the upload functionality without valid credentials. If file uploads are enabled on the server, the attacker can upload a web shell and gain remote code execution with the privileges of the web server user, potentially leading to full system compromise.",2025-07-31,Metasploit,,,
CVE-2014-1510,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.82339,CWE-269,"The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript code with chrome privileges by using an IDL fragment to trigger a window.open call.",2014-03-19,Metasploit,cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*;cpe:2.3:a:suse:suse_linux_enterprise_software_development_kit:11.0:sp3:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:suse_linux_enterprise_desktop:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:suse_linux_enterprise_server:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:suse_linux_enterprise_server:11:sp3:*:*:*:vmware:*:*,Canonical,Ubuntu Linux
CVE-2014-1511,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.83633,CWE-269,"Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified vectors.",2014-03-19,Metasploit,cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*;cpe:2.3:a:suse:suse_linux_enterprise_software_development_kit:11.0:sp3:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:suse_linux_enterprise_desktop:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:suse_linux_enterprise_server:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:suse_linux_enterprise_server:11:sp3:*:*:*:vmware:*:*,Canonical,Ubuntu Linux
CVE-2014-1610,0.0,,0.42777,CWE-20,"MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.",2014-01-30,Metasploit,cpe:2.3:a:mediawiki:mediawiki:1.19.0:*:*:*:*:*:*:*;cpe:2.3:a:mediawiki:mediawiki:1.19.10:*:*:*:*:*:*:*;cpe:2.3:a:mediawiki:mediawiki:1.19.1:*:*:*:*:*:*:*;cpe:2.3:a:mediawiki:mediawiki:1.19.2:*:*:*:*:*:*:*;cpe:2.3:a:mediawiki:mediawiki:1.19.3:*:*:*:*:*:*:*;cpe:2.3:a:mediawiki:mediawiki:1.19.4:*:*:*:*:*:*:*;cpe:2.3:a:mediawiki:mediawiki:1.19.5:*:*:*:*:*:*:*;cpe:2.3:a:mediawiki:mediawiki:1.19.6:*:*:*:*:*:*:*;cpe:2.3:a:mediawiki:mediawiki:1.19.7:*:*:*:*:*:*:*;cpe:2.3:a:mediawiki:mediawiki:1.19.8:*:*:*:*:*:*:*;cpe:2.3:a:mediawiki:mediawiki:1.19.9:*:*:*:*:*:*:*;cpe:2.3:a:mediawiki:mediawiki:1.21.1:*:*:*:*:*:*:*;cpe:2.3:a:mediawiki:mediawiki:1.21.2:*:*:*:*:*:*:*;cpe:2.3:a:mediawiki:mediawiki:1.21.3:*:*:*:*:*:*:*;cpe:2.3:a:mediawiki:mediawiki:1.21.4:*:*:*:*:*:*:*;cpe:2.3:a:mediawiki:mediawiki:1.22.0:*:*:*:*:*:*:*;cpe:2.3:a:mediawiki:mediawiki:1.22.1:*:*:*:*:*:*:*,Mediawiki,Mediawiki
CVE-2014-1635,0.0,,0.67487,CWE-119,Buffer overflow in login.cgi in MiniHttpd in Belkin N750 Router with firmware before F9K1103_WW_1.10.17m allows remote attackers to execute arbitrary code via a long string in the jump parameter.,2014-11-12,Metasploit,cpe:2.3:h:belkin:n750_wireless_router:f9k1103:*:*:*:*:*:*:*;cpe:2.3:o:belkin:n750_wireless_router_firmware:*:*:*:*:*:*:*:*,Belkin,N750 Wireless Router Firmware
CVE-2014-1649,0.0,,0.42312,CWE-264,The server in Symantec Workspace Streaming (SWS) before 7.5.0.749 allows remote attackers to access files and functionality by sending a crafted XMLRPC request over HTTPS.,2014-05-16,Metasploit,cpe:2.3:a:symantec:workspace_streaming:*:*:*:*:*:*:*:*;cpe:2.3:a:symantec:workspace_streaming:6.1:*:*:*:*:*:*:*;cpe:2.3:a:symantec:workspace_streaming:6.1:sp1:*:*:*:*:*:*;cpe:2.3:a:symantec:workspace_streaming:6.1:sp2:*:*:*:*:*:*;cpe:2.3:a:symantec:workspace_streaming:6.1:sp3:*:*:*:*:*:*;cpe:2.3:a:symantec:workspace_streaming:6.1:sp4:*:*:*:*:*:*,Symantec,Workspace Streaming
CVE-2014-1683,0.0,,0.31415,CWE-134,"The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) name, (2) email, (3) subject, or (4) message parameter to index.php.",2014-01-29,Metasploit,cpe:2.3:a:skybluecanvas:skybluecanvas:*:*:*:*:*:*:*:*,Skybluecanvas,Skybluecanvas
CVE-2014-1691,0.0,,0.42895,CWE-94,The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.,2014-04-01,Metasploit,cpe:2.3:a:horde:horde_application_framework:*:*:*:*:*:*:*:*;cpe:2.3:a:horde:horde_application_framework:5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:horde:horde_application_framework:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:horde:horde_application_framework:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:horde:horde_application_framework:5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:horde:horde_application_framework:5.0.4:*:*:*:*:*:*:*,Horde,Horde Application Framework
CVE-2014-1761,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.7746,CWE-787,"Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, as exploited in the wild in March 2014.",2014-03-25,CISA/Metasploit,cpe:2.3:a:microsoft:office:2011:*:*:*:*:macos:*:*;cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_web_apps:2010:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_web_apps:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_web_apps_server:2013:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2010:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2013:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2003:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2010:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2013:*:*:*:-:*:*:*;cpe:2.3:a:microsoft:word:2013:*:*:*:rt:*:*:*;cpe:2.3:a:microsoft:word:2013:sp1:*:*:-:*:*:*;cpe:2.3:a:microsoft:word:2013:sp1:*:*:rt:*:*:*;cpe:2.3:a:microsoft:word_viewer:-:*:*:*:*:*:*:*,Microsoft,Office
CVE-2014-1776,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.88013,CWE-416,"Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April 2014.  NOTE: this issue originally emphasized VGX.DLL, but Microsoft clarified that ""VGX.DLL does not contain the vulnerable code leveraged in this exploit. Disabling VGX.DLL is an exploit-specific workaround that provides an immediate, effective workaround to help block known attacks.""",2014-04-27,CISA,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:-:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows Server 2003
CVE-2014-1812,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.65117,CWE-255,"The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly handle distribution of passwords, which allows remote authenticated users to obtain sensitive credential information and consequently gain privileges by leveraging access to the SYSVOL share, as exploited in the wild in May 2014, aka ""Group Policy Preferences Password Elevation of Privilege Vulnerability.""",2014-05-14,CISA/Metasploit,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2014-1841,0.0,,0.04851,CWE-22,Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to copy an arbitrary user's home folder via a Move action with a .. (dot dot) in the src parameter.,2014-04-29,Nuclei,cpe:2.3:a:southrivertech:titan_ftp_server:*:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:10.0.1733:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:10.01.1740:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:10.30:*:*:*:*:*:*:*,Southrivertech,Titan Ftp Server
CVE-2014-1842,0.0,,0.04787,CWE-22,Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to list all usernames via a Go action with a .. (dot dot) in the search-bar value.,2014-04-29,Nuclei,cpe:2.3:a:southrivertech:titan_ftp_server:*:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:10.0.1733:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:10.01.1740:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:10.30:*:*:*:*:*:*:*,Southrivertech,Titan Ftp Server
CVE-2014-1843,0.0,,0.04667,CWE-22,Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to obtain the property information of an arbitrary home folder via a Properties action with a .. (dot dot) in the src parameter.,2014-04-29,Nuclei,cpe:2.3:a:southrivertech:titan_ftp_server:*:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:10.0.1733:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:10.01.1740:*:*:*:*:*:*:*;cpe:2.3:a:southrivertech:titan_ftp_server:10.30:*:*:*:*:*:*:*,Southrivertech,Titan Ftp Server
CVE-2014-1903,0.0,,0.52186,CWE-264,"admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args parameters to admin/config.php.",2014-02-18,Metasploit,cpe:2.3:a:freepbx:freepbx:2.10:*:*:*:*:*:*:*;cpe:2.3:a:freepbx:freepbx:2.11:*:*:*:*:*:*:*;cpe:2.3:a:freepbx:freepbx:2.12:*:*:*:*:*:*:*;cpe:2.3:a:sangoma:freepbx:2.9:*:*:*:*:*:*:*,Freepbx,Freepbx
CVE-2014-2120,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.14029,CWE-79,"Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.",2014-03-19,CISA,cpe:2.3:o:cisco:adaptive_security_appliance_software:-:*:*:*:*:*:*:*,Cisco,Adaptive Security Appliance Software
CVE-2014-2127,0.0,,0.11456,CWE-20,"Cisco Adaptive Security Appliance (ASA) Software 8.x before 8.2(5.48), 8.3 before 8.3(2.40), 8.4 before 8.4(7.9), 8.6 before 8.6(1.13), 9.0 before 9.0(4.1), and 9.1 before 9.1(4.3) does not properly process management-session information during privilege validation for SSL VPN portal connections, which allows remote authenticated users to gain privileges by establishing a Clientless SSL VPN session and entering crafted URLs, aka Bug ID CSCul70099.",2014-04-10,Metasploit,cpe:2.3:o:cisco:adaptive_security_appliance_software:8.0:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:8.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:8.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:8.3\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:8.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:8.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.0:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.1:*:*:*:*:*:*:*,Cisco,Adaptive Security Appliance Software
CVE-2014-2206,0.0,,0.6144,CWE-119,"Stack-based buffer overflow in GetGo Download Manager 4.9.0.1982, 4.8.2.1346, 4.4.5.502, and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a long HTTP Response Header.",2014-03-05,Metasploit,cpe:2.3:a:getgosoft:getgo_download_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:getgosoft:getgo_download_manager:4.8.2.1346:*:*:*:*:*:*:*;cpe:2.3:a:getgosoft:getgo_download_manager:4.9.0.1982:*:*:*:*:*:*:*,Getgosoft,Getgo Download Manager
CVE-2014-2238,0.0,,0.11311,CWE-89,SQL injection vulnerability in the manage configuration page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filter_config_id parameter.,2014-03-05,Metasploit,cpe:2.3:a:mantisbt:mantisbt:1.2.13:*:*:*:*:*:*:*;cpe:2.3:a:mantisbt:mantisbt:1.2.14:*:*:*:*:*:*:*;cpe:2.3:a:mantisbt:mantisbt:1.2.15:*:*:*:*:*:*:*;cpe:2.3:a:mantisbt:mantisbt:1.2.16:*:*:*:*:*:*:*,Mantisbt,Mantisbt
CVE-2014-2268,0.0,,0.31212,CWE-264,"views/Index.php in the Install module in vTiger 6.0 before Security Patch 2 does not properly restrict access, which allows remote attackers to re-install the application via a request that sets the X-Requested-With HTTP header, as demonstrated by executing arbitrary PHP code via the db_name parameter.",2014-11-16,Metasploit,cpe:2.3:a:vtiger:vtiger_crm:1.0:*:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:2.0:*:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:2.1:*:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:3.0:*:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:3.0:beta:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:3.2:*:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:4.0:*:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:4.2.4:*:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:4.2:*:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:4:*:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:4:beta:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:4:rc1:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:5.0.4:*:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:5.0.4:rc:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:5.1.0:*:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:5.1.0:rc:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:5.2.0:*:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:5.2.1:*:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:5.3.0:*:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:5.4.0:*:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:6.0.0:beta:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:6.0.0:rc:*:*:*:*:*:*;cpe:2.3:a:vtiger:vtiger_crm:6.0.0:sp1:*:*:*:*:*:*,Vtiger,Vtiger Crm
CVE-2014-2299,0.0,,0.47422,CWE-119,Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large record in MPEG data.,2014-03-11,Metasploit,cpe:2.3:a:wireshark:wireshark:1.10.0:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.10.1:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.10.2:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.10.3:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.10.4:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.10.5:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.8.0:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.8.10:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.8.11:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.8.12:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.8.1:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.8.2:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.8.3:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.8.4:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.8.5:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.8.6:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.8.7:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.8.8:*:*:*:*:*:*:*;cpe:2.3:a:wireshark:wireshark:1.8.9:*:*:*:*:*:*:*,Wireshark,Wireshark
CVE-2014-2314,0.0,,0.26151,CWE-22,Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers to create arbitrary files via unspecified vectors.,2014-03-09,Metasploit,cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.0:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2014-2321,0.0,,0.58364,CWE-264,"web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests, as demonstrated by using ""set TelnetCfg"" commands to enable a TELNET service with specified credentials.",2014-03-11,Nuclei,cpe:2.3:h:zte:f460:-:*:*:*:*:*:*:*;cpe:2.3:h:zte:f660:-:*:*:*:*:*:*:*,Zte,F460
CVE-2014-2323,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.61665,CWE-89,"SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.",2014-03-14,Nuclei,cpe:2.3:a:lighttpd:lighttpd:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_high_availability_extension:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3:*:*:*:*:*:*,Debian,Debian Linux
CVE-2014-2364,0.0,,0.61384,CWE-121,"Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter, (8) GetColor, (9) ServerResponse, (10) SetBaud, or (11) IPAddress parameter to an ActiveX control in (a) webvact.ocx, (b) dvs.ocx, or (c) webdact.ocx.",2014-07-19,Metasploit,cpe:2.3:a:advantech:advantech_webaccess:*:*:*:*:*:*:*:*;cpe:2.3:a:advantech:advantech_webaccess:5.0:*:*:*:*:*:*:*;cpe:2.3:a:advantech:advantech_webaccess:6.0:*:*:*:*:*:*:*;cpe:2.3:a:advantech:advantech_webaccess:7.0:*:*:*:*:*:*:*,Advantech,Advantech Webaccess
CVE-2014-2383,0.0,,0.39231,CWE-200,"dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.",2014-04-28,Nuclei,cpe:2.3:a:dompdf:dompdf:*:beta3:*:*:*:*:*:*,Dompdf,Dompdf
CVE-2014-2424,0.0,,0.48355,NVD-CWE-noinfo,Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7.0 allows remote authenticated users to affect integrity via vectors related to CEP system.,2014-04-16,Metasploit,cpe:2.3:a:oracle:fusion_middleware:11.1.1.7.0:*:*:*:*:*:*:*,Oracle,Fusion Middleware
CVE-2014-2477,0.0,,0.07197,NVD-CWE-noinfo,"Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.12 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-2486.",2014-07-17,Metasploit,cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:3.2.10:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:3.2.12:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:3.2.14:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:3.2.16:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:3.2.18:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:3.2.20:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:3.2.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:3.2.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:3.2.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:3.2.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:3.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.0.10:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.0.12:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.0.14:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.0.16:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.0.18:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.0.20:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.0.22:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.0.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.1.10:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.1.12:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.1.14:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.1.16:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.1.18:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.1.20:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.1.22:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.1.24:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.1.26:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.1.28:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.1.30:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.1.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.1.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.1.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.2.10:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.2.12:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.2.14:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.2.16:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.2.18:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.2.20:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.2.22:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.2.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.2.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.2.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.2.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.3.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.3.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.3.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:4.3.8:*:*:*:*:*:*:*,Oracle,Vm Virtualbox
CVE-2014-2533,0.0,,0.02906,CWE-264,/sbin/ifwatchd in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to gain privileges by providing an arbitrary program name as a command-line argument.,2014-03-18,Metasploit,cpe:2.3:o:blackberry:qnx_neutrino_rtos:6.4.1:*:*:*:*:*:*:*;cpe:2.3:o:blackberry:qnx_neutrino_rtos:6.5.0:*:*:*:*:*:*:*;cpe:2.3:o:blackberry:qnx_neutrino_rtos:6.5.0:sp1:*:*:*:*:*:*,Blackberry,Qnx Neutrino Rtos
CVE-2014-2623,0.0,,0.89394,NVD-CWE-noinfo,Unspecified vulnerability in HP Storage Data Protector 8.x allows remote attackers to execute arbitrary code via unknown vectors.,2014-07-18,Metasploit,cpe:2.3:a:hp:storage_data_protector:8.0:-:*:*:*:windows_7:*:*;cpe:2.3:a:hp:storage_data_protector:8.0:-:*:*:*:windows_8:*:*;cpe:2.3:a:hp:storage_data_protector:8.0:-:*:*:*:windows_server_2003:*:*;cpe:2.3:a:hp:storage_data_protector:8.0:-:*:*:*:windows_server_2008:*:*;cpe:2.3:a:hp:storage_data_protector:8.10:-:*:*:*:windows_7:*:*;cpe:2.3:a:hp:storage_data_protector:8.10:-:*:*:*:windows_8:*:*;cpe:2.3:a:hp:storage_data_protector:8.10:-:*:*:*:windows_server_2003:*:*;cpe:2.3:a:hp:storage_data_protector:8.10:-:*:*:*:windows_server_2008:*:*,Hp,Storage Data Protector
CVE-2014-2624,0.0,,0.65435,NVD-CWE-noinfo,"Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.0x, 9.1x, and 9.2x allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2264.",2014-09-11,Metasploit,cpe:2.3:a:hp:network_node_manager_i:9.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:network_node_manager_i:9.10:*:*:*:*:*:*:*;cpe:2.3:a:hp:network_node_manager_i:9.20:*:*:*:*:*:*:*,Hp,Network Node Manager I
CVE-2014-2630,0.0,,0.0708,NVD-CWE-noinfo,"Unspecified vulnerability in HP Operations Agent 11.00, when Glance is used, allows local users to gain privileges via unknown vectors.",2014-08-12,Metasploit,cpe:2.3:a:hp:operations_agent:11.0:*:*:*:*:*:*:*,Hp,Operations Agent
CVE-2014-2817,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.26349,NVD-CWE-noinfo,"Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka ""Internet Explorer Elevation of Privilege Vulnerability.""",2014-08-12,CISA,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:-:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows Server 2003
CVE-2014-2849,0.0,,0.61192,CWE-264,The Change Password dialog box (change_password) in Sophos Web Appliance before 3.8.2 allows remote authenticated users to change the admin user password via a crafted request.,2014-04-11,Metasploit,cpe:2.3:a:sophos:web_appliance_firmware:3.7.8:*:*:*:*:*:*:*;cpe:2.3:h:sophos:web_appliance:-:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.0.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.0.1.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.0.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.0.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.0.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.0.4:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.0.5.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.0.5:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.1.0.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.1.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.1.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.1.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.1.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.1.4:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.2.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.2.2.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.2.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.2.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.2.4:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.2.5:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.2.6:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.2.7:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.3.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.4:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.5.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.5:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.6.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.6:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.3.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.4:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.5:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.6:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.7:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.8:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.1.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.1.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.4:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.5:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.6:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.1.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.2.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.2.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.2.4.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.2.4.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.4.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.4.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.4:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.4:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.5:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.6:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.7:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.8.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.8.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.9.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.9:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.8.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.8.1:*:*:*:*:*:*:*,Sophos,Web Appliance Firmware
CVE-2014-2850,0.0,,0.57847,CWE-78,The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter.,2014-04-11,Metasploit,cpe:2.3:a:sophos:web_appliance_firmware:3.7.8:*:*:*:*:*:*:*;cpe:2.3:h:sophos:web_appliance:-:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.0.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.0.1.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.0.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.0.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.0.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.0.4:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.0.5.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.0.5:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.1.0.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.1.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.1.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.1.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.1.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.1.4:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.2.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.2.2.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.2.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.2.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.2.4:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.2.5:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.2.6:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.2.7:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.3.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.4:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.5.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.5:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.6.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.3.6:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.3.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.4:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.5:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.6:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.7:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.4.8:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.1.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.1.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.4:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.5:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.5.6:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.1.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.2.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.2.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.2.4.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.2.4.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.4.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.4.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.6.4:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.3:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.4:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.5:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.6:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.7:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.8.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.8.2:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.9.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.7.9:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.8.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:web_appliance_firmware:3.8.1:*:*:*:*:*:*:*,Sophos,Web Appliance Firmware
CVE-2014-2908,0.0,,0.20862,CWE-79,Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.,2014-04-25,Nuclei,cpe:2.3:h:siemens:simatic_s7_cpu-1211c:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_s7_cpu_1212c:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_s7_cpu_1214c:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_s7_cpu_1215c:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_s7_cpu_1217c:-:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_s7_cpu_1200_firmware:2.0:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_s7_cpu_1200_firmware:3.0.2:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_s7_cpu_1200_firmware:3.0:*:*:*:*:*:*:*,Siemens,Simatic S7 Cpu 1200 Firmware
CVE-2014-2928,0.0,,0.3905,NVD-CWE-Other,"The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1, BIG-IP Analytics 11.0.0 through 11.5.1, BIG-IP Edge Gateway, WebAccelerator, WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, Enterprise Manager 2.1.0 through 2.3.0 and 3.0.0 through 3.1.1, and BIG-IQ Cloud, Device, and Security 4.0.0 through 4.3.0 allows remote administrators to execute arbitrary commands via shell metacharacters in the hostname element in a SOAP request.",2014-05-12,Metasploit,cpe:2.3:a:f5:big-ip_access_policy_manager:10.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_access_policy_manager:10.2.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_access_policy_manager:10.2.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_access_policy_manager:10.2.2:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_access_policy_manager:11.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:10.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:10.0.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:10.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:10.2.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:10.2.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:10.2.2:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:11.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_edge_gateway:10.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_edge_gateway:10.2.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_edge_gateway:10.2.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_edge_gateway:10.2.2:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_edge_gateway:11.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:10.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:10.0.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:10.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:10.2.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:10.2.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:10.2.2:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:11.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:10.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:10.0.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:10.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:10.2.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:10.2.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:10.2.2:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:11.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:10.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:10.0.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:10.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:10.2.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:10.2.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:10.2.2:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:11.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:10.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:10.0.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:10.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:10.2.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:10.2.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:10.2.2:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:10.2.3:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:10.2.4:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:11.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:11.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:11.2.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:11.2.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:11.3.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:11.4.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:11.4.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:9.4.5:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:9.4.6:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:9.4.7:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:9.4.8:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_wan_optimization_manager:10.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_wan_optimization_manager:10.0.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_wan_optimization_manager:10.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_wan_optimization_manager:10.2.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_wan_optimization_manager:10.2.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_wan_optimization_manager:10.2.2:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_wan_optimization_manager:11.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:10.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:10.0.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:10.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:10.2.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:10.2.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:10.2.2:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:10.2.3:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:10.2.4:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:11.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:11.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:11.2.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:11.2.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:11.3.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:9.4.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:9.4.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:9.4.2:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:9.4.3:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:9.4.4:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:9.4.5:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:9.4.6:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:9.4.7:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:9.4.8:*:*:*:*:*:*:*,F5,Big-Ip Webaccelerator
CVE-2014-2962,0.0,,0.47095,CWE-22,Absolute path traversal vulnerability in the webproc cgi module on the Belkin N150 F9K1009 v1 router with firmware before 1.00.08 allows remote attackers to read arbitrary files via a full pathname in the getpage parameter.,2014-06-19,Nuclei,cpe:2.3:h:belkin:n150_f9k1009:v1:*:*:*:*:*:*:*;cpe:2.3:o:belkin:n150_f9k1009_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:belkin:n150_f9k1009_firmware:1.00.01:*:*:*:*:*:*:*,Belkin,N150 F9K1009 Firmware
CVE-2014-3120,8.1,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N,0.88559,CWE-284,"The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search.  NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.",2014-07-28,CISA/Metasploit/Nuclei,cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*,Elastic,Elasticsearch
CVE-2014-3153,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.37233,NVD-CWE-noinfo,"The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.",2014-06-07,CISA/Metasploit,cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.2:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_high_availability_extension:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_real_time_extension:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:*,Linux,Linux Kernel
CVE-2014-3206,0.0,,0.51658,CWE-20,Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or the auth_name parameter to localhost/backupmgmt/pre_connect_check.php.,2018-02-23,Nuclei,cpe:2.3:h:seagate:blackarmor_nas_110:-:*:*:*:*:*:*:*;cpe:2.3:h:seagate:blackarmor_nas_220:-:*:*:*:*:*:*:*;cpe:2.3:o:seagate:blackarmor_nas_110_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:seagate:blackarmor_nas_220_firmware:-:*:*:*:*:*:*:*,Seagate,Blackarmor Nas 220 Firmware
CVE-2014-3300,0.0,,0.21879,CWE-264,"The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager (CDM) in Unified CDM Application Software before 10 does not properly implement access control, which allows remote attackers to modify user information via a crafted URL, aka Bug ID CSCum77041.",2014-07-07,Metasploit,cpe:2.3:a:cisco:unified_cdm_application_software:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_cdm_application_software:8.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_domain_manager:-:*:*:*:*:*:*:*,Cisco,Unified Cdm Application Software
CVE-2014-3566,3.4,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N,0.99999,CWE-310,"The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the ""POODLE"" issue.",2014-10-15,EPSS/Metasploit,cpe:2.3:a:ibm:vios:2.2.0.10:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:2.2.0.11:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:2.2.0.12:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:2.2.0.13:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:2.2.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:2.2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:2.2.1.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:2.2.1.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:2.2.1.5:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:2.2.1.6:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:2.2.1.7:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:2.2.1.8:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:2.2.1.9:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:2.2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:2.2.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:2.2.2.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:2.2.2.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:2.2.2.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:2.2.2.5:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:2.2.3.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:2.2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:2.2.3.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:2.2.3.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:vios:2.2.3.4:*:*:*:*:*:*:*;cpe:2.3:a:novell:suse_linux_enterprise_software_development_kit:11.0:sp3:*:*:*:*:*:*;cpe:2.3:a:novell:suse_linux_enterprise_software_development_kit:12.0:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8a:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8b:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8c:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8d:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8e:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8f:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8g:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8h:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8i:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8j:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8k:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8l:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8m:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8m:beta1:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8n:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8o:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8p:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8q:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8r:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8s:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8t:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8u:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8v:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8w:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8x:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8y:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8z:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8za:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:0.9.8zb:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0:beta1:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0:beta2:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0:beta3:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0:beta4:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0:beta5:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0a:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0b:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0c:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0d:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0e:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0f:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0g:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0h:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0i:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0j:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0k:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0l:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0m:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0n:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1:beta1:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1:beta2:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1:beta3:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1a:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1b:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1c:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1d:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1e:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1f:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1g:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1h:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1i:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database:11.2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database:12.1.0.2:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:5.3:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:6.1:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:7.1:*:*:*:*:*:*:*;cpe:2.3:o:mageia:mageia:3.0:*:*:*:*:*:*:*;cpe:2.3:o:mageia:mageia:4.0:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:5.1.1:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:5.1.2:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:5.1.3:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:5.1.4:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:5.1:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:5.2.1:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:5.2.2:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:5.2:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.0.1:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.0.2:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.0.3:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.0.4:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.0.5:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.0.6:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.0:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.0:beta:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.1.1:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.1.2:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.1.3:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.1.4:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.1.5:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.1:*:*:*:*:*:*:*;cpe:2.3:o:novell:suse_linux_enterprise_desktop:10.0:*:*:*:*:*:*:*;cpe:2.3:o:novell:suse_linux_enterprise_desktop:11.0:*:*:*:*:*:*:*;cpe:2.3:o:novell:suse_linux_enterprise_desktop:12.0:*:*:*:*:*:*:*;cpe:2.3:o:novell:suse_linux_enterprise_desktop:9.0:*:*:*:*:*:*:*;cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:sp3:*:*:*:*:*:*;cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:sp3:*:*:*:vmware:*:*;cpe:2.3:o:novell:suse_linux_enterprise_server:12.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop_supplementary:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop_supplementary:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_supplementary:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_supplementary:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_supplementary:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation_supplementary:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation_supplementary:7.0:*:*:*:*:*:*:*,Redhat,Enterprise Linux
CVE-2014-3704,0.0,,0.99974,CWE-89,"The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.",2014-10-16,EPSS/Metasploit/Nuclei,cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2014-3744,0.0,,0.34012,CWE-22,Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path.,2017-10-23,Nuclei,cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*,Nodejs,Node.Js
CVE-2014-3789,0.0,,0.64191,CWE-94,GetPermissions.asp in Cogent Real-Time Systems Cogent DataHub before 7.3.5 allows remote attackers to execute arbitrary commands via unspecified vectors.,2014-05-22,Metasploit,cpe:2.3:a:cogentdatahub:cogent_datahub:*:*:*:*:*:*:*:*;cpe:2.3:a:cogentdatahub:cogent_datahub:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cogentdatahub:cogent_datahub:7.0:*:*:*:*:*:*:*;cpe:2.3:a:cogentdatahub:cogent_datahub:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:cogentdatahub:cogent_datahub:7.1.1.63:*:*:*:*:*:*:*;cpe:2.3:a:cogentdatahub:cogent_datahub:7.1.1:*:*:*:*:*:*:*;cpe:2.3:a:cogentdatahub:cogent_datahub:7.1.2:*:*:*:*:*:*:*;cpe:2.3:a:cogentdatahub:cogent_datahub:7.2.2:*:*:*:*:*:*:*;cpe:2.3:a:cogentdatahub:cogent_datahub:7.3.0:*:*:*:*:*:*:*;cpe:2.3:a:cogentdatahub:cogent_datahub:7.3.1:*:*:*:*:*:*:*;cpe:2.3:a:cogentdatahub:cogent_datahub:7.3.2:*:*:*:*:*:*:*;cpe:2.3:a:cogentdatahub:cogent_datahub:7.3.3:*:*:*:*:*:*:*,Cogentdatahub,Cogent Datahub
CVE-2014-3791,0.0,,0.78703,CWE-119,Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 6.8 allows remote attackers to execute arbitrary code via a long string in a cookie UserID parameter to vfolder.ghp.,2014-05-20,Metasploit,cpe:2.3:a:efssoft:easy_file_sharing_web_server:6.8:*:*:*:*:*:*:*,Efssoft,Easy File Sharing Web Server
CVE-2014-3804,0.0,,0.72376,CWE-94,"The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) update_system_info_debian_package, (2) ossec_task, (3) set_ossim_setup admin_ip, (4) sync_rserver, or (5) set_ossim_setup framework_ip request, a different vulnerability than CVE-2014-3805.",2014-06-13,Metasploit,cpe:2.3:a:alienvault:open_source_security_information_management:*:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.0.3:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.0.4:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.0:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.1.3:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.1:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.2.2:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.2.3:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.2:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.3.1:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.3.2:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.3.3:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.3:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.4:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.5:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.6:*:*:*:*:*:*:*,Alienvault,Open Source Security Information Management
CVE-2014-3828,0.0,,0.72712,CWE-89,"Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allow remote attackers to execute arbitrary SQL commands via (1) the index_id parameter to views/graphs/common/makeXML_ListMetrics.php, (2) the sid parameter to views/graphs/GetXmlTree.php, (3) the session_id parameter to views/graphs/graphStatus/displayServiceStatus.php, (4) the mnftr_id parameter to configuration/configObject/traps/GetXMLTrapsForVendor.php, or (5) the index parameter to common/javascript/commandGetArgs/cmdGetExample.php in include/.",2014-10-23,Metasploit,cpe:2.3:a:merethis:centreon:2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:merethis:centreon_enterprise_server:2.2:*:*:*:*:*:*:*,Merethis,Centreon
CVE-2014-3829,0.0,,0.80998,CWE-94,"displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) session_id or (2) template_id parameter, related to the command_line variable.",2014-10-23,Metasploit,cpe:2.3:a:merethis:centreon:2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:merethis:centreon_enterprise_server:2.2:*:*:*:*:*:*:*,Merethis,Centreon
CVE-2014-3888,0.0,,0.62312,CWE-119,"Stack-based buffer overflow in BKFSim_vhfd.exe in Yokogawa CENTUM CS 1000, CENTUM CS 3000 R3.09.50 and earlier, CENTUM VP R5.03.20 and earlier, Exaopc R3.72.00 and earlier, B/M9000CS R5.05.01 and earlier, and B/M9000 VP R7.03.01 and earlier, when FCS/Test Function is enabled, allows remote attackers to execute arbitrary code via a crafted packet.",2014-07-10,Metasploit,cpe:2.3:a:yokogawa:b\/m9000_vp_software:*:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:b\/m9000cs_software:*:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_1000_software:-:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.01:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.02:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.03:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.04:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.05:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.06:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.07:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.08.50:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.08.70:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.08:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.09.50:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.09:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000_entry_class_software:*:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000_software:*:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_vp_entry_class_software:*:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_vp_software:*:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_vp_software:4.03.00:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:exaopc:*:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:exaopc:3.71.02:*:*:*:*:*:*:*;cpe:2.3:h:yokogawa:b\/m9000_vp:-:*:*:*:*:*:*:*;cpe:2.3:h:yokogawa:b\/m9000cs:-:*:*:*:*:*:*:*;cpe:2.3:h:yokogawa:centum_cs_1000:-:*:*:*:*:*:*:*;cpe:2.3:h:yokogawa:centum_cs_3000:-:*:*:*:*:*:*:*;cpe:2.3:h:yokogawa:centum_cs_3000_entry_class:-:*:*:*:*:*:*:*;cpe:2.3:h:yokogawa:centum_vp:-:*:*:*:*:*:*:*;cpe:2.3:h:yokogawa:centum_vp_entry_class:-:*:*:*:*:*:*:*,Yokogawa,B/M9000Cs
CVE-2014-3913,0.0,,0.6086,CWE-119,Stack-based buffer overflow in AccessServer32.exe in Ericom AccessNow Server allows remote attackers to execute arbitrary code via a request for a non-existent file.,2014-06-04,Metasploit,cpe:2.3:a:ericom:accessnow_server:-:*:*:*:*:*:*:*,Ericom,Accessnow Server
CVE-2014-3914,0.0,,0.72606,CWE-22,"Directory traversal vulnerability in the Admin Center for Tivoli Storage Manager (TSM) in Rocket ServerGraph 1.2 allows remote attackers to (1) create arbitrary files via a .. (dot dot) in the query parameter in a writeDataFile action to the fileRequestor servlet, execute arbitrary files via a .. (dot dot) in the query parameter in a (2) run or (3) runClear action to the fileRequestor servlet, (4) read arbitrary files via a readDataFile action to the fileRequestor servlet, (5) execute arbitrary code via a save_server_groups action to the userRequest servlet, or (6) delete arbitrary files via a del action in the fileRequestServlet servlet.",2014-08-07,Metasploit,cpe:2.3:a:rocketsoftware:rocket_servergraph:1.2:*:*:*:*:*:*:*,Rocketsoftware,Rocket Servergraph
CVE-2014-3931,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.26572,CWE-119,fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory write and memory corruption.,2017-03-31,CISA,cpe:2.3:a:multi-router_looking_glass_project:multi-router_looking_glass:*:*:*:*:*:*:*:*,Multi-Router Looking Glass Project,Multi-Router Looking Glass
CVE-2014-3936,0.0,,0.76555,CWE-119,"Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev. A1) with firmware 1.01b06 and earlier, DIR-505 with firmware before 1.08b10, and DIR-505L with firmware 1.01 and earlier allows remote attackers to execute arbitrary code via a long Content-Length header in a GetDeviceSettings action in an HNAP request.",2014-06-02,Metasploit,cpe:2.3:h:dlink:dir-505l_shareport_mobile_companion:a1:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir505_shareport_mobile_companion:a1:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dsp-w215:a1:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir505_shareport_mobile_companion_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir505l_shareport_mobile_companion_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dsp-w215_firmware:*:b06:*:*:*:*:*:*,D-Link,Dir505 Shareport Mobile Companion Firmware
CVE-2014-3996,0.0,,0.35547,CWE-89,"SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build 90043, Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7 build 7003, IT360 and IT360 Managed Service Providers (MSP) edition before 10.3.3 build 10330, and possibly other ManageEngine products, allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the sv parameter to LinkViewFetchServlet.dat.",2014-12-05,Metasploit,cpe:2.3:a:manageengine:desktop_central:*:build_90043:*:*:*:*:*:*;cpe:2.3:a:manageengine:desktop_central:*:build_90043:*:*:managed_service_providers:*:*:*;cpe:2.3:a:manageengine:it360:*:build_10330:*:*:*:*:*:*;cpe:2.3:a:manageengine:it360:*:build_10330:*:*:managed_service_providers:*:*:*;cpe:2.3:a:manageengine:password_manager_pro:*:build_7003:*:*:*:*:*:*;cpe:2.3:a:manageengine:password_manager_pro:*:build_7003:*:*:managed_service_providers:*:*:*,Manageengine,It360
CVE-2014-4076,0.0,,0.22666,CWE-264,"Microsoft Windows Server 2003 SP2 allows local users to gain privileges via a crafted IOCTL call to (1) tcpip.sys or (2) tcpip6.sys, aka ""TCP/IP Elevation of Privilege Vulnerability.""",2014-11-11,Metasploit,cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:x86:*,Microsoft,Windows Server 2003
CVE-2014-4077,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.47679,NVD-CWE-noinfo,"Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 2007 SP3, when IMJPDCT.EXE (aka IME for Japanese) is installed, allow remote attackers to bypass a sandbox protection mechanism via a crafted PDF document, aka ""Microsoft IME (Japanese) Elevation of Privilege Vulnerability,"" as exploited in the wild in 2014.",2014-11-11,CISA,cpe:2.3:a:microsoft:office_2007_ime:sp3:*:*:ja:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2014-4113,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.87042,NVD-CWE-noinfo,"win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, as exploited in the wild in October 2014, aka ""Win32k.sys Elevation of Privilege Vulnerability.""",2014-10-15,CISA/Metasploit,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2014-4114,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.81628,NVD-CWE-noinfo,"Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object in an Office document, as exploited in the wild with a ""Sandworm"" attack in June through October 2014, aka ""Windows OLE Remote Code Execution Vulnerability.""",2014-10-15,CISA/Metasploit,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:gold:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2014-4123,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.40289,NVD-CWE-noinfo,"Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka ""Internet Explorer Elevation of Privilege Vulnerability,"" as exploited in the wild in October 2014, a different vulnerability than CVE-2014-4124.",2014-10-15,CISA,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows Server 2003
CVE-2014-4148,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.52744,CWE-94,"win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted TrueType font, as exploited in the wild in October 2014, aka ""TrueType Font Parsing Remote Code Execution Vulnerability.""",2014-10-15,CISA,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2014-4210,0.0,,0.38152,NVD-CWE-noinfo,Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allows remote attackers to affect confidentiality via vectors related to WLS - Web Services.,2014-07-17,Nuclei,cpe:2.3:a:oracle:fusion_middleware:10.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:fusion_middleware:10.3.6:*:*:*:*:*:*:*,Oracle,Fusion Middleware
CVE-2014-4404,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.49049,CWE-787,Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted key-mapping properties.,2014-09-18,CISA/Metasploit,cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*,Apple,Iphone Os
CVE-2014-4511,0.0,,0.8273,NVD-CWE-Other,"Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a (1) blame, (2) file, or (3) stats page, as demonstrated by requests to blame/master/, master/, and stats/master/.",2014-07-22,Metasploit,cpe:2.3:a:gitlist:gitlist:*:*:*:*:*:*:*:*;cpe:2.3:a:gitlist:gitlist:0.1:*:*:*:*:*:*:*;cpe:2.3:a:gitlist:gitlist:0.2:*:*:*:*:*:*:*;cpe:2.3:a:gitlist:gitlist:0.3:*:*:*:*:*:*:*,Gitlist,Gitlist
CVE-2014-4513,0.0,,0.04573,CWE-79,"Multiple cross-site scripting (XSS) vulnerabilities in server/offline.php in the ActiveHelper LiveHelp Live Chat plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) MESSAGE, (2) EMAIL, or (3) NAME parameter.",2014-07-01,Nuclei,cpe:2.3:a:activehelper:activehelper_livehelp_live_chat:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:activehelper:activehelper_livehelp_live_chat:2.6.0:*:*:*:*:wordpress:*:*;cpe:2.3:a:activehelper:activehelper_livehelp_live_chat:2.6.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:activehelper:activehelper_livehelp_live_chat:2.6.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:activehelper:activehelper_livehelp_live_chat:2.6.5:*:*:*:*:wordpress:*:*;cpe:2.3:a:activehelper:activehelper_livehelp_live_chat:2.6.7:*:*:*:*:wordpress:*:*;cpe:2.3:a:activehelper:activehelper_livehelp_live_chat:2.7.0:*:*:*:*:wordpress:*:*;cpe:2.3:a:activehelper:activehelper_livehelp_live_chat:2.7.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:activehelper:activehelper_livehelp_live_chat:2.7.4:*:*:*:*:wordpress:*:*;cpe:2.3:a:activehelper:activehelper_livehelp_live_chat:2.7.5:*:*:*:*:wordpress:*:*;cpe:2.3:a:activehelper:activehelper_livehelp_live_chat:2.9.0:*:*:*:*:wordpress:*:*;cpe:2.3:a:activehelper:activehelper_livehelp_live_chat:2.9.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:activehelper:activehelper_livehelp_live_chat:2.9.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:activehelper:activehelper_livehelp_live_chat:2.9.5:*:*:*:*:wordpress:*:*;cpe:2.3:a:activehelper:activehelper_livehelp_live_chat:3.0.0:*:*:*:*:wordpress:*:*,Activehelper,Activehelper Livehelp Live Chat
CVE-2014-4535,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03983,CWE-79,Cross-site scripting (XSS) vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php.,2019-12-27,Nuclei,cpe:2.3:a:import_legacy_media_project:import_legacy_media:*:*:*:*:*:wordpress:*:*,Import Legacy Media Project,Import Legacy Media
CVE-2014-4536,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03902,CWE-79,"Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) go, (2) contactId, or (3) campaignId parameter.",2019-12-27,Nuclei,cpe:2.3:a:katz:infusionsoft_gravity_forms:*:*:*:*:*:wordpress:*:*,Katz,Infusionsoft Gravity Forms
CVE-2014-4539,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03983,CWE-79,Cross-site scripting (XSS) vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php.,2019-12-27,Nuclei,cpe:2.3:a:movies_project:movies:*:*:*:*:*:wordpress:*:*,Movies Project,Movies
CVE-2014-4544,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03779,CWE-79,Cross-site scripting (XSS) vulnerability in the Podcast Channels plugin 0.20 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the Filename parameter to getid3/demos/demo.write.php.,2019-12-27,Nuclei,cpe:2.3:a:podcast_channels_project:podcast_channels:*:*:*:*:*:wordpress:*:*,Podcast Channels Project,Podcast Channels
CVE-2014-4550,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03884,CWE-79,Cross-site scripting (XSS) vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the shortcode parameter.,2019-12-27,Nuclei,cpe:2.3:a:visualshortcodes:ninja:*:*:*:*:*:wordpress:*:*,Visualshortcodes,Ninja
CVE-2014-4558,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.04055,CWE-79,Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the api_url parameter.,2019-12-27,Nuclei,cpe:2.3:a:cybercompany:swipehq-payment-gateway-woocommerce:*:*:*:*:*:wordpress:*:*,Cybercompany,Swipehq-Payment-Gateway-Woocommerce
CVE-2014-4561,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03686,CWE-79,The ultimate-weather plugin 1.0 for WordPress has XSS,2020-01-10,Nuclei,cpe:2.3:a:ultimate-weather_project:ultimate-weather:1.0:*:*:*:*:wordpress:*:*,Ultimate-Weather Project,Ultimate-Weather
CVE-2014-4577,0.0,,0.03749,CWE-22,Absolute path traversal vulnerability in reviews.php in the WP AmASIN - The Amazon Affiliate Shop plugin 0.9.6 and earlier for WordPress allows remote attackers to read arbitrary files via a full pathname in the url parameter.,2014-10-21,Nuclei,cpe:2.3:a:websupporter:wp_amasin_-_the_amazon_affiliate_shop:*:*:*:*:*:wordpress:*:*,Websupporter,Wp Amasin - The Amazon Affiliate Shop
CVE-2014-4592,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03884,CWE-79,Cross-site scripting (XSS) vulnerability in rss.class/scripts/magpie_debug.php in the WP-Planet plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter.,2019-12-27,Nuclei,cpe:2.3:a:czepol:wp-planet:*:*:*:*:*:wordpress:*:*,Czepol,Wp-Planet
CVE-2014-4671,0.0,,0.23024,CWE-352,"Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API.",2014-07-09,Metasploit,cpe:2.3:a:adobe:adobe_air:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air:13.0.0.111:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air:13.0.0.83:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air_sdk:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air_sdk:13.0.0.111:*:*:*:*:*:*:*;cpe:2.3:a:adobe:adobe_air_sdk:13.0.0.83:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.223:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.228:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.233:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.235:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.236:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.238:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.243:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.251:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.258:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.261:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.262:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.270:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.273:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.275:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.280:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.285:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.291:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.297:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.310:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.332:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.335:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.336:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.341:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.346:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.350:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.356:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:11.2.202.359:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:13.0.0.182:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:13.0.0.201:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:13.0.0.206:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:13.0.0.214:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.125:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2014-4725,0.0,,0.59682,CWE-287,The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/.,2014-07-27,Metasploit,cpe:2.3:a:mailpoet:mailpoet_newsletters:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:0.9.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:0.9.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:0.9.6:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:0.9:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:1.0.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:1.0:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:1.1.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:1.1.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:1.1.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:1.1.4:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:1.1.5:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:1.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.0.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.0.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.0.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.0.4:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.0.5:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.0.6:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.0.7:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.0.8:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.0.9.5:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.0.9:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.0:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.1.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.1.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.1.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.1.4:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.1.5:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.1.6:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.1.7:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.1.8:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.1.9:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.2.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.2.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.2.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.3.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.3.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.3.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.3.4:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.3.5:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.4.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.4.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.4.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.4.4:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.4:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.5.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.5.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.5.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.5.4:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.5.5:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.5.7:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.5.8:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.5.9.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.5.9.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.5.9.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.5.9.4:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.5.9:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.5:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.6.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.6.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.6.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.6.4:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.6.5:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.6:*:*:*:*:wordpress:*:*;cpe:2.3:a:mailpoet:mailpoet_newsletters:2.6:beta:*:*:*:wordpress:*:*,Mailpoet,Mailpoet Newsletters
CVE-2014-4863,0.0,,0.15705,CWE-200,"The Arris Touchstone DG950A cable modem with software 7.10.131 has an SNMP community of public, which allows remote attackers to obtain sensitive password, key, and SSID information via an SNMP request.",2014-09-05,Metasploit,cpe:2.3:a:arris:touchstone_dg950a_software:7.10.131:*:*:*:*:*:*:*;cpe:2.3:h:arris:touchstone_dg950a:-:*:*:*:*:*:*:*,Arris,Touchstone Dg950A
CVE-2014-4872,0.0,,0.80095,CWE-306,"BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows remote attackers to upload arbitrary files, execute arbitrary code, or obtain sensitive credential and configuration information via a .NET Remoting request to (1) FileStorageService or (2) ConfigurationService.",2014-10-10,Metasploit,cpe:2.3:a:bmc:track-it\!:11.3.0.355:*:*:*:*:*:*:*,Bmc,Track-It!
CVE-2014-4877,0.0,,0.39883,CWE-22,"Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.",2014-10-29,Metasploit,cpe:2.3:a:gnu:wget:*:*:*:*:*:*:*:*;cpe:2.3:a:gnu:wget:1.12:*:*:*:*:*:*:*;cpe:2.3:a:gnu:wget:1.13.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:wget:1.13.2:*:*:*:*:*:*:*;cpe:2.3:a:gnu:wget:1.13.3:*:*:*:*:*:*:*;cpe:2.3:a:gnu:wget:1.13.4:*:*:*:*:*:*:*;cpe:2.3:a:gnu:wget:1.13:*:*:*:*:*:*:*;cpe:2.3:a:gnu:wget:1.14:*:*:*:*:*:*:*,Gnu,Wget
CVE-2014-4880,0.0,,0.71356,CWE-119,"Buffer overflow in Hikvision DVR DS-7204 Firmware 2.2.10 build 131009, and other models and versions, allows remote attackers to execute arbitrary code via an RTSP PLAY request with a long Authorization header.",2014-12-08,Metasploit,cpe:2.3:h:hikvision:dvr_ds-7204:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:dvr_ds-7204_firmware:2.2.10:build_131009:*:*:*:*:*:*,Hikvision,Dvr Ds-7204 Firmware
CVE-2014-4936,0.0,,0.16784,CWE-345,The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow man-in-the-middle attackers to execute arbitrary code by spoofing the update server and uploading an executable.,2014-12-16,Metasploit,cpe:2.3:a:malwarebytes:malwarebytes_anti-exploit:*:*:*:*:consumer:*:*:*;cpe:2.3:a:malwarebytes:malwarebytes_anti-malware:*:*:*:*:consumer:*:*:*,Malwarebytes,Malwarebytes Anti-Exploit
CVE-2014-4940,0.0,,0.18734,CWE-22,Multiple directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the fn parameter to (1) charts/treemap.php or (2) charts/zoomabletreemap.php.,2014-07-11,Nuclei,cpe:2.3:a:tera_charts_plugin_project:tera-charts:0.1:*:*:*:*:wordpress:*:*,Tera Charts Plugin Project,Tera-Charts
CVE-2014-4941,0.0,,0.04306,CWE-22,Absolute path traversal vulnerability in Cross-RSS (wp-cross-rss) plugin 1.7 for WordPress allows remote attackers to read arbitrary files via a full pathname in the rss parameter to proxy.php.,2014-07-11,Nuclei,cpe:2.3:a:cross-rss_plugin_project:wp-cross-rss:1.7:*:*:*:*:wordpress:*:*,Cross-Rss Plugin Project,Wp-Cross-Rss
CVE-2014-4942,0.0,,0.0437,CWE-200,"The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function.",2014-07-11,Nuclei,cpe:2.3:a:levelfourdevelopment:wp-easycart:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:levelfourdevelopment:wp-easycart:2.0.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:levelfourdevelopment:wp-easycart:2.0.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:levelfourdevelopment:wp-easycart:2.0.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:levelfourdevelopment:wp-easycart:2.0.4:*:*:*:*:wordpress:*:*,Levelfourdevelopment,Wp-Easycart
CVE-2014-4971,0.0,,0.23046,CWE-20,"Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ Access Control subsystem and (2) the BthPan.sys driver in the Bluetooth Personal Area Networking subsystem.",2014-07-26,Metasploit,cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*,Microsoft,Windows Xp
CVE-2014-4977,0.0,,0.74932,CWE-89,"Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) selectedUserGroup parameter in a create new user request to cgi-bin/admin.cgi or the (2) user_id parameter in the changeUnit function, (3) methodDetail parameter in the methodDetail function, or (4) xcNetworkDetail parameter in the xcNetworkDetail function in d4d/exporters.php.",2014-07-16,Metasploit,cpe:2.3:a:sonicwall:scrutinizer:11.0.1:*:*:*:*:*:*:*,Sonicwall,Scrutinizer
CVE-2014-5005,0.0,,0.77848,CWE-22,Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a .. (dot dot) in the fileName parameter in an LFU action to statusUpdate.,2014-10-21,Metasploit,cpe:2.3:a:zohocorp:manageengine_desktop_central:*:*:*:*:*:*:*:*,Zohocorp,Manageengine Desktop Central
CVE-2014-5073,0.0,,0.7345,NVD-CWE-Other,vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary commands via shell metacharacters in the fileDate parameter in a DOWN call.,2014-08-29,Metasploit,cpe:2.3:a:vmturbo:operations_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:vmturbo:operations_manager:4.0:*:*:*:*:*:*:*;cpe:2.3:a:vmturbo:operations_manager:4.5:-:*:*:*:*:*:*;cpe:2.3:a:vmturbo:operations_manager:4.5:1:*:*:*:*:*:*,Vmturbo,Operations Manager
CVE-2014-5111,0.0,,0.21237,CWE-22,"Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a .. (dot dot) in the lang parameter to (1) home/index.php, (2) asterisk_info/asterisk_info.php, (3) repo/repo.php, or (4) endpointcfg/endpointcfg.php in maint/modules/.",2014-07-28,Nuclei,cpe:2.3:a:netfortris:trixbox:-:*:*:*:*:*:*:*,Netfortris,Trixbox
CVE-2014-5181,0.0,,0.04259,CWE-22,Directory traversal vulnerability in lastfm-proxy.php in the Last.fm Rotation (lastfm-rotation) plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the snode parameter.,2014-08-06,Nuclei,cpe:2.3:a:last.fm_rotation_plugin_project:lastfm-rotation_plugin:1.0:*:*:*:*:wordpress:*:*,Last.Fm Rotation Plugin Project,Lastfm-Rotation Plugin
CVE-2014-5187,0.0,,0.04718,CWE-22,Directory traversal vulnerability in the Tom M8te (tom-m8te) plugin 1.5.3 for WordPress allows remote attackers to read arbitrary files via the file parameter to tom-download-file.php.,2014-08-06,Nuclei,cpe:2.3:a:tom_m8te_plugin_project:tom-m8te_plugin:1.5.3:*:*:*:*:wordpress:*:*,Tom M8Te Plugin Project,Tom-M8Te Plugin
CVE-2014-5208,0.0,,0.22543,CWE-284,"BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5.04.00, and Exaopc through R3.72.10, does not require authentication, which allows remote attackers to read arbitrary files via a RETR operation, write to arbitrary files via a STOR operation, or obtain sensitive database-location information via a PMODE operation, a different vulnerability than CVE-2014-0784.",2014-12-22,Metasploit,cpe:2.3:a:yokogawa:centum_cs_3000:r3.01:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.02:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.03:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.04:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.05:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.06:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.07:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.08.50:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.08.70:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.08:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.09.50:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_cs_3000:r3.09:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_vp:*:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_vp:r5.01.00:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_vp:r5.01.20:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_vp:r5.02.00:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:centum_vp:r5.03.00:*:*:*:*:*:*:*;cpe:2.3:a:yokogawa:exaopc:*:*:*:*:*:*:*:*;cpe:2.3:h:yokogawa:centum_cs_3000:-:*:*:*:*:*:*:*;cpe:2.3:h:yokogawa:centum_vp:-:*:*:*:*:*:*:*;cpe:2.3:h:yokogawa:exaopc:-:*:*:*:*:*:*:*,Yokogawa,Exaopc
CVE-2014-5258,0.0,,0.19764,CWE-22,Directory traversal vulnerability in showTempFile.php in webEdition CMS before 6.3.9.0 Beta allows remote authenticated users to read arbitrary files via a .. (dot dot) in the file parameter.,2014-11-06,Nuclei,cpe:2.3:a:webedition:webedition_cms:*:*:*:*:*:*:*:*,Webedition,Webedition Cms
CVE-2014-5266,0.0,,0.24385,CWE-399,"The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265.",2014-08-18,Metasploit,cpe:2.3:a:drupal:drupal:6.0:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.0:beta1:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.0:beta2:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.0:beta3:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.0:beta4:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.0:dev:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.0:rc1:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.0:rc2:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.0:rc3:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.0:rc4:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.10:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.11:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.12:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.13:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.14:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.15:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.16:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.17:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.18:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.19:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.1:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.20:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.21:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.22:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.23:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.24:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.25:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.26:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.27:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.28:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.29:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.2:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.30:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.31:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.32:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.3:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.4:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.5:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.6:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.7:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.8:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:6.9:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:alpha1:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:alpha2:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:alpha3:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:alpha4:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:alpha5:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:alpha6:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:alpha7:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:beta1:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:beta2:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:beta3:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:dev:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:rc1:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:rc2:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:rc3:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.0:rc4:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.10:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.11:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.12:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.13:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.14:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.15:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.16:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.17:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.18:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.19:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.1:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.20:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.21:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.22:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.23:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.24:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.25:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.26:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.27:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.28:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.29:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.2:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.30:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.3:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.4:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.5:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.6:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.7:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.8:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.9:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:7.x-dev:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.0.4:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.0.5:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.0.6:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.0:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.1.3:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.1.4:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.2:beta1:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.3.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.3.3:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.3:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.4.0:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.4.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.4.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.5.0:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.6.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.6:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.7.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.7:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.8.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.8:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:3.9.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2014-5301,0.0,,0.78378,CWE-22,Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4.,2017-08-28,Metasploit,cpe:2.3:a:manageengine:assetexplorer:-:*:*:*:*:*:*:*;cpe:2.3:a:manageengine:it360:-:*:*:*:*:*:*:*;cpe:2.3:a:manageengine:servicedesk_plus:-:*:*:*:*:*:*:*;cpe:2.3:a:manageengine:supportcenter:-:*:*:*:*:*:*:*,Manageengine,Servicedesk Plus
CVE-2014-5337,0.0,,0.16988,CWE-264,"The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remote attackers to obtain sensitive information via an exportarticles action to export/content.php.",2014-08-29,Metasploit,cpe:2.3:a:wordpress_mobile_pack_project:wordpress_mobile_pack:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:wordpress_mobile_pack_project:wordpress_mobile_pack:1.2.0:*:*:*:*:wordpress:*:*;cpe:2.3:a:wordpress_mobile_pack_project:wordpress_mobile_pack:1.2.0:b2:*:*:*:wordpress:*:*;cpe:2.3:a:wordpress_mobile_pack_project:wordpress_mobile_pack:1.2.0:b:*:*:*:wordpress:*:*;cpe:2.3:a:wpmobilepack:wordpress_mobile_pack:1.0.8223:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpmobilepack:wordpress_mobile_pack:1.1.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpmobilepack:wordpress_mobile_pack:1.1.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpmobilepack:wordpress_mobile_pack:1.1.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpmobilepack:wordpress_mobile_pack:1.1.91:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpmobilepack:wordpress_mobile_pack:1.1.92:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpmobilepack:wordpress_mobile_pack:1.1.9:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpmobilepack:wordpress_mobile_pack:1.2.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpmobilepack:wordpress_mobile_pack:1.2.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpmobilepack:wordpress_mobile_pack:1.2.4:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpmobilepack:wordpress_mobile_pack:1.2.5:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpmobilepack:wordpress_mobile_pack:2.0:*:*:*:*:wordpress:*:*,Wordpress Mobile Pack Project,Wordpress Mobile Pack
CVE-2014-5368,0.0,,0.18817,CWE-22,Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Source Control (wp-source-control) plugin 3.0.0 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter.,2014-08-22,Nuclei,cpe:2.3:a:wp_content_source_control_project:wp_content_source_control:*:*:*:*:*:wordpress:*:*,Wp Content Source Control Project,Wp Content Source Control
CVE-2014-5377,0.0,,0.57475,CWE-200,ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request.,2014-09-04,Metasploit,cpe:2.3:a:manageengine:device_expert:*:*:*:*:*:*:*:*,Manageengine,Device Expert
CVE-2014-5383,0.0,,0.21193,CWE-89,SQL injection vulnerability in AlienVault OSSIM before 4.7.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.,2014-08-21,Metasploit,cpe:2.3:a:alienvault:open_source_security_information_management:*:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:2.1.2:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:2.1.5-1:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:2.1.5-2:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:2.1.5-3:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:2.1.5:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:2.1:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:3.1.10:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:3.1.12:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:3.1.9:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:3.1:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.0.3:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.0.4:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.0:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.1.3:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.1:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.2.2:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.2.3:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.2:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.3.1:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.3.2:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.3.3:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.3:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.4:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.5:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:open_source_security_information_management:4.6:*:*:*:*:*:*:*,Alienvault,Open Source Security Information Management
CVE-2014-5445,0.0,,0.98012,CWE-22,Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the (1) CSVServlet or (2) CReportPDFServlet servlet.,2014-12-04,EPSS/Metasploit,cpe:2.3:a:zohocorp:manageengine_it360:10.3.0:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:*:*:*:*:*:*:*:*,Zohocorp,Manageengine It360
CVE-2014-5460,0.0,,0.7089,CWE-20,"Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file, then accessing it via a direct request to the file in wp-content/uploads/slideshow-gallery/.",2014-09-11,Metasploit,cpe:2.3:a:tribulant:tibulant_slideshow_gallery:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:tribulant:tibulant_slideshow_gallery:1.4.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:tribulant:tibulant_slideshow_gallery:1.4.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:tribulant:tibulant_slideshow_gallery:1.4.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:tribulant:tibulant_slideshow_gallery:1.4.4:*:*:*:*:wordpress:*:*;cpe:2.3:a:tribulant:tibulant_slideshow_gallery:1.4.5:*:*:*:*:wordpress:*:*;cpe:2.3:a:tribulant:tibulant_slideshow_gallery:1.4:*:*:*:*:wordpress:*:*,Tribulant,Tibulant Slideshow Gallery
CVE-2014-5468,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.52563,CWE-20,"A File Inclusion vulnerability exists in Railo 4.2.1 and earlier via a specially-crafted URL request to the thumbnail.cfm to specify a malicious PNG file, which could let a remote malicious user obtain sensitive information or execute arbitrary code.",2020-02-07,Metasploit,cpe:2.3:a:getrailo:railo:*:*:*:*:*:*:*:*,Getrailo,Railo
CVE-2014-5470,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.10012,CWE-77,Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for part of the input data passed to an eval operation.,2024-06-21,Metasploit,,,
CVE-2014-5519,0.0,,0.64971,CWE-94,The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the edit[content] parameter to index.php/HeIp.  NOTE: some of these details are obtained from third party information.,2014-09-11,Metasploit,cpe:2.3:a:phpwiki_project:phpwiki:1.5.0:*:*:*:*:*:*:*,Phpwiki Project,Phpwiki
CVE-2014-6034,0.0,,0.78954,CWE-22,"Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360 10.4 and earlier allows remote attackers or remote authenticated users to write to and execute arbitrary WAR files via a .. (dot dot) in the regionID parameter.",2014-12-04,Metasploit,cpe:2.3:a:zohocorp:manageengine_it360:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:10.0:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:10.1:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:10.2:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:11.0:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:11.1:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:11.2:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:11.3:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:8.8:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:9.0:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:9.1:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:9.2:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:9.4:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_social_it_plus:11.0:*:*:*:*:*:*:*,Zohocorp,Manageengine Social It Plus
CVE-2014-6037,0.0,,0.84182,CWE-22,"Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers to execute arbitrary code by uploading a ZIP file which contains an executable file with .. (dot dot) sequences in its name, then accessing the executable via a direct request to the file under the web root. Fixed in Build 11072.",2014-10-26,Metasploit,cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:8.2:8020:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:9.0:9002:*:*:*:*:*:*,Zohocorp,Manageengine Eventlog Analyzer
CVE-2014-6038,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.72757,CWE-200,Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability. Fixed in EventLog Analyzer 10.0 Build 10000.,2020-01-13,Metasploit,cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:*:*:*:*:*:*:*:*,Zohocorp,Manageengine Eventlog Analyzer
CVE-2014-6039,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.68779,CWE-522,ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed version 10 Build 10000.,2020-01-13,Metasploit,cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:*:*:*:*:*:*:*:*,Zohocorp,Manageengine Eventlog Analyzer
CVE-2014-6041,0.0,,0.18278,CWE-264,"The Android WebView in Android before 4.4 allows remote attackers to bypass the Same Origin Policy via a crafted attribute containing a \u0000 character, as demonstrated by an onclick=""window.open('\u0000javascript: sequence to the Android Browser application 4.2.1 or a third-party web browser.",2014-09-02,Metasploit,cpe:2.3:a:google:android_browser:4.2.1:*:*:*:*:android:*:*,Google,Android Browser
CVE-2014-6271,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99999,CWE-78,"GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka ""ShellShock.""  NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.",2014-09-24,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:checkpoint:security_gateway:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_wan_optimization_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_cloud:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_device:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_security:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:enterprise_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:traffix_signaling_delivery_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:traffix_signaling_delivery_controller:3.3.2:*:*:*:*:*:*:*;cpe:2.3:a:f5:traffix_signaling_delivery_controller:3.4.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:traffix_signaling_delivery_controller:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:traffix_signaling_delivery_controller:4.1.0:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:*:*:*:*:*:*:*:*;cpe:2.3:a:ibm:infosphere_guardium_database_activity_monitoring:8.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:infosphere_guardium_database_activity_monitoring:9.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:infosphere_guardium_database_activity_monitoring:9.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:pureapplication_system:*:*:*:*:*:*:*:*;cpe:2.3:a:ibm:pureapplication_system:2.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_risk_manager:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.0:mr1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.0:mr2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.1:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.1:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.1:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.1:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p10:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p11:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p12:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p13:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p4:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p5:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p6:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p7:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p8:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p9:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.0:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.0:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.0:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.0:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.1:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.1:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.1:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.1:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.2:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.2:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.2:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.2:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.2:p4:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.3:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.3:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.3:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.3:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.3:p4:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.4:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.4:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.4:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.4:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.4:p4:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.4:p5:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.4:p6:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.5:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.5:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.5:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.5:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.5:p4:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.5:p5:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.5:p6:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.6:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.6:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.6:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.6:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.6:p4:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.6:p5:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.6:p6:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.6:p7:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.7:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.7:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.7:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.7:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.7:p4:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8.15:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p10:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p11:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p12:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p13:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p14:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p15:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p16:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p4:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p5:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p6:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p7:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p8:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p9:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.9:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.6:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.6:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.6:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.6:p4:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.6:p5:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.6:p6:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.6:p7:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p10:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p11:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p12:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p13:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p14:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p15:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p16:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p17:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p4:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p5:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p6:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p7:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p8:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p9:*:*:*:*:*:*;cpe:2.3:a:ibm:smartcloud_entry_appliance:2.3.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:smartcloud_entry_appliance:2.4.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:smartcloud_entry_appliance:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:smartcloud_entry_appliance:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:smartcloud_provisioning:2.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:software_defined_network_for_virtual_environments:*:*:*:*:kvm:*:*:*;cpe:2.3:a:ibm:software_defined_network_for_virtual_environments:*:*:*:*:openflow:*:*:*;cpe:2.3:a:ibm:software_defined_network_for_virtual_environments:*:*:*:*:vmware:*:*:*;cpe:2.3:a:ibm:starter_kit_for_cloud:2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:workload_deployer:*:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_configuration_management:10.3:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_configuration_management:11.1:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_configuration_management:11.2:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_configuration_management:11.3.0:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_configuration_management:11:*:*:*:*:*:*:*;cpe:2.3:a:redhat:gluster_storage_server_for_on-premise:2.1:*:*:*:*:*:*:*;cpe:2.3:a:redhat:virtualization:3.4:*:*:*:*:*:*:*;cpe:2.3:a:suse:studio_onsite:1.3:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server_appliance:5.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server_appliance:5.0:update_1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server_appliance:5.0:update_2:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server_appliance:5.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server_appliance:5.1:update_1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server_appliance:5.1:update_2:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server_appliance:5.5:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server_appliance:5.5:update_1:*:*:*:*:*:*;cpe:2.3:h:citrix:netscaler_sdx:-:*:*:*:*:*:*:*;cpe:2.3:h:f5:arx:-:*:*:*:*:*:*:*;cpe:2.3:h:ibm:flex_system_v7000:-:*:*:*:*:*:*:*;cpe:2.3:h:ibm:san_volume_controller:-:*:*:*:*:*:*:*;cpe:2.3:h:ibm:stn6500:-:*:*:*:*:*:*:*;cpe:2.3:h:ibm:stn6800:-:*:*:*:*:*:*:*;cpe:2.3:h:ibm:stn7800:-:*:*:*:*:*:*:*;cpe:2.3:h:ibm:storwize_v3500:-:*:*:*:*:*:*:*;cpe:2.3:h:ibm:storwize_v3700:-:*:*:*:*:*:*:*;cpe:2.3:h:ibm:storwize_v5000:-:*:*:*:*:*:*:*;cpe:2.3:h:ibm:storwize_v7000:-:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*;cpe:2.3:o:citrix:netscaler_sdx_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:f5:arx_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ibm:flex_system_v7000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ibm:san_volume_controller_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_mobile_8.0_firmware:8.0.0.1:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_mobile_8.0_firmware:8.0.0.2:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_mobile_8.0_firmware:8.0.0.3:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_mobile_8.0_firmware:8.0.0.5:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.1:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.2:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.3:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.4:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.5:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.6:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.7:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.8:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.0.2:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.0.3:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.0.5:*:*:*:*:*:*:*;cpe:2.3:o:ibm:stn6500_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ibm:stn6800_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ibm:stn7800_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ibm:storwize_v3500_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ibm:storwize_v3700_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ibm:storwize_v5000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ibm:storwize_v7000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:mageia:mageia:3.0:*:*:*:*:*:*:*;cpe:2.3:o:mageia:mageia:4.0:*:*:*:*:*:*:*;cpe:2.3:o:novell:open_enterprise_server:11.0:sp2:*:*:*:linux_kernel:*:*;cpe:2.3:o:novell:open_enterprise_server:2.0:sp3:*:*:*:linux_kernel:*:*;cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:4:*:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.1.1:-:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.1.1:build_0927:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:4.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:5.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:5.9_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.4_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.5_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.3_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.4_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.5_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.6_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.7_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:5.0_ppc:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:5.9_ppc:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.4_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:6.5_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.3_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.4_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.5_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.6_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.7_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:5.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:ltss:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:*;cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:-:*:*:*:*:*:*;cpe:2.3:o:vmware:esx:4.0:*:*:*:*:*:*:*;cpe:2.3:o:vmware:esx:4.1:*:*:*:*:*:*:*,Ibm,Security Access Manager For Mobile 8.0 Firmware
CVE-2014-6278,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.99621,CWE-78,"GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.",2014-09-30,CISA/EPSS/Metasploit,cpe:2.3:a:gnu:bash:1.14.0:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:1.14.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:1.14.2:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:1.14.3:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:1.14.4:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:1.14.5:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:1.14.6:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:1.14.7:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:2.01.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:2.01:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:2.02.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:2.02:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:2.03:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:2.04:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:2.05:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:2.05:a:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:2.05:b:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:2.0:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:3.0.16:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:3.0:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:3.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:3.2.48:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:3.2:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:4.0:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:4.0:rc1:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:4.1:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:4.2:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:4.3:*:*:*:*:*:*:*,Gnu,Bash
CVE-2014-6287,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99323,CWE-94,The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.,2014-10-07,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:rejetto:http_file_server:*:*:*:*:*:*:*:*,Rejetto,Http File Server
CVE-2014-6308,0.0,,0.2226,CWE-22,Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter in a render action to oc-admin/index.php.,2014-10-20,Nuclei,cpe:2.3:a:osclass:osclass:*:*:*:*:*:*:*:*;cpe:2.3:a:osclass:osclass:3.4.0:*:*:*:*:*:*:*,Osclass,Osclass
CVE-2014-6321,0.0,,0.95988,CWE-94,"Schannel in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via crafted packets, aka ""Microsoft Schannel Remote Code Execution Vulnerability.""",2014-11-11,EPSS,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2014-6324,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.87448,NVD-CWE-noinfo,"The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote authenticated domain users to obtain domain administrator privileges via a forged signature in a ticket, as exploited in the wild in November 2014, aka ""Kerberos Checksum Vulnerability.""",2014-11-18,CISA/Metasploit,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2014-6332,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.94996,CWE-119,"OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted web site, as demonstrated by an array-redimensioning attempt that triggers improper handling of a size value in the SafeArrayDimen function, aka ""Windows OLE Automation Array Remote Code Execution Vulnerability.""",2014-11-11,CISA/Metasploit,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2014-6352,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.77553,NVD-CWE-noinfo,"Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object, as exploited in the wild in October 2014 with a crafted PowerPoint document.",2014-10-22,CISA/Metasploit,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2014-6446,0.0,,0.46174,CWE-94,"The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via a request to utilities/code_generator.php.",2014-09-26,Metasploit,cpe:2.3:a:infusionsoft_gravity_forms_project:infusionsoft_gravity_forms:1.5.10:*:*:*:*:wordpress:*:*;cpe:2.3:a:infusionsoft_gravity_forms_project:infusionsoft_gravity_forms:1.5.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:infusionsoft_gravity_forms_project:infusionsoft_gravity_forms:1.5.4.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:infusionsoft_gravity_forms_project:infusionsoft_gravity_forms:1.5.4.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:infusionsoft_gravity_forms_project:infusionsoft_gravity_forms:1.5.4:*:*:*:*:wordpress:*:*;cpe:2.3:a:infusionsoft_gravity_forms_project:infusionsoft_gravity_forms:1.5.5:*:*:*:*:wordpress:*:*;cpe:2.3:a:infusionsoft_gravity_forms_project:infusionsoft_gravity_forms:1.5.6:*:*:*:*:wordpress:*:*;cpe:2.3:a:infusionsoft_gravity_forms_project:infusionsoft_gravity_forms:1.5.7.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:infusionsoft_gravity_forms_project:infusionsoft_gravity_forms:1.5.7.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:infusionsoft_gravity_forms_project:infusionsoft_gravity_forms:1.5.7:*:*:*:*:wordpress:*:*;cpe:2.3:a:infusionsoft_gravity_forms_project:infusionsoft_gravity_forms:1.5.8.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:infusionsoft_gravity_forms_project:infusionsoft_gravity_forms:1.5.8:*:*:*:*:wordpress:*:*;cpe:2.3:a:infusionsoft_gravity_forms_project:infusionsoft_gravity_forms:1.5.9.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:infusionsoft_gravity_forms_project:infusionsoft_gravity_forms:1.5.9.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:infusionsoft_gravity_forms_project:infusionsoft_gravity_forms:1.5.9.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:infusionsoft_gravity_forms_project:infusionsoft_gravity_forms:1.5.9.4:*:*:*:*:wordpress:*:*;cpe:2.3:a:infusionsoft_gravity_forms_project:infusionsoft_gravity_forms:1.5.9.5:*:*:*:*:wordpress:*:*;cpe:2.3:a:infusionsoft_gravity_forms_project:infusionsoft_gravity_forms:1.5.9:*:*:*:*:wordpress:*:*,Infusionsoft Gravity Forms Project,Infusionsoft Gravity Forms
CVE-2014-6593,0.0,,0.67234,NVD-CWE-noinfo,"Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE.",2015-01-21,Metasploit,cpe:2.3:a:oracle:jdk:1.5.0:update75:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update85:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update71:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update72:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.8.0:update25:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.8.0:update6:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.5.0:update75:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update85:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update71:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update72:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.8.0:update25:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.8.0:update6:*:*:*:*:*:*;cpe:2.3:a:oracle:jrockit:r27.8.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jrockit:r28.3.4:*:*:*:*:*:*:*,Oracle,Jrockit
CVE-2014-7146,0.0,,0.50561,CWE-20,"The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted (1) description field or (2) issuelink attribute in an XML file, which is not properly handled when executing the preg_replace function with the e modifier.",2014-11-18,Metasploit,cpe:2.3:a:mantisbt:mantisbt:1.2.17:*:*:*:*:*:*:*,Mantisbt,Mantisbt
CVE-2014-7169,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9994,CWE-78,"GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.",2014-09-25,CISA/EPSS,cpe:2.3:a:checkpoint:security_gateway:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_wan_optimization_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_cloud:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_device:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_security:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:enterprise_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:traffix_signaling_delivery_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:traffix_signaling_delivery_controller:3.3.2:*:*:*:*:*:*:*;cpe:2.3:a:f5:traffix_signaling_delivery_controller:3.4.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:traffix_signaling_delivery_controller:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:traffix_signaling_delivery_controller:4.1.0:*:*:*:*:*:*:*;cpe:2.3:a:gnu:bash:*:*:*:*:*:*:*:*;cpe:2.3:a:ibm:infosphere_guardium_database_activity_monitoring:8.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:infosphere_guardium_database_activity_monitoring:9.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:infosphere_guardium_database_activity_monitoring:9.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:pureapplication_system:*:*:*:*:*:*:*:*;cpe:2.3:a:ibm:pureapplication_system:2.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_risk_manager:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.0:mr1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.0:mr2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.1:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.1:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.1:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.1:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p10:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p11:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p12:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p13:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p4:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p5:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p6:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p7:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p8:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.2:p9:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.0:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.0:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.0:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.0:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.1:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.1:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.1:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.1:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.2:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.2:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.2:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.2:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.2:p4:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.3:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.3:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.3:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.3:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.3:p4:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.4:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.4:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.4:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.4:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.4:p4:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.4:p5:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.4:p6:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.5:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.5:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.5:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.5:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.5:p4:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.5:p5:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.5:p6:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.6:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.6:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.6:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.6:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.6:p4:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.6:p5:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.6:p6:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.6:p7:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.7:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.7:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.7:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.7:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.7:p4:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8.15:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p10:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p11:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p12:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p13:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p14:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p15:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p16:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p4:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p5:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p6:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p7:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p8:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p9:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.9:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.6:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.6:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.6:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.6:p4:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.6:p5:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.6:p6:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.6:p7:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p10:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p11:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p12:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p13:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p14:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p15:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p16:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p17:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p4:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p5:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p6:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p7:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p8:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_vulnerability_manager:7.2.8:p9:*:*:*:*:*:*;cpe:2.3:a:ibm:smartcloud_entry_appliance:2.3.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:smartcloud_entry_appliance:2.4.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:smartcloud_entry_appliance:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:smartcloud_entry_appliance:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:smartcloud_provisioning:2.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:software_defined_network_for_virtual_environments:*:*:*:*:kvm:*:*:*;cpe:2.3:a:ibm:software_defined_network_for_virtual_environments:*:*:*:*:openflow:*:*:*;cpe:2.3:a:ibm:software_defined_network_for_virtual_environments:*:*:*:*:vmware:*:*:*;cpe:2.3:a:ibm:starter_kit_for_cloud:2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:workload_deployer:*:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_configuration_management:10.3:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_configuration_management:11.1:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_configuration_management:11.2:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_configuration_management:11.3.0:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_configuration_management:11:*:*:*:*:*:*:*;cpe:2.3:a:redhat:gluster_storage_server_for_on-premise:2.1:*:*:*:*:*:*:*;cpe:2.3:a:redhat:virtualization:3.4:*:*:*:*:*:*:*;cpe:2.3:a:suse:studio_onsite:1.3:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server_appliance:5.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server_appliance:5.0:update_1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server_appliance:5.0:update_2:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server_appliance:5.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server_appliance:5.1:update_1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server_appliance:5.1:update_2:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server_appliance:5.5:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server_appliance:5.5:update_1:*:*:*:*:*:*;cpe:2.3:h:citrix:netscaler_sdx:-:*:*:*:*:*:*:*;cpe:2.3:h:f5:arx:-:*:*:*:*:*:*:*;cpe:2.3:h:ibm:flex_system_v7000:-:*:*:*:*:*:*:*;cpe:2.3:h:ibm:san_volume_controller:-:*:*:*:*:*:*:*;cpe:2.3:h:ibm:stn6500:-:*:*:*:*:*:*:*;cpe:2.3:h:ibm:stn6800:-:*:*:*:*:*:*:*;cpe:2.3:h:ibm:stn7800:-:*:*:*:*:*:*:*;cpe:2.3:h:ibm:storwize_v3500:-:*:*:*:*:*:*:*;cpe:2.3:h:ibm:storwize_v3700:-:*:*:*:*:*:*:*;cpe:2.3:h:ibm:storwize_v5000:-:*:*:*:*:*:*:*;cpe:2.3:h:ibm:storwize_v7000:-:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*;cpe:2.3:o:citrix:netscaler_sdx_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:f5:arx_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ibm:flex_system_v7000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ibm:san_volume_controller_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_mobile_8.0_firmware:8.0.0.1:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_mobile_8.0_firmware:8.0.0.2:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_mobile_8.0_firmware:8.0.0.3:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_mobile_8.0_firmware:8.0.0.5:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.1:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.2:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.3:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.4:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.5:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.6:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.7:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.8:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.0.2:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.0.3:*:*:*:*:*:*:*;cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.0.5:*:*:*:*:*:*:*;cpe:2.3:o:ibm:stn6500_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ibm:stn6800_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ibm:stn7800_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ibm:storwize_v3500_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ibm:storwize_v3700_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ibm:storwize_v5000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ibm:storwize_v7000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:mageia:mageia:3.0:*:*:*:*:*:*:*;cpe:2.3:o:mageia:mageia:4.0:*:*:*:*:*:*:*;cpe:2.3:o:novell:open_enterprise_server:11.0:sp2:*:*:*:linux_kernel:*:*;cpe:2.3:o:novell:open_enterprise_server:2.0:sp3:*:*:*:linux_kernel:*:*;cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:4:*:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.1.1:-:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.1.1:build_0927:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:4.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:5.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:5.9_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.4_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.5_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.3_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.4_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.5_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.6_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.7_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:5.0_ppc:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:5.9_ppc:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.4_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:6.5_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.3_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.4_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.5_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.6_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.7_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:5.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:ltss:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:*;cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:-:*:*:*:*:*:*;cpe:2.3:o:vmware:esx:4.0:*:*:*:*:*:*:*;cpe:2.3:o:vmware:esx:4.1:*:*:*:*:*:*:*,Ibm,Security Access Manager For Mobile 8.0 Firmware
CVE-2014-7205,0.0,,0.78582,CWE-94,Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors.,2014-10-08,Metasploit,cpe:2.3:a:bassmaster_project:bassmaster:*:*:*:*:*:*:*:*,Bassmaster Project,Bassmaster
CVE-2014-7228,0.0,,0.55126,CWE-310,"Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 through 3.3.4; Akeeba Backup for Joomla! Professional 3.0.0 through 4.0.2; Backup Professional for WordPress 1.0.b1 through 1.1.3; Solo 1.0.b1 through 1.1.2; Admin Tools Core and Professional 2.0.0 through 2.4.4; and CMS Update 1.0.a1 through 1.0.1, when performing a backup or update for an archive, does not delete parameters from $_GET and $_POST when it is cleansing $_REQUEST, but later accesses $_GET and $_POST using the getQueryParam function, which allows remote attackers to bypass encryption and execute arbitrary code via a command message that extracts a crafted archive.",2014-11-03,Metasploit,cpe:2.3:a:joomla:joomla\!:2.5.10:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.11:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.12:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.13:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.14:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.15:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.16:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.17:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.18:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.19:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.20:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.21:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.22:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.23:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.24:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.25:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.4:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.5:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.6:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.7:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.8:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.9:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.0.4:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.4:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.5:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.6:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.4:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.5:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.4:*:*:*:*:*:*:*,Joomla,Joomla!
CVE-2014-7236,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.55637,CWE-74,Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary Perl code via the debugenableplugins parameter to do/view/Main/WebHome.,2020-02-17,Metasploit,cpe:2.3:a:twiki:twiki:*:*:*:*:*:*:*:*;cpe:2.3:a:twiki:twiki:6.0:*:*:*:*:*:*:*,Twiki,Twiki
CVE-2014-7285,0.0,,0.50324,CWE-77,The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.,2014-12-17,Metasploit,cpe:2.3:a:symantec:web_gateway:*:*:*:*:*:*:*:*,Symantec,Web Gateway
CVE-2014-7816,0.0,,0.25082,CWE-22,"Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files via a .. (dot dot) in a resource URI.",2014-12-01,Metasploit,cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:undertow:*:beta2:*:*:*:*:*:*;cpe:2.3:a:redhat:undertow:*:cr4:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2014-7862,0.0,,0.81048,CWE-264,The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action.,2018-01-04,Metasploit,cpe:2.3:a:zohocorp:desktop_central:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:desktop_central:*:*:*:*:managed_service_providers:*:*:*,Zohocorp,Desktop Central
CVE-2014-7863,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.83399,CWE-200,"The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to (1) read arbitrary files via the fileName parameter in a copyfile operation or (2) obtain sensitive information via a directory listing in a listdirectory operation to servlet/FailOverHelperServlet.",2020-02-08,Metasploit,cpe:2.3:a:zohocorp:manageengine_applications_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_it360:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*,Zohocorp,Manageengine Applications Manager
CVE-2014-7981,0.0,,0.08543,CWE-89,SQL injection vulnerability in Joomla! CMS 3.1.x and 3.2.x before 3.2.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.,2014-10-08,Metasploit,cpe:2.3:a:joomla:joomla\!:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.4:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.5:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.6:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.2:*:*:*:*:*:*:*,Joomla,Joomla!
CVE-2014-7992,0.0,,0.27154,CWE-200,"The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensitive credential information from process memory via a session on TCP port 2067, aka Bug ID CSCur14014.",2014-11-18,Metasploit,cpe:2.3:o:cisco:ios:-:*:*:*:*:*:*:*,Cisco,Ios
CVE-2014-8270,0.0,,0.20084,CWE-264,"BMC Track-It! 11.3 allows remote attackers to gain privileges and execute arbitrary code by creating an account whose name matches that of a local system account, then performing a password reset.",2014-12-12,Metasploit,cpe:2.3:a:bmc:track-it\!:11.3:*:*:*:*:*:*:*,Bmc,Track-It!
CVE-2014-8361,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99975,NVD-CWE-noinfo,"The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.",2015-05-01,CISA/EPSS/Metasploit,cpe:2.3:a:realtek:realtek_sdk:-:*:*:*:*:*:*:*;cpe:2.3:h:aterm:w1200ex-ms:-:*:*:*:*:*:*:*;cpe:2.3:h:aterm:w1200ex:-:*:*:*:*:*:*:*;cpe:2.3:h:aterm:w300p:-:*:*:*:*:*:*:*;cpe:2.3:h:aterm:w500p:-:*:*:*:*:*:*:*;cpe:2.3:h:aterm:wf300hp2:-:*:*:*:*:*:*:*;cpe:2.3:h:aterm:wf800hp:-:*:*:*:*:*:*:*;cpe:2.3:h:aterm:wg1200hp2:-:*:*:*:*:*:*:*;cpe:2.3:h:aterm:wg1200hp3:-:*:*:*:*:*:*:*;cpe:2.3:h:aterm:wg1200hp:-:*:*:*:*:*:*:*;cpe:2.3:h:aterm:wg1200hs2:-:*:*:*:*:*:*:*;cpe:2.3:h:aterm:wg1200hs:-:*:*:*:*:*:*:*;cpe:2.3:h:aterm:wg1800hp3:-:*:*:*:*:*:*:*;cpe:2.3:h:aterm:wg1800hp4:-:*:*:*:*:*:*:*;cpe:2.3:h:aterm:wg1900hp2:-:*:*:*:*:*:*:*;cpe:2.3:h:aterm:wg1900hp:-:*:*:*:*:*:*:*;cpe:2.3:h:aterm:wr8165n:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-501:a1:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-515:a1:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-600l:a1:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-600l:b1:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-605l:a1:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-605l:b1:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-605l:c1:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-615:fx:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-615:j1:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-619l:a1:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-619l:b1:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-809:a1:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-809:a2:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-900l:a1:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-905l:a1:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-905l:b1:*:*:*:*:*:*:*;cpe:2.3:o:aterm:w1200ex-ms_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:aterm:w1200ex_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:aterm:w300p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:aterm:w500p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:aterm:wf300hp2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:aterm:wf800hp_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:aterm:wg1200hp2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:aterm:wg1200hp3_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:aterm:wg1200hp_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:aterm:wg1200hs2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:aterm:wg1200hs_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:aterm:wg1800hp3_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:aterm:wg1800hp4_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:aterm:wg1900hp2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:aterm:wg1900hp_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:aterm:wr8165n_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-501_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-515_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-600l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-605l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-615_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-615_firmware:10.01b02:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-619l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-809_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-900l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-905l_firmware:*:*:*:*:*:*:*:*,D-Link,Dir-905L Firmware
CVE-2014-8420,0.0,,0.23987,CWE-20,"The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before 7.2 SP2, and SonicWALL UMA before 7.2 SP2 allows remote authenticated users to execute arbitrary code via unspecified vectors.",2014-11-25,Metasploit,cpe:2.3:a:sonicwall:analyzer:7.2:sp1:*:*:*:*:*:*;cpe:2.3:a:sonicwall:global_management_system:7.2:sp1:*:*:*:*:*:*;cpe:2.3:h:sonicwall:uma_em5000:-:*:*:*:*:*:*:*,Sonicwall,Uma Em5000
CVE-2014-8423,0.0,,0.62476,CWE-74,Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute arbitrary commands via unknown vectors.,2014-11-28,Metasploit,cpe:2.3:o:arris:vap2500_firmware:*:*:*:*:*:*:*:*,Arris,Vap2500 Firmware
CVE-2014-8424,0.0,,0.59617,CWE-287,"ARRIS VAP2500 before FW08.41 does not properly validate passwords, which allows remote attackers to bypass authentication.",2014-11-28,Metasploit,cpe:2.3:o:arris:vap2500_firmware:*:*:*:*:*:*:*:*,Arris,Vap2500 Firmware
CVE-2014-8439,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.20008,CWE-119,"Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference) via unspecified vectors.",2014-11-25,CISA,cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:air_sdk_\&_compiler:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2014-8440,0.0,,0.81943,NVD-CWE-noinfo,"Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0576, CVE-2014-0581, and CVE-2014-8441.",2014-11-11,Metasploit,cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:air_sdk_\&_compiler:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2014-8499,0.0,,0.33591,CWE-89,Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allow remote authenticated users to execute arbitrary SQL commands via the SEARCH_ALL parameter to (1) SQLAdvancedALSearchResult.cc or (2) AdvancedSearchResult.cc.,2014-11-17,Metasploit,cpe:2.3:a:manageengine:password_manager_pro:*:build_7104:*:*:*:*:*:*;cpe:2.3:a:manageengine:password_manager_pro:*:build_7104:*:*:managed_service_providers:*:*:*,Manageengine,Password Manager Pro
CVE-2014-8516,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.8168,CWE-434,"Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via unspecified vectors.",2020-01-03,Metasploit,cpe:2.3:a:cloudfastpath:netcharts_server:-:*:*:*:*:*:*:*,Cloudfastpath,Netcharts Server
CVE-2014-8517,0.0,,0.69115,CWE-77,"The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 through 6.0.6, and 6.1 through 6.1.5 allows remote attackers to execute arbitrary commands via a | (pipe) character at the end of an HTTP redirect.",2014-11-17,Metasploit,cpe:2.3:o:apple:mac_os_x:10.10.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.10.1:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.8.5:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.9.5:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:5.1.1:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:5.1.2:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:5.1.3:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:5.1.4:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:5.1:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:5.2.1:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:5.2.2:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:5.2:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.0.1:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.0.2:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.0.3:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.0.4:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.0.5:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.0.6:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.0:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.1.1:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.1.2:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.1.3:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.1.4:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.1.5:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.1:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2014-8586,0.0,,0.40085,CWE-89,SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to execute arbitrary SQL commands via the calid parameter.,2014-11-04,Metasploit,cpe:2.3:a:cp_multi_view_event_calendar_project:cp_multi_view_event_calendar:1.0.1:*:*:*:wordpress:*:*:*,Cp Multi View Event Calendar Project,Cp Multi View Event Calendar
CVE-2014-8598,0.0,,0.38463,CWE-19,"The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to (1) upload arbitrary XML files via the import page or (2) obtain sensitive information via the export page.  NOTE: this issue can be combined with CVE-2014-7146 to execute arbitrary PHP code.",2014-11-18,Metasploit,cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*,Mantisbt,Mantisbt
CVE-2014-8636,0.0,,0.65657,CWE-94,"The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with a DOM object that has a named getter, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via unspecified vectors.",2015-01-14,Metasploit,cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*,Mozilla,Firefox
CVE-2014-8676,0.0,,0.40779,CWE-22,Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) in a URL path parameter.,2017-08-31,Nuclei,cpe:2.3:a:soplanning:soplanning:*:*:*:*:*:*:*:*,Soplanning,Soplanning
CVE-2014-8682,0.0,,0.33391,CWE-89,"Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go.",2014-11-21,Nuclei,cpe:2.3:a:gogits:gogs:*:*:*:*:*:*:*:*;cpe:2.3:a:gogits:gogs:0.3.1-9:*:*:*:*:*:*:*;cpe:2.3:a:gogits:gogs:0.4.1:*:*:*:*:*:*:*;cpe:2.3:a:gogits:gogs:0.4.2:*:*:*:*:*:*:*;cpe:2.3:a:gogits:gogs:0.5.0:*:*:*:*:*:*:*;cpe:2.3:a:gogits:gogs:0.5.2:*:*:*:*:*:*:*,Gogits,Gogs
CVE-2014-8684,0.0,,0.71515,CWE-310,CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.,2017-09-19,Metasploit,cpe:2.3:a:codeigniter:codeigniter:*:*:*:*:*:*:*:*;cpe:2.3:a:kohanaframework:kohana:3.2.3:*:*:*:*:*:*:*;cpe:2.3:a:kohanaframework:kohana:3.3.0:*:*:*:*:*:*:*;cpe:2.3:a:kohanaframework:kohana:3.3.1:*:*:*:*:*:*:*,Codeigniter,Codeigniter
CVE-2014-8686,0.0,,0.37222,CWE-310,CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available.,2017-09-19,Metasploit,cpe:2.3:a:codeigniter:codeigniter:*:*:*:*:*:*:*:*,Codeigniter,Codeigniter
CVE-2014-8687,0.0,,0.43813,CWE-327,Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by leveraging use of a static encryption key to create session tokens.,2017-06-08,Metasploit,cpe:2.3:h:seagate:business_nas:-:*:*:*:*:*:*:*;cpe:2.3:o:seagate:business_nas_firmware:2014.00319:*:*:*:*:*:*:*,Seagate,Business Nas Firmware
CVE-2014-8739,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.91656,CWE-434,"Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.",2020-02-08,Metasploit/Nuclei,cpe:2.3:a:creative-solutions:creative_contact_form:*:*:*:*:*:joomla\!:*:*;cpe:2.3:a:creative-solutions:creative_contact_form:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:jquery_file_upload_project:jquery_file_upload:6.4.4:*:*:*:*:*:*:*,Creative-Solutions,Creative Contact Form
CVE-2014-8741,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.77198,CWE-22,Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers to write to arbitrary files via unspecified vectors.,2020-01-27,Metasploit,cpe:2.3:a:lexmark:markvision_enterprise:*:*:*:*:*:*:*:*,Lexmark,Markvision Enterprise
CVE-2014-8791,0.0,,0.14766,CWE-94,"project/register.php in Tuleap before 7.7, when sys_create_project_in_one_step is disabled, allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via the data parameter.",2014-12-02,Metasploit,cpe:2.3:a:enalean:tuleap:7.6:*:*:*:*:*:*:*,Enalean,Tuleap
CVE-2014-8799,0.0,,0.67631,CWE-22,Directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the src parameter to lib/dp_image.php.,2014-11-28,Metasploit/Nuclei,cpe:2.3:a:dukapress:dukapress:*:*:*:*:*:wordpress:*:*,Dukapress,Dukapress
CVE-2014-8998,0.0,,0.359,CWE-94,"lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a crafted HTTP header to index.php, which is processed by the preg_replace function with the eval switch.",2014-11-20,Metasploit,cpe:2.3:a:x7chat:x7_chat:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:x7chat:x7_chat:2.0.0:a1:*:*:*:*:*:*;cpe:2.3:a:x7chat:x7_chat:2.0.0:a2:*:*:*:*:*:*;cpe:2.3:a:x7chat:x7_chat:2.0.0:a3:*:*:*:*:*:*;cpe:2.3:a:x7chat:x7_chat:2.0.0:b1:*:*:*:*:*:*;cpe:2.3:a:x7chat:x7_chat:2.0.0:b2:*:*:*:*:*:*;cpe:2.3:a:x7chat:x7_chat:2.0.1:a1:*:*:*:*:*:*;cpe:2.3:a:x7chat:x7_chat:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:x7chat:x7_chat:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:x7chat:x7_chat:2.0.4.1:*:*:*:*:*:*:*;cpe:2.3:a:x7chat:x7_chat:2.0.4.3:*:*:*:*:*:*:*;cpe:2.3:a:x7chat:x7_chat:2.0.4.4:*:*:*:*:*:*:*;cpe:2.3:a:x7chat:x7_chat:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:x7chat:x7_chat:2.0.5.1:*:*:*:*:*:*:*;cpe:2.3:a:x7chat:x7_chat:2.0.5:*:*:*:*:*:*:*,X7Chat,X7 Chat
CVE-2014-9016,0.0,,0.82234,NVD-CWE-noinfo,The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.,2014-11-24,Metasploit,cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*;cpe:2.3:a:secure_password_hashes_project:secure_passwords_hashes:*:*:*:*:*:drupal:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2014-9094,0.0,,0.07309,CWE-79,Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) swfloc or (2) designrand parameter.,2014-11-26,Nuclei,cpe:2.3:a:digitalzoomstudio:video_gallery:-:*:*:*:*:wordpress:*:*,Digitalzoomstudio,Video Gallery
CVE-2014-9119,0.0,,0.16117,CWE-22,Directory traversal vulnerability in download.php in the DB Backup plugin 4.5 and earlier for Wordpress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.,2014-12-31,Nuclei,cpe:2.3:a:db_backup_project:db_backup:*:*:*:*:*:wordpress:*:*,Db Backup Project,Db Backup
CVE-2014-9163,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.20356,NVD-CWE-Other,"Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in December 2014.",2014-12-10,CISA,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2014-9180,0.0,,0.04417,NVD-CWE-Other,Open redirect vulnerability in go.php in Eleanor CMS allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the QUERY_STRING.,2014-12-02,Nuclei,cpe:2.3:a:eleanor-cms:eleanor_cms:-:*:*:*:*:*:*:*,Eleanor-Cms,Eleanor Cms
CVE-2014-9195,0.0,,0.80689,CWE-306,"Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic.",2015-01-17,Metasploit,cpe:2.3:a:phoenixcontact-software:multiprog:5.0:*:*:*:*:*:*:*;cpe:2.3:a:phoenixcontact-software:multiprog:5.0:*:*:*:express:*:*:*;cpe:2.3:a:phoenixcontact-software:multiprog:5.0:*:*:*:pro\+:*:*:*;cpe:2.3:o:phoenixcontact-software:proconos_eclr:*:*:*:*:*:*:*:*;cpe:2.3:o:phoenixcontact-software:proconos_eclr:*:*:*:*:single_chip:*:*:*;cpe:2.3:o:phoenixcontact-software:proconos_eclr:*:*:*:*:softplc:*:*:*;cpe:2.3:o:phoenixcontact-software:proconos_eclr:*:*:*:*:visual_studio:*:*:*,Phoenixcontact-Software,Proconos Eclr
CVE-2014-9222,0.0,,0.63748,CWE-17,"AllegroSoft RomPager 4.34 and earlier, as used in Huawei Home Gateway products and other vendors and products, allows remote attackers to gain privileges via a crafted cookie that triggers memory corruption, aka the ""Misfortune Cookie"" vulnerability.",2014-12-24,Metasploit,cpe:2.3:a:allegrosoft:rompager:*:*:*:*:*:*:*:*,Allegrosoft,Rompager
CVE-2014-9308,0.0,,0.51617,NVD-CWE-Other,"Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka WordPress Shopping Cart) plugin before 3.0.9 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in products/banners/.",2015-01-15,Metasploit,cpe:2.3:a:wpeasycart:wp_easycart:*:*:*:*:*:wordpress:*:*,Wpeasycart,Wp Easycart
CVE-2014-9312,0.0,,0.45354,CWE-434,Unrestricted File Upload vulnerability in Photo Gallery 1.2.5.,2017-08-28,Metasploit,cpe:2.3:a:10web:photo_gallery:1.2.5:*:*:*:*:wordpress:*:*,10Web,Photo Gallery
CVE-2014-9390,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.63178,CWE-20,"Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.",2020-02-12,Metasploit,cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*;cpe:2.3:a:apple:xcode:6.2:-:*:*:*:*:*:*;cpe:2.3:a:apple:xcode:6.2:beta_2:*:*:*:*:*:*;cpe:2.3:a:eclipse:egit:*:*:*:*:*:*:*:*;cpe:2.3:a:eclipse:jgit:*:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*;cpe:2.3:a:libgit2:libgit2:*:*:*:*:*:*:*:*;cpe:2.3:a:mercurial:mercurial:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2014-9444,0.0,,0.06701,CWE-79,Cross-site scripting (XSS) vulnerability in the Frontend Uploader plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the errors[fu-disallowed-mime-type][0][name] parameter to the default URI.,2015-01-02,Nuclei,cpe:2.3:a:frontend_uploader_project:frontend_uploader:0.9.2:*:*:*:*:wordpress:*:*,Frontend Uploader Project,Frontend Uploader
CVE-2014-9566,0.0,,0.47749,CWE-89,"Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwinds Orion Platform 2015.1, as used in Network Performance Monitor (NPM) before 11.5, NetFlow Traffic Analyzer (NTA) before 4.1, Network Configuration Manager (NCM) before 7.3.2, IP Address Manager (IPAM) before 4.3, User Device Tracker (UDT) before 3.2, VoIP & Network Quality Manager (VNQM) before 4.2, Server & Application Manager (SAM) before 6.2, Web Performance Monitor (WPM) before 2.2, and possibly other Solarwinds products, allow remote authenticated users to execute arbitrary SQL commands via the (1) dir or (2) sort parameter to the (a) GetAccounts or (b) GetAccountGroups endpoint.",2015-03-10,Metasploit,cpe:2.3:a:solarwinds:orion_ip_address_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:orion_netflow_traffic_analyzer:*:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:orion_network_configuration_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:orion_network_performance_monitor:*:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:orion_server_and_application_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:orion_user_device_tracker:*:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:orion_voip_\&_network_quality_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:orion_web_performance_monitor:*:*:*:*:*:*:*:*,Solarwinds,Orion Ip Address Manager
CVE-2014-9567,0.0,,0.4334,CWE-94,"Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the upload/files/ or upload/temp/ directory.",2015-01-07,Metasploit,cpe:2.3:a:projectsend:projectsend:100:*:*:*:*:*:*:*;cpe:2.3:a:projectsend:projectsend:102:*:*:*:*:*:*:*;cpe:2.3:a:projectsend:projectsend:105:*:*:*:*:*:*:*;cpe:2.3:a:projectsend:projectsend:110:*:*:*:*:*:*:*;cpe:2.3:a:projectsend:projectsend:155:*:*:*:*:*:*:*;cpe:2.3:a:projectsend:projectsend:156:*:*:*:*:*:*:*;cpe:2.3:a:projectsend:projectsend:157:*:*:*:*:*:*:*;cpe:2.3:a:projectsend:projectsend:161:*:*:*:*:*:*:*;cpe:2.3:a:projectsend:projectsend:180:*:*:*:*:*:*:*;cpe:2.3:a:projectsend:projectsend:335:*:*:*:*:*:*:*;cpe:2.3:a:projectsend:projectsend:375:*:*:*:*:*:*:*;cpe:2.3:a:projectsend:projectsend:405:*:*:*:*:*:*:*;cpe:2.3:a:projectsend:projectsend:412:*:*:*:*:*:*:*;cpe:2.3:a:projectsend:projectsend:514:*:*:*:*:*:*:*;cpe:2.3:a:projectsend:projectsend:561:*:*:*:*:*:*:*,Projectsend,Projectsend
CVE-2014-9583,0.0,,0.80731,CWE-264,"common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC66U, RT-N66U, and other routers, does not properly check the MAC address for a request, which allows remote attackers to bypass authentication and execute arbitrary commands via a NET_CMD_ID_MANU_CMD packet to UDP port 9999.  NOTE: this issue was incorrectly mapped to CVE-2014-10000, but that ID is invalid due to its use as an example of the 2014 CVE ID syntax change.",2015-01-08,Metasploit,cpe:2.3:h:asus:rt-ac66u:*:*:*:*:*:*:*:*;cpe:2.3:h:asus:rt-n66u:*:*:*:*:*:*:*:*;cpe:2.3:o:asus:wrt_firmware:3.0.0.4.376.2524-g0012f52:*:*:*:*:*:*:*;cpe:2.3:o:asus:wrt_firmware:3.0.0.4.376_1071:*:*:*:*:*:*:*;cpe:2.3:o:t-mobile:tm-ac1900:3.0.0.4.376_3169:*:*:*:*:*:*:*,Asus,Wrt Firmware
CVE-2014-9606,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.04292,CWE-79,"Multiple cross-site scripting (XSS) vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) server parameter to remotereporter/load_logfiles.php, (2) customctid parameter to webadmin/policy/category_table_ajax.php, (3) urllist parameter to webadmin/alert/alert.php, (4) QUERY_STRING to webadmin/ajaxfilemanager/ajax_get_file_listing.php, or (5) PATH_INFO to webadmin/policy/policy_table_ajax.php/.",2020-02-19,Nuclei,cpe:2.3:a:netsweeper:netsweeper:*:*:*:*:*:*:*:*,Netsweeper,Netsweeper
CVE-2014-9607,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.05452,CWE-79,Cross-site scripting (XSS) vulnerability in remotereporter/load_logfiles.php in Netsweeper 4.0.3 and 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter.,2020-02-19,Nuclei,cpe:2.3:a:netsweeper:netsweeper:4.0.3:*:*:*:*:*:*:*;cpe:2.3:a:netsweeper:netsweeper:4.0.4:*:*:*:*:*:*:*,Netsweeper,Netsweeper
CVE-2014-9608,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03939,CWE-79,"Cross-site scripting (XSS) vulnerability in webadmin/policy/group_table_ajax.php/ in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.",2020-02-19,Nuclei,cpe:2.3:a:netsweeper:netsweeper:*:*:*:*:*:*:*:*,Netsweeper,Netsweeper
CVE-2014-9609,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.10619,CWE-22,"Directory traversal vulnerability in webadmin/reporter/view_server_log.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to list directory contents via a .. (dot dot) in the log parameter in a stats action.",2020-02-19,Nuclei,cpe:2.3:a:netsweeper:netsweeper:*:*:*:*:*:*:*:*,Netsweeper,Netsweeper
CVE-2014-9614,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.66638,CWE-798,"The Web Panel in Netsweeper before 4.0.5 has a default password of branding for the branding account, which makes it easier for remote attackers to obtain access via a request to webadmin/.",2020-02-19,Nuclei,cpe:2.3:a:netsweeper:netsweeper:*:*:*:*:*:*:*:*,Netsweeper,Netsweeper
CVE-2014-9615,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03705,CWE-79,Cross-site scripting (XSS) vulnerability in Netsweeper 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter to webadmin/deny/index.php.,2020-02-19,Nuclei,cpe:2.3:a:netsweeper:netsweeper:4.0.4:*:*:*:*:*:*:*,Netsweeper,Netsweeper
CVE-2014-9617,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.08013,CWE-601,Open redirect vulnerability in remotereporter/load_logfiles.php in Netsweeper before 4.0.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.,2020-02-19,Nuclei,cpe:2.3:a:netsweeper:netsweeper:*:*:*:*:*:*:*:*,Netsweeper,Netsweeper
CVE-2014-9618,0.0,,0.73312,CWE-287,"The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and subsequently create arbitrary profiles via a showdeny action to the default URL.",2017-09-19,Nuclei,cpe:2.3:a:netsweeper:netsweeper:*:*:*:*:*:*:*:*;cpe:2.3:a:netsweeper:netsweeper:4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:netsweeper:netsweeper:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:netsweeper:netsweeper:4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:netsweeper:netsweeper:4.0.3:*:*:*:*:*:*:*;cpe:2.3:a:netsweeper:netsweeper:4.0.4:*:*:*:*:*:*:*;cpe:2.3:a:netsweeper:netsweeper:4.0.5:*:*:*:*:*:*:*;cpe:2.3:a:netsweeper:netsweeper:4.0.6:*:*:*:*:*:*:*;cpe:2.3:a:netsweeper:netsweeper:4.0.7:*:*:*:*:*:*:*;cpe:2.3:a:netsweeper:netsweeper:4.0.8:*:*:*:*:*:*:*;cpe:2.3:a:netsweeper:netsweeper:4.1.0:*:*:*:*:*:*:*;cpe:2.3:a:netsweeper:netsweeper:4.1.1:*:*:*:*:*:*:*,Netsweeper,Netsweeper
CVE-2014-9707,0.0,,0.28237,CWE-17,"EmbedThis GoAhead 3.0.0 through 3.4.1 does not properly handle path segments starting with a . (dot), which allows remote attackers to conduct directory traversal attacks, cause a denial of service (heap-based buffer overflow and crash), or possibly execute arbitrary code via a crafted URI.",2015-03-31,Metasploit,cpe:2.3:a:embedthis:goahead:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:embedthis:goahead:3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:embedthis:goahead:3.3.2:*:*:*:*:*:*:*;cpe:2.3:a:embedthis:goahead:3.3.3:*:*:*:*:*:*:*;cpe:2.3:a:embedthis:goahead:3.3.4:*:*:*:*:*:*:*;cpe:2.3:a:embedthis:goahead:3.3.5:*:*:*:*:*:*:*;cpe:2.3:a:embedthis:goahead:3.3.6:*:*:*:*:*:*:*;cpe:2.3:a:embedthis:goahead:3.4.0:*:*:*:*:*:*:*,Embedthis,Goahead
CVE-2014-9727,0.0,,0.71837,CWE-78,AVM Fritz!Box allows remote attackers to execute arbitrary commands via shell metacharacters in the var:lang parameter to cgi-bin/webcm.,2015-05-29,Metasploit,cpe:2.3:a:avm:fritz\!box:*:*:*:*:*:*:*:*,Avm,Fritz!Box
CVE-2014-9735,0.0,,0.75256,CWE-264,"The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.",2015-06-30,Metasploit/Nuclei,cpe:2.3:a:themepunch:showbiz_pro:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themepunch:slider_revolution:*:*:*:*:*:wordpress:*:*,Themepunch,Showbiz Pro
CVE-2015-0002,0.0,,0.13802,CWE-264,"The AhcVerifyAdminContext function in ahcache.sys in the Application Compatibility component in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not verify that an impersonation token is associated with an administrative account, which allows local users to gain privileges by running AppCompatCache.exe with a crafted DLL file, aka MSRC ID 20544 or ""Microsoft Application Compatibility Infrastructure Elevation of Privilege Vulnerability.""",2015-01-13,Metasploit,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:gold:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:gold:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:x64:*:*,Microsoft,Windows 7
CVE-2015-0014,0.0,,0.96893,CWE-119,"Buffer overflow in the Telnet service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted packets, aka ""Windows Telnet Service Buffer Overflow Vulnerability.""",2015-01-13,EPSS,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:gold:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:x64:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2015-0016,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.7594,CWE-22,"Directory traversal vulnerability in the TS WebProxy (aka TSWbPrxy) component in Microsoft Windows Vista SP2, Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to gain privileges via a crafted pathname in an executable file, as demonstrated by a transition from Low Integrity to Medium Integrity, aka ""Directory Traversal Elevation of Privilege Vulnerability.""",2015-01-13,CISA/Metasploit,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:gold:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:gold:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2015-0071,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N,0.33581,NVD-CWE-noinfo,"Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka ""Internet Explorer ASLR Bypass Vulnerability.""",2015-02-11,CISA,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2015-0072,0.0,,0.71698,CWE-79,"Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject arbitrary web script or HTML via vectors involving an IFRAME element that triggers a redirect, a second IFRAME element that does not trigger a redirect, and an eval of a WindowProxy object, aka ""Universal XSS (UXSS).""",2015-02-07,Metasploit,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*,Microsoft,Internet Explorer
CVE-2015-0096,0.0,,0.71075,CWE-426,"Untrusted search path vulnerability in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, leading to DLL loading during Windows Explorer access to the icon of a crafted shortcut, aka ""DLL Planting Remote Code Execution Vulnerability.""",2015-03-11,Metasploit,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2015-0204,0.0,,0.98685,CWE-310,"The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the ""FREAK"" issue.  NOTE: the scope of this CVE is only client code based on OpenSSL, not EXPORT_RSA issues associated with servers or other TLS implementations.",2015-01-09,EPSS,cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0a:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0b:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0c:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0d:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0e:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0f:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0g:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0h:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0i:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0j:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0k:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0l:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0m:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0n:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.0o:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1a:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1b:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1c:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1d:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1e:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1f:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1g:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1h:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1i:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1j:*:*:*:*:*:*:*,Openssl,Openssl
CVE-2015-0235,0.0,,0.94859,CWE-787,"Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka ""GHOST.""",2015-01-28,Metasploit,cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*;cpe:2.3:a:ibm:pureapplication_system:1.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:pureapplication_system:1.1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:pureapplication_system:2.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:security_access_manager_for_enterprise_single_sign-on:8.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_application_session_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_eagle_application_processor:16.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_eagle_lnp_application_processor:10.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_lsms:13.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_policy_management:10.4.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_policy_management:11.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_policy_management:12.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_policy_management:9.7.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_policy_management:9.9.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_border_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_border_controller:7.2.0:-:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_border_controller:8.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_user_data_repository:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_webrtc_session_controller:7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_webrtc_session_controller:7.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:exalogic_infrastructure:1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:exalogic_infrastructure:2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*;cpe:2.3:a:php:php:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:virtualization:6.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:7:0:*:*:*:*:*:*,Oracle,Linux
CVE-2015-0240,0.0,,0.87636,CWE-17,"The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, which allows remote attackers to execute arbitrary code via crafted Netlogon packets that use the ServerPasswordSet RPC API, as demonstrated by packets reaching the _netr_ServerPasswordSet function in rpc_server/netlogon/srv_netlog_nt.c.",2015-02-24,Metasploit,cpe:2.3:a:samba:samba:3.5.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.10:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.11:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.12:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.13:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.14:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.15:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.16:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.17:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.18:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.19:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.20:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.21:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.22:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.2:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.3:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.4:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.5:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.6:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.7:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.8:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.5.9:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.10:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.11:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.12:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.13:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.14:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.15:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.16:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.17:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.18:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.19:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.1:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.20:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.21:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.22:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.23:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.24:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:3.6.2:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.10:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.11:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.12:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.13:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.14:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.15:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.16:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.17:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.18:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.19:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.20:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.21:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.22:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.23:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.24:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.3:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.4:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.5:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.6:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.7:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.8:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.0.9:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.1.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.1.10:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.1.11:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.1.12:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.1.13:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.1.14:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.1.15:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.1.16:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.1.1:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.1.3:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.1.4:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.1.5:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.1.6:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.1.7:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.1.8:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.1.9:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.2.0:rc1:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.2.0:rc2:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.2.0:rc3:*:*:*:*:*:*;cpe:2.3:a:samba:samba:4.2.0:rc4:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*;cpe:2.3:o:novell:suse_linux_enterprise_desktop:12:*:*:*:*:*:*:*;cpe:2.3:o:novell:suse_linux_enterprise_server:12:*:*:*:*:*:*:*;cpe:2.3:o:novell:suse_linux_enterprise_software_development_kit:12:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*,Redhat,Enterprise Linux
CVE-2015-0310,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.15217,NVD-CWE-noinfo,"Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism on Windows, and have an unspecified impact on other platforms, via unknown vectors, as exploited in the wild in January 2015.",2015-01-23,CISA,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2015-0311,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.8582,NVD-CWE-noinfo,"Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015.",2015-01-23,CISA/Metasploit,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:-:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2015-0313,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.95683,CWE-416,"Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2015, a different vulnerability than CVE-2015-0315, CVE-2015-0320, and CVE-2015-0322.",2015-02-02,CISA/EPSS/Metasploit,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:evergreen:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:-:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2015-0318,0.0,,0.75781,NVD-CWE-noinfo,"Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0321, CVE-2015-0329, and CVE-2015-0330.",2015-02-06,Metasploit,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.125:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.145:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.176:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.179:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.152:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.167:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.189:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.223:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.239:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.246:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:16.0.0.235:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:16.0.0.257:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:16.0.0.287:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:16.0.0.296:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2015-0336,0.0,,0.71536,NVD-CWE-noinfo,"Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code by leveraging an unspecified ""type confusion,"" a different vulnerability than CVE-2015-0334.",2015-03-13,Metasploit,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.125:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.145:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.176:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.179:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.152:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.167:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.189:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.223:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.239:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.246:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:16.0.0.235:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:16.0.0.257:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:16.0.0.287:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:16.0.0.296:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:16.0.0.305:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2015-0359,0.0,,0.95184,NVD-CWE-Other,"Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0346.",2015-04-14,EPSS/Metasploit,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.125:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.145:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.176:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.179:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.152:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.167:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.189:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.223:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.239:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.246:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:16.0.0.235:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:16.0.0.257:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:16.0.0.287:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:16.0.0.296:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:17.0.0.134:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2015-0554,0.0,,0.39797,CWE-264,"The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly restrict access to the web interface, which allows remote attackers to obtain sensitive information or cause a denial of service (device restart) as demonstrated by a direct request to (1) wlsecurity.html or (2) resetrouter.html.",2015-01-21,Nuclei,cpe:2.3:h:adb:p.dga4001n:*:*:*:*:*:*:*:*;cpe:2.3:o:adb:p.dga4001n_firmware:pdg_tef_sp_4.06l.6:*:*:*:*:*:*:*,Adb,P.Dga4001N Firmware
CVE-2015-0666,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.40379,CWE-22,"Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) before 7.1(1) allows remote attackers to read arbitrary files via a crafted pathname, aka Bug ID CSCus00241.",2015-04-03,CISA,cpe:2.3:a:cisco:prime_data_center_network_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_data_center_network_manager:6.3\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_data_center_network_manager:6.3\(2\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_data_center_network_manager:7.0\(1\):*:*:*:*:*:*:*,Cisco,Prime Data Center Network Manager
CVE-2015-0779,0.0,,0.74516,CWE-22,"Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration Management (ZCM) 10 and 11 before 11.3.2 allows remote attackers to execute arbitrary code via a crafted directory name in the uid parameter, in conjunction with a WAR filename in the filename parameter and WAR content in the POST data, a different vulnerability than CVE-2010-5323 and CVE-2010-5324.",2015-06-07,Metasploit,cpe:2.3:a:novell:zenworks_configuration_management:11.2.1:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_configuration_management:11.2.2:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_configuration_management:11.2.3:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_configuration_management:11.2:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_configuration_management:11:*:*:*:*:*:*:*;cpe:2.3:a:novell:zenworks_configuration_management:11:sp1:*:*:*:*:*:*,Novell,Zenworks Configuration Management
CVE-2015-0802,0.0,,0.67268,CWE-264,"Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a privileged window with an unintended persistence of access to restricted internal methods.",2015-04-01,Metasploit,cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*,Opensuse,Opensuse
CVE-2015-0816,0.0,,0.66936,CWE-264,"Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js.",2015-04-01,Metasploit,cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*,Mozilla,Firefox
CVE-2015-0921,0.0,,0.17355,NVD-CWE-Other,XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 allows remote authenticated users to read arbitrary files via the conditionXML parameter to the taskLogTable to orionUpdateTableFilter.do.,2015-01-09,Metasploit,cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:epolicy_orchestrator:5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:epolicy_orchestrator:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.0:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.1:*:*:*:*:*:*:*,Mcafee,Epolicy Orchestrator
CVE-2015-0922,0.0,,0.13346,CWE-200,"McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password.",2015-01-09,Metasploit,cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:epolicy_orchestrator:5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:epolicy_orchestrator:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.0:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.1:*:*:*:*:*:*:*,Mcafee,Epolicy Orchestrator
CVE-2015-0923,0.0,,0.22034,NVD-CWE-Other,"The ContentBlockEx method in Workarea/ServerControlWS.asmx in Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1 allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference within an XML document named in the xslt parameter, related to an XML External Entity (XXE) issue.",2015-02-14,Metasploit,cpe:2.3:a:ektron:ektron_content_management_system:8.5.0:*:*:*:*:*:*:*;cpe:2.3:a:ektron:ektron_content_management_system:8.7.0:*:*:*:*:*:*:*;cpe:2.3:a:ektron:ektron_content_management_system:8.7.0:sp1:*:*:*:*:*:*;cpe:2.3:a:ektron:ektron_content_management_system:8.9.0:*:*:*:*:*:*:*,Ektron,Ektron Content Management System
CVE-2015-0925,0.0,,0.52125,CWE-94,"The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a subprocess reached through a named pipe, as demonstrated by a UNC share pathname.",2015-01-22,Metasploit,cpe:2.3:a:ipass:ipass_open_mobile:*:*:*:*:*:windows:*:*,Ipass,Ipass Open Mobile
CVE-2015-0936,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.7809,CWE-320,"Ceragon FibeAir IP-10 have a default SSH public key in the authorized_keys file for the mateidu user, which allows remote attackers to obtain SSH access by leveraging knowledge of the private key.",2017-06-01,Metasploit,cpe:2.3:h:ceragon:fibeair_ip-10c:-:*:*:*:*:*:*:*;cpe:2.3:h:ceragon:fibeair_ip-10e:-:*:*:*:*:*:*:*;cpe:2.3:h:ceragon:fibeair_ip-10g:-:*:*:*:*:*:*:*;cpe:2.3:o:ceragon:fibeair_ip-10_firmware:-:*:*:*:*:*:*:*,Ceragon,Fibeair Ip-10 Firmware
CVE-2015-1000005,0.0,,0.08833,CWE-22,Remote file download vulnerability in candidate-application-form v1.0 wordpress plugin,2016-10-06,Nuclei,cpe:2.3:a:candidate-application-form_project:candidate-application-form:1.0:*:*:*:*:wordpress:*:*,Candidate-Application-Form Project,Candidate-Application-Form
CVE-2015-1000010,0.0,,0.07038,CWE-284,Remote file download in simple-image-manipulator v1.0 wordpress plugin,2016-10-06,Nuclei,cpe:2.3:a:simple-image-manipulator_project:simple-image-manipulator:1.0:*:*:*:*:wordpress:*:*,Simple-Image-Manipulator Project,Simple-Image-Manipulator
CVE-2015-1000012,0.0,,0.09325,CWE-200,Local File Inclusion Vulnerability in mypixs v0.3 wordpress plugin,2016-10-06,Nuclei,cpe:2.3:a:mypixs_project:mypixs:0.3:*:*:*:*:wordpress:*:*,Mypixs Project,Mypixs
CVE-2015-10133,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.01436,CWE-98,"The Subscribe to Comments for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.1.2 via the Path to header value. This allows authenticated attackers, with administrative privileges and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This same function can also be used to execute arbitrary PHP code.",2025-07-19,Metasploit,cpe:2.3:a:markjaquith:subscribe_to_comments:*:*:*:*:*:wordpress:*:*,Markjaquith,Subscribe To Comments
CVE-2015-10134,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01153,CWE-22,"The Simple Backup plugin for WordPress is vulnerable to Arbitrary File Download in versions up to, and including, 2.7.10. via the download_backup_file function. This is due to a lack of capability checks and file type validation. This makes it possible for attackers to download sensitive files such as the wp-config.php file from the affected site.",2025-07-19,Metasploit,cpe:2.3:a:mywebsiteadvisor:simple_backup:*:*:*:*:*:wordpress:*:*,Mywebsiteadvisor,Simple Backup
CVE-2015-10135,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02764,CWE-434,The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxUpload function in versions before 1.3.9.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.,2025-07-19,Metasploit,cpe:2.3:a:eoxia:wpshop_2:*:*:*:*:*:wordpress:*:*,Eoxia,Wpshop 2
CVE-2015-10136,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02041,CWE-22,"The GI-Media Library plugin for WordPress is vulnerable to Directory Traversal in versions before 3.0 via the 'fileid' parameter. This allows unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.",2025-07-19,Metasploit,cpe:2.3:a:zishanj:gi-media-library:*:*:*:*:*:wordpress:*:*,Zishanj,Gi-Media-Library
CVE-2015-10137,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03257,CWE-434,"The Website Contact Form With File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_file()' function in versions up to, and including, 1.3.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.",2025-07-22,Metasploit,cpe:2.3:a:najeebmedia:website_contact_form_with_file_upload:*:*:*:*:*:wordpress:*:*,Najeebmedia,Website Contact Form With File Upload
CVE-2015-10138,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02425,CWE-434,"The Work The Flow File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jQuery-File-Upload-9.5.0 server and test files in versions up to, and including, 2.5.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.",2025-07-19,Metasploit,cpe:2.3:a:lynton_reed:work_the_flow_file_upload:*:*:*:*:*:wordpress:*:*,Lynton Reed,Work The Flow File Upload
CVE-2015-10139,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.00993,CWE-269,The WPLMS theme for WordPress is vulnerable to Privilege Escalation in versions 1.5.2 to 1.8.4.1 via the 'wp_ajax_import_data' AJAX action. This makes it possible for authenticated attackers to change otherwise restricted settings and potentially create a new accessible admin account.,2025-07-19,Metasploit,cpe:2.3:a:vibethemes:wordpress_learning_management_system_:*:*:*:*:*:wordpress:*:*,Vibethemes,Wordpress Learning Management System
CVE-2015-10140,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.00984,CWE-862,"The Ajax Load More plugin before 2.8.1.2 does not have authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber, to upload and delete arbitrary files.",2025-07-22,Metasploit,cpe:2.3:a:connekthq:ajax_load_more:*:*:*:*:*:wordpress:*:*,Connekthq,Ajax Load More
CVE-2015-10141,0.0,,0.0503,CWE-78,"An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker can send a crafted eval command over this interface to execute arbitrary PHP code, which may invoke system-level functions such as system() or passthru(). This results in full compromise of the host under the privileges of the web server user.",2025-07-23,Metasploit/Nuclei,,,
CVE-2015-10143,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01805,CWE-862,The Platform theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the *_ajax_save_options() function in all versions up to 1.4.4 (exclusive). This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.,2025-07-25,Metasploit,cpe:2.3:a:pagelines:platform_theme:*:*:*:*:*:wordpress:*:*,Pagelines,Platform Theme
CVE-2015-10144,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02104,CWE-434,"The Responsive Thumbnail Slider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type sanitization in the via the image uploader in versions up to 1.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected sites server using a double extension which may make remote code execution possible.",2025-07-25,Metasploit,cpe:2.3:a:i13websolution:thumbnail_carousel_slider:*:*:*:*:*:wordpress:*:*,I13Websolution,Thumbnail Carousel Slider
CVE-2015-1126,0.0,,0.09895,CWE-20,"WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly handle the userinfo field in FTP URLs, which allows remote attackers to trigger incorrect resource access via unspecified vectors.",2015-04-10,Metasploit,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.0.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.0.6:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.1.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.1.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:8.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:8.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:8.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:8.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:8.0.4:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*,Apple,Iphone Os
CVE-2015-1130,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.09887,CWE-59,The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges via unspecified vectors.,2015-04-10,CISA/Metasploit,cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2015-1155,0.0,,0.10946,CWE-264,"The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to bypass the Same Origin Policy and read arbitrary files via a crafted web site.",2015-05-08,Metasploit,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.0.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.0.6:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.1.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.1.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:7.1.5:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:8.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:8.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:8.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:8.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:8.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:8.0.5:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*,Apple,Iphone Os
CVE-2015-1171,0.0,,0.62663,CWE-119,Stack-based buffer overflow in GSM SIM Utility (aka SIM Card Editor) 6.6 allows remote attackers to execute arbitrary code via a long entry in a .sms file.,2015-08-28,Metasploit,cpe:2.3:a:gsm:sim_card_editor:6.6:*:*:*:*:*:*:*,Gsm,Sim Card Editor
CVE-2015-1172,0.0,,0.59254,NVD-CWE-Other,"Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme (aka holding_pattern) 0.6 and earlier for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in an unspecified directory.",2015-02-11,Metasploit,cpe:2.3:a:holding_pattern_project:holding_pattern:*:*:*:*:*:wordpress:*:*,Holding Pattern Project,Holding Pattern
CVE-2015-1187,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.82863,CWE-287,The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.,2017-09-21,CISA/Metasploit,cpe:2.3:h:dlink:dir-626l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-636l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-651:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-808l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-810l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-820l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-826l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-830l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-836l:-:*:*:*:*:*:*:*;cpe:2.3:h:trendnet:tew-651br:-:*:*:*:*:*:*:*;cpe:2.3:h:trendnet:tew-652br:-:*:*:*:*:*:*:*;cpe:2.3:h:trendnet:tew-711br:-:*:*:*:*:*:*:*;cpe:2.3:h:trendnet:tew-731br:-:*:*:*:*:*:*:*;cpe:2.3:h:trendnet:tew-810dr:-:*:*:*:*:*:*:*;cpe:2.3:h:trendnet:tew-813dru:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-626l_firmware:1.04:b04:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-636l_firmware:1.04:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-651_firmware:1.10na:b02:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-808l_firmware:1.03:b05:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-810l_firmware:1.01:b04:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-810l_firmware:2.02:b01:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-820l_firmware:1.02:b10:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-820l_firmware:1.05:b03:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-820l_firmware:2.01:b02:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-826l_firmware:1.00:b23:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-830l_firmware:1.00:b07:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-836l_firmware:1.01:b03:*:*:*:*:*:*;cpe:2.3:o:trendnet:tew-651br_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:trendnet:tew-652br_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:trendnet:tew-711br_firmware:1.00:b31:*:*:*:*:*:*;cpe:2.3:o:trendnet:tew-731br_firmware:2.01:b01:*:*:*:*:*:*;cpe:2.3:o:trendnet:tew-810dr_firmware:1.00:b19:*:*:*:*:*:*;cpe:2.3:o:trendnet:tew-813dru_firmware:1.00:b23:*:*:*:*:*:*,D-Link,Dir-626L Firmware
CVE-2015-1318,0.0,,0.04187,CWE-264,The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a crafted usr/share/apport/apport file in a namespace (container).,2015-04-17,Metasploit,cpe:2.3:a:apport_project:apport:2.13.1:*:*:*:*:*:*:*;cpe:2.3:a:apport_project:apport:2.13.2:*:*:*:*:*:*:*;cpe:2.3:a:apport_project:apport:2.13.3:*:*:*:*:*:*:*;cpe:2.3:a:apport_project:apport:2.13:*:*:*:*:*:*:*;cpe:2.3:a:apport_project:apport:2.14.1:*:*:*:*:*:*:*;cpe:2.3:a:apport_project:apport:2.14.2:*:*:*:*:*:*:*;cpe:2.3:a:apport_project:apport:2.14.3:*:*:*:*:*:*:*;cpe:2.3:a:apport_project:apport:2.14.4:*:*:*:*:*:*:*;cpe:2.3:a:apport_project:apport:2.14.5:*:*:*:*:*:*:*;cpe:2.3:a:apport_project:apport:2.14.6:*:*:*:*:*:*:*;cpe:2.3:a:apport_project:apport:2.14.7:*:*:*:*:*:*:*;cpe:2.3:a:apport_project:apport:2.14:*:*:*:*:*:*:*;cpe:2.3:a:apport_project:apport:2.15.1:*:*:*:*:*:*:*;cpe:2.3:a:apport_project:apport:2.15:*:*:*:*:*:*:*;cpe:2.3:a:apport_project:apport:2.16.1:*:*:*:*:*:*:*;cpe:2.3:a:apport_project:apport:2.16.2:*:*:*:*:*:*:*;cpe:2.3:a:apport_project:apport:2.16:*:*:*:*:*:*:*;cpe:2.3:a:apport_project:apport:2.17:*:*:*:*:*:*:*,Apport Project,Apport
CVE-2015-1328,0.0,,0.37679,CWE-264,"The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace.",2016-11-28,Metasploit,cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2015-1376,0.0,,0.33974,CWE-284,"pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrary files via an upload URL with a host other than pixabay.com.",2015-01-28,Metasploit,cpe:2.3:a:pixabay_images_project:pixabay_images:*:*:*:*:*:wordpress:*:*,Pixabay Images Project,Pixabay Images
CVE-2015-1419,0.0,,0.06725,NVD-CWE-noinfo,"Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing.",2015-01-28,Nuclei,cpe:2.3:a:vsftpd_project:vsftpd:*:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*,Opensuse,Opensuse
CVE-2015-1427,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99906,NVD-CWE-noinfo,The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.,2015-02-17,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:fuse:1.0.0:*:*:*:*:*:*:*,Elastic,Elasticsearch
CVE-2015-1486,0.0,,0.64487,CWE-287,The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote attackers to bypass authentication via a crafted password-reset action that triggers a new administrative session.,2015-08-01,Metasploit,cpe:2.3:a:symantec:endpoint_protection_manager:12.1.0:*:*:*:*:*:*:*,Symantec,Endpoint Protection Manager
CVE-2015-1487,0.0,,0.47331,CWE-20,"The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated users to write to arbitrary files, and consequently obtain administrator privileges, via a crafted filename.",2015-08-01,Metasploit,cpe:2.3:a:symantec:endpoint_protection_manager:12.1.0:*:*:*:*:*:*:*,Symantec,Endpoint Protection Manager
CVE-2015-1489,0.0,,0.24638,CWE-264,The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated users to gain privileges via unspecified vectors.,2015-08-01,Metasploit,cpe:2.3:a:symantec:endpoint_protection_manager:12.1.0:*:*:*:*:*:*:*,Symantec,Endpoint Protection Manager
CVE-2015-1497,0.0,,0.75116,CWE-94,"radexecd.exe in Persistent Systems Radia Client Automation (RCA) 7.9, 8.1, 9.0, and 9.1 allows remote attackers to execute arbitrary commands via a crafted request to TCP port 3465.",2015-02-16,Metasploit,cpe:2.3:a:persistent_systems:radia_client_automation:7.9:*:*:*:*:*:*:*;cpe:2.3:a:persistent_systems:radia_client_automation:8.1:*:*:*:*:*:*:*;cpe:2.3:a:persistent_systems:radia_client_automation:9.0:*:*:*:*:*:*:*;cpe:2.3:a:persistent_systems:radia_client_automation:9.1:*:*:*:*:*:*:*,Persistent Systems,Radia Client Automation
CVE-2015-1503,0.0,,0.58302,CWE-22,Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the file parameter to a webmail/client/skins/default/css/css.php page or .../. (dot dot dot slash dot) in the (2) script or (3) style parameter to webmail/old/calendar/minimizer/index.php.,2018-05-08,Nuclei,cpe:2.3:a:icewarp:mail_server:*:*:*:*:*:*:*:*,Icewarp,Mail Server
CVE-2015-1538,0.0,,0.99064,CWE-189,"Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code via crafted atoms in MP4 data that trigger an unchecked multiplication, aka internal bug 20139950, a related issue to CVE-2015-4496.",2015-10-01,EPSS,cpe:2.3:o:google:android:*:*:*:*:*:*:*:*,Google,Android
CVE-2015-1579,0.0,,0.22055,CWE-22,Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php.  NOTE: this vulnerability may be a duplicate of CVE-2014-9734.,2015-02-11,Nuclei,cpe:2.3:a:elegantthemes:divi:-:*:*:*:*:wordpress:*:*,Elegantthemes,Divi
CVE-2015-1587,0.0,,0.44188,NVD-CWE-Other,"Unrestricted file upload vulnerability in file_to_index.php in Maarch LetterBox 2.8 and earlier and GEC/GED 1.4 and earlier allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a request to a predictable filename in tmp/.",2015-02-19,Metasploit,cpe:2.3:a:maarch:gec\/ged:*:*:*:*:*:*:*:*;cpe:2.3:a:maarch:letterbox:*:*:*:*:*:*:*:*,Maarch,Gec/Ged
CVE-2015-1592,0.0,,0.75029,CWE-74,"Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::thaw function, which allows remote attackers to include and execute arbitrary local Perl files and possibly execute arbitrary code via unspecified vectors.",2015-02-19,Metasploit,cpe:2.3:a:sixapart:movable_type:*:*:*:*:advanced:*:*:*;cpe:2.3:a:sixapart:movable_type:*:*:*:*:open_source:*:*:*;cpe:2.3:a:sixapart:movable_type:*:*:*:*:pro:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2015-1635,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99999,CWE-94,"HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka ""HTTP.sys Remote Code Execution Vulnerability.""",2015-04-14,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2015-1641,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.9679,CWE-787,"Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote attackers to execute arbitrary code via a crafted RTF document, aka ""Microsoft Office Memory Corruption Vulnerability.""",2015-04-14,CISA/EPSS,cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_web_apps:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_web_apps:2013:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:outlook:2011:*:*:*:*:mac_os_x:*:*;cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2013:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2011:*:*:*:*:macos:*:*;cpe:2.3:a:microsoft:word:2013:sp1:*:*:-:*:*:*;cpe:2.3:a:microsoft:word:2013:sp1:*:*:rt:*:*:*,Microsoft,Office
CVE-2015-1642,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.53213,CWE-787,"Microsoft Office 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted document, aka ""Microsoft Office Memory Corruption Vulnerability.""",2015-08-15,CISA,cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*,Microsoft,Office
CVE-2015-1671,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.54628,NVD-CWE-noinfo,"The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; Lync Basic 2013 SP1; Silverlight 5 before 5.1.40416.00; and Silverlight 5 Developer Runtime before 5.1.40416.00, allows remote attackers to execute arbitrary code via a crafted TrueType font, aka ""TrueType Font Parsing Vulnerability.""",2015-05-13,CISA,cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.0:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.5.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.5:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:live_meeting:2007:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:lync:2010:*:*:*:attendee:*:*:*;cpe:2.3:a:microsoft:lync:2013:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:silverlight:5.0:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows Server 2003
CVE-2015-1701,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.562,NVD-CWE-noinfo,"Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka ""Win32k Elevation of Privilege Vulnerability.""",2015-04-21,CISA/Metasploit,cpe:2.3:o:microsoft:windows_2003_server:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_2003_server:r2:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 2003 Server
CVE-2015-1769,6.6,CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.04339,CWE-264,"Mount Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 mishandles symlinks, which allows physically proximate attackers to execute arbitrary code by connecting a crafted USB device, aka ""Mount Manager Elevation of Privilege Vulnerability.""",2015-08-15,CISA,cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 10
CVE-2015-1770,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.35105,CWE-824,"Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka ""Microsoft Office Uninitialized Memory Use Vulnerability.""",2015-06-10,CISA,cpe:2.3:a:microsoft:office:2013:sp1:*:*:-:*:*:*;cpe:2.3:a:microsoft:office:2013:sp1:*:*:rt:*:*:*,Microsoft,Office
CVE-2015-1793,0.0,,0.61798,CWE-254,"The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.",2015-07-09,Metasploit,cpe:2.3:a:openssl:openssl:1.0.1n:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1o:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:supply_chain_products_suite:6.1.2.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:supply_chain_products_suite:6.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:supply_chain_products_suite:6.2.0:*:*:*:*:*:*:*;cpe:2.3:o:oracle:opus_10g_ethernet_switch_family:*:*:*:*:*:*:*:*,Oracle,Opus 10G Ethernet Switch Family
CVE-2015-1830,0.0,,0.84408,CWE-22,Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.,2015-08-19,Metasploit,cpe:2.3:a:apache:activemq:5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.10.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.10.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.10.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.11.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.11.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.3.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.3.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.3.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.4.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.4.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.4.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.4.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.5.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.5.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.6.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.7.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.8.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.9.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.9.1:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2015-1880,0.0,,0.14255,CWE-79,Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.,2015-05-12,Nuclei,cpe:2.3:o:fortinet:fortios:5.2.0:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.2.1:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.2.2:*:*:*:*:*:*:*,Fortinet,Fortios
CVE-2015-1930,0.0,,0.09971,CWE-119,"Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.",2015-06-30,Metasploit,cpe:2.3:a:ibm:tivoli_storage_manager_fastback:6.1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_fastback:6.1.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_fastback:6.1.10.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_fastback:6.1.10.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_fastback:6.1.11.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_fastback:6.1.11.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_fastback:6.1.7.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_fastback:6.1.8.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_fastback:6.1.8.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_fastback:6.1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_storage_manager_fastback:6.1.9.1:*:*:*:*:*:*:*,Ibm,Tivoli Storage Manager Fastback
CVE-2015-20067,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.08185,CWE-862,"The WP Attachment Export WordPress plugin before 0.2.4 does not have proper access controls, allowing unauthenticated users to download the XML data that holds all the details of attachments/posts on a Wordpress",2021-11-01,Nuclei,cpe:2.3:a:wp_attachment_export_project:wp_attachment_export:*:*:*:*:*:wordpress:*:*,Wp Attachment Export Project,Wp Attachment Export
CVE-2015-2049,0.0,,0.66674,NVD-CWE-Other,Unrestricted file upload vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension.,2015-02-23,Metasploit,cpe:2.3:h:dlink:dcs-931l:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dcs-931l_firmware:*:*:*:*:*:*:*:*,D-Link,Dcs-931L Firmware
CVE-2015-2051,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97101,CWE-77,The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.,2015-02-23,CISA/EPSS/Metasploit,cpe:2.3:h:dlink:dir-645:a1:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-645_firmware:*:*:*:*:*:*:*:*,D-Link,Dir-645 Firmware
CVE-2015-2065,0.0,,0.4107,CWE-89,SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery (contus-video-gallery) plugin before 2.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the vid parameter in a rss action to wp-admin/admin-ajax.php.,2015-02-24,Metasploit,cpe:2.3:a:apptha:wordpress_video_gallery:*:*:*:*:*:wordpress:*:*,Apptha,Wordpress Video Gallery
CVE-2015-2067,0.0,,0.39424,CWE-22,Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.,2015-02-24,Nuclei,cpe:2.3:a:magmi_project:magmi:-:*:*:*:*:magento_server:*:*,Magmi Project,Magmi
CVE-2015-2068,0.0,,0.1404,CWE-79,Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote attackers to inject arbitrary web script or HTML via the (1) profile parameter to web/magmi.php or (2) QUERY_STRING to web/magmi_import_run.php.,2015-02-24,Nuclei,cpe:2.3:a:magmi_project:magmi:-:*:*:*:*:magento_server:*:*,Magmi Project,Magmi
CVE-2015-2080,0.0,,0.74881,CWE-200,"The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.",2016-10-07,Nuclei,cpe:2.3:a:eclipse:jetty:9.2.3:*:*:*:*:*:*:*;cpe:2.3:a:eclipse:jetty:9.2.4:*:*:*:*:*:*:*;cpe:2.3:a:eclipse:jetty:9.2.5:*:*:*:*:*:*:*;cpe:2.3:a:eclipse:jetty:9.2.6:*:*:*:*:*:*:*;cpe:2.3:a:eclipse:jetty:9.2.7:*:*:*:*:*:*:*;cpe:2.3:a:eclipse:jetty:9.2.8:*:*:*:*:*:*:*;cpe:2.3:a:eclipse:jetty:9.3.0:m0:*:*:*:*:*:*;cpe:2.3:a:eclipse:jetty:9.3.0:m1:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2015-2166,0.0,,0.26774,CWE-22,"Directory traversal vulnerability in the Instance Monitor in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5, and 6 allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the default URI.",2015-04-06,Nuclei,cpe:2.3:a:ericsson:drutt_mobile_service_delivery_platform:4.0:*:*:*:*:*:*:*;cpe:2.3:a:ericsson:drutt_mobile_service_delivery_platform:5.0:*:*:*:*:*:*:*;cpe:2.3:a:ericsson:drutt_mobile_service_delivery_platform:6.0:*:*:*:*:*:*:*,Ericsson,Drutt Mobile Service Delivery Platform
CVE-2015-2196,0.0,,0.11182,CWE-89,SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a spiderbigcalendar_month action to wp-admin/admin-ajax.php.,2015-03-03,Nuclei,cpe:2.3:a:web-dorado:spider_calendar:1.4.9:*:*:*:*:wordpress:*:*,Web-Dorado,Spider Calendar
CVE-2015-2208,0.0,,0.61959,CWE-77,The saveObject function in moadmin.php in phpMoAdmin 1.1.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the object parameter.,2015-03-12,Metasploit,cpe:2.3:a:avinu:phpmoadmin:1.1.2:*:*:*:*:*:*:*,Avinu,Phpmoadmin
CVE-2015-2219,0.0,,0.04146,CWE-264,"Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to the System Update service (SUService.exe) through an unspecified named pipe.",2015-05-12,Metasploit,cpe:2.3:a:lenovo:system_update:*:*:*:*:*:*:*:*,Lenovo,System Update
CVE-2015-2284,0.0,,0.74054,CWE-264,"userlogin.jsp in SolarWinds Firewall Security Manager (FSM) before 6.6.5 HotFix1 allows remote attackers to gain privileges and execute arbitrary code via unspecified vectors, related to client session handling.",2015-03-24,Metasploit,cpe:2.3:a:solarwinds:firewall_security_manager:*:*:*:*:*:*:*:*,Solarwinds,Firewall Security Manager
CVE-2015-2291,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.09011,CWE-20,"(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.",2017-08-09,CISA,cpe:2.3:a:intel:ethernet_diagnostics_driver_iqvw32.sys:1.03.0.7:*:*:*:*:*:*:*;cpe:2.3:a:intel:ethernet_diagnostics_driver_iqvw64.sys:1.03.0.7:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2015-2342,0.0,,0.89048,NVD-CWE-Other,"The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol.",2015-10-12,Metasploit,cpe:2.3:a:vmware:vcenter_server:5.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:5.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:5.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.0:*:*:*:*:*:*:*,Vmware,Vcenter Server
CVE-2015-2360,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.14958,CWE-119,"win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application, aka ""Win32k Elevation of Privilege Vulnerability.""",2015-06-10,CISA,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:r2:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2015-2387,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.3512,CWE-787,"ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka ""ATMFD.DLL Memory Corruption Vulnerability.""",2015-07-14,CISA,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2015-2419,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.44688,CWE-787,"JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka ""JScript9 Memory Corruption Vulnerability.""",2015-07-14,CISA,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2015-2424,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.38497,CWE-787,"Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, and PowerPoint 2013 RT SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka ""Microsoft Office Memory Corruption Vulnerability.""",2015-07-14,CISA,cpe:2.3:a:microsoft:excel_viewer:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2011:*:*:*:*:macos:*:*;cpe:2.3:a:microsoft:office:2013:sp1:*:*:-:*:*:*;cpe:2.3:a:microsoft:office:2013:sp1:*:*:rt:*:*:*;cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:powerpoint:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:powerpoint:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2013:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:word_viewer:-:*:*:*:*:*:*:*,Microsoft,Excel Viewer
CVE-2015-2425,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.44851,CWE-787,"Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka ""Internet Explorer Memory Corruption Vulnerability,"" a different vulnerability than CVE-2015-2383 and CVE-2015-2384.",2015-07-14,CISA,cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2015-2426,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.8669,CWE-119,"Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka ""OpenType Font Driver Vulnerability.""",2015-07-20,CISA/Metasploit,cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 10
CVE-2015-2433,0.0,,0.18402,CWE-200,"The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to bypass the ASLR protection mechanism via a crafted application, aka ""Kernel ASLR Bypass Vulnerability.""",2015-08-15,Metasploit,cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 10
CVE-2015-2502,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.51127,CWE-787,"Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka ""Memory Corruption Vulnerability,"" as exploited in the wild in August 2015.",2015-08-19,CISA,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows Server 2008
CVE-2015-2509,0.0,,0.71044,CWE-284,"Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows user-assisted remote attackers to execute arbitrary code via a crafted Media Center link (mcl) file, aka ""Windows Media Center RCE Vulnerability.""",2015-09-09,Metasploit,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2015-2545,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.86053,NVD-CWE-noinfo,"Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted EPS image, aka ""Microsoft Office Malformed EPS File Vulnerability.""",2015-09-09,CISA,cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2013:sp1:*:*:-:*:*:*;cpe:2.3:a:microsoft:office:2013:sp1:*:*:rt:*:*:*;cpe:2.3:a:microsoft:office:2016:*:-:*:-:*:-:*,Microsoft,Office
CVE-2015-2546,8.2,CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H,0.10929,CWE-119,"The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka ""Win32k Memory Corruption Elevation of Privilege Vulnerability,"" a different vulnerability than CVE-2015-2511, CVE-2015-2517, and CVE-2015-2518.",2015-09-09,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2015-2562,0.0,,0.38721,CWE-89,"Multiple SQL injection vulnerabilities in the Web-Dorado ECommerce WD (com_ecommercewd) component 1.2.5 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) search_category_id, (2) sort_order, or (3) filter_manufacturer_ids in a displayproducts action to index.php.",2015-03-20,Metasploit,cpe:2.3:a:web-dorado:ecommerce_wd:1.2.5:*:*:*:*:joomla\!:*:*,Web-Dorado,Ecommerce Wd
CVE-2015-2590,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.25469,NVD-CWE-noinfo,"Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.",2015-07-16,CISA,cpe:2.3:a:oracle:jdk:1.6.0:update95:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update75:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update80:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.8.0:update33:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.8.0:update45:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update95:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update75:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update80:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.8.0:update33:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.8.0:update45:*:*:*:*:*:*;cpe:2.3:a:redhat:satellite:5.6:*:*:*:*:*:*:*;cpe:2.3:a:redhat:satellite:5.7:*:*:*:*:*:*:*;cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp3:*:*:*:*:*:*;cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.0_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:6.7_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.1_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.2_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.3_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.4_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.5_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:6.7_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.1_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.2_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.3_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.4_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.5_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.1_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.2_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.3_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.4_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.5_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:6.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2015-2673,0.0,,0.18932,CWE-264,The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP EasyCart plugin 1.1.30 through 3.0.20 for WordPress allow remote attackers to gain administrator privileges and execute arbitrary code via the option_name and option_value parameters.,2017-10-06,Metasploit,cpe:2.3:a:wpeasycart:wp_easycart:1.1.30:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:1.1.31:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:1.1.32:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:1.1.33:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:1.1.34:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:1.1.35:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:1.1.36:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:1.2.0:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:1.2.10:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:1.2.11:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:1.2.12:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:1.2.13:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:1.2.14:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:1.2.15:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:1.2.16:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:1.2.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:1.2.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:1.2.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:1.2.4:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:1.2.5:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:1.2.6:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:1.2.7:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:1.2.8:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:1.2.9:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.0.10:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.0.11:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.0.12:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.0.13:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.0.14:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.0.15:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.0.16:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.0.17:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.0.18:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.0.19:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.0.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.0.1\@824267:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.0.20:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.0.21:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.0.22:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.0.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.0.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.0.4:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.0.5:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.0.6:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.0.7:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.0.8:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.0.9:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.0:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.10:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.11:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.12:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.13:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.14:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.15:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.16:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.17:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.18:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.19:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.20:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.21:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.22:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.23:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.24:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.25:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.26:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.27:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.28:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.29:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.30:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.31:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.32:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.33:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.34:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.35:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.36:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.4:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.5:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.6:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.7:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.8:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:2.1.9:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:3.0.0:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:3.0.10:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:3.0.11:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:3.0.12:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:3.0.13:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:3.0.14:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:3.0.15:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:3.0.16:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:3.0.17:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:3.0.18:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:3.0.19:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:3.0.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:3.0.20:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:3.0.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:3.0.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:3.0.4:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:3.0.5:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:3.0.6:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:3.0.7:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:3.0.8:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpeasycart:wp_easycart:3.0.9:*:*:*:*:wordpress:*:*,Wpeasycart,Wp Easycart
CVE-2015-2755,0.0,,0.03831,CWE-352,"Multiple cross-site request forgery (CSRF) vulnerabilities in the AB Google Map Travel (AB-MAP) plugin before 4.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) lat (Latitude), (2) long (Longitude), (3) map_width, (4) map_height, or (5) zoom (Map Zoom) parameter in the ab_map_options page to wp-admin/admin.php.",2015-04-01,Nuclei,cpe:2.3:a:ab_google_map_travel_project:ab_google_map_travel:*:*:*:*:*:wordpress:*:*,Ab Google Map Travel Project,Ab Google Map Travel
CVE-2015-2794,0.0,,0.74552,CWE-264,The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.,2017-02-06,Nuclei,cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*,Dnnsoftware,Dotnetnuke
CVE-2015-2797,0.0,,0.77599,CWE-119,"Stack-based buffer overflow in AirTies Air 6372, 5760, 5750, 5650TT, 5453, 5444TT, 5443, 5442, 5343, 5342, 5341, and 5021 DSL modems with firmware 1.0.2.0 and earlier allows remote attackers to execute arbitrary code via a long string in the redirect parameter to cgi-bin/login.",2015-06-19,Metasploit,cpe:2.3:h:airties:air_5021:-:*:*:*:*:*:*:*;cpe:2.3:h:airties:air_5341:-:*:*:*:*:*:*:*;cpe:2.3:h:airties:air_5342:-:*:*:*:*:*:*:*;cpe:2.3:h:airties:air_5343:-:*:*:*:*:*:*:*;cpe:2.3:h:airties:air_5442:-:*:*:*:*:*:*:*;cpe:2.3:h:airties:air_5443:-:*:*:*:*:*:*:*;cpe:2.3:h:airties:air_5444tt:-:*:*:*:*:*:*:*;cpe:2.3:h:airties:air_5453:-:*:*:*:*:*:*:*;cpe:2.3:h:airties:air_5650tt:-:*:*:*:*:*:*:*;cpe:2.3:h:airties:air_5750:-:*:*:*:*:*:*:*;cpe:2.3:h:airties:air_5760:-:*:*:*:*:*:*:*;cpe:2.3:h:airties:air_6372:-:*:*:*:*:*:*:*;cpe:2.3:o:airties:air_firmware:*:*:*:*:*:*:*:*,Airties,Air Firmware
CVE-2015-2807,0.0,,0.07328,CWE-79,Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter.,2015-09-01,Nuclei,cpe:2.3:a:documentcloud:navis_documentcloud:*:*:*:*:*:wordpress:*:*,Documentcloud,Navis Documentcloud
CVE-2015-2843,0.0,,0.38149,CWE-89,Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before 3.3-1421902800 allow remote attackers to execute arbitrary SQL commands via the (1) user_name or (2) user_pass parameter in go_login.php or the PATH_INFO to (3) go_login/validate_credentials/admin/ or (4) index.php/go_site/go_get_user_info/.,2015-05-12,Metasploit,cpe:2.3:a:goautodial:goadmin_ce:3.0:*:*:*:*:*:*:*;cpe:2.3:a:goautodial:goadmin_ce:3.3:*:*:*:*:*:*:*,Goautodial,Goadmin Ce
CVE-2015-2845,0.0,,0.71687,CWE-78,The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1421902800 allows remote attackers to execute arbitrary commands via the $type portion of the PATH_INFO.,2015-05-12,Metasploit,cpe:2.3:a:goautodial:goadmin_ce:3.0:*:*:*:*:*:*:*;cpe:2.3:a:goautodial:goadmin_ce:3.3:*:*:*:*:*:*:*,Goautodial,Goadmin Ce
CVE-2015-2856,0.0,,0.56573,CWE-22,Directory traversal vulnerability in the template function in function.inc in Accellion File Transfer Appliance devices before FTA_9_11_210 allows remote attackers to read arbitrary files via a .. (dot dot) in the statecode cookie.,2017-10-10,Metasploit,cpe:2.3:a:accellion:file_transfer_appliance:*:*:*:*:*:*:*:*,Accellion,File Transfer Appliance
CVE-2015-2857,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.84178,CWE-77,Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters in the oauth_token parameter.,2017-08-22,Metasploit,cpe:2.3:a:accellion:file_transfer_appliance:*:*:*:*:*:*:*:*,Accellion,File Transfer Appliance
CVE-2015-2863,0.0,,0.10317,NVD-CWE-Other,"Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.",2015-07-20,Nuclei,cpe:2.3:a:kaseya:virtual_system_administrator:*:*:*:*:*:*:*:*,Kaseya,Virtual System Administrator
CVE-2015-2993,0.0,,0.55362,CWE-264,"SysAid Help Desk before 15.2 does not properly restrict access to certain functionality, which allows remote attackers to (1) create administrator accounts via a crafted request to /createnewaccount or (2) write to arbitrary files via the fileName parameter to /userentry.",2015-06-08,Metasploit,cpe:2.3:a:sysaid:sysaid:*:*:*:*:*:*:*:*,Sysaid,Sysaid
CVE-2015-2994,0.0,,0.49791,NVD-CWE-Other,"Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary code by uploading a file with a .jsp extension, then accessing it via a direct request to the file in icons/user_photo/.",2015-06-08,Metasploit,cpe:2.3:a:sysaid:sysaid:*:*:*:*:*:*:*:*,Sysaid,Sysaid
CVE-2015-2995,0.0,,0.33791,CWE-22,"The RdsLogsEntry servlet in SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote attackers to upload and execute arbitrary files via a NULL byte after the extension, as demonstrated by a .war%00 file.",2015-06-08,Metasploit,cpe:2.3:a:sysaid:sysaid:*:*:*:*:*:*:*:*,Sysaid,Sysaid
CVE-2015-2996,0.0,,0.86643,CWE-22,Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the fileName parameter to getGfiUpgradeFile or (2) cause a denial of service (CPU and memory consumption) via a .. (dot dot) in the fileName parameter to calculateRdsFileChecksum.,2015-06-08,Metasploit/Nuclei,cpe:2.3:a:sysaid:sysaid:*:*:*:*:*:*:*:*,Sysaid,Sysaid
CVE-2015-2997,0.0,,0.57204,CWE-200,"SysAid Help Desk before 15.2 allows remote attackers to obtain sensitive information via an invalid value in the accountid parameter to getAgentLogFile, as demonstrated by a large directory traversal sequence, which reveals the installation path in an error message.",2015-06-08,Metasploit,cpe:2.3:a:sysaid:sysaid:*:*:*:*:*:*:*:*,Sysaid,Sysaid
CVE-2015-2998,0.0,,0.26349,CWE-200,"SysAid Help Desk before 15.2 uses a hardcoded encryption key, which makes it easier for remote attackers to obtain sensitive information, as demonstrated by decrypting the database password in WEB-INF/conf/serverConf.xml.",2015-06-08,Metasploit,cpe:2.3:a:sysaid:sysaid:*:*:*:*:*:*:*:*,Sysaid,Sysaid
CVE-2015-3035,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.83772,CWE-22,"Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310 allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.",2015-04-22,CISA/Metasploit/Nuclei,cpe:2.3:h:tp-link:archer_c5:1.20:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:archer_c7:2:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:archer_c8:1:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:archer_c9:1:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:tl-wdr3500:1:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:tl-wdr3600:1:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:tl-wdr4300:1:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:tl-wr740n:5:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:tl-wr741nd:5:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:tl-wr841n:10:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:tl-wr841n:9:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:tl-wr841nd:10:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:tl-wr841nd:9:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:archer_c5_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:archer_c7_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:archer_c8_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:archer_c9_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:tl-wdr3500_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:tl-wdr3600_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:tl-wdr4300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:tl-wr740n_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:tl-wr741nd_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:tl-wr841n_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:tl-wr841nd_firmware:*:*:*:*:*:*:*:*,TP-Link,Tl-Wr741Nd Firmware
CVE-2015-3043,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.7983,CWE-787,"Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in April 2015, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, and CVE-2015-3042.",2015-04-14,CISA/Metasploit,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:novell:suse_linux_enterprise_desktop:11.0:sp3:*:*:*:*:*:*;cpe:2.3:o:novell:suse_linux_enterprise_desktop:12.0:*:*:*:*:*:*:*;cpe:2.3:o:novell:suse_linux_enterprise_workstation_extension:12.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:evergreen:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2015-3090,0.0,,0.87303,CWE-119,"Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3078, CVE-2015-3089, and CVE-2015-3093.",2015-05-13,Metasploit,cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:air_sdk_\&_compiler:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.125:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.145:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.176:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.179:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.152:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.167:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.189:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.223:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.239:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.246:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:16.0.0.235:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:16.0.0.257:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:16.0.0.287:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:16.0.0.296:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:17.0.0.134:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:17.0.0.169:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2015-3105,0.0,,0.96079,CWE-119,"Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.",2015-06-10,EPSS/Metasploit,cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:air_sdk_\&_compiler:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.125:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.145:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.176:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:14.0.0.179:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.152:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.167:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.189:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.223:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.239:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:15.0.0.246:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:16.0.0.235:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:16.0.0.257:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:16.0.0.287:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:16.0.0.296:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:17.0.0.134:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:17.0.0.169:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:17.0.0.188:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:google:android:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2015-3113,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9994,CWE-787,"Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.",2015-06-23,CISA/EPSS/Metasploit,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:insight_orchestration:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:systems_insight_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:version_control_agent:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:version_control_repository_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:version_control_repository_manager:7.6:*:*:*:*:*:*:*;cpe:2.3:a:hp:virtual_connect_enterprise_manager:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:evergreen:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:-:*:*:*:*:*:*,Apple,Mac Os X
CVE-2015-3224,0.0,,0.44984,CWE-284,"request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.",2015-07-26,Metasploit/Nuclei,cpe:2.3:a:rubyonrails:web_console:*:*:*:*:*:*:*:*,Rubyonrails,Web Console
CVE-2015-3245,0.0,,0.05271,CWE-20,"Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, allows local users to cause a denial of service (/etc/passwd corruption) via a newline character in the GECOS field.",2015-08-11,Metasploit,cpe:2.3:a:redhat:libuser:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:libuser:0.60-1:*:*:*:*:*:*:*;cpe:2.3:a:redhat:libuser:0.60-2:*:*:*:*:*:*:*;cpe:2.3:a:redhat:libuser:0.60-3:*:*:*:*:*:*:*;cpe:2.3:a:redhat:libuser:0.60-4:*:*:*:*:*:*:*;cpe:2.3:a:redhat:libuser:0.60-5:*:*:*:*:*:*:*;cpe:2.3:a:redhat:libuser:0.60-6:*:*:*:*:*:*:*,Redhat,Libuser
CVE-2015-3246,0.0,,0.06797,CWE-264,"libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.",2015-08-11,Metasploit,cpe:2.3:a:redhat:libuser:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:libuser:0.60-1:*:*:*:*:*:*:*;cpe:2.3:a:redhat:libuser:0.60-2:*:*:*:*:*:*:*;cpe:2.3:a:redhat:libuser:0.60-3:*:*:*:*:*:*:*;cpe:2.3:a:redhat:libuser:0.60-4:*:*:*:*:*:*:*;cpe:2.3:a:redhat:libuser:0.60-5:*:*:*:*:*:*:*;cpe:2.3:a:redhat:libuser:0.60-6:*:*:*:*:*:*:*,Redhat,Libuser
CVE-2015-3306,0.0,,0.96803,CWE-284,The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.,2015-05-18,EPSS/Metasploit/Nuclei,cpe:2.3:a:proftpd:proftpd:1.3.5:*:*:*:*:*:*:*,Proftpd,Proftpd
CVE-2015-3315,0.0,,0.04776,CWE-59,"Automatic Bug Reporting Tool (ABRT) allows local users to read, change the ownership of, or have other unspecified impact on arbitrary files via a symlink attack on (1) /var/tmp/abrt/*/maps, (2) /tmp/jvm-*/hs_error.log, (3) /proc/*/exe, (4) /etc/os-release in a chroot, or (5) an unspecified root directory related to librpm.",2017-06-26,Metasploit,cpe:2.3:a:redhat:automatic_bug_reporting_tool:-:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*,Redhat,Enterprise Linux Desktop
CVE-2015-3337,0.0,,0.33129,CWE-22,"Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.",2015-05-01,Nuclei,cpe:2.3:a:elasticsearch:elasticsearch:*:*:*:*:*:*:*:*;cpe:2.3:a:elasticsearch:elasticsearch:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:elasticsearch:elasticsearch:1.5.1:*:*:*:*:*:*:*,Elasticsearch,Elasticsearch
CVE-2015-3628,0.0,,0.68483,CWE-264,"The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP AAM 11.4.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.3.0, BIG-IP GTM 11.3.0 before 11.6.0 HF6, BIG-IP PSM 11.3.0 through 11.4.1, Enterprise Manager 3.1.0 through 3.1.1, BIG-IQ Cloud and Security 4.0.0 through 4.5.0, BIG-IQ Device 4.2.0 through 4.5.0, and BIG-IQ ADC 4.5.0 allows remote authenticated users with the ""Resource Administrator"" role to gain privileges via an iCall (1) script or (2) handler in a SOAP request to iControl/iControlPortal.cgi.",2015-12-07,Metasploit,cpe:2.3:a:f5:big-ip_access_policy_manager:11.3.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_access_policy_manager:11.4.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_access_policy_manager:11.4.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.2:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.3:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.3.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.4.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.4.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.2:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.3:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:11.3.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:11.4.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:11.4.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:11.5.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:11.5.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:11.5.2:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:11.5.3:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.4.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.4.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.2:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.3:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:11.3.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:11.4.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:11.4.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:11.5.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:11.5.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:11.5.2:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:11.5.3:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_edge_gateway:11.3.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_enterprise_manager:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_enterprise_manager:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_enterprise_manager:3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:11.3.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:11.4.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:11.4.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:11.5.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:11.5.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:11.5.2:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:11.5.3:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:11.3.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:11.4.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:11.4.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:11.5.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:11.5.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:11.5.2:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:11.5.3:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:11.3.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:11.4.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:11.4.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.2:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.3:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.3.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.4.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.4.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.2:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.3:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:11.3.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:11.4.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_protocol_security_module:11.4.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_wan_optimization_manager:11.3.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:11.3.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_adc:4.5.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_cloud:4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_cloud:4.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_cloud:4.2.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_cloud:4.3.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_cloud:4.4.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_cloud:4.5.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_device:4.2.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_device:4.3.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_device:4.4.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_device:4.5.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_security:4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_security:4.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_security:4.2.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_security:4.3.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_security:4.4.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_security:4.5.0:*:*:*:*:*:*:*,F5,Big-Iq Security
CVE-2015-3648,0.0,,0.08083,CWE-22,Directory traversal vulnerability in pages/setup.php in Montala Limited ResourceSpace before 7.2.6727 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the defaultlanguage parameter.,2015-06-09,Nuclei,cpe:2.3:a:montala:resourcespace:*:*:*:*:*:*:*:*,Montala,Resourcespace
CVE-2015-3673,0.0,,0.05812,CWE-264,"Admin Framework in Apple OS X before 10.10.4 does not properly restrict the location of writeconfig clients, which allows local users to obtain root privileges by moving and then modifying Directory Utility.",2015-07-03,Metasploit,cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2015-3760,0.0,,0.01751,CWE-20,"dyld in Apple OS X before 10.10.5 does not properly validate pathnames in the environment, which allows local users to gain privileges via unspecified vectors.",2015-08-16,Metasploit,cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2015-3864,0.0,,0.87125,CWE-189,"Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824.",2015-10-01,Metasploit,cpe:2.3:o:google:android:*:*:*:*:*:*:*:*,Google,Android
CVE-2015-3884,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.14399,CWE-434,"Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/attachments/ or uploads/users/.",2017-03-17,Metasploit,cpe:2.3:a:qdpm:qdpm:*:*:*:*:*:*:*:*,Qdpm,Qdpm
CVE-2015-3897,0.0,,0.17681,CWE-22,Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the theme parameter and a file path in the location parameter to bonita/portal/themeResource.,2015-06-18,Nuclei,cpe:2.3:a:bonitasoft:bonita_bpm_portal:*:*:*:*:*:*:*:*,Bonitasoft,Bonita Bpm Portal
CVE-2015-4000,3.7,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N,0.9986,CWE-310,"The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the ""Logjam"" issue.",2015-05-21,EPSS/Metasploit,cpe:2.3:a:apple:safari:-:*:*:*:*:*:*:*;cpe:2.3:a:google:chrome:-:*:*:*:*:*:*:*;cpe:2.3:a:ibm:content_manager:8.5:*:*:*:*:enterprise:*:*;cpe:2.3:a:microsoft:internet_explorer:-:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:-:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:38.1.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:39.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox_esr:31.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:network_security_services:3.19:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:seamonkey:2.35:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:31.8:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:38.1:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*;cpe:2.3:a:opera:opera_browser:-:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update95:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update75:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update80:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.8.0:update45:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.8.0:update_33:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update_95:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update_75:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update_80:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.8.0:update_33:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.8.0:update_45:*:*:*:*:*:*;cpe:2.3:a:oracle:jrockit:r28.3.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:sparc-opl_service_processor:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:b.11.31:*:*:*:*:*:*:*;cpe:2.3:o:mozilla:firefox_os:2.2:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11.0:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:*:*:*:*:*:*:*;cpe:2.3:o:suse:suse_linux_enterprise_server:12:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2015-4050,0.0,,0.08269,CWE-284,"FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.",2015-06-02,Nuclei,cpe:2.3:a:sensiolabs:symfony:2.3.19:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.3.20:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.3.21:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.3.22:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.3.23:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.3.24:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.3.25:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.3.26:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.3.27:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.3.28:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.4.10:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.4.9:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.5.10:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.5.11:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.5.4:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.5.5:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.5.6:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.5.7:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.5.8:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.5.9:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.6.0:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.6.1:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.6.3:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.6.4:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.6.5:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.6.6:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:2.6.7:*:*:*:*:*:*:*,Sensiolabs,Symfony
CVE-2015-4062,0.0,,0.09183,CWE-89,SQL injection vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the where1 parameter in the nsp_search page to wp-admin/admin.php.,2015-05-27,Nuclei,cpe:2.3:a:newstatpress_project:newstatpress:*:*:*:*:*:wordpress:*:*,Newstatpress Project,Newstatpress
CVE-2015-4063,0.0,,0.06188,CWE-79,Cross-site scripting (XSS) vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the where1 parameter in the nsp_search page to wp-admin/admin.php.,2015-05-27,Nuclei,cpe:2.3:a:newstatpress_project:newstatpress:*:*:*:*:*:wordpress:*:*,Newstatpress Project,Newstatpress
CVE-2015-4068,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H,0.63643,CWE-22,Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denial of service via a crafted file path to the (1) reportFileServlet or (2) exportServlet servlet.,2015-05-29,CISA,cpe:2.3:a:arcserve:udp:*:*:*:*:*:*:*:*;cpe:2.3:a:arcserve:udp:5.0:-:*:*:*:*:*:*,Arcserve,Udp
CVE-2015-4074,0.0,,0.5651,CWE-22,Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter in a ticket.download_attachment task.,2017-09-20,Nuclei,cpe:2.3:a:helpdesk_pro_project:helpdesk_pro:*:*:*:*:*:joomla\!:*:*,Helpdesk Pro Project,Helpdesk Pro
CVE-2015-4127,0.0,,0.07495,CWE-79,"Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers to inject arbitrary web script or HTML via the address parameter, as demonstrated by a request to index.php/2015/05/21/church_admin-registration-form/.",2015-05-28,Nuclei,cpe:2.3:a:church_admin_project:church_admin:*:*:*:*:*:wordpress:*:*,Church Admin Project,Church Admin
CVE-2015-4133,0.0,,0.61607,NVD-CWE-Other,"Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in uploads/ directory.",2015-05-28,Metasploit,cpe:2.3:a:reflex_gallery_project:reflex_gallery:*:*:*:*:*:wordpress:*:*,Reflex Gallery Project,Reflex Gallery
CVE-2015-4414,0.0,,0.18958,CWE-22,Directory traversal vulnerability in download_audio.php in the SE HTML5 Album Audio Player (se-html5-album-audio-player) plugin 1.1.0 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.,2015-06-17,Nuclei,cpe:2.3:a:se_html5_album_audio_player_project:se_html5_album_audio_player:*:*:*:*:*:wordpress:*:*,Se Html5 Album Audio Player Project,Se Html5 Album Audio Player
CVE-2015-4455,0.0,,0.40595,CWE-434,"Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/gform_aviary.",2017-05-23,Nuclei,cpe:2.3:a:aviary_image_editor_add-on_for_gravity_forms_project:aviary_image_editor_add-on_for_gravity_forms:*:beta:*:*:*:wordpress:*:*,Aviary Image Editor Add-On For Gravity Forms Project,Aviary Image Editor Add-On For Gravity Forms
CVE-2015-4495,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.70226,NVD-CWE-noinfo,"The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.",2015-08-08,CISA/Metasploit,cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*;cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*;cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp1:*:*:*:*:*:*;cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp2:*:*:*:*:*:*;cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp3:*:*:*:*:*:*;cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*;cpe:2.3:o:mozilla:firefox_os:*:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*;cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:-:*:*:*:*:*:*,Mozilla,Firefox Os
CVE-2015-4624,0.0,,0.36954,CWE-284,Hak5 WiFi Pineapple 2.0 through 2.3 uses predictable CSRF tokens.,2017-03-31,Metasploit,cpe:2.3:h:hak5:wi-fi_pineapple:-:*:*:*:*:*:*:*;cpe:2.3:o:hak5:wi-fi_pineapple_firmware:2.0:*:*:*:*:*:*:*;cpe:2.3:o:hak5:wi-fi_pineapple_firmware:2.1:*:*:*:*:*:*:*;cpe:2.3:o:hak5:wi-fi_pineapple_firmware:2.2:*:*:*:*:*:*:*;cpe:2.3:o:hak5:wi-fi_pineapple_firmware:2.3:*:*:*:*:*:*:*,Hak5,Wi-Fi Pineapple Firmware
CVE-2015-4632,0.0,,0.51829,CWE-22,"Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the template_path parameter to (1) svc/virtualshelves/search or (2) svc/members/search.",2018-10-18,Nuclei,cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*,Koha,Koha
CVE-2015-4666,0.0,,0.16235,CWE-22,Directory traversal vulnerability in opm/read_sessionlog.php in Xceedium Xsuite 2.4.4.5 and earlier allows remote attackers to read arbitrary files via a ....// (quadruple dot double slash) in the logFile parameter.,2015-08-13,Nuclei,cpe:2.3:a:xceedium:xsuite:2.3.0:*:*:*:*:*:*:*;cpe:2.3:a:xceedium:xsuite:2.4.3.0:*:*:*:*:*:*:*,Xceedium,Xsuite
CVE-2015-4668,0.0,,0.06719,CWE-601,Open redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirurl parameter.,2017-09-25,Nuclei,cpe:2.3:a:xceedium:xsuite:2.3.0:*:*:*:*:*:*:*;cpe:2.3:a:xceedium:xsuite:2.4.3.0:*:*:*:*:*:*:*,Xceedium,Xsuite
CVE-2015-4694,0.0,,0.15646,CWE-22,Directory traversal vulnerability in download.php in the Zip Attachments plugin before 1.5.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the za_file parameter.,2016-01-08,Nuclei,cpe:2.3:a:zip_attachments_project:zip_attachments:*:*:*:*:*:wordpress:*:*,Zip Attachments Project,Zip Attachments
CVE-2015-4852,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96032,CWE-502,"The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.",2015-11-18,CISA/EPSS/Metasploit,cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:virtual_desktop_infrastructure:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.1.2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.0.0:*:*:*:*:*:*:*,Oracle,Virtual Desktop Infrastructure
CVE-2015-4902,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.13354,NVD-CWE-noinfo,"Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.",2015-10-22,CISA,cpe:2.3:a:oracle:jdk:1.6.0:update101:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update85:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.8.0:update60:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update101:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update85:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.8.0:update60:*:*:*:*:*:*;cpe:2.3:a:redhat:satellite:5.6:*:*:*:*:*:*:*;cpe:2.3:a:redhat:satellite:5.7:*:*:*:*:*:*:*;cpe:2.3:a:suse:linux_enterprise_module_for_legacy:12:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus_compute_node:7.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus_compute_node:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:5.0_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.0_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:6.7_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.2_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.3_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.4_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.5_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:5.0_ppc:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:6.7_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.2_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.3_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.4_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.5_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.2_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.3_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.4_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.5_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:12:sp1:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp1:*:*:*:*:*:*,Redhat,Enterprise Linux Desktop
CVE-2015-5082,0.0,,0.69909,CWE-77,Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) NEW_PASSWORD_1 or (2) NEW_PASSWORD_2 parameter to cgi-bin/chpasswd.cgi.,2015-09-28,Metasploit,cpe:2.3:a:endian_firewall:endian_firewall:*:*:*:*:*:*:*:*,Endian Firewall,Endian Firewall
CVE-2015-5119,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99344,CWE-416,"Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows and OS X and 11.x through 11.2.202.468 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.",2015-07-08,CISA/EPSS/Metasploit,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:evergreen:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:-:*:*:*:*:*:*,Apple,Mac Os X
CVE-2015-5122,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.93688,CWE-416,"Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.",2015-07-14,CISA/Metasploit,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer_10:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer_11:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:esr:*:*:*;cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:evergreen:11.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:6.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:*:*:*:*:*:*:*,Apple,Macos
CVE-2015-5123,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.18493,CWE-416,"Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.",2015-07-14,CISA,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:chrome:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:esr:*:*:*;cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:evergreen:11.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:6.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:*:*:*:*:*:*:*,Redhat,Enterprise Linux Desktop
CVE-2015-5287,0.0,,0.03268,CWE-59,"The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.",2015-12-07,Metasploit,cpe:2.3:a:redhat:automatic_bug_reporting_tool:*:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*,Redhat,Enterprise Linux Desktop
CVE-2015-5317,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.22429,CWE-200,The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.,2015-11-25,CISA,cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*;cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*;cpe:2.3:a:redhat:openshift:*:*:*:*:enterprise:*:*:*;cpe:2.3:a:redhat:openshift:2.0:*:*:*:*:*:*:*,Jenkins,Jenkins
CVE-2015-5354,0.0,,0.12523,CWE-601,Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to admin/nos/login.,2015-07-01,Nuclei,cpe:2.3:a:novius-os:novius_os:5.0.1:*:*:*:*:*:*:*,Novius-Os,Novius Os
CVE-2015-5371,0.0,,0.93162,NVD-CWE-noinfo,The AuthenticationFilter class in SolarWinds Storage Manager allows remote attackers to upload and execute arbitrary scripts via unspecified vectors.,2015-07-06,Metasploit,cpe:2.3:a:solarwinds:storage_manager:-:*:*:*:*:*:*:*,Solarwinds,Storage Manager
CVE-2015-5374,0.0,,0.74323,CWE-19,A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02. Specially crafted packets sent to port 50000/UDP could cause a denial-of-service of the affected device. A manual reboot may be required to recover the service of the device.,2015-07-18,Metasploit,cpe:2.3:h:siemens:siprotec_4:*:*:*:*:*:*:*:*;cpe:2.3:h:siemens:siprotec_compact:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:siprotec_firmware:4.24:*:*:*:*:*:*:*,Siemens,Siprotec Firmware
CVE-2015-5453,0.0,,0.57309,CWE-77,Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the id parameter to ADMIN/mailqueue.spl.,2015-07-08,Metasploit,cpe:2.3:a:watchguard:xcs:10.0:*:*:*:*:*:*:*;cpe:2.3:a:watchguard:xcs:9.2:*:*:*:*:*:*:*,Watchguard,Xcs
CVE-2015-5461,0.0,,0.06283,NVD-CWE-Other,Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.,2015-07-08,Nuclei,cpe:2.3:a:stageshow_project:stageshow:*:*:*:*:*:wordpress:*:*,Stageshow Project,Stageshow
CVE-2015-5469,0.0,,0.10148,CWE-22,Absolute path traversal vulnerability in the MDC YouTube Downloader plugin 2.1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter to includes/download.php.,2017-05-23,Nuclei,cpe:2.3:a:mdc_youtube_downloader_project:mdc_youtube_downloader:2.1.0:*:*:*:*:wordpress:*:*,Mdc Youtube Downloader Project,Mdc Youtube Downloader
CVE-2015-5471,0.0,,0.32483,CWE-22,Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter.,2016-01-12,Nuclei,cpe:2.3:a:swim_team_project:swim_team:1.44.10777:*:*:*:*:wordpress:*:*,Swim Team Project,Swim Team
CVE-2015-5477,0.0,,0.91284,CWE-19,named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.,2015-07-29,Metasploit,cpe:2.3:a:isc:bind:*:p1:*:*:*:*:*:*;cpe:2.3:a:isc:bind:*:p2:*:*:*:*:*:*,Isc,Bind
CVE-2015-5531,0.0,,0.9175,CWE-22,Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.,2015-08-17,Metasploit/Nuclei,cpe:2.3:a:elasticsearch:elasticsearch:*:*:*:*:*:*:*:*,Elasticsearch,Elasticsearch
CVE-2015-5603,0.0,,0.59312,CWE-94,"The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java code via unspecified vectors, related to ""Velocity Template Injection Vulnerability.""",2015-09-21,Metasploit,cpe:2.3:a:atlassian:hipchat:*:*:*:*:*:*:*:*,Atlassian,Hipchat
CVE-2015-5688,0.0,,0.09385,CWE-22,Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI.,2015-09-04,Nuclei,cpe:2.3:a:geddyjs:geddy:13.0.7:*:*:*:*:node.js:*:*,Geddyjs,Geddy
CVE-2015-5889,0.0,,0.0513,CWE-264,rsh in the remote_cmds component in Apple OS X before 10.11 allows local users to obtain root privileges via vectors involving environment variables.,2015-10-09,Metasploit,cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2015-5958,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.27377,CWE-78,phpFileManager 0.9.8 allows remote attackers to execute arbitrary commands via a crafted URL.,2017-08-31,Metasploit,cpe:2.3:a:phpfilemanager_project:phpfilemanager:0.9.8:*:*:*:*:*:*:*,Phpfilemanager Project,Phpfilemanager
CVE-2015-6000,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.40241,CWE-434,"Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.3.0 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in test/logo/.",2020-02-06,Metasploit,cpe:2.3:a:vtiger:vtiger_crm:*:*:*:*:*:*:*:*,Vtiger,Vtiger Crm
CVE-2015-6127,0.0,,0.46006,CWE-200,"Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows remote attackers to read arbitrary files via a crafted .mcl file, aka ""Windows Media Center Information Disclosure Vulnerability.""",2015-12-09,Metasploit,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2015-6128,0.0,,0.81886,CWE-20,"Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandle library loading, which allows local users to gain privileges via a crafted application, aka ""Windows Library Loading Remote Code Execution Vulnerability.""",2015-12-09,Metasploit,cpe:2.3:o:microsoft:windows_7:*:sp1:x64:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:sp1:x86:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2015-6132,0.0,,0.84701,CWE-264,"Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle library loading, which allows local users to gain privileges via a crafted application, aka ""Windows Library Loading Remote Code Execution Vulnerability.""",2015-12-09,Metasploit,cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 10
CVE-2015-6133,0.0,,0.66581,CWE-264,"Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle library loading, which allows local users to gain privileges via a crafted application, aka ""Windows Library Loading Remote Code Execution Vulnerability.""",2015-12-09,Metasploit,cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*,Microsoft,Windows 10
CVE-2015-6175,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.05169,NVD-CWE-noinfo,"The kernel in Microsoft Windows 10 Gold allows local users to gain privileges via a crafted application, aka ""Windows Kernel Memory Elevation of Privilege Vulnerability.""",2015-12-09,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2015-6477,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.12042,CWE-79,Multiple cross-site scripting (XSS) vulnerabilities in the Wind Farm Portal application in Nordex Control 2 (NC2) SCADA 16 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.,2015-10-18,Nuclei,cpe:2.3:o:nordex:nordex_control_2_scada:*:*:*:*:*:*:*:*,Nordex,Nordex Control 2 Scada
CVE-2015-6522,0.0,,0.74127,CWE-89,SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the size parameter to get_album_item.php.,2015-08-19,Metasploit,cpe:2.3:a:wpsymposium:wp_symposium:*:*:*:*:*:wordpress:*:*,Wpsymposium,Wp Symposium
CVE-2015-6544,0.0,,0.05477,CWE-79,Cross-site scripting (XSS) vulnerability in application/dashboard.class.inc.php in Combodo iTop before 2.2.0-2459 allows remote attackers to inject arbitrary web script or HTML via a dashboard title.,2018-02-20,Nuclei,cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*,Combodo,Itop
CVE-2015-6920,0.0,,0.0384,CWE-79,Cross-site scripting (XSS) vulnerability in js/window.php in the sourceAFRICA plugin 0.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter.,2015-09-11,Nuclei,cpe:2.3:a:sourceafrica_project:sourceafrica:0.1.3:*:*:*:*:wordpress:*:*,Sourceafrica Project,Sourceafrica
CVE-2015-6922,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.82102,CWE-287,"Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authentication, which allows remote attackers to bypass authentication and (1) add an administrative account via crafted request to LocalAuth/setAccount.aspx or (2) write to and execute arbitrary files via a full pathname in the PathData parameter to ConfigTab/uploader.aspx.",2020-02-17,Metasploit,cpe:2.3:a:kaseya:virtual_system_administrator:*:*:*:*:*:*:*:*,Kaseya,Virtual System Administrator
CVE-2015-6967,0.0,,0.49308,NVD-CWE-Other,"Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in content/private/plugins/my_image/image.php.",2015-09-16,Metasploit,cpe:2.3:a:nibbleblog:nibbleblog:*:*:*:*:*:*:*:*,Nibbleblog,Nibbleblog
CVE-2015-7007,0.0,,0.53338,NVD-CWE-noinfo,Script Editor in Apple OS X before 10.11.1 allows remote attackers to bypass an intended user-confirmation requirement for AppleScript execution via unspecified vectors.,2015-10-23,Metasploit,cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2015-7243,0.0,,0.58272,CWE-119,Buffer overflow in Boxoft WAV to MP3 Converter allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted WAV file.,2015-09-18,Metasploit,cpe:2.3:a:boxoft:boxoft_wav_to_mp3_converter:-:*:*:*:*:*:*:*,Boxoft,Boxoft Wav To Mp3 Converter
CVE-2015-7245,0.0,,0.45479,CWE-22,"Directory traversal vulnerability in D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 allows remote attackers to read sensitive information via a .. (dot dot) in the errorpage parameter.",2017-04-24,Nuclei,cpe:2.3:h:dlink:dvg-n5402sp:-:*:*:*:*:*:*:*;cpe:2.3:o:d-link:dvg-n5402sp_firmware:w1000cn-00:*:*:*:*:*:*:*;cpe:2.3:o:d-link:dvg-n5402sp_firmware:w1000cn-03:*:*:*:*:*:*:*;cpe:2.3:o:d-link:dvg-n5402sp_firmware:w2000en-00:*:*:*:*:*:*:*,D-Link,Dvg-N5402Sp Firmware
CVE-2015-7297,0.0,,0.99967,CWE-89,"SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2015-7858.",2015-10-29,EPSS/Metasploit/Nuclei,cpe:2.3:a:joomla:joomla\!:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.4:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.4:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.4.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.4.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.4.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.4.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.4.4:*:*:*:*:*:*:*,Joomla,Joomla!
CVE-2015-7309,0.0,,0.38611,CWE-74,"The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it.",2015-09-22,Metasploit,cpe:2.3:a:boltcms:bolt:*:*:*:*:*:*:*:*,Boltcms,Bolt
CVE-2015-7377,0.0,,0.04405,CWE-79,Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the invitaion_code parameter in a pie-register page to the default URI.,2015-10-16,Nuclei,cpe:2.3:a:genetechsolutions:pie_register:*:*:*:*:*:wordpress:*:*,Genetechsolutions,Pie Register
CVE-2015-7387,0.0,,0.80192,CWE-89,"ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as demonstrated by ""SELECT 1;INSERT INTO."" Fixed in Build 11200.",2015-09-28,Metasploit,cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:*:*:*:*:*:*:*:*,Zohocorp,Manageengine Eventlog Analyzer
CVE-2015-7450,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97655,CWE-502,"Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.",2016-01-02,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:ibm:sterling_b2b_integrator:5.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:sterling_integrator:5.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_common_reporting:2.1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_common_reporting:2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_common_reporting:2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_common_reporting:3.1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_common_reporting:3.1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_common_reporting:3.1.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_common_reporting:3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:tivoli_common_reporting:3.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:watson_content_analytics:*:*:*:*:*:*:*:*;cpe:2.3:a:ibm:watson_explorer_analytical_components:*:*:*:*:*:*:*:*;cpe:2.3:a:ibm:watson_explorer_analytical_components:11.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:watson_explorer_annotation_administration_console:*:*:*:*:*:*:*:*;cpe:2.3:a:ibm:watson_explorer_annotation_administration_console:11.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:websphere_application_server:7.0.0.0:*:*:*:-:*:*:*;cpe:2.3:a:ibm:websphere_application_server:8.0.0.0:*:*:*:-:*:*:*;cpe:2.3:a:ibm:websphere_application_server:8.5.0.0:*:*:*:hypervisor:*:*:*;cpe:2.3:a:ibm:websphere_application_server:8.5.5.5:*:*:*:liberty:*:*:*;cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:traditional:*:*:*,Ibm,Sterling B2B Integrator
CVE-2015-7601,0.0,,0.58334,CWE-22,Directory traversal vulnerability in PCMan's FTP Server 2.0.7 allows remote attackers to read arbitrary files via a ..// (dot dot double slash) in a RETR command.,2015-09-29,Metasploit,cpe:2.3:a:pcman\'s_ftp_server_project:pcman\'s_ftp_server:2.0.7:*:*:*:*:*:*:*,Pcman'S Ftp Server Project,Pcman'S Ftp Server
CVE-2015-7602,0.0,,0.60938,CWE-22,Directory traversal vulnerability in BisonWare BisonFTP 3.5 allows remote attackers to read arbitrary files via a ../ (dot dot slash) in a RETR command.,2015-09-29,Metasploit,cpe:2.3:a:bisonware:bisonftp:3.5:*:*:*:*:*:*:*,Bisonware,Bisonftp
CVE-2015-7603,0.0,,0.60676,CWE-22,Directory traversal vulnerability in Konica Minolta FTP Utility 1.0 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in a RETR command.,2015-09-29,Metasploit,cpe:2.3:a:konicaminolta:ftp_utility:1.0:*:*:*:*:*:*:*,Konicaminolta,Ftp Utility
CVE-2015-7611,0.0,,0.68603,CWE-78,"Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.",2016-06-07,Metasploit,cpe:2.3:a:apache:james_server:2.3.2:*:*:*:*:*:*:*,Apache,James Server
CVE-2015-7645,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.68396,NVD-CWE-noinfo,"Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.",2015-10-15,CISA,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:19.0.0.185:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:19.0.0.207:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:evergreen:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:-:*:*:*:*:*:*,Apple,Mac Os X
CVE-2015-7709,0.0,,0.78965,CWE-264,The arkeiad daemon in the Arkeia Backup Agent in Western Digital Arkeia 11.0.12 and earlier allows remote attackers to bypass authentication and execute arbitrary commands via a series of crafted requests involving the ARKFS_EXEC_CMD operation.,2015-10-05,Metasploit,cpe:2.3:a:arkeia:western_digital_arkeia:*:*:*:*:*:*:*:*,Arkeia,Western Digital Arkeia
CVE-2015-7755,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.614,CWE-287,"Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 allows remote attackers to obtain administrative access by entering an unspecified password during a (1) SSH or (2) TELNET session.",2015-12-19,CISA/Metasploit,cpe:2.3:o:juniper:screenos:6.3.0:r17:*:*:*:*:*:*;cpe:2.3:o:juniper:screenos:6.3.0:r18:*:*:*:*:*:*;cpe:2.3:o:juniper:screenos:6.3.0:r19:*:*:*:*:*:*;cpe:2.3:o:juniper:screenos:6.3.0:r20:*:*:*:*:*:*,Juniper,Screenos
CVE-2015-7765,0.0,,0.67284,NVD-CWE-Other,"ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of ""plugin"" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password.",2015-10-09,Metasploit,cpe:2.3:a:zohocorp:manageengine_opmanager:11.5:*:*:*:*:*:*:*,Zohocorp,Manageengine Opmanager
CVE-2015-7766,0.0,,0.80644,CWE-264,"PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as demonstrated by ""INSERT/**/INTO.""",2015-10-09,Metasploit,cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:11.6:*:*:*:*:*:*:*,Zohocorp,Manageengine Opmanager
CVE-2015-7768,0.0,,0.63209,CWE-119,Buffer overflow in Konica Minolta FTP Utility 1.0 allows remote attackers to execute arbitrary code via a long CWD command.,2015-10-09,Metasploit,cpe:2.3:a:konicaminolta:ftp_utility:1.0:*:*:*:*:*:*:*,Konicaminolta,Ftp Utility
CVE-2015-7780,0.0,,0.10631,CWE-22,Directory traversal vulnerability in ManageEngine Firewall Analyzer before 8.0.,2017-06-27,Nuclei,cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:*:*:*:*:*:*:*:*,Zohocorp,Manageengine Firewall Analyzer
CVE-2015-7808,0.0,,0.80635,CWE-20,The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in the arguments parameter to ajax/api/hook/decodeArguments.,2015-11-24,Metasploit,cpe:2.3:a:vbulletin:vbulletin:5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.0.4:*:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.0.5:*:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.1.0:*:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.1.0:rc1:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.1.1:*:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.1.2:*:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.1.2:beta1:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.1.2:rc1:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.1.2:rc2:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.1.3:*:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.1.3:alpha5:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.1.4:*:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.1.5:*:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.1.6:*:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.1.7:*:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.1.8:*:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.1.9:*:*:*:*:*:*:*,Vbulletin,Vbulletin
CVE-2015-7823,0.0,,0.05143,NVD-CWE-Other,Open redirect vulnerability in CMSPages/GetDocLink.ashx in Kentico CMS 8.2 through 8.2.41 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the link parameter.,2015-10-21,Nuclei,cpe:2.3:a:kentico:kentico_cms:8.2:*:*:*:*:*:*:*,Kentico,Kentico Cms
CVE-2015-7857,0.0,,0.93896,CWE-89,SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.php in Joomla! 3.2 before 3.4.5 allows remote attackers to execute arbitrary SQL commands via the list[select] parameter to index.php.,2015-10-29,Metasploit,cpe:2.3:a:joomla:joomla\!:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.4:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.4:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.4.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.4.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.4.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.4.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.4.4:*:*:*:*:*:*:*,Joomla,Joomla!
CVE-2015-7858,0.0,,0.84757,CWE-89,"SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2015-7297.",2015-10-29,Metasploit,cpe:2.3:a:joomla:joomla\!:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.4:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.4:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.4.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.4.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.4.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.4.3:*:*:*:*:*:*:*,Joomla,Joomla!
CVE-2015-7871,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.81762,CWE-287,"Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.",2017-08-07,Metasploit,cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_performance_manager:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:clustered_data_ontap:*:*;cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p186:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p187:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p188:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p189:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p190:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p191:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p192:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p193:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p194:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p195:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p196:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p197:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p198:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p199:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p200:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p201:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p202:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p203:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p204:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p205:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p206:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p207:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p208:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p209:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p210:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p211:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p212:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p213:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p214:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p215:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p216:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p217:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p218:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p219:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p220:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p221:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p222:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p223:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p224:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p225:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p226:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p227:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p228:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p229:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p230:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p231_rc1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p232_rc1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p233_rc1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p234_rc1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p235_rc1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p236_rc1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p237_rc1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p238_rc1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p239_rc1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p240_rc1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p241_rc1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p242_rc1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p243_rc1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p244_rc1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p245_rc1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p246_rc1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p247_rc1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p248_rc1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p249_rc1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.5:p250_rc1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.8:p1-beta1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.8:p1-beta2:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.8:p1-beta3:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.8:p1-beta4:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.8:p1-beta5:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.8:p1-rc1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.8:p1-rc2:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.8:p1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.8:p2-rc1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.8:p2-rc2:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.8:p2-rc3:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.8:p2:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.8:p3-rc1:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.8:p3-rc2:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.8:p3-rc3:*:*:*:*:*:*;cpe:2.3:a:ntp:ntp:4.2.8:p3:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:data_ontap:-:*:*:*:*:7-mode:*:*,Debian,Debian Linux
CVE-2015-8103,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.86714,CWE-502,"The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the ""Groovy variant in 'ysoserial'"".",2015-11-25,Metasploit,cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*;cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*;cpe:2.3:a:redhat:openshift_container_platform:2.2:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_container_platform:3.1:*:*:*:*:*:*:*,Redhat,Openshift Container Platform
CVE-2015-8249,0.0,,0.73603,CWE-434,The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the ConnectionId parameter.,2017-09-28,Metasploit,cpe:2.3:a:manageengine:desktop_central:9.0:*:*:*:*:*:*:*,Manageengine,Desktop Central
CVE-2015-8279,0.0,,0.51379,CWE-264,Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an unspecified PHP script.,2016-01-15,Metasploit,cpe:2.3:a:samsung:web_viewer:*:*:*:*:*:*:*:*,Samsung,Web Viewer
CVE-2015-8349,0.0,,0.03263,CWE-79,Cross-site scripting (XSS) vulnerability in SourceBans before 2.0 pre-alpha allows remote attackers to inject arbitrary web script or HTML via the advSearch parameter to index.php.,2017-09-11,Nuclei,cpe:2.3:a:gameconnect:sourcebans:*:*:*:*:*:*:*:*,Gameconnect,Sourcebans
CVE-2015-8350,0.0,,0.02645,CWE-79,Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) open-tab parameter in a wp_cta_global_settings action to wp-admin/edit.php or (2) wp-cta-variation-id parameter to ab-testing-call-to-action-example/.,2017-09-11,Nuclei,cpe:2.3:a:inboundnow:call_to_action:*:*:*:*:*:wordpress:*:*,Inboundnow,Call To Action
CVE-2015-8399,0.0,,0.61114,CWE-200,Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2) admin/viewdefaultdecorator.action.,2016-04-11,Nuclei,cpe:2.3:a:atlassian:confluence:*:*:*:*:*:*:*:*,Atlassian,Confluence
CVE-2015-8562,0.0,,0.98283,CWE-20,"Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015.",2015-12-16,EPSS/Metasploit/Nuclei,cpe:2.3:a:joomla:joomla\!:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.10:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.11:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.12:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.13:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.14:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.15:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.16:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.17:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.18:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.19:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.20:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.21:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.22:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.23:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.24:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.25:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.26:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.4:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.6:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.7:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.8:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.5.9:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.6.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.6.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.6.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.6.4:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.6.5:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.6.6:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.7.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.7.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.7.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.7.4:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:1.7.5:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.10:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.11:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.12:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.13:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.14:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.15:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.16:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.17:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.18:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.19:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.20:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.21:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.22:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.23:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.24:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.25:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.26:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.27:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.28:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.4:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.5:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.6:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.7:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.8:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:2.5.9:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.4:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.5:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.1.6:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.2.4:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.3.4:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.4.0:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.4.1:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.4.2:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.4.3:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.4.4:*:*:*:*:*:*:*;cpe:2.3:a:joomla:joomla\!:3.4.5:*:*:*:*:*:*:*,Joomla,Joomla!
CVE-2015-8612,0.0,,0.0634,CWE-264,The EnableNetwork method in the Network class in plugins/mechanism/Network.py in Blueman before 2.0.3 allows local users to gain privileges via the dhcp_handler argument.,2016-01-08,Metasploit,cpe:2.3:a:blueman_project:blueman:*:*:*:*:*:*:*:*,Blueman Project,Blueman
CVE-2015-8651,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.67922,CWE-190,"Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors.",2015-12-28,CISA,cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:air_sdk_\&_compiler:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:insight_control:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:insight_control_server_provisioning:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:matrix_operating_environment:7.6:*:*:*:*:*:*:*;cpe:2.3:a:hp:system_management_homepage:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:systems_insight_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:version_control_repository_manager:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:google:android:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:evergreen:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:sp1:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:sp1:*:*:*:*:*:*,Apple,Iphone Os
CVE-2015-8660,6.7,CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.22374,CWE-264,"The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application.",2015-12-28,Metasploit,cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2015-8813,0.0,,0.11595,CWE-918,The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.,2017-03-03,Nuclei,cpe:2.3:a:umbraco:umbraco:*:*:*:*:*:*:*:*,Umbraco,Umbraco
CVE-2015-9266,0.0,,0.73999,CWE-22,"The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary files using directory traversal techniques. An attacker can exploit this vulnerability to gain root privileges. This vulnerability is fixed in the following product versions (fixes released in July 2015, all prior versions are affected): airMAX AC 7.1.3; airMAX M (and airRouter) 5.6.2 XM/XW/TI, 5.5.11 XM/TI, and 5.5.10u2 XW; airGateway 1.1.5; airFiber AF24/AF24HD 2.2.1, AF5x 3.0.2.1, and AF5 2.2.1; airOS 4 XS2/XS5 4.0.4; and EdgeSwitch XP (formerly TOUGHSwitch) 1.3.2.",2018-09-05,Metasploit,cpe:2.3:h:ui:af5:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:af5x:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:airfiber_af24:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:airfiber_af24hd:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:airgateway:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:airmax_ac:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:airmax_m:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:airmax_m_ti:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:airmax_m_xm:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:airmax_m_xw:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:edgeswitch_xp:-:*:*:*:*:*:*:*;cpe:2.3:o:ubnt:airos_4_xs2:*:*:*:*:*:*:*:*;cpe:2.3:o:ubnt:airos_4_xs5:*:*:*:*:*:*:*:*;cpe:2.3:o:ubnt:edgeswitch_xp_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:af5_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:af5x_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:airfiber_af24_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:airfiber_af24hd_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:airgateway_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:airmax_ac_firmware:7.1.3:*:*:*:*:*:*:*;cpe:2.3:o:ui:airmax_m_ti_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:airmax_m_xm_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:airmax_m_xw_firmware:*:*:*:*:*:*:*:*,Ui,Airmax Ac Firmware
CVE-2015-9312,0.0,,0.01879,CWE-79,The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.,2019-08-14,Nuclei,cpe:2.3:a:newstatpress_project:newstatpress:*:*:*:*:*:wordpress:*:*,Newstatpress Project,Newstatpress
CVE-2015-9323,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.46125,CWE-89,The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.,2019-08-16,Nuclei,cpe:2.3:a:duckdev:404_to_301:*:*:*:*:*:wordpress:*:*,Duckdev,404 To 301
CVE-2015-9406,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.55008,CWE-22,Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a .. (dot dot) in the files parameter to css/css.php.,2019-09-20,Metasploit/Nuclei,cpe:2.3:a:mtheme-unus_project:mtheme-unus:*:*:*:*:*:wordpress:*:*,Mtheme-Unus Project,Mtheme-Unus
CVE-2015-9414,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03605,CWE-79,The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter.,2019-09-26,Nuclei,cpe:2.3:a:wpsymposiumpro:wp-symposium:*:*:*:*:*:wordpress:*:*,Wpsymposiumpro,Wp-Symposium
CVE-2015-9415,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N,0.03399,CWE-20,The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion.,2019-09-26,Nuclei,cpe:2.3:a:angrycreative:bj_lazy_load:*:*:*:*:*:wordpress:*:*,Angrycreative,Bj Lazy Load
CVE-2015-9480,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.12574,CWE-22,The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter.,2019-10-10,Nuclei,cpe:2.3:a:robot-cpa:robotcpa:5:*:*:*:*:wordpress:*:*,Robot-Cpa,Robotcpa
CVE-2015-9499,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.14775,CWE-434,The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive.,2019-10-22,Nuclei,cpe:2.3:a:themepunch:showbiz_pro:*:*:*:*:*:wordpress:*:*,Themepunch,Showbiz Pro
CVE-2015-9538,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.10118,CWE-22,The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection.,2019-11-26,Metasploit,cpe:2.3:a:imagely:nextgen_gallery:*:*:*:*:*:wordpress:*:*,Imagely,Nextgen Gallery
CVE-2016-0034,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.69709,NVD-CWE-noinfo,"Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web site, aka ""Silverlight Runtime Remote Code Execution Vulnerability.""",2016-01-13,CISA,cpe:2.3:a:microsoft:silverlight:*:*:*:*:*:*:*:*,Microsoft,Silverlight
CVE-2016-0040,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.24554,NVD-CWE-noinfo,"The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a crafted application, aka ""Windows Elevation of Privilege Vulnerability.""",2016-02-10,CISA/Metasploit,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2016-0041,0.0,,0.83285,NVD-CWE-Other,"Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold and 1511, and Internet Explorer 10 and 11 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka ""DLL Loading Remote Code Execution Vulnerability.""",2016-02-10,Metasploit,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*,Microsoft,Windows 10
CVE-2016-0051,0.0,,0.23383,CWE-264,"The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka ""WebDAV Elevation of Privilege Vulnerability.""",2016-02-10,Metasploit,cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*,Microsoft,Windows 10
CVE-2016-0099,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.37164,CWE-120,"The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain privileges via a crafted application, aka ""Secondary Logon Elevation of Privilege Vulnerability.""",2016-03-09,CISA/Metasploit,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2016-0100,0.0,,0.58009,CWE-20,"Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle library loading, which allows local users to gain privileges via a crafted application, aka ""Library Loading Input Validation Remote Code Execution Vulnerability.""",2016-03-09,Metasploit,cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*,Microsoft,Windows Server 2008
CVE-2016-0151,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.63195,CWE-269,"The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka ""Windows CSRSS Security Feature Bypass Vulnerability.""",2016-04-12,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2016-0162,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N,0.22088,NVD-CWE-noinfo,"Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, aka ""Internet Explorer Information Disclosure Vulnerability.""",2016-04-12,CISA,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows Server 2008
CVE-2016-0165,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.13841,NVD-CWE-noinfo,"The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka ""Win32k Elevation of Privilege Vulnerability,"" a different vulnerability than CVE-2016-0143 and CVE-2016-0167.",2016-04-12,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2016-0167,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.05729,NVD-CWE-noinfo,"The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka ""Win32k Elevation of Privilege Vulnerability,"" a different vulnerability than CVE-2016-0143 and CVE-2016-0165.",2016-04-12,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2016-0185,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.6994,NVD-CWE-noinfo,"Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted Media Center link (aka .mcl) file, aka ""Windows Media Center Remote Code Execution Vulnerability.""",2016-05-11,CISA,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2016-0189,7.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.93165,CWE-787,"The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka ""Scripting Engine Memory Corruption Vulnerability,"" a different vulnerability than CVE-2016-0187.",2016-05-11,CISA/Metasploit,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:jscript:5.8:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:vbscript:5.7:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:vbscript:5.8:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows Server 2008
CVE-2016-0491,0.0,,0.8075,NVD-CWE-noinfo,Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect integrity and availability via unknown vectors related to Load Testing for Web Apps.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that the UploadFileAction servlet allows remote authenticated users to upload and execute arbitrary files via an * (asterisk) character in the fileType parameter.,2016-01-21,Metasploit,cpe:2.3:a:oracle:application_testing_suite:12.4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:application_testing_suite:12.5.0.2:*:*:*:*:*:*:*,Oracle,Application Testing Suite
CVE-2016-0492,0.0,,0.92719,NVD-CWE-noinfo,"Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Load Testing for Web Apps, a different vulnerability than CVE-2016-0488.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the isAllowedUrl function, which allows remote attackers to bypass authentication via directory traversal sequences following a URI entry that does not require authentication, as demonstrated by olt/Login.do/../../olt/UploadFileUpload.do.",2016-01-21,Metasploit,cpe:2.3:a:oracle:application_testing_suite:12.4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:application_testing_suite:12.5.0.2:*:*:*:*:*:*:*,Oracle,Application Testing Suite
CVE-2016-0709,0.0,,0.77495,CWE-22,"Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. (dot dot) in a ZIP archive entry, as demonstrated by ""../../webapps/x.jsp.""",2016-04-11,Metasploit,cpe:2.3:a:apache:jetspeed:*:*:*:*:*:*:*:*,Apache,Jetspeed
CVE-2016-0710,0.0,,0.52351,CWE-89,Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.,2016-04-11,Metasploit,cpe:2.3:a:apache:jetspeed:*:*:*:*:*:*:*:*,Apache,Jetspeed
CVE-2016-0752,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.95537,CWE-22,"Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.",2016-02-16,CISA/EPSS/Metasploit,cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:5.0.0:beta1:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_module_for_containers:12:*:*:*:*:*:*:*,Opensuse,Leap
CVE-2016-0792,0.0,,0.83259,CWE-20,"Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.",2016-04-07,Metasploit,cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*;cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*;cpe:2.3:a:redhat:openshift:3.1:*:*:*:enterprise:*:*:*,Jenkins,Jenkins
CVE-2016-0800,0.0,,0.82112,CWE-200,"The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ""DROWN"" attack.",2016-03-01,Metasploit,cpe:2.3:a:openssl:openssl:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1:beta1:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1:beta2:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1:beta3:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1a:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1b:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1c:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1d:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1e:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1f:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1g:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1h:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1i:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1j:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1k:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1l:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1m:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1n:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1o:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1p:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1q:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1r:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:client:-:*:*:*:*:iphone_os:*:*;cpe:2.3:a:pulsesecure:steel_belted_radius:-:*:*:*:*:*:*:*,Openssl,Openssl
CVE-2016-0854,0.0,,0.77044,NVD-CWE-Other,Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to write to files of arbitrary types via unspecified vectors.,2016-01-15,Metasploit,cpe:2.3:a:advantech:webaccess:*:*:*:*:*:*:*:*,Advantech,Webaccess
CVE-2016-0957,0.0,,0.5071,NVD-CWE-noinfo,"Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, which allows remote attackers to bypass dispatcher rules via unspecified vectors.",2016-02-10,Nuclei,cpe:2.3:a:adobe:dispatcher:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:experience_manager:5.6.1:*:*:*:*:*:*:*;cpe:2.3:a:adobe:experience_manager:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:adobe:experience_manager:6.1.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2016-0984,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.55375,CWE-416,"Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, and CVE-2016-0983.",2016-02-10,CISA,cpe:2.3:a:adobe:air_desktop_runtime:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:air_sdk_\&_compiler:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:esr:*:*:*;cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:google:android:-:*:*:*:*:*:*:*;cpe:2.3:o:google:chrome_os:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2016-1000126,0.0,,0.03223,CWE-79,Reflected XSS in wordpress plugin admin-font-editor v1.8,2016-10-10,Nuclei,cpe:2.3:a:admin-font-editor_project:admin-font-editor:*:*:*:*:*:wordpress:*:*,Admin-Font-Editor Project,Admin-Font-Editor
CVE-2016-1000127,0.0,,0.03223,CWE-79,Reflected XSS in wordpress plugin ajax-random-post v2.00,2016-10-10,Nuclei,cpe:2.3:a:ajax-random-post_project:ajax-random-post:*:*:*:*:*:wordpress:*:*,Ajax-Random-Post Project,Ajax-Random-Post
CVE-2016-1000128,0.0,,0.04195,CWE-79,Reflected XSS in wordpress plugin anti-plagiarism v3.60,2016-10-10,Nuclei,cpe:2.3:a:anti-plagiarism_project:anti-plagiarism:*:*:*:*:*:wordpress:*:*,Anti-Plagiarism Project,Anti-Plagiarism
CVE-2016-1000129,0.0,,0.03236,CWE-79,Reflected XSS in wordpress plugin defa-online-image-protector v3.3,2016-10-10,Nuclei,cpe:2.3:a:defa-online-image-protector_project:defa-online-image-protector:*:*:*:*:*:wordpress:*:*,Defa-Online-Image-Protector Project,Defa-Online-Image-Protector
CVE-2016-1000130,0.0,,0.02897,CWE-79,Reflected XSS in wordpress plugin e-search v1.0,2016-10-10,Nuclei,cpe:2.3:a:e-search_project:e-search:1.0:*:*:*:*:wordpress:*:*,E-Search Project,E-Search
CVE-2016-1000131,0.0,,0.0465,CWE-79,Reflected XSS in wordpress plugin e-search v1.0,2016-10-10,Nuclei,cpe:2.3:a:e-search_project:esearch:1.0:*:*:*:*:wordpress:*:*,E-Search Project,Esearch
CVE-2016-1000132,0.0,,0.04426,CWE-79,Reflected XSS in wordpress plugin enhanced-tooltipglossary v3.2.8,2016-10-10,Nuclei,cpe:2.3:a:cminds:tooltip_glossary:*:*:*:*:*:wordpress:*:*,Cminds,Tooltip Glossary
CVE-2016-1000133,0.0,,0.03415,CWE-79,Reflected XSS in wordpress plugin forget-about-shortcode-buttons v1.1.1,2016-10-10,Nuclei,cpe:2.3:a:designsandcode:forget_about_shortcode_buttons:*:*:*:*:*:wordpress:*:*,Designsandcode,Forget About Shortcode Buttons
CVE-2016-1000134,0.0,,0.0465,CWE-79,Reflected XSS in wordpress plugin hdw-tube v1.2,2016-10-10,Nuclei,cpe:2.3:a:hdw-tube_project:hdw-tube:*:*:*:*:*:wordpress:*:*,Hdw-Tube Project,Hdw-Tube
CVE-2016-1000135,0.0,,0.0465,CWE-79,Reflected XSS in wordpress plugin hdw-tube v1.2,2016-10-10,Nuclei,cpe:2.3:a:hdw-tube_project:hdw-tube:*:*:*:*:*:wordpress:*:*,Hdw-Tube Project,Hdw-Tube
CVE-2016-1000136,0.0,,0.03415,CWE-79,Reflected XSS in wordpress plugin heat-trackr v1.0,2016-10-10,Nuclei,cpe:2.3:a:heat-trackr_project:heat-trackr:1.0:*:*:*:*:wordpress:*:*,Heat-Trackr Project,Heat-Trackr
CVE-2016-1000137,0.0,,0.04448,CWE-79,Reflected XSS in wordpress plugin hero-maps-pro v2.1.0,2016-10-10,Nuclei,cpe:2.3:a:hero-maps-pro_project:hero-maps-pro:*:*:*:*:*:wordpress:*:*,Hero-Maps-Pro Project,Hero-Maps-Pro
CVE-2016-1000138,0.0,,0.03432,CWE-79,Reflected XSS in wordpress plugin indexisto v1.0.5,2016-10-10,Nuclei,cpe:2.3:a:indexisto_project:indexisto:*:*:*:*:*:wordpress:*:*,Indexisto Project,Indexisto
CVE-2016-1000139,0.0,,0.04195,CWE-79,Reflected XSS in wordpress plugin infusionsoft v1.5.11,2016-10-10,Nuclei,cpe:2.3:a:infusionsoft_project:infusionsoft:*:*:*:*:*:wordpress:*:*,Infusionsoft Project,Infusionsoft
CVE-2016-1000140,0.0,,0.03432,CWE-79,Reflected XSS in wordpress plugin new-year-firework v1.1.9,2016-10-10,Nuclei,cpe:2.3:a:new-year-firework_project:new-year-firework:*:*:*:*:*:wordpress:*:*,New-Year-Firework Project,New-Year-Firework
CVE-2016-1000141,0.0,,0.03462,CWE-79,Reflected XSS in wordpress plugin page-layout-builder v1.9.3,2016-10-10,Nuclei,cpe:2.3:a:page-layout-builder_project:page-layout-builder:*:*:*:*:*:wordpress:*:*,Page-Layout-Builder Project,Page-Layout-Builder
CVE-2016-1000142,0.0,,0.04448,CWE-79,Reflected XSS in wordpress plugin parsi-font v4.2.5,2016-10-10,Nuclei,cpe:2.3:a:parsi-font_project:parsi-font:4.2.5:*:*:*:*:wordpress:*:*,Parsi-Font Project,Parsi-Font
CVE-2016-1000143,0.0,,0.03558,CWE-79,Reflected XSS in wordpress plugin photoxhibit v2.1.8,2016-10-10,Nuclei,cpe:2.3:a:photoxhibit_project:photoxhibit:*:*:*:*:*:wordpress:*:*,Photoxhibit Project,Photoxhibit
CVE-2016-1000146,0.0,,0.03462,CWE-79,Reflected XSS in wordpress plugin pondol-formmail v1.1,2016-10-10,Nuclei,cpe:2.3:a:pondol-formmail_project:pondol-formmail:*:*:*:*:*:wordpress:*:*,Pondol-Formmail Project,Pondol-Formmail
CVE-2016-1000148,0.0,,0.03209,CWE-79,Reflected XSS in wordpress plugin s3-video v0.983,2016-10-10,Nuclei,cpe:2.3:a:s3-video_project:s3-video:*:*:*:*:*:wordpress:*:*,S3-Video Project,S3-Video
CVE-2016-1000149,0.0,,0.03977,CWE-79,Reflected XSS in wordpress plugin simpel-reserveren v3.5.2,2016-10-10,Nuclei,cpe:2.3:a:simpel-reserveren_project:simpel-reserveren:*:*:*:*:*:wordpress:*:*,Simpel-Reserveren Project,Simpel-Reserveren
CVE-2016-1000152,0.0,,0.04173,CWE-79,Reflected XSS in wordpress plugin tidio-form v1.0,2016-10-10,Nuclei,cpe:2.3:a:tidio-form_project:tidio-form:1.0:*:*:*:*:wordpress:*:*,Tidio-Form Project,Tidio-Form
CVE-2016-1000153,0.0,,0.04486,CWE-79,Reflected XSS in wordpress plugin tidio-gallery v1.1,2016-10-10,Nuclei,cpe:2.3:a:tidio-gallery_project:tidio-gallery:*:*:*:*:*:wordpress:*:*,Tidio-Gallery Project,Tidio-Gallery
CVE-2016-1000154,0.0,,0.03432,CWE-79,Reflected XSS in wordpress plugin whizz v1.0.7,2016-10-10,Nuclei,cpe:2.3:a:browserweb:whizz:*:*:*:*:*:wordpress:*:*,Browserweb,Whizz
CVE-2016-1000155,0.0,,0.04486,CWE-79,Reflected XSS in wordpress plugin wpsolr-search-engine v7.6,2016-10-10,Nuclei,cpe:2.3:a:wpsolr:wpsolr-search-engine:7.6:*:*:*:*:wordpress:*:*,Wpsolr,Wpsolr-Search-Engine
CVE-2016-1000282,0.0,,0.13377,CWE-77,Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.,2019-02-05,Metasploit,cpe:2.3:a:haraka_project:haraka:*:*:*:*:*:*:*:*,Haraka Project,Haraka
CVE-2016-10033,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99714,CWE-88,"The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \"" (backslash double quote) in a crafted Sender property.",2016-12-30,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:phpmailer_project:phpmailer:*:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*,Phpmailer Project,Phpmailer
CVE-2016-10045,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98038,CWE-77,The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.,2016-12-30,EPSS/Metasploit,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*;cpe:2.3:a:phpmailer_project:phpmailer:*:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*,Phpmailer Project,Phpmailer
CVE-2016-10073,0.0,,0.83614,CWE-200,"The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potentially obtain sensitive information via a crafted HTTP Host header, as demonstrated by a password reset request.",2017-05-23,Metasploit,cpe:2.3:a:vanillaforums:vanilla:*:*:*:*:*:*:*:*,Vanillaforums,Vanilla
CVE-2016-1010,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.19785,CWE-190,"Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-0993.",2016-03-12,CISA,cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:air_desktop_runtime:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:air_sdk_\&_compiler:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:*;cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:google:android:-:*:*:*:*:*:*:*;cpe:2.3:o:google:chrome_os:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:samsung:x14j_firmware:t-ms14jakucb-1102.5:*:*:*:*:*:*:*,Samsung,X14J Firmware
CVE-2016-10108,0.0,,0.95174,CWE-77,Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/google_analytics.php URL via a modified arg parameter in the POST data.,2017-01-03,EPSS/Metasploit/Nuclei,cpe:2.3:a:western_digital:mycloud_nas:2.11.142:*:*:*:*:*:*:*,Western Digital,Mycloud Nas
CVE-2016-10134,0.0,,0.83284,CWE-89,SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.,2017-02-17,Metasploit/Nuclei,cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:3.0.3:*:*:*:*:*:*:*,Zabbix,Zabbix
CVE-2016-10174,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.8345,CWE-120,The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.,2017-01-30,CISA/Metasploit,cpe:2.3:h:netgear:d6100:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:d7000:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:d7800:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:jnr1010v2:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:jnr3300:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:jwnr2010v5:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r2000:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6100:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6220:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r7500:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r7500v2:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wndr3700v4:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wndr3800:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wndr4300:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wndr4300v2:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wndr4500v3:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wndr4700:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wnr1000v2:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wnr1000v4:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wnr2000v3:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wnr2000v4:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wnr2000v5:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wnr2020:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wnr2050:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wnr2200:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wnr2500:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wnr614:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wnr618:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:d6100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:d7000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:d7800_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:jnr1010v2_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:jnr3300_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:jwnr2010v5_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r2000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6220_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r7500_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r7500v2_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wndr3700v4_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wndr3800_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wndr4300_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wndr4300v2_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wndr4500v3_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wndr4700_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wnr1000v2_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wnr1000v4_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wnr2000v3_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wnr2000v4_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wnr2000v5_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wnr2020_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wnr2050_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wnr2200_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wnr2500_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wnr614_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wnr618_firmware:-:*:*:*:*:*:*:*,Netgear,D6100 Firmware
CVE-2016-10175,0.0,,0.64983,CWE-200,"The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success.html URI. This serial number allows a user to obtain the administrator username and password, when used in combination with the CVE-2016-10176 vulnerability that allows resetting the answers to the password-recovery questions.",2017-01-30,Metasploit,cpe:2.3:h:netgear:wnr2000v5:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wnr2000v5_firmware:*:*:*:*:*:*:*:*,Netgear,Wnr2000V5 Firmware
CVE-2016-10176,0.0,,0.77577,CWE-20,"The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. This special URL is handled by the embedded web server (uhttpd) and processed accordingly. The web server also contains another URL, apply_noauth.cgi, that allows an unauthenticated user to perform sensitive actions on the device. This functionality can be exploited to change the router settings (such as the answers to the password-recovery questions) and achieve remote code execution.",2017-01-30,Metasploit,cpe:2.3:h:netgear:wnr2000v5:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wnr2000v5_firmware:*:*:*:*:*:*:*:*,Netgear,Wnr2000V5 Firmware
CVE-2016-1019,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.22487,NVD-CWE-noinfo,"Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.",2016-04-07,CISA,cpe:2.3:a:adobe:air_desktop_runtime:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:air_sdk_\&_compiler:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:esr:*:*:*;cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:google:android:-:*:*:*:*:*:*:*;cpe:2.3:o:google:chrome_os:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2016-10225,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03953,CWE-264,"The sunxi-debug driver in Allwinner 3.4 legacy kernel for H3, A83T and H8 devices allows local users to gain root privileges by sending ""rootmydevice"" to /proc/sunxi_debug/sunxi_debug.",2017-03-27,Metasploit,cpe:2.3:h:allwinner:a83t:-:*:*:*:*:*:*:*;cpe:2.3:h:allwinner:h3:-:*:*:*:*:*:*:*;cpe:2.3:h:allwinner:h8:-:*:*:*:*:*:*:*;cpe:2.3:o:allwinner:linux-3.4-sunxi:-:*:*:*:*:*:*:*,Allwinner,Linux-3.4-Sunxi
CVE-2016-10367,0.0,,0.16109,CWE-22,"In Opsview Monitor Pro (Prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch), an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request utilizing a simple URL encoding bypass, %252f instead of /.",2017-05-03,Nuclei,cpe:2.3:a:opsview:opsview:4.5.0:*:*:*:pro:*:*:*;cpe:2.3:a:opsview:opsview:4.6.4:*:*:*:pro:*:*:*;cpe:2.3:a:opsview:opsview:5.0.2:*:*:*:pro:*:*:*;cpe:2.3:a:opsview:opsview:5.1.0:*:*:*:pro:*:*:*,Opsview,Opsview
CVE-2016-10368,0.0,,0.02178,CWE-601,"Open redirect vulnerability in Opsview Monitor Pro (Prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the back parameter to the /login URI.",2017-05-03,Nuclei,cpe:2.3:a:opsview:opsview:4.5.0:*:*:*:pro:*:*:*;cpe:2.3:a:opsview:opsview:4.6.4:*:*:*:pro:*:*:*;cpe:2.3:a:opsview:opsview:5.0.2:*:*:*:pro:*:*:*;cpe:2.3:a:opsview:opsview:5.1.0:*:*:*:pro:*:*:*,Opsview,Opsview
CVE-2016-10372,0.0,,0.81899,CWE-264,"The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP port 7547, as demonstrated by opening WAN access to TCP port 80, retrieving the login password (which defaults to the Wi-Fi password), and using the NewNTPServer feature.",2017-05-16,Metasploit,cpe:2.3:h:eir:d1000_modem:-:*:*:*:*:*:*:*;cpe:2.3:o:eir:d1000_modem_firmware:-:*:*:*:*:*:*:*,Eir,D1000 Modem Firmware
CVE-2016-10542,0.0,,0.07539,CWE-400,"ws is a ""simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455"". By sending an overly long websocket payload to a `ws` server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.",2018-05-31,Metasploit,cpe:2.3:a:ws_project:ws:*:*:*:*:*:node.js:*:*,Ws Project,Ws
CVE-2016-10709,0.0,,0.33708,CWE-78,"pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, related to _rrd_graph_img.php.",2018-01-22,Metasploit,cpe:2.3:a:pfsense:pfsense:*:*:*:*:community:*:*:*,Pfsense,Pfsense
CVE-2016-10924,0.0,,0.11662,CWE-22,The ebook-download plugin before 1.2 for WordPress has directory traversal.,2019-08-22,Nuclei,cpe:2.3:a:zedna_ebook_download_project:zedna_ebook_download:*:*:*:*:*:wordpress:*:*,Zedna Ebook Download Project,Zedna Ebook Download
CVE-2016-10940,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.05596,CWE-89,The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter.,2019-09-13,Nuclei,cpe:2.3:a:zm-gallery_project:zm-gallery:1.0:*:*:*:*:wordpress:*:*,Zm-Gallery Project,Zm-Gallery
CVE-2016-10956,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.10178,CWE-20,The mail-masta plugin 1.0 for WordPress has local file inclusion in count_of_send.php and csvexport.php.,2019-09-16,Nuclei,cpe:2.3:a:mail-masta_project:mail-masta:1.0:*:*:*:*:wordpress:*:*,Mail-Masta Project,Mail-Masta
CVE-2016-10960,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.08976,CWE-20,The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter.,2019-09-16,Nuclei,cpe:2.3:a:joomlaserviceprovider:wsecure:*:*:*:*:lite:wordpress:*:*,Joomlaserviceprovider,Wsecure
CVE-2016-10972,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09268,CWE-269,The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel.,2019-09-16,Nuclei,cpe:2.3:a:tagdiv:newspaper:*:*:*:*:*:wordpress:*:*,Tagdiv,Newspaper
CVE-2016-10973,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01703,CWE-79,The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php.,2019-09-16,Nuclei,cpe:2.3:a:brafton:brafton:*:*:*:*:*:wordpress:*:*,Brafton,Brafton
CVE-2016-10976,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01506,CWE-79,"The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.",2019-09-17,Nuclei,cpe:2.3:a:kodebyraaet:safe_editor:*:*:*:*:*:wordpress:*:*,Kodebyraaet,Safe Editor
CVE-2016-10993,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.02796,CWE-79,The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter.,2019-09-17,Nuclei,cpe:2.3:a:scoreme_project:scoreme:*:*:*:*:*:wordpress:*:*,Scoreme Project,Scoreme
CVE-2016-11021,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.68525,CWE-78,setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.,2020-03-09,CISA/Metasploit,cpe:2.3:h:dlink:dcs-930l:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dcs-930l_firmware:*:*:*:*:*:*:*:*,D-Link,Dcs-930L Firmware
CVE-2016-1209,0.0,,0.61612,CWE-20,The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request.,2016-05-14,Metasploit,cpe:2.3:a:ninjaforms:ninja_forms:*:*:*:*:*:wordpress:*:*,Ninjaforms,Ninja Forms
CVE-2016-1240,0.0,,0.09783,CWE-20,"The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out.",2016-10-03,Metasploit,cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:7.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:8.0:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2016-15041,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.01261,CWE-79,"The MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mwp_setup_purchase_username’ parameter in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",2024-10-16,Nuclei,cpe:2.3:a:mainwp:mainwp_dashboard:*:*:*:*:*:wordpress:*:*,Mainwp,Mainwp Dashboard
CVE-2016-15042,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05672,CWE-434,"The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the `nm_filemanager_upload_file` and `nm_postfront_upload_file` AJAX actions. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.",2024-10-16,Nuclei,cpe:2.3:a:najeebmedia:frontend_file_manager:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:najeebmedia:post_front-end_form:*:*:*:*:*:wordpress:*:*,Najeebmedia,Frontend File Manager
CVE-2016-15043,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.10032,CWE-434,"The WP Mobile Detector plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in resize.php file in versions up to, and including, 3.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.",2025-07-19,Metasploit/Nuclei,cpe:2.3:a:wp_mobile_detector_project:wp_mobile_detector:*:*:*:*:*:wordpress:*:*,Wp Mobile Detector Project,Wp Mobile Detector
CVE-2016-15044,0.0,,0.01411,CWE-94,A remote code execution vulnerability exists in Kaltura versions prior to 11.1.0-2 due to unsafe deserialization of user-controlled data within the keditorservices module. An unauthenticated remote attacker can exploit this issue by sending a specially crafted serialized PHP object in the kdata GET parameter to the redirectWidgetCmd endpoint. Successful exploitation leads to execution of arbitrary PHP code in the context of the web server process.,2025-07-23,Metasploit,,,
CVE-2016-15045,0.0,,0.00358,CWE-269,"A local privilege escalation vulnerability exists in lastore-daemon, the system package manager daemon used in Deepin Linux (developed by Wuhan Deepin Technology Co., Ltd.). In versions 0.9.53-1 (Deepin 15.5) and 0.9.66-1 (Deepin 15.7), the D-Bus configuration permits any user in the sudo group to invoke the InstallPackage method without password authentication. By default, the first user created on Deepin is in the sudo group. An attacker with shell access can craft a .deb package containing a malicious post-install script and use dbus-send to install it via lastore-daemon, resulting in arbitrary code execution as root.",2025-07-23,Metasploit,,,
CVE-2016-15057,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.03732,CWE-77,"** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum.

This issue affects Apache Continuum: all versions.

Attackers with access to the installations REST API can use this to invoke arbitrary commands on the server.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.",2026-01-26,Metasploit,cpe:2.3:a:apache:continuum:*:*:*:*:*:*:*:*,Apache,Continuum
CVE-2016-1524,0.0,,0.94104,NVD-CWE-Other,"Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote attackers to execute arbitrary Java code by using (1) fileUpload.do or (2) lib-1.0/external/flash/fileUpload.do to upload a JSP file, and then accessing it via a direct request for a /null URI.",2016-02-13,Metasploit,cpe:2.3:a:netgear:prosafe_network_management_software_300:*:*:*:*:*:*:*:*,Netgear,Prosafe Network Management Software 300
CVE-2016-1525,0.0,,0.75013,CWE-22,Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allows remote authenticated users to read arbitrary files via a .. (dot dot) in the realName parameter.,2016-02-13,Metasploit,cpe:2.3:a:netgear:prosafe_network_management_software_300:1.5.0.11:*:*:*:*:*:*:*,Netgear,Prosafe Network Management Software 300
CVE-2016-1531,0.0,,0.05901,CWE-264,"Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.",2016-04-07,Metasploit,cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*,Exim,Exim
CVE-2016-1542,0.0,,0.74618,CWE-20,"The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and enumerate users by sending an action packet to xmlrpc after an authorization failure.",2016-06-13,Metasploit,cpe:2.3:a:bmc:bladelogic_server_automation_console:8.2.02:*:*:*:*:*:*:*;cpe:2.3:a:bmc:bladelogic_server_automation_console:8.2.03:*:*:*:*:*:*:*;cpe:2.3:a:bmc:bladelogic_server_automation_console:8.2.04:*:*:*:*:*:*:*;cpe:2.3:a:bmc:bladelogic_server_automation_console:8.3.00:*:*:*:*:*:*:*;cpe:2.3:a:bmc:bladelogic_server_automation_console:8.3.01:*:*:*:*:*:*:*;cpe:2.3:a:bmc:bladelogic_server_automation_console:8.3.02:*:*:*:*:*:*:*;cpe:2.3:a:bmc:bladelogic_server_automation_console:8.3.03:*:*:*:*:*:*:*;cpe:2.3:a:bmc:bladelogic_server_automation_console:8.5.00:*:*:*:*:*:*:*;cpe:2.3:a:bmc:bladelogic_server_automation_console:8.5.01:*:*:*:*:*:*:*;cpe:2.3:a:bmc:bladelogic_server_automation_console:8.6.00:*:*:*:*:*:*:*;cpe:2.3:a:bmc:bladelogic_server_automation_console:8.7.00:*:*:*:*:*:*:*,Bmc,Bladelogic Server Automation Console
CVE-2016-1543,0.0,,0.71854,CWE-284,"The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and reset arbitrary user passwords by sending an action packet to xmlrpc after an authorization failure.",2016-06-13,Metasploit,cpe:2.3:a:bmc:bladelogic_server_automation_console:8.2.02:*:*:*:*:*:*:*;cpe:2.3:a:bmc:bladelogic_server_automation_console:8.2.03:*:*:*:*:*:*:*;cpe:2.3:a:bmc:bladelogic_server_automation_console:8.2.04:*:*:*:*:*:*:*;cpe:2.3:a:bmc:bladelogic_server_automation_console:8.3.00:*:*:*:*:*:*:*;cpe:2.3:a:bmc:bladelogic_server_automation_console:8.3.01:*:*:*:*:*:*:*;cpe:2.3:a:bmc:bladelogic_server_automation_console:8.3.02:*:*:*:*:*:*:*;cpe:2.3:a:bmc:bladelogic_server_automation_console:8.3.03:*:*:*:*:*:*:*;cpe:2.3:a:bmc:bladelogic_server_automation_console:8.5.00:*:*:*:*:*:*:*;cpe:2.3:a:bmc:bladelogic_server_automation_console:8.5.01:*:*:*:*:*:*:*;cpe:2.3:a:bmc:bladelogic_server_automation_console:8.6.00:*:*:*:*:*:*:*;cpe:2.3:a:bmc:bladelogic_server_automation_console:8.7.00:*:*:*:*:*:*:*,Bmc,Bladelogic Server Automation Console
CVE-2016-1555,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98325,CWE-77,"(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.",2017-04-21,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:h:netgear:wn604:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wn802tv2:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wnap320:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wndap210v2:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wndap350:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wndap360:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wndap660:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wn604_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wn802tv2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wnap320_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wndap210v2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wndap350_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wndap360_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wndap660_firmware:*:*:*:*:*:*:*:*,Netgear,Wnap320 Firmware
CVE-2016-1560,0.0,,0.72289,CWE-798,"ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the support account in the web interface, which allows remote attackers to obtain administrative access via an SSH or HTTP session.",2017-04-21,Metasploit,cpe:2.3:h:exagrid:ex10000e:-:*:*:*:*:*:*:*;cpe:2.3:h:exagrid:ex13000e:-:*:*:*:*:*:*:*;cpe:2.3:h:exagrid:ex21000e:-:*:*:*:*:*:*:*;cpe:2.3:h:exagrid:ex3000:-:*:*:*:*:*:*:*;cpe:2.3:h:exagrid:ex32000e:-:*:*:*:*:*:*:*;cpe:2.3:h:exagrid:ex40000e:-:*:*:*:*:*:*:*;cpe:2.3:h:exagrid:ex5000:-:*:*:*:*:*:*:*;cpe:2.3:h:exagrid:ex7000:-:*:*:*:*:*:*:*;cpe:2.3:o:exagrid:ex10000e_firmware:4.8:*:*:*:*:*:*:*;cpe:2.3:o:exagrid:ex13000e_firmware:4.8:*:*:*:*:*:*:*;cpe:2.3:o:exagrid:ex21000e_firmware:4.8:*:*:*:*:*:*:*;cpe:2.3:o:exagrid:ex3000_firmware:4.8:*:*:*:*:*:*:*;cpe:2.3:o:exagrid:ex32000e_firmware:4.8:*:*:*:*:*:*:*;cpe:2.3:o:exagrid:ex40000e_firmware:4.8:*:*:*:*:*:*:*;cpe:2.3:o:exagrid:ex5000_firmware:4.8:*:*:*:*:*:*:*;cpe:2.3:o:exagrid:ex7000_firmware:4.8:*:*:*:*:*:*:*,Exagrid,Ex3000 Firmware
CVE-2016-1561,0.0,,0.74261,CWE-200,"ExaGrid appliances with firmware before 4.8 P26 have a default SSH public key in the authorized_keys file for root, which allows remote attackers to obtain SSH access by leveraging knowledge of a private key from another installation or a firmware image.",2017-04-21,Metasploit,cpe:2.3:h:exagrid:ex10000e:-:*:*:*:*:*:*:*;cpe:2.3:h:exagrid:ex13000e:-:*:*:*:*:*:*:*;cpe:2.3:h:exagrid:ex21000e:-:*:*:*:*:*:*:*;cpe:2.3:h:exagrid:ex3000:-:*:*:*:*:*:*:*;cpe:2.3:h:exagrid:ex32000e:-:*:*:*:*:*:*:*;cpe:2.3:h:exagrid:ex40000e:-:*:*:*:*:*:*:*;cpe:2.3:h:exagrid:ex5000:-:*:*:*:*:*:*:*;cpe:2.3:h:exagrid:ex7000:-:*:*:*:*:*:*:*;cpe:2.3:o:exagrid:ex10000e_firmware:4.8:*:*:*:*:*:*:*;cpe:2.3:o:exagrid:ex13000e_firmware:4.8:*:*:*:*:*:*:*;cpe:2.3:o:exagrid:ex21000e_firmware:4.8:*:*:*:*:*:*:*;cpe:2.3:o:exagrid:ex3000_firmware:4.8:*:*:*:*:*:*:*;cpe:2.3:o:exagrid:ex32000e_firmware:4.8:*:*:*:*:*:*:*;cpe:2.3:o:exagrid:ex40000e_firmware:4.8:*:*:*:*:*:*:*;cpe:2.3:o:exagrid:ex5000_firmware:4.8:*:*:*:*:*:*:*;cpe:2.3:o:exagrid:ex7000_firmware:4.8:*:*:*:*:*:*:*,Exagrid,Ex3000 Firmware
CVE-2016-1593,0.0,,0.64142,CWE-22,Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated administrators to upload and execute arbitrary JSP files via a .. (dot dot) in a filename within a multipart/form-data POST request to a LiveTime.woa URL.,2016-04-22,Metasploit,cpe:2.3:a:novell:service_desk:*:*:*:*:*:*:*:*,Novell,Service Desk
CVE-2016-1646,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.4811,CWE-125,"The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.",2016-03-29,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:a:suse:package_hub:-:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2016-1713,0.0,,0.16561,CWE-434,"Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.4.0 allows remote authenticated users to execute arbitrary code by uploading a crafted image file with an executable extension, then accessing it via a direct request to the file in test/logo/.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6000.",2017-04-14,Metasploit,cpe:2.3:a:vtiger:vtiger_crm:6.4.0:*:*:*:*:*:*:*,Vtiger,Vtiger Crm
CVE-2016-1909,0.0,,0.71268,CWE-264,"Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4.2.x before 4.2.16, 4.3.x before 4.3.17 and 5.0.x before 5.0.8 have a hardcoded passphrase for the Fortimanager_Access account, which allows remote attackers to obtain administrative access via an SSH session.",2016-01-15,Metasploit,cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.0.0:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.0.1:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.0.2:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.0.3:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.0.4:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.0.5:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.0.6:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.0.7:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.0:*:*:*:*:*:*:*,Fortinet,Fortios
CVE-2016-20016,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.86289,NVD-CWE-noinfo,"MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI. A remote unauthenticated attacker can execute arbitrary operating system commands as root. This vulnerability has also been referred to as the ""JAWS webserver RCE"" because of the easily identifying HTTP response server field. Other firmware versions, at least from 2014 through 2019, can be affected. This was exploited in the wild in 2017 through 2022.",2022-10-19,Metasploit,cpe:2.3:h:mvpower:tv-7104he:-:*:*:*:*:*:*:*;cpe:2.3:h:mvpower:tv7108he:-:*:*:*:*:*:*:*;cpe:2.3:o:mvpower:tv-7104he_firmware:1.8.4_115215b9:*:*:*:*:*:*:*;cpe:2.3:o:mvpower:tv7108he_firmware:-:*:*:*:*:*:*:*,Mvpower,Tv-7104He Firmware
CVE-2016-20017,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.6043,CWE-77,"D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.",2022-10-19,CISA/Metasploit,cpe:2.3:h:dlink:dsl-2750b:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dsl-2750b_firmware:*:*:*:*:*:*:*:*,D-Link,Dsl-2750B Firmware
CVE-2016-2004,0.0,,0.94297,CWE-306,"HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2623.",2016-04-21,Metasploit/Nuclei,cpe:2.3:a:hp:data_protector:*:*:*:*:*:*:*:*,Hp,Data Protector
CVE-2016-2055,0.0,,0.17852,CWE-200,"xymond/xymond.c in xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote attackers to read arbitrary files in the configuration directory via a ""config"" command.",2016-04-13,Metasploit,cpe:2.3:a:xymon:xymon:4.1.0:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.1.1:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.1.2:p1:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.1.2:p2:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.2.0:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.2.2:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.2.2:rc1:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.2.3:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.2.3:rc1:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.2:alfa:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.2:beta20060605:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.2:rc20060712:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.0:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.0:beta1:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.0:beta2:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.0:beta3:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.0:rc1:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.10:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.11:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.12:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.13:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.14:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.15:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.16:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.17:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.18:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.19:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.19:rc1:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.1:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.20:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.21:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.22:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.23:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.24:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.2:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.3:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.4:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.5:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.6:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.7:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.8:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.9:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2016-2056,0.0,,0.54507,CWE-77,"xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the adduser_name argument in (1) web/useradm.c or (2) web/chpasswd.c.",2016-04-13,Metasploit,cpe:2.3:a:xymon:xymon:4.1.0:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.1.1:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.1.2:p1:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.1.2:p2:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.2.0:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.2.2:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.2.2:rc1:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.2.3:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.2.3:rc1:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.2:alfa:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.2:beta20060605:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.2:rc20060712:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.0:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.0:beta1:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.0:beta2:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.0:beta3:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.0:rc1:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.10:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.11:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.12:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.13:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.14:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.15:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.16:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.17:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.18:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.19:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.19:rc1:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.1:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.20:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.21:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.22:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.23:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.24:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.2:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.3:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.4:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.5:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.6:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.7:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.8:*:*:*:*:*:*:*;cpe:2.3:a:xymon:xymon:4.3.9:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2016-2098,0.0,,0.81445,CWE-20,"Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.",2016-04-07,Metasploit,cpe:2.3:a:rubyonrails:rails:4.0.0:-:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.0:beta:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.0:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.0:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.10:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.1:-:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.1:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.1:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.1:rc3:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.1:rc4:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.3:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.4:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.4:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.5:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.6:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.6:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.6:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.6:rc3:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.7:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.8:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.0.9:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.0:-:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.0:beta1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.0:beta2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.0:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.0:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.10:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.10:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.10:rc3:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.10:rc4:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.12:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.13:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.14:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.14:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.1:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.2:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.2:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.2:rc3:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.3:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.4:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.5:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.6:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.6:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.7.1:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.7:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.8:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.1.9:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.2.0:beta1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.2.0:beta2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.2.0:beta3:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.2.0:beta4:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.2.0:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.2.0:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.2.0:rc3:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.2.1:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.2.1:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.2.1:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.2.1:rc3:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.2.1:rc4:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.2.2:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.2.3:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.2.3:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.2.4:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.2.4:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.2.5:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.2.5:rc1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:4.2.5:rc2:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:ruby_on_rails:4.1.14.1:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2016-2183,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.95707,CWE-200,"The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a ""Sweet32"" attack.",2016-09-01,EPSS,cpe:2.3:a:cisco:content_security_management_appliance:9.6.6-068:*:*:*:*:*:*:*;cpe:2.3:a:cisco:content_security_management_appliance:9.7.0-006:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*;cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1a:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1b:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1c:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1d:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1e:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1f:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1g:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1h:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1i:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1j:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1k:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1l:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1m:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1n:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1o:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1p:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1q:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1r:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.1t:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:1.0.2h:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database:11.2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database:12.1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:python:python:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_web_server:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_web_server:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_web_server:3.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*,Redhat,Enterprise Linux
CVE-2016-2203,0.0,,0.0706,CWE-255,The management console on Symantec Messaging Gateway (SMG) Appliance devices before 10.6.1 allows local users to discover an encrypted AD password by leveraging certain read privileges.,2016-04-22,Metasploit,cpe:2.3:a:symantec:messaging_gateway:10.6.0:patch3:*:*:*:*:*:*;cpe:2.3:a:symantec:messaging_gateway:10.6.0:patch5:*:*:*:*:*:*;cpe:2.3:a:symantec:messaging_gateway:10.6.0:patch7:*:*:*:*:*:*,Symantec,Messaging Gateway
CVE-2016-2296,0.0,,0.6437,CWE-254,"Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for ""post-admin"" login pages, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors.",2016-05-14,Metasploit,cpe:2.3:a:meteocontrol:web\'log_basic_100:-:*:*:*:*:*:*:*;cpe:2.3:a:meteocontrol:web\'log_light:-:*:*:*:*:*:*:*;cpe:2.3:a:meteocontrol:web\'log_pro:-:*:*:*:*:*:*:*;cpe:2.3:a:meteocontrol:web\'log_pro_unlimited:-:*:*:*:*:*:*:*,Meteocontrol,Web'Log Basic 100
CVE-2016-2298,0.0,,0.24101,CWE-200,"Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allows remote attackers to obtain sensitive cleartext information via unspecified vectors.",2016-05-14,Metasploit,cpe:2.3:a:meteocontrol:web\'log_basic_100:-:*:*:*:*:*:*:*;cpe:2.3:a:meteocontrol:web\'log_light:-:*:*:*:*:*:*:*;cpe:2.3:a:meteocontrol:web\'log_pro:-:*:*:*:*:*:*:*;cpe:2.3:a:meteocontrol:web\'log_pro_unlimited:-:*:*:*:*:*:*:*,Meteocontrol,Web'Log Basic 100
CVE-2016-2386,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.7106,CWE-89,"SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.",2016-02-16,CISA,cpe:2.3:a:sap:netweaver_application_server_java:7.40:*:*:*:*:*:*:*,Sap,Netweaver Application Server Java
CVE-2016-2388,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.51553,CWE-200,"The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.",2016-02-16,CISA,cpe:2.3:a:sap:netweaver_application_server_java:*:*:*:*:*:*:*:*,Sap,Netweaver Application Server Java
CVE-2016-2389,0.0,,0.4145,CWE-22,"Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the Path parameter to /Catalog, aka SAP Security Note 2230978.",2016-02-16,Nuclei,cpe:2.3:a:sap:netweaver:7.40:*:*:*:*:*:*:*,Sap,Netweaver
CVE-2016-2555,0.0,,0.79622,CWE-89,SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriends function to friends.inc.php.,2017-04-13,Metasploit,cpe:2.3:a:atutor:atutor:2.2.1:*:*:*:*:*:*:*,Atutor,Atutor
CVE-2016-2776,0.0,,0.89482,CWE-20,"buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.",2016-09-28,Metasploit,cpe:2.3:a:isc:bind:*:p3:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.0:*:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.0:a1:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.0:a2:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.0:b1:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.0:b2:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.0:p1:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.0:p2:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.0:rc1:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.0:rc2:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.1:*:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.1:b1:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.1:b2:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.1:p1:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.1:p2:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.1:rc1:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.1:rc2:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.2:b1:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.2:p1:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.2:p2:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.2:p3:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.2:p4:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.2:rc1:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.2:rc2:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.3:*:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.3:b1:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.3:p1:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.3:p2:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.3:p3:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.3:p4:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.3:rc1:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.4:p2:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.4:p3:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.11.0:a1:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.11.0:a2:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.11.0:a3:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.11.0:b1:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.11.0:b2:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.11.0:b3:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.11.0:rc1:*:*:*:*:*:*;cpe:2.3:o:hp:hp-ux:11.31:*:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:5.0:*:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:*;cpe:2.3:o:oracle:solaris:10.0:*:*:*:*:*:*:*;cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*;cpe:2.3:o:oracle:vm_server:3.2:*:*:*:*:*:*:*;cpe:2.3:o:oracle:vm_server:3.3:*:*:*:*:*:*:*;cpe:2.3:o:oracle:vm_server:3.4:*:*:*:*:*:*:*,Oracle,Linux
CVE-2016-3081,0.0,,0.93249,CWE-77,"Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.",2016-04-26,Metasploit/Nuclei,cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:siebel_e-billing:7.1:*:*:*:*:*:*:*,Apache,Struts
CVE-2016-3087,0.0,,0.81087,CWE-20,"Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.",2016-06-07,Metasploit,cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:*,Apache,Struts
CVE-2016-3088,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98518,CWE-434,The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.,2016-06-01,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*,Apache,Activemq
CVE-2016-3213,0.0,,0.70288,CWE-264,"The Web Proxy Auto Discovery (WPAD) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold and 1511, and Internet Explorer 9 through 11 has an improper fallback mechanism, which allows remote attackers to gain privileges via NetBIOS name responses, aka ""WPAD Elevation of Privilege Vulnerability.""",2016-06-16,Metasploit,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*,Microsoft,Windows 10
CVE-2016-3225,0.0,,0.43493,CWE-264,"The SMB server component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application that forwards an authentication request to an unintended service, aka ""Windows SMB Server Elevation of Privilege Vulnerability.""",2016-06-16,Metasploit,cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*,Microsoft,Windows 10
CVE-2016-3235,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.43431,NVD-CWE-noinfo,"Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading, which allows local users to gain privileges via a crafted application, aka ""Microsoft Office OLE DLL Side Loading Vulnerability.""",2016-06-16,CISA/Metasploit,cpe:2.3:a:microsoft:visio:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:visio:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:visio:2013:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:visio:2016:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:visio_viewer:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:visio_viewer:2010:*:*:*:*:*:*:*,Microsoft,Visio
CVE-2016-3236,0.0,,0.77658,CWE-19,"The Web Proxy Auto Discovery (WPAD) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandles proxy discovery, which allows remote attackers to redirect network traffic via unspecified vectors, aka ""Windows WPAD Proxy Discovery Elevation of Privilege Vulnerability.""",2016-06-16,Metasploit,cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*,Microsoft,Windows 10
CVE-2016-3298,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.3279,NVD-CWE-noinfo,"Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to determine the existence of arbitrary files via a crafted web site, aka ""Internet Explorer Information Disclosure Vulnerability.""",2016-10-14,CISA,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows Server 2008
CVE-2016-3309,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.20625,NVD-CWE-noinfo,"The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka ""Win32k Elevation of Privilege Vulnerability,"" a different vulnerability than CVE-2016-3308, CVE-2016-3310, and CVE-2016-3311.",2016-08-09,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2016-3321,0.0,,0.35331,CWE-200,"Microsoft Internet Explorer 10 and 11 load different files for attempts to open a file:// URL depending on whether the file exists, which allows local users to enumerate files via vectors involving a file:// URL and an HTML5 sandbox iframe, aka ""Internet Explorer Information Disclosure Vulnerability.""",2016-08-09,Metasploit,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*,Microsoft,Internet Explorer
CVE-2016-3351,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.26286,NVD-CWE-noinfo,"Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka ""Microsoft Browser Information Disclosure Vulnerability.""",2016-09-14,CISA,cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows Server 2008
CVE-2016-3393,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.68684,NVD-CWE-noinfo,"Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to execute arbitrary code via a crafted web site, aka ""Windows Graphics Component RCE Vulnerability.""",2016-10-14,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2016-3427,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.92334,NVD-CWE-noinfo,"Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.",2016-04-21,CISA,cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:cassandra:4.0.0:beta1:*:*:*:*:*:*;cpe:2.3:a:netapp:e-series_santricity_management_plug-ins:-:*:*:*:*:vmware_vcenter:*:*;cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*;cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_cloud_manager:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_performance_manager:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_report:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:7-mode:*:*;cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:clustered_data_ontap:*:*;cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:storagegrid:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vmware_vsphere:*:*;cpe:2.3:a:oracle:jdk:1.6.0:update113:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.7.0:update99:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:1.8.0:update77:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.6.0:update113:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.7.0:update99:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.8.0:update77:*:*:*:*:*:*;cpe:2.3:a:oracle:jrockit:r28.3.9:*:*:*:*:*:*:*;cpe:2.3:a:redhat:satellite:5.6:*:*:*:*:*:*:*;cpe:2.3:a:redhat:satellite:5.7:*:*:*:*:*:*:*;cpe:2.3:a:suse:linux_enterprise_module_for_legacy:12:*:*:*:*:*:*:*;cpe:2.3:a:suse:manager:2.1:*:*:*:*:*:*:*;cpe:2.3:a:suse:manager_proxy:2.1:*:*:*:*:*:*:*;cpe:2.3:a:suse:openstack_cloud:5:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:6.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:sp1:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:12:sp1:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp1:*:*:*:*:*:*,Oracle,Linux
CVE-2016-3510,0.0,,0.91402,NVD-CWE-noinfo,"Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components, a different vulnerability than CVE-2016-3586.",2016-07-21,Metasploit/Nuclei,cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.0.0:*:*:*:*:*:*:*,Oracle,Weblogic Server
CVE-2016-3643,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03704,CWE-264,"SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by ""sudo cat /etc/passwd.""",2016-06-17,CISA,cpe:2.3:a:solarwinds:virtualization_manager:*:*:*:*:*:*:*:*,Solarwinds,Virtualization Manager
CVE-2016-3714,8.4,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97485,CWE-20,"The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka ""ImageTragick.""",2016-05-05,CISA/EPSS/Metasploit,cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*;cpe:2.3:a:imagemagick:imagemagick:7.0.0-0:*:*:*:*:*:*:*;cpe:2.3:a:imagemagick:imagemagick:7.0.1-0:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*;cpe:2.3:o:suse:suse_linux_enterprise_server:12:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2016-3715,5.5,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N,0.75383,NVD-CWE-noinfo,The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.,2016-05-05,CISA,cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*;cpe:2.3:a:imagemagick:imagemagick:7.0.0-0:*:*:*:*:*:*:*;cpe:2.3:a:imagemagick:imagemagick:7.0.1-0:*:*:*:*:*:*:*;cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp2:*:*:*:*:*:*;cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp3:*:*:*:*:*:*;cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*;cpe:2.3:a:suse:manager:2.1:*:*:*:*:*:*:*;cpe:2.3:a:suse:manager_proxy:2.1:*:*:*:*:*:*:*;cpe:2.3:a:suse:openstack_cloud:5:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:*;cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*;cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.0_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:6.7_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.2_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.3_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.4_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.5_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.6_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.7_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:6.7_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.2_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.3_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.4_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.5_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.6_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.7_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.2_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.3_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.4_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.5_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.6_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.7_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_supplementary_eus:6.7z:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:sp1:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:12:sp1:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp1:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:sp1:*:*:*:*:*:*,Redhat,Enterprise Linux Desktop
CVE-2016-3718,5.5,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N,0.76897,CWE-918,The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.,2016-05-05,CISA,cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*;cpe:2.3:a:imagemagick:imagemagick:7.0.0-0:*:*:*:*:*:*:*;cpe:2.3:a:imagemagick:imagemagick:7.0.1-0:*:*:*:*:*:*:*;cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp2:*:*:*:*:*:*;cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp3:*:*:*:*:*:*;cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*;cpe:2.3:a:suse:manager:2.1:*:*:*:*:*:*:*;cpe:2.3:a:suse:manager_proxy:2.1:*:*:*:*:*:*:*;cpe:2.3:a:suse:openstack_cloud:5:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:*;cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*;cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.0_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:6.7_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.2_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.3_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.4_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.5_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.6_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.7_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:6.7_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.2_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.3_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.4_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.5_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.6_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.7_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.2_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.3_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.4_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.5_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.6_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.7_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_supplementary_eus:6.7z:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:sp1:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:12:sp1:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp1:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:sp1:*:*:*:*:*:*,Redhat,Enterprise Linux Desktop
CVE-2016-3976,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.46605,CWE-22,"Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971.",2016-04-07,CISA,cpe:2.3:a:sap:netweaver_application_server_java:*:*:*:*:*:*:*:*,Sap,Netweaver Application Server Java
CVE-2016-3978,0.0,,0.06869,CWE-79,"The Web User Interface (WebUI) in FortiOS 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via the ""redirect"" parameter to ""login.""",2016-04-08,Nuclei,cpe:2.3:o:fortinet:fortios:5.0.0:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.0.10:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.0.11:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.0.12:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.0.1:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.0.2:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.0.3:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.0.4:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.0.5:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.0.6:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.0.7:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.0.8:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.0.9:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.2.0:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.2.1:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.2.2:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.4:*:*:*:*:*:*:*,Fortinet,Fortios
CVE-2016-4010,0.0,,0.92869,CWE-74,Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data.,2017-01-23,Metasploit,cpe:2.3:a:magento:magento:*:*:*:*:community:*:*:*;cpe:2.3:a:magento:magento:*:*:*:*:enterprise:*:*:*,Magento,Magento
CVE-2016-4117,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.94354,NVD-CWE-noinfo,"Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.",2016-05-11,CISA/Metasploit,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:evergreen:11.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:sp1:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:sp1:*:*:*:*:*:*,Redhat,Enterprise Linux Desktop
CVE-2016-4171,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.20211,NVD-CWE-noinfo,"Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.",2016-06-16,CISA,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:esr:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:google:chrome_os:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:sp1:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:sp1:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2016-4437,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.93039,NVD-CWE-noinfo,"Apache Shiro before 1.2.5, when a cipher key has not been configured for the ""remember me"" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.",2016-06-07,CISA/Metasploit/Nuclei,cpe:2.3:a:apache:aurora:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_middleware_text-only_advisories:1.0:*:*:*:*:middleware:*:*,Apache,Aurora
CVE-2016-4523,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.31392,CWE-125,The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via unspecified vectors.,2016-06-09,CISA,cpe:2.3:a:trihedral:vtscada:*:*:*:*:*:*:*:*,Trihedral,Vtscada
CVE-2016-4557,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.10202,NVD-CWE-Other,"The replace_map_fd_with_map_ptr function in kernel/bpf/verifier.c in the Linux kernel before 4.5.5 does not properly maintain an fd data structure, which allows local users to gain privileges or cause a denial of service (use-after-free) via crafted BPF instructions that reference an incorrect file descriptor.",2016-05-23,Metasploit,cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2016-4655,5.5,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.33353,NVD-CWE-noinfo,The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.,2016-08-25,CISA/Metasploit,cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:10.0:*:*:*:*:*:*:*,Apple,Iphone Os
CVE-2016-4656,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.23626,CWE-787,The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.,2016-08-25,CISA/Metasploit,cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*,Apple,Iphone Os
CVE-2016-4657,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.66788,CWE-787,WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.,2016-08-25,CISA/Metasploit,cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*,Apple,Iphone Os
CVE-2016-4669,0.0,,0.03731,CWE-20,"An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the ""Kernel"" component. It allows local users to execute arbitrary code in a privileged context or cause a denial of service (MIG code mishandling and system crash) via unspecified vectors.",2017-02-20,Metasploit,cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Iphone Os
CVE-2016-4975,0.0,,0.19798,CWE-93,"Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the ""Location"" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).",2018-08-14,Nuclei,cpe:2.3:a:apache:http_server:2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.16:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.17:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.18:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.19:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.20:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.21:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.22:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.23:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.24:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.25:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.26:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.27:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.29:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.31:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.2.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.16:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.17:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.18:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.20:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.23:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.9:*:*:*:*:*:*:*,Apache,Http Server
CVE-2016-4977,0.0,,0.79176,CWE-19,"When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type.",2017-05-25,Nuclei,cpe:2.3:a:pivotal:spring_security_oauth:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:pivotal:spring_security_oauth:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:pivotal:spring_security_oauth:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:pivotal:spring_security_oauth:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:pivotal:spring_security_oauth:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:pivotal:spring_security_oauth:1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:pivotal:spring_security_oauth:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:pivotal:spring_security_oauth:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:pivotal:spring_security_oauth:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:pivotal:spring_security_oauth:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:pivotal:spring_security_oauth:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:pivotal:spring_security_oauth:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:pivotal:spring_security_oauth:2.0.6:*:*:*:*:*:*:*;cpe:2.3:a:pivotal:spring_security_oauth:2.0.7:*:*:*:*:*:*:*;cpe:2.3:a:pivotal:spring_security_oauth:2.0.8:*:*:*:*:*:*:*;cpe:2.3:a:pivotal:spring_security_oauth:2.0.9:*:*:*:*:*:*:*,Pivotal,Spring Security Oauth
CVE-2016-4997,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.05676,CWE-264,The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement.,2016-07-03,Metasploit,cpe:2.3:a:novell:suse_linux_enterprise_software_development_kit:12.0:*:*:*:*:*:*:*;cpe:2.3:a:novell:suse_linux_enterprise_software_development_kit:12.0:sp1:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:novell:suse_linux_enterprise_desktop:12.0:*:*:*:*:*:*:*;cpe:2.3:o:novell:suse_linux_enterprise_desktop:12.0:sp1:*:*:*:*:*:*;cpe:2.3:o:novell:suse_linux_enterprise_live_patching:12.0:*:*:*:*:*:*:*;cpe:2.3:o:novell:suse_linux_enterprise_module_for_public_cloud:12.0:*:*:*:*:*:*:*;cpe:2.3:o:novell:suse_linux_enterprise_real_time_extension:12.0:sp1:*:*:*:*:*:*;cpe:2.3:o:novell:suse_linux_enterprise_server:12.0:*:*:*:*:*:*:*;cpe:2.3:o:novell:suse_linux_enterprise_server:12.0:sp1:*:*:*:*:*:*;cpe:2.3:o:novell:suse_linux_enterprise_workstation_extension:12.0:*:*:*:*:*:*:*;cpe:2.3:o:novell:suse_linux_enterprise_workstation_extension:12.0:sp1:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2016-4998,0.0,,0.01885,CWE-119,The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value that leads to crossing a ruleset blob boundary.,2016-07-03,Metasploit,cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2016-5195,7.0,CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.83524,CWE-362,"Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka ""Dirty COW.""",2016-11-10,CISA,cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:hci_storage_nodes:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_performance_manager:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_unified_manager_for_clustered_data_ontap:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:snapprotect:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.10:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_aus:6.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_aus:6.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_aus:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:6.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_long_life:5.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_long_life:5.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_tus:6.5:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2016-5198,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.34703,CWE-787,"V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which allowed a remote attacker to perform arbitrary read/write operations, leading to code execution, via a crafted HTML page.",2017-01-19,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:google:android:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2016-5330,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.1802,CWE-426,"Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware Tools 10.0.5 in VMware ESXi 5.0 through 6.0, VMware Workstation Pro 12.1.x before 12.1.1, VMware Workstation Player 12.1.x before 12.1.1, and VMware Fusion 8.1.x before 8.1.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory.",2016-08-08,Metasploit,cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:tools:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workstation_player:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workstation_pro:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:*:*:*:*:*:*:*:*,Vmware,Esxi
CVE-2016-5425,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03782,CWE-276,"The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.",2016-10-13,Metasploit,cpe:2.3:a:apache:tomcat:-:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*;cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*,Oracle,Linux
CVE-2016-5649,0.0,,0.27215,CWE-319,"A vulnerability is in the 'BSW_cxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.50_7.0.50, and DGND3700, version DGND3700-V1.0.0.17_1.0.17, which can allow a remote attacker to access this page without any authentication. When processed, it exposes the admin password in clear text before it gets redirected to absw_vfysucc.cgia. An attacker can use this password to gain administrator access to the targeted router's web interface.",2018-07-24,Nuclei,cpe:2.3:h:netgear:dgn2200:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:dgnd3700:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:dgn2200_firmware:1.0.0.50_7.0.50:*:*:*:*:*:*:*;cpe:2.3:o:netgear:dgnd3700_firmware:1.0.0.17_1.0.17:*:*:*:*:*:*:*,Netgear,Dgn2200 Firmware
CVE-2016-5674,0.0,,0.9461,CWE-20,"__debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter.",2016-08-31,Metasploit/Nuclei,cpe:2.3:a:netgear:readynas_surveillance:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:netgear:readynas_surveillance:1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:netgear:readynas_surveillance:1.2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:netgear:readynas_surveillance:1.3.2.14:*:*:*:*:*:*:*;cpe:2.3:a:netgear:readynas_surveillance:1.3.2.4:*:*:*:*:*:*:*;cpe:2.3:a:netgear:readynas_surveillance:1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:netgear:readynas_surveillance:1.4.1:*:*:*:*:*:*:*;cpe:2.3:a:netgear:readynas_surveillance:1.4.2:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrmini_2:1.7.5:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrmini_2:1.7.6:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrmini_2:2.0.0:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrmini_2:2.2.1:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrmini_2:3.0.0:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:1.75:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.0.0:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.0.1:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.1.5:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.2.2:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.3.1.20:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.3.7.10:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.3.7.9:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.3.9.6:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.3:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:3.0.0:*:*:*:*:*:*:*,Nuuo,Nvrmini 2
CVE-2016-5675,0.0,,0.70877,CWE-20,"handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter.",2016-08-31,Metasploit,cpe:2.3:a:netgear:readynas_surveillance:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:netgear:readynas_surveillance:1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:netgear:readynas_surveillance:1.2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:netgear:readynas_surveillance:1.3.2.14:*:*:*:*:*:*:*;cpe:2.3:a:netgear:readynas_surveillance:1.3.2.4:*:*:*:*:*:*:*;cpe:2.3:a:netgear:readynas_surveillance:1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:netgear:readynas_surveillance:1.4.1:*:*:*:*:*:*:*;cpe:2.3:a:netgear:readynas_surveillance:1.4.2:*:*:*:*:*:*:*;cpe:2.3:a:nuuo:crystal:2.2.1:*:*:*:*:*:*:*;cpe:2.3:a:nuuo:crystal:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:nuuo:crystal:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:nuuo:crystal:3.2.0:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrmini_2:1.7.5:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrmini_2:1.7.6:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrmini_2:2.0.0:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrmini_2:2.2.1:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrmini_2:3.0.0:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:1.0.0:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:1.0.1:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:1.1.0.117:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:1.1.0:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:1.1.1:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:1.1.2:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:1.2.0:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:1.3.0:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:1.75:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.0.0:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.0.1:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.1.5:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.2.2:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.3.1.20:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.3.7.10:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.3.7.9:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.3.9.6:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.3:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:3.0.0:*:*:*:*:*:*:*,Nuuo,Nvrsolo
CVE-2016-5676,0.0,,0.53715,CWE-285,"cgi-bin/cgi_system in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to reset the administrator password via a cmd=loaddefconfig action.",2016-08-31,Metasploit,cpe:2.3:a:netgear:readynas_surveillance:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:netgear:readynas_surveillance:1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:netgear:readynas_surveillance:1.2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:netgear:readynas_surveillance:1.3.2.14:*:*:*:*:*:*:*;cpe:2.3:a:netgear:readynas_surveillance:1.3.2.4:*:*:*:*:*:*:*;cpe:2.3:a:netgear:readynas_surveillance:1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:netgear:readynas_surveillance:1.4.1:*:*:*:*:*:*:*;cpe:2.3:a:netgear:readynas_surveillance:1.4.2:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrmini_2:1.7.5:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrmini_2:1.7.6:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrmini_2:2.0.0:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrmini_2:2.2.1:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrmini_2:3.0.0:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:1.75:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.0.0:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.0.1:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.1.5:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.2.2:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.3.1.20:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.3.7.10:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.3.7.9:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.3.9.6:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:2.3:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo:3.0.0:*:*:*:*:*:*:*,Nuuo,Nvrsolo
CVE-2016-5734,0.0,,0.81373,CWE-94,"phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table search-and-replace implementation.",2016-07-03,Metasploit,cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*,Phpmyadmin,Phpmyadmin
CVE-2016-5810,0.0,,0.15356,CWE-200,upAdminPg.asp in Advantech WebAccess before 8.1_20160519 allows remote authenticated administrators to obtain sensitive password information via unspecified vectors.,2017-05-02,Metasploit,cpe:2.3:a:advantech:webaccess:*:*:*:*:*:*:*:*,Advantech,Webaccess
CVE-2016-6195,0.0,,0.68493,CWE-89,"SQL injection vulnerability in forumrunner/includes/moderation.php in vBulletin before 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1 allows remote attackers to execute arbitrary SQL commands via the postids parameter to forumrunner/request.php, as exploited in the wild in July 2016.",2016-08-30,Nuclei,cpe:2.3:a:vbulletin:vbulletin:*:patch_level_4:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:4.2.3:*:*:*:*:*:*:*,Vbulletin,Vbulletin
CVE-2016-6210,5.9,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N,0.88944,CWE-200,"sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.",2017-02-13,Metasploit,cpe:2.3:a:openbsd:openssh:*:p2:*:*:*:*:*:*,Openbsd,Openssh
CVE-2016-6253,0.0,,0.03563,CWE-59,"mail.local in NetBSD versions 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows local users to change ownership of or append data to arbitrary files on the target system via a symlink attack on the user mailbox.",2017-01-20,Metasploit,cpe:2.3:o:netbsd:netbsd:6.0.1:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.0.2:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.0.3:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.0.4:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.0.5:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.0.6:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.0:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.1.1:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.1.2:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.1.3:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.1.4:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.1.5:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:6.1:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:7.0:*:*:*:*:*:*:*,Netbsd,Netbsd
CVE-2016-6267,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.54872,CWE-20,"SnmpUtils in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) spare_Community, (2) spare_AllowGroupIP, or (3) spare_AllowGroupNetmask parameter to admin_notification.php.",2017-01-30,Metasploit,cpe:2.3:a:trendmicro:smart_protection_server:2.5:*:*:*:*:*:*:*;cpe:2.3:a:trendmicro:smart_protection_server:2.6:*:*:*:*:*:*:*;cpe:2.3:a:trendmicro:smart_protection_server:3.0:*:*:*:*:*:*:*,Trendmicro,Smart Protection Server
CVE-2016-6277,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.99781,CWE-352,"NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly other routers allow remote attackers to execute arbitrary commands via shell metacharacters in the path info to cgi-bin/.",2016-12-14,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:h:netgear:d6220:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:d6400:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6250:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6400:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6700:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6900:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r7000:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r7100lg:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r7300dst:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r7900:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r8000:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:d6220_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:d6400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6250_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6700_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6900_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r7000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r7100lg_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r7300dst_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r7900_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r8000_firmware:*:*:*:*:*:*:*:*,Netgear,D6220 Firmware
CVE-2016-6366,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.87565,CWE-120,"Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted IPv4 SNMP packets, aka Bug ID CSCva92151 or EXTRABACON.",2016-08-18,CISA/Metasploit,cpe:2.3:h:cisco:7604:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:7606-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:7609-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:7613-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5500-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5500:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5500_csc-ssm:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5505:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5506-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5506h-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5506w-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5508-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5510:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5512-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5515-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5516-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5520:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5525-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5540:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5545-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5550:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5555-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5580:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5585-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6500-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6500:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6503-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6504-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6506-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6509-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6509-neb-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6509-v-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6513-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6513:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:pix_firewall_501:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:pix_firewall_506:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:pix_firewall_506e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:pix_firewall_515:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:pix_firewall_515e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:pix_firewall_520:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:pix_firewall_525:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:pix_firewall_535:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:asa_1000v_cloud_firewall_software:8.7.1.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:asa_1000v_cloud_firewall_software:8.7.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:pix_firewall_software:-:*:*:*:*:*:*:*,Cisco,Pix Firewall Software
CVE-2016-6367,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.22583,CWE-77,"Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.",2016-08-18,CISA,cpe:2.3:h:cisco:asa_5500-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5500:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5500_csc-ssm:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5505:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5506-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5506h-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5506w-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5508-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5510:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5512-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5515-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5516-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5520:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5525-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5540:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5545-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5550:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5555-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5580:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5585-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firewall_services_module:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:pix_firewall_501:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:pix_firewall_506:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:pix_firewall_506e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:pix_firewall_515:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:pix_firewall_515e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:pix_firewall_520:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:pix_firewall_525:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:pix_firewall_535:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*,Cisco,Adaptive Security Appliance Software
CVE-2016-6415,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.87313,CWE-200,"The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiation request, aka Bug IDs CSCvb29204 and CSCvb36055 or BENIGNCERTAIN.",2016-09-19,CISA/Metasploit,cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*,Cisco,Ios
CVE-2016-6433,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.7575,CWE-20,"The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrary commands via crafted web-application parameters, aka Bug ID CSCva30872.",2016-10-06,Metasploit,cpe:2.3:a:cisco:secure_firewall_management_center:5.2.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:5.3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:5.3.0.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:5.3.0.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:5.3.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:5.3.1.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:5.3.1.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:5.3.1.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:5.3.1.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:5.3.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:5.4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:5.4.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:5.4.1.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:5.4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:5.4.1.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:5.4.1.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:5.4.1.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:5.4.1.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:5.4.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:6.0.1:*:*:*:*:*:*:*,Cisco,Secure Firewall Management Center
CVE-2016-6435,0.0,,0.36617,CWE-200,"The web console in Cisco Firepower Management Center 6.0.1 allows remote authenticated users to read arbitrary files via crafted parameters, aka Bug ID CSCva30376.",2016-10-06,Metasploit,cpe:2.3:a:cisco:secure_firewall_management_center:6.0.1:*:*:*:*:*:*:*,Cisco,Secure Firewall Management Center
CVE-2016-6563,0.0,,0.79947,CWE-121,"Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D-Link DIR routers. The vulnerable XML fields within the SOAP body are: Action, Username, LoginPassword, and Captcha. The following products are affected: DIR-823, DIR-822, DIR-818L(W), DIR-895L, DIR-890L, DIR-885L, DIR-880L, DIR-868L, and DIR-850L.",2018-07-13,Metasploit,cpe:2.3:h:dlink:dir-818l\(w\):-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-822:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-823:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-850l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-868l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-880l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-885l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-890l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-895l:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-818l\(w\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-822_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-823_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-850l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-868l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-880l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-885l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-890l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-895l_firmware:-:*:*:*:*:*:*:*,D-Link,Dir-823 Firmware
CVE-2016-6600,0.0,,0.90554,CWE-22,Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. (dot dot) in the fileName parameter to servlets/FileUploadServlet.,2017-01-23,Metasploit,cpe:2.3:a:zohocorp:webnms_framework:5.2:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:webnms_framework:5.2:sp1:*:*:*:*:*:*,Zohocorp,Webnms Framework
CVE-2016-6601,0.0,,0.97415,CWE-22,Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. (dot dot) in the fileName parameter to servlets/FetchFile.,2017-01-23,EPSS/Metasploit/Nuclei,cpe:2.3:a:zohocorp:webnms_framework:5.2:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:webnms_framework:5.2:sp1:*:*:*:*:*:*,Zohocorp,Webnms Framework
CVE-2016-6602,0.0,,0.5507,CWE-327,"ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml.  NOTE: this issue can be combined with CVE-2016-6601 for a remote exploit.",2017-01-23,Metasploit,cpe:2.3:a:zohocorp:webnms_framework:5.2:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:webnms_framework:5.2:sp1:*:*:*:*:*:*,Zohocorp,Webnms Framework
CVE-2016-6883,0.0,,0.13906,CWE-200,MatrixSSL before 3.8.3 configured with RSA Cipher Suites allows remote attackers to obtain sensitive information via a Bleichenbacher variant attack.,2017-03-03,Metasploit,cpe:2.3:a:matrixssl:matrixssl:*:*:*:*:*:*:*:*,Matrixssl,Matrixssl
CVE-2016-6897,0.0,,0.28258,CWE-352,"Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896.",2017-01-18,Metasploit,cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*,Wordpress,Wordpress
CVE-2016-7193,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.57705,CWE-119,"Microsoft Word 2007 SP2, Office 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2, Office Web Apps Server 2013 SP1, and Office Online Server allow remote attackers to execute arbitrary code via a crafted RTF document, aka ""Microsoft Office Memory Corruption Vulnerability.""",2016-10-14,CISA,cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2011:*:*:*:*:macos:*:*;cpe:2.3:a:microsoft:word:2013:sp1:*:*:-:*:*:*;cpe:2.3:a:microsoft:word:2013:sp1:*:*:rt:*:*:*;cpe:2.3:a:microsoft:word:2016:*:*:*:*:macos:*:*;cpe:2.3:a:microsoft:word_viewer:-:*:*:*:*:*:*:*,Microsoft,Office
CVE-2016-7200,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.8249,CWE-787,"The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka ""Scripting Engine Memory Corruption Vulnerability,"" a different vulnerability than CVE-2016-7201, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, CVE-2016-7242, and CVE-2016-7243.",2016-11-10,CISA,cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:-:*:*:*:*:x64:*,Microsoft,Windows 10 1507
CVE-2016-7201,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.79687,CWE-843,"The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka ""Scripting Engine Memory Corruption Vulnerability,"" a different vulnerability than CVE-2016-7200, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, CVE-2016-7242, and CVE-2016-7243.",2016-11-10,CISA,cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2016-7255,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.80968,NVD-CWE-noinfo,"The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow local users to gain privileges via a crafted application, aka ""Win32k Elevation of Privilege Vulnerability.""",2016-11-10,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2016-7256,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.64835,NVD-CWE-noinfo,"atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site, aka ""Open Type Font Remote Code Execution Vulnerability.""",2016-11-10,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2016-7262,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.58204,NVD-CWE-noinfo,"Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer allow user-assisted remote attackers to execute arbitrary commands via a crafted cell that is mishandled upon a click, aka ""Microsoft Office Security Feature Bypass Vulnerability.""",2016-12-20,CISA,cpe:2.3:a:microsoft:excel:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:excel:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:excel:2013:sp1:*:*:-:*:*:*;cpe:2.3:a:microsoft:excel:2013:sp1:*:*:rt:*:*:*;cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:excel_viewer:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*,Microsoft,Excel
CVE-2016-7456,0.0,,0.32789,CWE-255,"VMware vSphere Data Protection (VDP) 5.5.x though 6.1.x has an SSH private key with a publicly known password, which makes it easier for remote attackers to obtain login access via an SSH session.",2016-12-29,Metasploit,cpe:2.3:a:vmware:vsphere_data_protection:5.5.10:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vsphere_data_protection:5.5.11:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vsphere_data_protection:5.5.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vsphere_data_protection:5.5.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vsphere_data_protection:5.5.6:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vsphere_data_protection:5.5.7:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vsphere_data_protection:5.5.8:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vsphere_data_protection:5.5.9:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vsphere_data_protection:5.8.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vsphere_data_protection:5.8.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vsphere_data_protection:5.8.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vsphere_data_protection:5.8.3:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vsphere_data_protection:5.8.4:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vsphere_data_protection:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vsphere_data_protection:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vsphere_data_protection:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vsphere_data_protection:6.0.3:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vsphere_data_protection:6.0.4:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vsphere_data_protection:6.1.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vsphere_data_protection:6.1.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vsphere_data_protection:6.1.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vsphere_data_protection:6.1.3:*:*:*:*:*:*:*,Vmware,Vsphere Data Protection
CVE-2016-7547,0.0,,0.92721,CWE-361,A command execution flaw on the Trend Micro Threat Discovery Appliance 2.6.1062r1 exists with the timezone parameter in the admin_sys_time.cgi interface.,2017-04-12,Metasploit,cpe:2.3:a:trendmicro:threat_discovery_appliance:2.6.1062:r1:*:*:*:*:*:*,Trendmicro,Threat Discovery Appliance
CVE-2016-7552,0.0,,0.93249,CWE-22,"On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthenticated attacker to delete arbitrary files as root. This can be used to bypass authentication or cause a DoS.",2017-04-12,Metasploit/Nuclei,cpe:2.3:a:trendmicro:threat_discovery_appliance:2.6.1062:r1:*:*:*:*:*:*,Trendmicro,Threat Discovery Appliance
CVE-2016-7834,0.0,,0.03901,CWE-200,"SONY SNC-CH115, SNC-CH120, SNC-CH160, SNC-CH220, SNC-CH260, SNC-DH120, SNC-DH120T, SNC-DH160, SNC-DH220, SNC-DH220T, SNC-DH260, SNC-EB520, SNC-EM520, SNC-EM521, SNC-ZB550, SNC-ZM550, SNC-ZM551, SNC-EP550, SNC-EP580, SNC-ER550, SNC-ER550C, SNC-ER580, SNC-ER585, SNC-ER585H, SNC-ZP550, SNC-ZR550, SNC-EP520, SNC-EP521, SNC-ER520, SNC-ER521, SNC-ER521C network cameras with firmware before Ver.1.86.00 and SONY SNC-CX600, SNC-CX600W, SNC-EB600, SNC-EB600B, SNC-EB602R, SNC-EB630, SNC-EB630B, SNC-EB632R, SNC-EM600, SNC-EM601, SNC-EM602R, SNC-EM602RC, SNC-EM630, SNC-EM631, SNC-EM632R, SNC-EM632RC, SNC-VB600, SNC-VB600B, SNC-VB600B5, SNC-VB630, SNC-VB6305, SNC-VB6307, SNC-VB632D, SNC-VB635, SNC-VM600, SNC-VM600B, SNC-VM600B5, SNC-VM601, SNC-VM601B, SNC-VM602R, SNC-VM630, SNC-VM6305, SNC-VM6307, SNC-VM631, SNC-VM632R, SNC-WR600, SNC-WR602, SNC-WR602C, SNC-WR630, SNC-WR632, SNC-WR632C, SNC-XM631, SNC-XM632, SNC-XM636, SNC-XM637, SNC-VB600L, SNC-VM600L, SNC-XM631L, SNC-WR602CL network cameras with firmware before Ver.2.7.2 are prone to sensitive information disclosure. This may allow an attacker on the same local network segment to login to the device with administrative privileges and perform operations on the device.",2017-04-13,Nuclei,cpe:2.3:h:sony:snc-ch115:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-ch120:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-ch160:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-ch220:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-ch260:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-cx600:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-cx600w:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-dh120:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-dh120t:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-dh160:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-dh220:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-dh220t:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-dh260:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-eb520:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-eb600:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-eb600b:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-eb602r:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-eb630:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-eb630b:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-eb632r:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-em520:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-em521:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-em600:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-em601:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-em602r:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-em602rc:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-em630:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-em631:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-em632r:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-em632rc:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-ep520:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-ep521:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-ep550:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-ep580:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-er520:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-er521:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-er521c:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-er550:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-er550c:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-er580:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-er585:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-er585h:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-vb600:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-vb600b5:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-vb600b:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-vb600l:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-vb6305:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-vb6307:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-vb630:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-vb632d:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-vb635:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-vm600:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-vm600b5:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-vm600b:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-vm600l:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-vm601:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-vm601b:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-vm602r:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-vm6305:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-vm6307:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-vm630:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-vm631:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-vm632r:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-wr600:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-wr602:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-wr602c:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-wr602cl:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-wr630:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-wr632:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-wr632c:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-xm631:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-xm631l:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-xm632:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-xm636:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-xm637:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-zb550:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-zm550:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-zm551:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-zp550:-:*:*:*:*:*:*:*;cpe:2.3:h:sony:snc-zr550:-:*:*:*:*:*:*:*;cpe:2.3:o:sony:snc_series_firmware:*:*:*:*:*:*:*:*,Sony,Snc Series Firmware
CVE-2016-7836,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.1938,CWE-287,SKYSEA Client View Ver.11.221.03 and earlier allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program.,2017-06-09,CISA,cpe:2.3:a:skygroup:skysea_client_view:*:*:*:*:*:*:*:*,Skygroup,Skysea Client View
CVE-2016-7855,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.25198,CWE-416,"Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in October 2016.",2016-11-01,CISA,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:linux:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:google:chrome_os:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2016-7892,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.18786,CWE-416,"Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Successful exploitation could lead to arbitrary code execution.",2016-12-15,CISA,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:*;cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:google:chrome_os:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2016-7976,0.0,,0.23453,CWE-20,The PS Interpreter in Ghostscript 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams.,2017-08-07,Metasploit,cpe:2.3:a:artifex:ghostscript:9.18:*:*:*:*:*:*:*;cpe:2.3:a:artifex:ghostscript:9.20:*:*:*:*:*:*:*,Artifex,Ghostscript
CVE-2016-7981,0.0,,0.08216,CWE-79,Cross-site scripting (XSS) vulnerability in valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the var_url parameter in a valider_xml action.,2017-01-18,Nuclei,cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*,Spip,Spip
CVE-2016-8527,0.0,,0.13164,CWE-79,"Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting (XSS). The vulnerability is present in the VisualRF component of AirWave. By exploiting this vulnerability, an attacker who can trick a logged-in AirWave administrative user into clicking a link could obtain sensitive information, such as session cookies or passwords. The vulnerability requires that an administrative users click on the malicious link while currently logged into AirWave in the same browser.",2018-08-06,Nuclei,cpe:2.3:a:hp:airwave:*:*:*:*:*:*:*:*,Hp,Airwave
CVE-2016-8562,7.5,CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03624,NVD-CWE-noinfo,"A vulnerability has been identified in SIMATIC CP 1543-1 (All versions < V2.0.28), SIPLUS NET CP 1543-1 (All versions < V2.0.28). Under special conditions it was possible to write SNMP variables on port 161/udp which should be read-only and should only be configured with TIA-Portal. A write to these variables could reduce the availability or cause a denial-of-service.",2016-11-18,CISA,cpe:2.3:h:siemens:simatic_cp_1543-1:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:siplus_net_cp_1543-1:-:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_cp_1543-1_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:siplus_net_cp_1543-1_firmware:*:*:*:*:*:*:*:*,Siemens,Simatic Cp 1543-1 Firmware
CVE-2016-8581,0.0,,0.17058,CWE-79,A persistent XSS vulnerability exists in the User-Agent header of the login process of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to steal session IDs of logged in users when the current sessions are viewed by an administrator.,2016-10-28,Metasploit,cpe:2.3:a:alienvault:open_source_security_information_and_event_management:*:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:unified_security_management:*:*:*:*:*:*:*:*,Alienvault,Open Source Security Information And Event Management
CVE-2016-8582,0.0,,0.57425,CWE-89,A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database information or read local system files via MySQL's LOAD_FILE.,2016-10-28,Metasploit,cpe:2.3:a:alienvault:open_source_security_information_and_event_management:*:*:*:*:*:*:*:*;cpe:2.3:a:alienvault:unified_security_management:*:*:*:*:*:*:*:*,Alienvault,Open Source Security Information And Event Management
CVE-2016-8655,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.11127,CWE-362,"Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW capability to change a socket version, related to the packet_set_ring and packet_setsockopt functions.",2016-12-08,Metasploit,cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.10:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2016-8706,0.0,,0.45703,CWE-190,"An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.",2017-01-06,Nuclei,cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*,Memcached,Memcached
CVE-2016-8735,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.90338,NVD-CWE-noinfo,"Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.",2017-04-06,CISA,cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:-:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*;cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*;cpe:2.3:a:oracle:agile_engineering_data_management:6.1.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:agile_engineering_data_management:6.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:agile_plm:9.3.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_application_session_controller:3.7.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_application_session_controller:3.8.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_interactive_session_recorder:6.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_interactive_session_recorder:6.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_interactive_session_recorder:6.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:micros_relate_crm_software:10.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:micros_relate_crm_software:11.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.6.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.7.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.8.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.8.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_convenience_and_fuel_pos_software:2.1.132:*:*:*:*:*:*:*;cpe:2.3:a:oracle:transportation_management:6.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:transportation_management:6.3.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:transportation_management:6.3.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:transportation_management:6.3.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:transportation_management:6.3.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:transportation_management:6.3.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:transportation_management:6.3.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:transportation_management:6.3.7:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2016-8869,0.0,,0.97426,CWE-20,The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4 allows remote attackers to gain privileges by leveraging incorrect use of unfiltered data when registering on a site.,2016-11-04,EPSS/Metasploit,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Joomla,Joomla!
CVE-2016-8870,0.0,,0.81207,CWE-20,"The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting.",2016-11-04,Metasploit,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Joomla,Joomla!
CVE-2016-9079,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.87598,CWE-416,"A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.",2018-06-11,CISA/Metasploit,cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*;cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*;cpe:2.3:a:torproject:tor:-:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2016-9299,0.0,,0.96943,CWE-90,"The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.",2017-01-12,EPSS/Metasploit,cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*;cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*;cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2016-9361,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.19856,CWE-287,"An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4.  Administration passwords can be retried without authenticating.",2017-02-13,Metasploit,cpe:2.3:h:moxa:nport_5110:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5110a:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5130:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5130a:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5150:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5150a1-m12-ct-t:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5150a1-m12-ct:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5150a1-m12-t:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5150a1-m12:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5150a:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5210:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5210a:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5230:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5230a:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5232:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5232i:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5250a1-m12-ct-t:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5250a1-m12-ct:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5250a1-m12-t:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5250a1-m12:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5250a:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5410:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5430:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5430i:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5450-t:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5450:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5450a1-m12-ct-t:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5450a1-m12-ct:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5450a1-m12-t:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5450a1-m12:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5450i-t:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5450i:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5600-8-dtl_series_firmware:*:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5610-8-dtl:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5610:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5630:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5650-8-dtl:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5650:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_5650i-8-dtl:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_6150-t:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_6150:-:*:*:*:*:*:*:*;cpe:2.3:h:moxa:nport_p5110a:-:*:*:*:*:*:*:*;cpe:2.3:o:moxa:nport_5100_series_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:moxa:nport_5100a_series_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:moxa:nport_5200_series_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:moxa:nport_5200a_series_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:moxa:nport_5400_series_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:moxa:nport_5600_series_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:moxa:nport_5x50a1-m12_series_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:moxa:nport_6100_series_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:moxa:nport_p5150a_series_firmware:*:*:*:*:*:*:*:*,Moxa,Nport 5100 Series Firmware
CVE-2016-9563,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.23805,CWE-611,"BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909.",2016-11-23,CISA,cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:*,Sap,Netweaver Application Server Java
CVE-2016-9722,0.0,,0.12031,CWE-284,IBM QRadar 7.2 and 7.3 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 119737.,2018-01-10,Metasploit,cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.5:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.6:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.7:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.0:*:*:*:*:*:*:*,Ibm,Qradar Security Information And Event Manager
CVE-2017-0001,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03114,NVD-CWE-noinfo,"The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application, aka ""Windows GDI Elevation of Privilege Vulnerability."" This vulnerability is different from those described in CVE-2017-0005, CVE-2017-0025, and CVE-2017-0047.",2017-03-17,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2017-0005,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.11022,NVD-CWE-noinfo,"The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application, aka ""Windows GDI Elevation of Privilege Vulnerability."" This vulnerability is different from those described in CVE-2017-0001, CVE-2017-0025, and CVE-2017-0047.",2017-03-17,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2017-0022,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.18069,CWE-119,"Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows Server 2012 Gold and R2; Windows Server 2016; and Windows Vista SP2 improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site, aka ""Microsoft XML Information Disclosure Vulnerability.""",2017-03-17,CISA,cpe:2.3:a:microsoft:xml_core_services:3.0:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2017-0037,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.80386,CWE-843,"Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element.",2017-02-26,CISA,cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2017-0059,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N,0.61968,NVD-CWE-noinfo,"Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka ""Internet Explorer Information Disclosure Vulnerability."" This vulnerability is different from those described in CVE-2017-0008 and CVE-2017-0009.",2017-03-17,CISA,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows Server 2008
CVE-2017-0101,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.57482,CWE-119,"The kernel-mode drivers in Transaction Manager in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allow local users to gain privileges via a crafted application, aka ""Windows Elevation of Privilege Vulnerability.""",2017-03-17,CISA,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2017-0143,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.93307,NVD-CWE-noinfo,"The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka ""Windows SMB Remote Code Execution Vulnerability."" This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.",2017-03-17,CISA/Metasploit,cpe:2.3:a:microsoft:server_message_block:1.0:*:*:*:*:*:*:*;cpe:2.3:a:philips:intellispace_portal:7.0:*:*:*:*:*:*:*;cpe:2.3:a:philips:intellispace_portal:8.0:*:*:*:*:*:*:*;cpe:2.3:h:siemens:acuson_p300:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:acuson_p500:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:acuson_sc2000:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:acuson_x700:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:syngo_sc2000:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:tissue_preparation_system:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:versant_kpcr_molecular_system:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:versant_kpcr_sample_prep:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p300_firmware:13.02:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p300_firmware:13.03:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p300_firmware:13.20:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p300_firmware:13.21:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p500_firmware:va10:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p500_firmware:vb10:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_sc2000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_sc2000_firmware:5.0a:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_x700_firmware:1.0:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_x700_firmware:1.1:*:*:*:*:*:*:*;cpe:2.3:o:siemens:syngo_sc2000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:syngo_sc2000_firmware:5.0a:*:*:*:*:*:*:*;cpe:2.3:o:siemens:tissue_preparation_system_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:versant_kpcr_molecular_system_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:versant_kpcr_sample_prep_firmware:*:*:*:*:*:*:*:*,Siemens,Acuson P300 Firmware
CVE-2017-0144,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.9923,NVD-CWE-noinfo,"The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka ""Windows SMB Remote Code Execution Vulnerability."" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.",2017-03-17,CISA/EPSS/Metasploit,cpe:2.3:a:microsoft:server_message_block:1.0:*:*:*:*:*:*:*;cpe:2.3:h:siemens:acuson_p300:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:acuson_p500:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:acuson_sc2000:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:acuson_x700:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:syngo_sc2000:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:tissue_preparation_system:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:versant_kpcr_molecular_system:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:versant_kpcr_sample_prep:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p300_firmware:13.02:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p300_firmware:13.03:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p300_firmware:13.20:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p300_firmware:13.21:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p500_firmware:va10:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p500_firmware:vb10:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_sc2000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_sc2000_firmware:5.0a:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_x700_firmware:1.0:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_x700_firmware:1.1:*:*:*:*:*:*:*;cpe:2.3:o:siemens:syngo_sc2000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:syngo_sc2000_firmware:5.0a:*:*:*:*:*:*:*;cpe:2.3:o:siemens:tissue_preparation_system_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:versant_kpcr_molecular_system_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:versant_kpcr_sample_prep_firmware:*:*:*:*:*:*:*:*,Siemens,Acuson P300 Firmware
CVE-2017-0145,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.8985,NVD-CWE-noinfo,"The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka ""Windows SMB Remote Code Execution Vulnerability."" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148.",2017-03-17,CISA/Metasploit,cpe:2.3:a:microsoft:server_message_block:1.0:*:*:*:*:*:*:*;cpe:2.3:h:siemens:acuson_p300:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:acuson_p500:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:acuson_sc2000:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:acuson_x700:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:syngo_sc2000:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:tissue_preparation_system:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:versant_kpcr_molecular_system:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:versant_kpcr_sample_prep:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p300_firmware:13.02:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p300_firmware:13.03:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p300_firmware:13.20:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p300_firmware:13.21:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p500_firmware:va10:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p500_firmware:vb10:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_sc2000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_sc2000_firmware:5.0a:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_x700_firmware:1.0:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_x700_firmware:1.1:*:*:*:*:*:*:*;cpe:2.3:o:siemens:syngo_sc2000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:syngo_sc2000_firmware:5.0a:*:*:*:*:*:*:*;cpe:2.3:o:siemens:tissue_preparation_system_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:versant_kpcr_molecular_system_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:versant_kpcr_sample_prep_firmware:*:*:*:*:*:*:*:*,Siemens,Acuson P300 Firmware
CVE-2017-0146,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.89862,NVD-CWE-noinfo,"The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka ""Windows SMB Remote Code Execution Vulnerability."" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0148.",2017-03-17,CISA/Metasploit,cpe:2.3:a:microsoft:server_message_block:1.0:*:*:*:*:*:*:*;cpe:2.3:h:siemens:acuson_p300:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:acuson_p500:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:acuson_sc2000:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:acuson_x700:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:syngo_sc2000:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:tissue_preparation_system:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:versant_kpcr_molecular_system:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:versant_kpcr_sample_prep:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p300_firmware:13.02:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p300_firmware:13.03:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p300_firmware:13.20:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p300_firmware:13.21:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p500_firmware:va10:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p500_firmware:vb10:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_sc2000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_sc2000_firmware:5.0a:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_x700_firmware:1.0:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_x700_firmware:1.1:*:*:*:*:*:*:*;cpe:2.3:o:siemens:syngo_sc2000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:syngo_sc2000_firmware:5.0a:*:*:*:*:*:*:*;cpe:2.3:o:siemens:tissue_preparation_system_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:versant_kpcr_molecular_system_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:versant_kpcr_sample_prep_firmware:*:*:*:*:*:*:*:*,Siemens,Acuson P300 Firmware
CVE-2017-0147,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.99693,NVD-CWE-noinfo,"The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted packets, aka ""Windows SMB Information Disclosure Vulnerability.""",2017-03-17,CISA/EPSS/Metasploit,cpe:2.3:h:siemens:acuson_p300:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:acuson_p500:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:acuson_sc2000:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:acuson_x700:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:syngo_sc2000:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:tissue_preparation_system:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:versant_kpcr_molecular_system:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:versant_kpcr_sample_prep:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p300_firmware:13.02:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p300_firmware:13.03:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p300_firmware:13.20:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p300_firmware:13.21:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p500_firmware:va10:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p500_firmware:vb10:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_sc2000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_sc2000_firmware:5.0a:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_x700_firmware:1.0:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_x700_firmware:1.1:*:*:*:*:*:*:*;cpe:2.3:o:siemens:syngo_sc2000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:syngo_sc2000_firmware:5.0a:*:*:*:*:*:*:*;cpe:2.3:o:siemens:tissue_preparation_system_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:versant_kpcr_molecular_system_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:versant_kpcr_sample_prep_firmware:*:*:*:*:*:*:*:*,Siemens,Acuson P300 Firmware
CVE-2017-0148,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99373,CWE-20,"The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka ""Windows SMB Remote Code Execution Vulnerability."" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0146.",2017-03-17,CISA/EPSS/Metasploit,cpe:2.3:a:microsoft:server_message_block:1.0:*:*:*:*:*:*:*;cpe:2.3:h:siemens:acuson_p300:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:acuson_p500:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:acuson_sc2000:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:acuson_x700:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:syngo_sc2000:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:tissue_preparation_system:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:versant_kpcr_molecular_system:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:versant_kpcr_sample_prep:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p300_firmware:13.02:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p300_firmware:13.03:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p300_firmware:13.20:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p300_firmware:13.21:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p500_firmware:va10:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_p500_firmware:vb10:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_sc2000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_sc2000_firmware:5.0a:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_x700_firmware:1.0:*:*:*:*:*:*:*;cpe:2.3:o:siemens:acuson_x700_firmware:1.1:*:*:*:*:*:*:*;cpe:2.3:o:siemens:syngo_sc2000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:syngo_sc2000_firmware:5.0a:*:*:*:*:*:*:*;cpe:2.3:o:siemens:tissue_preparation_system_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:versant_kpcr_molecular_system_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:versant_kpcr_sample_prep_firmware:*:*:*:*:*:*:*:*,Siemens,Acuson P300 Firmware
CVE-2017-0149,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.29189,CWE-787,"Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka ""Internet Explorer Memory Corruption Vulnerability."" This vulnerability is different from those described in CVE-2017-0018 and CVE-2017-0037.",2017-03-17,CISA,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows Server 2008
CVE-2017-0199,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.99933,NVD-CWE-noinfo,"Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka ""Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API.""",2017-04-12,CISA/EPSS/Metasploit,cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2016:-:*:*:*:*:*:*;cpe:2.3:a:philips:intellispace_portal:7.0:*:*:*:*:*:*:*;cpe:2.3:a:philips:intellispace_portal:8.0:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2017-0210,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.19522,NVD-CWE-noinfo,"An elevation of privilege vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject it into another domain, aka ""Internet Explorer Elevation of Privilege Vulnerability.""",2017-04-12,CISA,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*,Microsoft,Windows Server 2012
CVE-2017-0213,7.3,CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H,0.84138,NVD-CWE-noinfo,"Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when an attacker runs a specially crafted application, aka ""Windows COM Elevation of Privilege Vulnerability"". This CVE ID is unique from CVE-2017-0214.",2017-05-12,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2017-0222,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.29645,CWE-787,"A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka ""Internet Explorer Memory Corruption Vulnerability."" This CVE ID is unique from CVE-2017-0226.",2017-05-12,CISA,cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*,Microsoft,Windows Server 2008
CVE-2017-0261,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.7813,CWE-416,"Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka ""Office Remote Code Execution Vulnerability"". This CVE ID is unique from CVE-2017-0262 and CVE-2017-0281.",2017-05-12,CISA,cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*,Microsoft,Office
CVE-2017-0262,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.80734,NVD-CWE-noinfo,"Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka ""Office Remote Code Execution Vulnerability"". This CVE ID is unique from CVE-2017-0261 and CVE-2017-0281.",2017-05-12,CISA,cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*,Microsoft,Office
CVE-2017-0263,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.10034,CWE-416,"The kernel-mode drivers in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow local users to gain privileges via a crafted application, aka ""Win32k Elevation of Privilege Vulnerability.""",2017-05-12,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2017-0358,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02277,CWE-269,"Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.",2018-04-13,Metasploit,cpe:2.3:a:tuxera:ntfs-3g:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2017-0372,0.0,,0.11653,CWE-74,"Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities.",2018-04-13,Metasploit,cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*;cpe:2.3:a:mediawiki:mediawiki:1.27.0:*:*:*:*:*:*:*;cpe:2.3:a:mediawiki:mediawiki:1.27.1:*:*:*:*:*:*:*;cpe:2.3:a:mediawiki:mediawiki:1.27.2:*:*:*:*:*:*:*;cpe:2.3:a:mediawiki:mediawiki:1.28.0:*:*:*:*:*:*:*;cpe:2.3:a:mediawiki:mediawiki:1.28.1:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2017-0929,0.0,,0.12543,CWE-918,DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.,2018-07-03,Nuclei,cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*,Dnnsoftware,Dotnetnuke
CVE-2017-1000002,0.0,,0.30833,CWE-22,ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting in code execution. ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal vulnerability in the Course Icon component resulting in information disclosure.,2017-07-17,Metasploit,cpe:2.3:a:atutor:atutor:*:*:*:*:*:*:*:*,Atutor,Atutor
CVE-2017-1000028,0.0,,0.99479,CWE-22,"Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability, that can be exploited by issuing a specially crafted HTTP GET request.",2017-07-17,EPSS/Metasploit/Nuclei,cpe:2.3:a:oracle:glassfish_server:4.1:*:*:*:open_source:*:*:*,Oracle,Glassfish Server
CVE-2017-1000029,0.0,,0.07605,CWE-200,"Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Local File Inclusion vulnerability, that makes it possible to include arbitrary files on the server, this vulnerability can be exploited without any prior authentication.",2017-07-17,Nuclei,cpe:2.3:a:oracle:glassfish_server:3.0.1:*:*:*:open_source:*:*:*,Oracle,Glassfish Server
CVE-2017-1000083,0.0,,0.50826,NVD-CWE-noinfo,"backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a ""--"" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename.",2017-09-05,Metasploit,cpe:2.3:a:gnome:evince:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2017-1000112,7.0,CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.20797,CWE-362,"Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. Fraggap can exceed MTU, causing copy = datalen - transhdrlen - fraggap to become negative. Subsequently skb_copy_and_csum_bits() writes out-of-bounds. A similar issue is present in IPv6 code. The bug was introduced in e89e9cf539a2 (""[IPv4/IPv6]: UFO Scatter-gather approach"") on Oct 18 2005.",2017-10-05,Metasploit,cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2017-1000117,0.0,,0.77823,CWE-601,"A malicious third-party can give a crafted ""ssh://..."" URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running ""git clone --recurse-submodules"" to trigger the vulnerability.",2017-10-05,Metasploit,cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.10.0:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.10.0:rc0:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.10.0:rc1:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.10.0:rc2:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.10.1:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.10.2:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.10.3:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.11.0:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.11.0:rc0:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.11.0:rc1:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.11.0:rc2:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.11.0:rc3:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.11.1:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.11.2:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.12.0:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.12.0:rc0:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.12.0:rc1:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.12.0:rc2:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.12.1:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.12.2:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.12.3:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.13.0:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.13.0:rc0:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.13.0:rc1:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.13.0:rc2:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.13.1:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.13.2:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.13.3:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.13.4:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.14.0:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.14.0:rc0:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.14.0:rc1:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.8.0:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.8.0:rc0:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.8.0:rc1:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.8.0:rc2:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.8.0:rc3:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.8.1:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.8.2:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.8.3:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.8.4:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.8.5:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.9.0:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.9.0:rc0:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.9.0:rc1:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.9.0:rc2:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.9.1:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.9.2:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.9.3:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.9.4:*:*:*:*:*:*:*,Git-Scm,Git
CVE-2017-1000119,0.0,,0.61347,CWE-434,October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server.,2017-10-05,Metasploit,cpe:2.3:a:octobercms:october:1.0.412:*:*:*:*:*:*:*,Octobercms,October
CVE-2017-1000163,0.0,,0.02377,CWE-601,"The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may result in phishing or social engineering attacks.",2017-11-17,Nuclei,cpe:2.3:a:phoenixframework:phoenix:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:phoenixframework:phoenix:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:phoenixframework:phoenix:1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:phoenixframework:phoenix:1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:phoenixframework:phoenix:1.0.4:*:*:*:*:*:*:*;cpe:2.3:a:phoenixframework:phoenix:1.1.0:*:*:*:*:*:*:*;cpe:2.3:a:phoenixframework:phoenix:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:phoenixframework:phoenix:1.1.2:*:*:*:*:*:*:*;cpe:2.3:a:phoenixframework:phoenix:1.1.3:*:*:*:*:*:*:*;cpe:2.3:a:phoenixframework:phoenix:1.1.4:*:*:*:*:*:*:*;cpe:2.3:a:phoenixframework:phoenix:1.1.5:*:*:*:*:*:*:*;cpe:2.3:a:phoenixframework:phoenix:1.1.6:*:*:*:*:*:*:*;cpe:2.3:a:phoenixframework:phoenix:1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:phoenixframework:phoenix:1.2.2:*:*:*:*:*:*:*;cpe:2.3:a:phoenixframework:phoenix:1.3.0-rc.0:*:*:*:*:*:*:*,Phoenixframework,Phoenix
CVE-2017-1000170,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.59063,CWE-22,jqueryFileTree 2.1.5 and older Directory Traversal,2017-11-17,Nuclei,cpe:2.3:a:jqueryfiletree_project:jqueryfiletree:*:*:*:*:*:*:*:*,Jqueryfiletree Project,Jqueryfiletree
CVE-2017-1000253,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.10695,CWE-119,"Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the ""gap"" between the stack and the binary.",2017-10-05,CISA,cpe:2.3:o:centos:centos:6.0:*:*:*:*:*:*:*;cpe:2.3:o:centos:centos:6.1:*:*:*:*:*:*:*;cpe:2.3:o:centos:centos:6.2:*:*:*:*:*:*:*;cpe:2.3:o:centos:centos:6.3:*:*:*:*:*:*:*;cpe:2.3:o:centos:centos:6.4:*:*:*:*:*:*:*;cpe:2.3:o:centos:centos:6.5:*:*:*:*:*:*:*;cpe:2.3:o:centos:centos:6.6:*:*:*:*:*:*:*;cpe:2.3:o:centos:centos:6.7:*:*:*:*:*:*:*;cpe:2.3:o:centos:centos:6.8:*:*:*:*:*:*:*;cpe:2.3:o:centos:centos:6.9:*:*:*:*:*:*:*;cpe:2.3:o:centos:centos:7.1406:*:*:*:*:*:*:*;cpe:2.3:o:centos:centos:7.1503:*:*:*:*:*:*:*;cpe:2.3:o:centos:centos:7.1511:*:*:*:*:*:*:*;cpe:2.3:o:centos:centos:7.1611:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.8:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.9:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.3:*:*:*:*:*:*:*,Centos,Centos
CVE-2017-1000353,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99679,CWE-502,"Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.",2018-01-29,CISA/EPSS/Metasploit,cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*;cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*,Jenkins,Jenkins
CVE-2017-1000364,0.0,,0.05186,CWE-119,"An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be ""jumped"" over (the stack guard page is bypassed), this affects Linux Kernel versions 4.11.5 and earlier (the stackguard page was introduced in 2010).",2017-06-19,Metasploit,cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2017-1000385,0.0,,0.22098,CWE-203,The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server's private key (this is a variation of the Bleichenbacher attack).,2017-12-12,Metasploit,cpe:2.3:a:erlang:erlang\/otp:18.3.4.7:*:*:*:*:*:*:*;cpe:2.3:a:erlang:erlang\/otp:19.3.6.4:*:*:*:*:*:*:*;cpe:2.3:a:erlang:erlang\/otp:20.1.7:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2017-1000479,0.0,,0.32767,CWE-352,"pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrary code, because the error detection occurs before an X-Frame-Options header is set. This is fixed in 2.4.2-RELEASE. OPNsense, a 2015 fork of pfSense, was not vulnerable since version 16.1.16 released on June 06, 2016. The unprotected web form was removed from the code during an internal security audit under ""possibly insecure"" suspicions.",2018-01-03,Metasploit,cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*;cpe:2.3:a:opnsense_project:opnsense:*:*:*:*:*:*:*:*,Netgate,Pfsense
CVE-2017-1000486,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.94104,CWE-326,Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution,2018-01-03,CISA/Metasploit/Nuclei,cpe:2.3:a:primetek:primefaces:*:*:*:*:*:*:*:*,Primetek,Primefaces
CVE-2017-1001000,0.0,,0.81848,NVD-CWE-noinfo,"The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.",2017-04-03,Metasploit,cpe:2.3:a:wordpress:wordpress:4.7.1:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:4.7.2:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:4.7:*:*:*:*:*:*:*,Wordpress,Wordpress
CVE-2017-10075,0.0,,0.17558,NVD-CWE-noinfo,"Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Supported versions that are affected are 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).",2017-08-08,Nuclei,cpe:2.3:a:oracle:webcenter_content:11.1.1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_content:12.2.1.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_content:12.2.1.2.0:*:*:*:*:*:*:*,Oracle,Webcenter Content
CVE-2017-10271,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.99993,NVD-CWE-noinfo,"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).",2017-10-19,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.2.0:*:*:*:*:*:*:*,Oracle,Weblogic Server
CVE-2017-1092,0.0,,0.75767,NVD-CWE-noinfo,"IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system admin on Windows servers. IBM X-Force ID: 120390.",2017-05-22,Metasploit,cpe:2.3:a:ibm:informix_open_admin_tool:11.5:*:*:*:*:*:*:*;cpe:2.3:a:ibm:informix_open_admin_tool:11.7:*:*:*:*:*:*:*;cpe:2.3:a:ibm:informix_open_admin_tool:12.1:*:*:*:*:*:*:*,Ibm,Informix Open Admin Tool
CVE-2017-10974,0.0,,0.81028,CWE-22,Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080. NOTE: this CVE is only about use of an initial /%5C sequence to defeat traversal protection mechanisms; the initial /%5C sequence was apparently not discussed in earlier research on this product.,2017-07-07,Nuclei,cpe:2.3:a:yaws:yaws:1.91:*:*:*:*:*:*:*,Yaws,Yaws
CVE-2017-11107,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02069,CWE-79,"phpLDAPadmin through 1.2.3 has XSS in htdocs/entry_chooser.php via the form, element, rdn, or container parameter.",2017-07-08,Nuclei,cpe:2.3:a:phpldapadmin_project:phpldapadmin:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2017-11165,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.6413,CWE-200,dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a direct request for the /services/getFile.cmd?userfile=config.xml URI.,2017-07-12,Nuclei,cpe:2.3:h:thermofisher:dt80_dex:-:*:*:*:*:*:*:*;cpe:2.3:o:thermofisher:dt80_dex_firmware:1.50.012:*:*:*:*:*:*:*,Thermofisher,Dt80 Dex Firmware
CVE-2017-1129,0.0,,0.30074,NVD-CWE-noinfo,"IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it could cause the Notes client to hang and have to be restarted. IBM X-Force ID: 121370.",2017-09-05,Metasploit,cpe:2.3:a:ibm:expeditor:6.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:expeditor:6.2.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:expeditor:6.2.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:8.5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:8.5.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:8.5.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:8.5.1.5:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:8.5.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:8.5.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:8.5.2.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:8.5.3.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:8.5.3.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:8.5.3.6:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:9.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:9.0.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:9.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:9.0.1.8:*:*:*:*:*:*:*,Ibm,Inotes
CVE-2017-11292,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.12104,CWE-843,"Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.",2017-10-22,CISA,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:*;cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:google:chrome_os:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2017-1130,0.0,,0.29222,NVD-CWE-noinfo,"IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it would open up many file select dialog boxes which would cause the client hang and have to be restarted. IBM X-Force ID: 121371.",2017-09-05,Metasploit,cpe:2.3:a:ibm:inotes:8.5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:8.5.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:8.5.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:8.5.1.5:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:8.5.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:8.5.2.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:8.5.2.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:8.5.3.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:8.5.3.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:8.5.3.6:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:9.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:9.0.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:9.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:inotes:9.0.1.8:*:*:*:*:*:*:*,Ibm,Inotes
CVE-2017-11317,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.83476,CWE-326,"Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.",2017-08-23,CISA/Metasploit,cpe:2.3:a:telerik:ui_for_asp.net_ajax:*:*:*:*:*:*:*:*;cpe:2.3:a:telerik:ui_for_asp.net_ajax:2017.2.503:*:*:*:*:*:*:*;cpe:2.3:a:telerik:ui_for_asp.net_ajax:2017.2.621:*:*:*:*:*:*:*,Telerik,Ui For Asp.Net Ajax
CVE-2017-11357,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.75709,CWE-434,"Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.",2017-08-23,CISA,cpe:2.3:a:progress:telerik_ui_for_asp.net_ajax:*:*:*:*:*:*:*:*,Progress,Telerik Ui For Asp.Net Ajax
CVE-2017-11391,0.0,,0.61777,CWE-77,"Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the ""t"" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4744.",2017-08-03,Metasploit,cpe:2.3:a:trendmicro:interscan_messaging_security_virtual_appliance:9.0:*:*:*:*:*:*:*;cpe:2.3:a:trendmicro:interscan_messaging_security_virtual_appliance:9.1:*:*:*:*:*:*:*,Trendmicro,Interscan Messaging Security Virtual Appliance
CVE-2017-11392,0.0,,0.33763,CWE-77,"Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the ""T"" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4745.",2017-08-03,Metasploit,cpe:2.3:a:trendmicro:interscan_messaging_security_virtual_appliance:9.0:*:*:*:*:*:*:*;cpe:2.3:a:trendmicro:interscan_messaging_security_virtual_appliance:9.1:*:*:*:*:*:*:*,Trendmicro,Interscan Messaging Security Virtual Appliance
CVE-2017-11394,0.0,,0.66774,CWE-20,Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the T parameter within Proxy.php. Formerly ZDI-CAN-4544.,2017-08-03,Metasploit,cpe:2.3:a:trendmicro:officescan:11.0:sp1:*:*:*:*:*:*;cpe:2.3:a:trendmicro:officescan:12.0:*:*:*:*:*:*:*,Trendmicro,Officescan
CVE-2017-11444,0.0,,0.13098,CWE-89,Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.,2017-07-19,Nuclei,cpe:2.3:a:intelliants:subrion_cms:*:*:*:*:*:*:*:*,Intelliants,Subrion Cms
CVE-2017-11467,0.0,,0.73071,CWE-269,"OrientDB through 2.2.22 does not enforce privilege requirements during ""where"" or ""fetchplan"" or ""order by"" use, which allows remote attackers to execute arbitrary OS commands via a crafted request.",2017-07-20,Metasploit,cpe:2.3:a:orientdb:orientdb:*:*:*:*:*:*:*:*,Orientdb,Orientdb
CVE-2017-11512,0.0,,0.79604,CWE-22,The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files.,2017-11-08,Nuclei,cpe:2.3:a:manageengine:servicedesk:9.3.9328:*:*:*:*:*:*:*,Manageengine,Servicedesk
CVE-2017-11517,0.0,,0.29083,CWE-119,Stack-based buffer overflow in GCoreServer.exe in the server in Geutebrueck Gcore 1.3.8.42 and 1.4.2.37 allows remote attackers to execute arbitrary code via a long URI in a GET request.,2017-07-21,Metasploit,cpe:2.3:a:geutebrueck:gcore:1.3.8.42:*:*:*:*:*:*:*;cpe:2.3:a:geutebrueck:gcore:1.4.2.37:*:*:*:*:*:*:*,Geutebrueck,Gcore
CVE-2017-11586,0.0,,0.02286,CWE-601,"dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action, related to controllers/Weixin.php.",2017-07-24,Nuclei,cpe:2.3:a:finecms:finecms:*:*:*:*:*:*:*:*,Finecms,Finecms
CVE-2017-11610,0.0,,0.87544,CWE-276,"The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.",2017-08-23,Metasploit/Nuclei,cpe:2.3:a:redhat:cloudforms:4.5:*:*:*:*:*:*:*;cpe:2.3:a:supervisord:supervisor:*:*:*:*:*:*:*:*;cpe:2.3:a:supervisord:supervisor:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:supervisord:supervisor:3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:supervisord:supervisor:3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:supervisord:supervisor:3.1.3:*:*:*:*:*:*:*;cpe:2.3:a:supervisord:supervisor:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:supervisord:supervisor:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:supervisord:supervisor:3.2.2:*:*:*:*:*:*:*;cpe:2.3:a:supervisord:supervisor:3.2.3:*:*:*:*:*:*:*;cpe:2.3:a:supervisord:supervisor:3.3.0:*:*:*:*:*:*:*;cpe:2.3:a:supervisord:supervisor:3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:supervisord:supervisor:3.3.2:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:26:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2017-11629,0.0,,0.01937,CWE-79,dayrui FineCms through 5.0.10 has Cross Site Scripting (XSS) in controllers/api.php via the function parameter in a c=api&m=data2 request.,2017-07-26,Nuclei,cpe:2.3:a:finecms:finecms:*:*:*:*:*:*:*:*,Finecms,Finecms
CVE-2017-11774,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.59893,CWE-119,"Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka ""Microsoft Outlook Security Feature Bypass Vulnerability.""",2017-10-13,CISA,cpe:2.3:a:microsoft:outlook:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:-:*:*:*;cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:rt:*:*:*;cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:*:*,Microsoft,Outlook
CVE-2017-11826,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.81454,CWE-119,"Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer, Word 2007, 2010, 2013 and 2016, Word Automation Services, and Office Online Server allow remote code execution when the software fails to properly handle objects in memory.",2017-10-13,CISA,cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_online_server:2016:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_web_apps_server:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_web_apps_server:2013:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_word_viewer:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2013:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2013:sp1:*:*:-:*:*:*;cpe:2.3:a:microsoft:word:2013:sp1:*:*:rt:*:*:*;cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:*:*,Microsoft,Office Compatibility Pack
CVE-2017-11882,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.99945,CWE-119,"Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka ""Microsoft Office Memory Corruption Vulnerability"". This CVE ID is unique from CVE-2017-11884.",2017-11-15,CISA/EPSS/Metasploit,cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*,Microsoft,Office
CVE-2017-12138,0.0,,0.03406,CWE-601,XOOPS Core 2.5.8 has a stored URL redirect bypass vulnerability in /modules/profile/index.php because of the URL filter.,2017-08-02,Nuclei,cpe:2.3:a:xoops:xoops:2.5.8:*:*:*:*:*:*:*,Xoops,Xoops
CVE-2017-12149,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.90713,CWE-502,"In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.",2017-10-04,CISA/Metasploit/Nuclei,cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.1:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.2:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.1:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.2:*:*:*:*:*:*:*,Redhat,Jboss Enterprise Application Platform
CVE-2017-12231,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.07128,CWE-399,"A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to the improper translation of H.323 messages that use the Registration, Admission, and Status (RAS) protocol and are sent to an affected device via IPv4 packets. An attacker could exploit this vulnerability by sending a crafted H.323 RAS packet through an affected device. A successful exploit could allow the attacker to cause the affected device to crash and reload, resulting in a DoS condition. This vulnerability affects Cisco devices that are configured to use an application layer gateway with NAT (NAT ALG) for H.323 RAS messages. By default, a NAT ALG is enabled for H.323 RAS messages. Cisco Bug IDs: CSCvc57217.",2017-09-29,CISA,cpe:2.3:h:cisco:1100-4g\/6g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4gltegb_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4gltena_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-6g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-lte_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100_terminal_services_gateways:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1101_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109-2p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1111x-8p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:111x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1120_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1131_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1160_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1801_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1802_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1803_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1811_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1812_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1841_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1861_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1905_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1906c_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1921_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1941_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1941w_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4000_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4221_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8101-32fh:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8101-32h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8102-64h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8201-32fh:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8201:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8202:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8208:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8212:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8218:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_12-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_18-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_4-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_8-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8804:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8808:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8812:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8818:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:9800-40:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:9800-80:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:9800-cl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:9800-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-esp100-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-esp100:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-esp200-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-hx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-hx_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-x_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-hx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-hx_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-x_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002_fixed_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1004:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1006-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1006:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1009-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1013:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1023:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9000:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9000v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9001:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9006:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_900:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-12c-f-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-12c-ft-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-4c-f-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-4c-ft-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-6cz-f-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-6cz-f-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-6cz-fs-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-6cz-fs-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-6cz-ft-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-6cz-ft-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9010:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9010:-:*:*:*:*:*:-:*;cpe:2.3:h:cisco:asr_901s-2sg-f-ah:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901s-2sg-f-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901s-3sg-f-ah:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901s-3sg-f-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901s-4sg-f-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_902:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_902u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_903:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_907:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_914:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-10sz-pd:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-10sz-pd_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-12cz-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-12cz-a_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-12cz-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-12cz-d_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-12sz-im:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-12sz-im_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-24sz-im:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-24sz-im_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-24sz-m:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-24sz-m_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-24tz-m:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-24tz-m_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-4sz-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-4sz-a_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-4sz-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-4sz-d_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920u-12sz-im:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9901:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9902:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9903:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9904:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9906:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9910:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9912:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9920:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9922:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48fd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48fd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48fd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48ur-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48ur-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48ur-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48ur:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uz-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uz-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uz-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uz:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pd:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pdm-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pdm-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pdm-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pdm:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ps-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ps-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24td-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24td-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24td-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ts-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ts-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fqm-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fqm-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fqm-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fqm:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fs-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ps-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ps-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48td-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48td-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48td-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48tq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48tq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48tq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ts-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ts-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24pd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24pd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24pd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24uq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24uq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24uq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24uq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12s-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12x48u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-16xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-16xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24p-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24pw-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24s-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24t-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xs:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-32xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-32xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48f-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48f-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48f-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48p-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48pw-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48t-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-f-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-f-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-nm-2-40g:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-nm-8-10g:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8200:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-1n1s-4t2x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-1n1s-6t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-2n2s-4t2x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-2n2s-6t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8500-4qc:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8500:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8500l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8510csr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8510msr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8540csr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8540msr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9200:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9200cx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9200l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24p-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24s-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24t-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24u-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24ux-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24ux-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48p-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48s-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48t-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48u-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48un-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48un-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48uxm-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48uxm-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24p-4g-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24p-4g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24p-4x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24p-4x-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24t-4g-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24t-4g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24t-4x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24t-4x-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48p-4g-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48p-4g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48p-4x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48p-4x-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48t-4g-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48t-4g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48t-4x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48t-4x-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l_stack:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300lm:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9500:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9500h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9600:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9600_supervisor_engine-1:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9600x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-40:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-40_wireless_controller:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-80:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-80_wireless_controller:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-cl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-l-c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-l-f:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800_embedded_wireless_controller:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3200_rugged_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3300_rugged_switch:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*,Cisco,Ios
CVE-2017-12232,6.5,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.02171,CWE-399,"A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS 15.0 through 15.6 could allow an unauthenticated, adjacent attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to a misclassification of Ethernet frames. An attacker could exploit this vulnerability by sending a crafted Ethernet frame to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvc03809.",2017-09-29,CISA,cpe:2.3:h:cisco:1000_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4g\/6g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4gltegb_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4gltena_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-lte_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1101_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109-2p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1111x-8p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1111x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:111x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1120_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1131_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1160_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1801_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1802_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1803_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1811_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1812_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1841_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1861_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1905_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1906c_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1921_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1941_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1941w_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4000_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4221_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:422_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321\/k9_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331\/k9_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351\/k9_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4431_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:44461_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4451-x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4451_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4461_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:829_industrial_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:829_industrial_integrated_services_routers:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:829_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:860vae-w_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:861_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:861w_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:866vae_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:867_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:867vae_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:871_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:880-voice_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:880_3g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:881-cube_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:881_3g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:881_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:881w_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:886_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:886va-cube_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:886va-w_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:886va_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:886vag_3g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:887_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:887v_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:887va-cube_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:887va-w_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:887va_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:887vag_3g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:887vam-w_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:887vamg_3g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:888-cube_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:888_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:888e-cube_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:888e_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:888eg_3g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:888w_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:891-24x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:891_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:891w_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:892_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:892f-cube_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:892w_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-esp100-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-esp100:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-esp200-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000_:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-hx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-hx_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-x_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-hx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-hx_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-x_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1004:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1006-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1006:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1009-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1013:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1023:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8200:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-1n1s-4t2x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-1n1s-6t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-2n2s-4t2x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-2n2s-6t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8500-4qc:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8500:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8500l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8510csr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8510msr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8540csr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8540msr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:cloud_services_router_1000v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:integrated_services_virtual_router:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*,Cisco,Ios
CVE-2017-12233,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.07128,CWE-20,"Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerabilities are due to the improper parsing of crafted CIP packets destined to an affected device. An attacker could exploit these vulnerabilities by sending crafted CIP packets to be processed by an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuz95334.",2017-09-29,CISA,cpe:2.3:h:cisco:1000_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4g\/6g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4gltegb_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4gltena_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-6g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-8p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-lte_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100_terminal_services_gateways:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1101-4p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1101_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109-2p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109-4p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1111-4pwe:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1111-8pwb:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1111x-8p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1113-8plteeawe:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1113-8pmwe:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1113-8pwe:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1116-4plteeawe:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1116-4pwe:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1117-4plteeawe:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1117-4pmlteeawe:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1117-4pmwe:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1117-4pwe:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1120:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1120_connected_grid_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1120_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1131_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1160_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1801_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1802_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1803_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1811_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1812_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1841_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1861_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1905_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1906c_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1921_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1941_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1941w_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3200_rugged_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3300_rugged_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3400_heavy_duty_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3400_rugged_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie9300:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:esr-6300-con-k9:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:esr-6300-ncp-k9:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*,Cisco,Ios
CVE-2017-12234,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.07128,CWE-20,"Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerabilities are due to the improper parsing of crafted CIP packets destined to an affected device. An attacker could exploit these vulnerabilities by sending crafted CIP packets to be processed by an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvc43709.",2017-09-29,CISA,cpe:2.3:h:cisco:1000_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4g\/6g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4gltegb_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4gltena_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-6g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-8p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-lte_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100_terminal_services_gateways:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1101-4p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1101_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109-2p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109-4p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1111-4pwe:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1111-8pwb:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1111x-8p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1113-8plteeawe:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1113-8pmwe:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1113-8pwe:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1116-4plteeawe:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1116-4pwe:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1117-4plteeawe:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1117-4pmlteeawe:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1117-4pmwe:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1117-4pwe:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1120:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1120_connected_grid_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1120_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1131_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1160_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1801_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1802_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1803_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1811_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1812_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1841_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1861_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1905_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1906c_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1921_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1941_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1941w_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3200_rugged_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3300_rugged_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3400_heavy_duty_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3400_rugged_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie9300:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:esr-6300-con-k9:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:esr-6300-ncp-k9:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*,Cisco,Ios
CVE-2017-12235,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.07128,CWE-20,"A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS 12.2 through 15.6 could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to the improper parsing of ingress PN-DCP Identify Request packets destined to an affected device. An attacker could exploit this vulnerability by sending a crafted PN-DCP Identify Request packet to an affected device and then continuing to send normal PN-DCP Identify Request packets to the device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. This vulnerability affects Cisco devices that are configured to process PROFINET messages. Beginning with Cisco IOS Software Release 12.2(52)SE, PROFINET is enabled by default on all the base switch module and expansion-unit Ethernet ports. Cisco Bug IDs: CSCuz47179.",2017-09-29,CISA,cpe:2.3:h:cisco:industrial_ethernet_2000_16ptc-g-e_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_16ptc-g-l_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_16ptc-g-nx_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_16t67-b_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_16t67p-g-e_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_16tc-g-e_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_16tc-g-l_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_16tc-g-n_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_16tc-g-x_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_16tc-l_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_24t67-b_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_4s-ts-g-b_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_4s-ts-g-l_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_4t-b_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_4t-g-b_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_4t-g-l_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_4t-l_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_4ts-b_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_4ts-g-b_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_4ts-g-l_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_4ts-l_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_8t67-b_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_8t67p-g-e_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_8tc-b_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_8tc-g-b_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_8tc-g-e_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_8tc-g-l_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_8tc-g-n_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_8tc-l_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:industrial_ethernet_2000_series_firmware:15.2\(5.4.32i\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*,Cisco,Ios
CVE-2017-12237,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.07128,CWE-399,"A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to how an affected device processes certain IKEv2 packets. An attacker could exploit this vulnerability by sending specific IKEv2 packets to an affected device to be processed. A successful exploit could allow the attacker to cause high CPU utilization, traceback messages, or a reload of the affected device that leads to a DoS condition. This vulnerability affects Cisco devices that have the Internet Security Association and Key Management Protocol (ISAKMP) enabled. Although only IKEv2 packets can be used to trigger this vulnerability, devices that are running Cisco IOS Software or Cisco IOS XE Software are vulnerable when ISAKMP is enabled. A device does not need to be configured with any IKEv2-specific features to be vulnerable. Many features use IKEv2, including different types of VPNs such as the following: LAN-to-LAN VPN; Remote-access VPN, excluding SSL VPN; Dynamic Multipoint VPN (DMVPN); and FlexVPN. Cisco Bug IDs: CSCvc41277.",2017-09-29,CISA,cpe:2.3:h:cisco:1000_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4g\/6g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4gltegb_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4gltena_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-6g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-lte_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1101_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109-2p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1111x-8p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1111x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1120_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1131_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1160_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1240_connected_grid_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1801_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1802_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1803_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1811_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1812_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1841_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1861_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1905_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1906c_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1921_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1941_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1941w_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4000_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4221_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:422_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321\/k9_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331\/k9_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351\/k9_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4431_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:44461_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4451-x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4451_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4461_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8101-32fh:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8101-32h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8102-64h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8201-32fh:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8201:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8202:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8208:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8212:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8218:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_12-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_18-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_4-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_8-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8804:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8808:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8812:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8818:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8831:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:9800-40:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:9800-80:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:9800-cl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:9800-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-hx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-hx_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-x_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-hx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-hx_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-x_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1004:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1006-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1006:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1009-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1013:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1023:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48fd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48fd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48fd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48ur-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48ur-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48ur-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48ur:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uz-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uz-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uz-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uz:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pd:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pdm-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pdm-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pdm-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pdm:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ps-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ps-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24td-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24td-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24td-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ts-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ts-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fqm-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fqm-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fqm-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fqm:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fs-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ps-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ps-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48td-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48td-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48td-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48tq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48tq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48tq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ts-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ts-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24pd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24pd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24pd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24uq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24uq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24uq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24uq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12s-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12x48u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-16xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-16xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24p-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24pw-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24s-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24t-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xs:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-32xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-32xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48f-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48f-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48f-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48p-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48pw-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48t-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-f-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-f-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-nm-2-40g:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-nm-8-10g:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8200:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-1n1s-4t2x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-1n1s-6t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-2n2s-4t2x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-2n2s-6t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8500-4qc:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8500:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8500l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8510csr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8510msr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8540csr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8540msr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9200:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9200cx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9200l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24p-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24s-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24t-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24u-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24ux-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24ux-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48p-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48s-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48t-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48u-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48un-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48un-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48uxm-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48uxm-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24p-4g-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24p-4g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24p-4x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24p-4x-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24t-4g-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24t-4g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24t-4x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24t-4x-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48p-4g-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48p-4g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48p-4x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48p-4x-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48t-4g-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48t-4g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48t-4x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48t-4x-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l_stack:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300lm:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9400:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9400_supervisor_engine-1:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9407r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9410r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9500:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9500h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9600:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9600_supervisor_engine-1:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9600x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-cl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-l-c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-l-f:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3200_rugged_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3300_rugged_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3400_heavy_duty_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3400_rugged_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie9300:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:cbr-8_converged_broadband_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:esr-6300-con-k9:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:esr-6300-ncp-k9:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:esr6300:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:integrated_services_virtual_router:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*,Cisco,Ios
CVE-2017-12238,6.5,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.02034,CWE-399,"A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS 15.0 through 15.4 for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a C6800-16P10G or C6800-16P10G-XL type line card to crash, resulting in a denial of service (DoS) condition. The vulnerability is due to a memory management issue in the affected software. An attacker could exploit this vulnerability by creating a large number of VPLS-generated MAC entries in the MAC address table of an affected device. A successful exploit could allow the attacker to cause a C6800-16P10G or C6800-16P10G-XL type line card to crash, resulting in a DoS condition. This vulnerability affects Cisco Catalyst 6800 Series Switches that are running a vulnerable release of Cisco IOS Software and have a Cisco C6800-16P10G or C6800-16P10G-XL line card in use with Supervisor Engine 6T. To be vulnerable, the device must also be configured with VPLS and the C6800-16P10G or C6800-16P10G-XL line card needs to be the core-facing MPLS interfaces. Cisco Bug IDs: CSCva61927.",2017-09-29,CISA,cpe:2.3:h:cisco:c6800-16p10g-xl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:c6800-16p10g:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6000:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6000_ws-svc-nam-1:2.2\(1a\):*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6000_ws-svc-nam-1:3.1\(1a\):*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6000_ws-svc-nam-2:2.2\(1a\):*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6000_ws-svc-nam-2:3.1\(1a\):*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6000_ws-x6380-nam:2.1\(2\):*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6000_ws-x6380-nam:3.1\(1a\):*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6500-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6500:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6500_ws-svc-nam-1:2.2\(1a\):*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6500_ws-svc-nam-1:3.1\(1a\):*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6500_ws-svc-nam-2:2.2\(1a\):*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6500_ws-svc-nam-2:3.1\(1a\):*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6500_ws-x6380-nam:2.1\(2\):*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6500_ws-x6380-nam:3.1\(1a\):*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6503-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6504-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6506-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6509-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6509-neb-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6509-v-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6513-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_6513:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*,Cisco,Ios
CVE-2017-12240,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.13883,CWE-20,"The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system. The attacker could also cause an affected system to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to a buffer overflow condition in the DHCP relay subsystem of the affected software. An attacker could exploit this vulnerability by sending a crafted DHCP Version 4 (DHCPv4) packet to an affected system. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a DoS condition. Cisco Bug IDs: CSCsm45390, CSCuw77959.",2017-09-29,CISA,cpe:2.3:h:cisco:1000_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4gltegb_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4gltena_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-6g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-lte_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1101_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109-2p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1111x-8p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1111x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:111x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1120_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1131_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1160_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1801_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1802_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1803_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1811_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1812_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1841_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1861_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1905_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1906c_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1921_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1941_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1941w_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4000_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4221_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:422_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8101-32fh:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8101-32h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8102-64h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8201-32fh:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8201:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8202:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8208:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8212:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8218:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_12-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_18-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_4-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_8-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8804:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8808:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8812:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8818:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8831:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:9800-40:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:9800-80:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:9800-cl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:9800-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-esp100-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-esp100:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-esp200-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-hx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-hx_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-x_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-hx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-hx_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-x_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1004:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1006-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1006:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1009-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1013:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1023:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9000:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9000v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9001:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9006:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_900:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-12c-f-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-12c-ft-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-4c-f-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-4c-ft-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-6cz-f-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-6cz-f-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-6cz-fs-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-6cz-fs-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-6cz-ft-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-6cz-ft-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9010:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901s-2sg-f-ah:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901s-2sg-f-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901s-3sg-f-ah:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901s-3sg-f-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901s-4sg-f-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_902:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_902u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_903:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_907:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_914:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-10sz-pd:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-10sz-pd_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-10sz-pd_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-12cz-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-12cz-a_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-12cz-a_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-12cz-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-12cz-d_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-12cz-d_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-12sz-im:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-12sz-im_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-12sz-im_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-24sz-im:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-24sz-im_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-24sz-im_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-24sz-m:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-24sz-m_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-24sz-m_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-24tz-m:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-24tz-m_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-24tz-m_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-4sz-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-4sz-a_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-4sz-a_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-4sz-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-4sz-d_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920-4sz-d_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_920u-12sz-im:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9901:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9902:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9903:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9904:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9906:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9910:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9912:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9920:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9922:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48fd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48fd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48fd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48ur-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48ur-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48ur-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48ur:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uz-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uz-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uz-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uz:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pd:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pdm-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pdm-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pdm-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pdm:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ps-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ps-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24td-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24td-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24td-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ts-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ts-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fqm-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fqm-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fqm-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fqm:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fs-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ps-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ps-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48td-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48td-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48td-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48tq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48tq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48tq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ts-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ts-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24pd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24pd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24pd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24uq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24uq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24uq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24uq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12s-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12x48u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-16xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-16xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24p-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24pw-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24s-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24t-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xs:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-32xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-32xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48f-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48f-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48f-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48p-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48pw-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48t-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-f-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-f-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-nm-2-40g:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-nm-8-10g:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*,Cisco,Ios
CVE-2017-12319,5.9,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H,0.05347,CWE-20,"A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability. The vulnerability exists due to changes in the implementation of the BGP MPLS-Based Ethernet VPN RFC (RFC 7432) draft between IOS XE software releases. When the BGP Inclusive Multicast Ethernet Tag Route or BGP EVPN MAC/IP Advertisement Route update packet is received, it could be possible that the IP address length field is miscalculated. An attacker could exploit this vulnerability by sending a crafted BGP packet to an affected device after the BGP session was established. An exploit could allow the attacker to cause the affected device to reload or corrupt the BGP routing table; either outcome would result in a DoS. The vulnerability may be triggered when the router receives a crafted BGP message from a peer on an existing BGP session. This vulnerability affects all releases of Cisco IOS XE Software prior to software release 16.3 that support BGP EVPN configurations. If the device is not configured for EVPN, it is not vulnerable. Cisco Bug IDs: CSCui67191, CSCvg52875.",2018-03-27,CISA,cpe:2.3:h:cisco:1000_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4g\/6g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4gltegb_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4gltena_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-6g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-lte_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1101_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109-2p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1111x-8p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1111x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:111x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1120_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1131_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1160_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1801_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1802_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1803_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1811_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1812_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1841_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1861_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1905_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1906c_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1921_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1941_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1941w_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4000_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4221_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:422_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321\/k9_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331\/k9_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351\/k9_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4431_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:44461_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4451-x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4451_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4461_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8101-32fh:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8101-32h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8102-64h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8201-32fh:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8201:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8202:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8208:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8212:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8218:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_12-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_18-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_4-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_8-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8804:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8808:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8812:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8818:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8831:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:9800-40:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:9800-80:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:9800-cl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:9800-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-esp100-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-esp100:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-esp200-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-hx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-hx_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-x_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-hx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-hx_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-x_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1004:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1006-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1006:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1009-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1013:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1023:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_900:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-12c-f-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-12c-ft-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-4c-f-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-4c-ft-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-6cz-f-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-6cz-f-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-6cz-fs-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-6cz-fs-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-6cz-ft-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-6cz-ft-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901s-2sg-f-ah:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901s-2sg-f-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901s-3sg-f-ah:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901s-3sg-f-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901s-4sg-f-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_902:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_902u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8200:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-1n1s-4t2x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-1n1s-6t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-2n2s-4t2x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-2n2s-6t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8500-4qc:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8500:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8500l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8510csr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8510msr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8540csr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8540msr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9200:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9200cx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9200l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24p-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24s-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24t-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24u-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24ux-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24ux-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48p-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48s-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48t-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48u-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48un-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48un-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48uxm-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48uxm-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24p-4g-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24p-4g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24p-4x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24p-4x-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24t-4g-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24t-4g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24t-4x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24t-4x-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48p-4g-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48p-4g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48p-4x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48p-4x-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48t-4g-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48t-4g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48t-4x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48t-4x-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l_stack:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300lm:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9400:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9400_supervisor_engine-1:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9407r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9410r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9500:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9500h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9600:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9600_supervisor_engine-1:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9600x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-40:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-80:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-cl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-l-c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-l-f:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3200_rugged_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3300_rugged_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:cloud_services_router_1000v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:esr-6300-con-k9:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:esr-6300-ncp-k9:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:integrated_services_virtual_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:network_convergence_system_520:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*,Cisco,Ios
CVE-2017-12373,0.0,,0.12798,CWE-200,"A vulnerability in the TLS protocol implementation of legacy Cisco ASA 5500 Series (ASA 5505, 5510, 5520, 5540, and 5550) devices could allow an unauthenticated, remote attacker to access sensitive information, aka a Return of Bleichenbacher's Oracle Threat (ROBOT) attack. An attacker could iteratively query a server running a vulnerable TLS stack implementation to perform cryptanalytic operations that may allow decryption of previously captured TLS sessions. Cisco Bug IDs: CSCvg97652.",2017-12-15,Metasploit,cpe:2.3:h:cisco:adaptive_security_appliance_5505:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:adaptive_security_appliance_5510:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:adaptive_security_appliance_5520:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:adaptive_security_appliance_5540:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:adaptive_security_appliance_5550:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_5505_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_5510_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_5520_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_5540_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_5550_firmware:-:*:*:*:*:*:*:*,Cisco,Adaptive Security Appliance 5505 Firmware
CVE-2017-12477,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.68217,CWE-287,"It was discovered that the bpserverd proprietary protocol in Unitrends Backup (UB) before 10.0.0, as invoked through xinetd, has an issue in which its authentication can be bypassed. A remote attacker could use this issue to execute arbitrary commands with root privilege on the target system.",2017-08-07,Metasploit,cpe:2.3:a:kaseya:unitrends_backup:*:*:*:*:*:*:*:*,Kaseya,Unitrends Backup
CVE-2017-12478,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.78269,CWE-287,It was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of its input parameters was not validated. A remote attacker could use this flaw to bypass authentication and execute arbitrary commands with root privilege on the target system.,2017-08-07,Metasploit,cpe:2.3:a:kaseya:unitrends_backup:*:*:*:*:*:*:*:*,Kaseya,Unitrends Backup
CVE-2017-12542,0.0,,0.99335,NVD-CWE-noinfo,A authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 (iLO 4) version prior to 2.53 was found.,2018-02-15,EPSS/Metasploit/Nuclei,cpe:2.3:h:hp:integrated_lights-out_4:-:*:*:*:*:*:*:*;cpe:2.3:o:hp:integrated_lights-out_4_firmware:*:*:*:*:*:*:*:*,Hp,Integrated Lights-Out 4 Firmware
CVE-2017-12544,0.0,,0.04601,CWE-79,A cross-site scripting vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.,2018-02-15,Nuclei,cpe:2.3:a:hp:system_management_homepage:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2017-12557,0.0,,0.80119,CWE-502,A Remote Code Execution vulnerability in HPE intelligent Management Center (iMC) PLAT version IMC Plat 7.3 E0504P2 and earlier was found.,2018-02-15,Metasploit,cpe:2.3:a:hp:intelligent_management_center:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:7.3:e0504p2:*:*:*:*:*:*,Hp,Intelligent Management Center
CVE-2017-12583,0.0,,0.03253,CWE-79,DokuWiki through 2017-02-19b has XSS in the at parameter (aka the DATE_AT variable) to doku.php.,2017-08-06,Nuclei,cpe:2.3:a:dokuwiki:dokuwiki:*:*:*:*:*:*:*:*,Dokuwiki,Dokuwiki
CVE-2017-12611,0.0,,0.8802,CWE-20,"In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.",2017-09-20,Nuclei,cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.11:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.13:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.17:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.19:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.20.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.21:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.22:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.23:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.24.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.24.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.25:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.26:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.27:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.28.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.29:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.30:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.31:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.32:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.33:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.5.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.5.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.5.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.5.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.5.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.5.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.5.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.5.8:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.5.9:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.5:beta1:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.5:beta2:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.5:beta3:*:*:*:*:*:*,Apache,Struts
CVE-2017-12615,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99607,CWE-434,When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.,2017-09-19,CISA/EPSS/Nuclei,cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.4:*:*:*:*:*:*:*;cpe:2.3:a:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.6:*:*:*:*:*:*:*;cpe:2.3:a:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.7:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_web_server:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_web_server_text-only_advisories:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus_compute_node:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus_compute_node:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus_compute_node:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus_compute_node:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.4_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.5_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.6_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.7_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.4_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.5_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.6_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.7_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.4_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.5_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.6_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.7_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:7.4_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:7.6_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:7.7_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.2_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2017-12617,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99988,CWE-434,"When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.",2017-10-04,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*;cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*;cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:agile_plm:9.3.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:agile_plm:9.3.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_for_mysql_database:12.1.0.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:fmw_platform:12.2.1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:fmw_platform:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:health_sciences_empirica_inspections:1.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:management_pack:11.2.1.0.13:*:*:*:*:goldengate:*:*;cpe:2.3:a:oracle:micros_lucas:2.9.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.6.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.8.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.8.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_advanced_inventory_planning:13.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_advanced_inventory_planning:13.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_advanced_inventory_planning:15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_back_office:14.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_back_office:14.1.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_central_office:14.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_central_office:14.1.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_convenience_and_fuel_pos_software:2.1.132:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_eftlink:1.1.124:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_eftlink:15.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_eftlink:16.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_insights:14.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_insights:14.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_insights:15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_insights:16.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_invoice_matching:12.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_invoice_matching:13.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_invoice_matching:13.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_invoice_matching:13.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_invoice_matching:14.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_invoice_matching:14.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_invoice_matching:15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_invoice_matching:16.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_order_broker:5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_order_broker:5.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_order_broker:5.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_order_management_system:4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_order_management_system:4.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_order_management_system:4.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_order_management_system:5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_point-of-service:14.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_point-of-service:14.1.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_price_management:12.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_price_management:13.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_price_management:13.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_price_management:13.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_price_management:14.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_price_management:14.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_price_management:15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_price_management:16.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_returns_management:14.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_returns_management:14.1.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_returns_management:2.3.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_returns_management:2.4.9:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_store_inventory_management:12.0.12:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_store_inventory_management:13.0.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_store_inventory_management:13.1.9:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_store_inventory_management:13.2.9:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_store_inventory_management:14.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_store_inventory_management:15.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_store_inventory_management:16.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:6.0.11:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:7.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:transportation_management:6.3.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:transportation_management:6.3.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:transportation_management:6.3.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:transportation_management:6.3.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:transportation_management:6.3.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:transportation_management:6.3.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:transportation_management:6.3.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:tuxedo_system_and_applications_monitor:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_sites:11.1.1.8.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:workload_manager:12.2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_web_server:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_web_server_text-only_advisories:-:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:esm:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:netapp:element:-:*:*:*:*:vcenter_server:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus_compute_node:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus_compute_node:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus_compute_node:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus_compute_node:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.0_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.4_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.5_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.6_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.7_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.4_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.5_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.6_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.7_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.4_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.5_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.6_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.7_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2017-12629,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.91896,CWE-611,"Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.",2017-10-14,Nuclei,cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*,Redhat,Enterprise Linux Server
CVE-2017-12635,0.0,,0.99838,CWE-269,"Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges.",2017-11-14,EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:couchdb:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:couchdb:2.0.0:rc1:*:*:*:*:*:*;cpe:2.3:a:apache:couchdb:2.0.0:rc2:*:*:*:*:*:*;cpe:2.3:a:apache:couchdb:2.0.0:rc3:*:*:*:*:*:*;cpe:2.3:a:apache:couchdb:2.0.0:rc4:*:*:*:*:*:*,Apache,Couchdb
CVE-2017-12636,0.0,,0.90602,CWE-78,"CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.",2017-11-14,Metasploit,cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:couchdb:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:couchdb:2.0.0:rc1:*:*:*:*:*:*;cpe:2.3:a:apache:couchdb:2.0.0:rc2:*:*:*:*:*:*;cpe:2.3:a:apache:couchdb:2.0.0:rc3:*:*:*:*:*:*;cpe:2.3:a:apache:couchdb:2.0.0:rc4:*:*:*:*:*:*,Apache,Couchdb
CVE-2017-12637,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.94557,CWE-22,"Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.",2017-08-07,CISA/Nuclei,cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:*,Sap,Netweaver Application Server Java
CVE-2017-12794,0.0,,0.23566,CWE-79,"In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with ""DEBUG = True"" (which makes this page accessible) in your production settings.",2017-09-07,Nuclei,cpe:2.3:a:djangoproject:django:1.10.0:*:*:*:*:*:*:*;cpe:2.3:a:djangoproject:django:1.10.1:*:*:*:*:*:*:*;cpe:2.3:a:djangoproject:django:1.10.2:*:*:*:*:*:*:*;cpe:2.3:a:djangoproject:django:1.10.3:*:*:*:*:*:*:*;cpe:2.3:a:djangoproject:django:1.10.4:*:*:*:*:*:*:*;cpe:2.3:a:djangoproject:django:1.10.5:*:*:*:*:*:*:*;cpe:2.3:a:djangoproject:django:1.10.6:*:*:*:*:*:*:*;cpe:2.3:a:djangoproject:django:1.10.7:*:*:*:*:*:*:*;cpe:2.3:a:djangoproject:django:1.11.0:*:*:*:*:*:*:*;cpe:2.3:a:djangoproject:django:1.11.1:*:*:*:*:*:*:*;cpe:2.3:a:djangoproject:django:1.11.2:*:*:*:*:*:*:*;cpe:2.3:a:djangoproject:django:1.11.3:*:*:*:*:*:*:*;cpe:2.3:a:djangoproject:django:1.11.4:*:*:*:*:*:*:*,Djangoproject,Django
CVE-2017-13067,0.0,,0.16678,NVD-CWE-noinfo,QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.3.0299 build 20170901. This particular vulnerability allows a remote attacker to execute commands on a QNAP NAS using a transcoding service on port 9251. A remote user does not require any privileges to successfully execute an attack.,2017-09-14,Metasploit,cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*,Qnap,Qts
CVE-2017-13098,0.0,,0.24282,CWE-203,"BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable application. This vulnerability is referred to as ""ROBOT.""",2017-12-13,Metasploit,cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:*,Bouncycastle,Bc-Java
CVE-2017-13099,0.0,,0.24922,CWE-203,"wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable wolfSSL application. This vulnerability is referred to as ""ROBOT.""",2017-12-13,Metasploit,cpe:2.3:a:arubanetworks:instant:*:*:*:*:*:*:*:*;cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_w1750d:-:*:*:*:*:*:*:*;cpe:2.3:o:siemens:scalance_w1750d_firmware:*:*:*:*:*:*:*:*,Siemens,Scalance W1750D Firmware
CVE-2017-13156,0.0,,0.20089,CWE-434,"An elevation of privilege vulnerability in the Android system (art). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-64211847.",2017-12-06,Metasploit,cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*;cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*;cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*;cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*;cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*,Google,Android
CVE-2017-13696,0.0,,0.79354,CWE-119,"A buffer overflow vulnerability lies in the web server component of Dup Scout Enterprise 9.9.14, Disk Savvy Enterprise 9.9.14, Sync Breeze Enterprise 9.9.16, and Disk Pulse Enterprise 9.9.16 where an attacker can craft a malicious GET request and exploit the web server component. Successful exploitation of the software will allow an attacker to gain complete access to the system with NT AUTHORITY / SYSTEM level privileges. The vulnerability lies due to improper handling and sanitization of the incoming request.",2018-01-24,Metasploit,cpe:2.3:a:flexense:diskpulse:9.9.16:*:*:*:enterprise:*:*:*;cpe:2.3:a:flexense:disksavvy:9.9.14:*:*:*:enterprise:*:*:*;cpe:2.3:a:flexense:dupscout:9.9.14:*:*:*:enterprise:*:*:*;cpe:2.3:a:flexense:syncbreeze:9.9.16:*:*:*:enterprise:*:*:*,Flexense,Dupscout
CVE-2017-13708,0.0,,0.11726,CWE-119,Buffer overflow in the web server service in VX Search Enterprise 10.0.14 allows remote attackers to execute arbitrary code via a crafted GET request.,2017-08-31,Metasploit,cpe:2.3:a:vxsearch:vx_search:10.0.14:*:*:*:enterprise:*:*:*,Vxsearch,Vx Search
CVE-2017-13861,0.0,,0.14888,CWE-119,"An issue was discovered in certain Apple products. iOS before 11.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the ""IOSurface"" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.",2017-12-25,Metasploit,cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Iphone Os
CVE-2017-13872,0.0,,0.36886,CWE-287,"An issue was discovered in certain Apple products. macOS High Sierra before Security Update 2017-001 is affected. The issue involves the ""Directory Utility"" component. It allows attackers to obtain administrator access without a password via certain interactions involving entry of the root user name.",2017-11-29,Metasploit,cpe:2.3:o:apple:mac_os_x:10.13.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.13.1:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2017-14016,0.0,,0.16043,CWE-121,"A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. The application lacks proper validation of the length of user-supplied data prior to copying it to a stack-based buffer, which could allow an attacker to execute arbitrary code under the context of the process.",2017-11-06,Metasploit,cpe:2.3:a:advantech:webaccess:*:*:*:*:*:*:*:*,Advantech,Webaccess
CVE-2017-14117,0.0,,0.08024,CWE-287,"The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures an unauthenticated proxy service on WAN TCP port 49152, which allows remote attackers to establish arbitrary TCP connections to intranet hosts by sending \x2a\xce\x01 followed by other predictable values.",2017-09-03,Metasploit,cpe:2.3:h:commscope:arris_nvg589:-:*:*:*:*:*:*:*;cpe:2.3:h:commscope:arris_nvg599:-:*:*:*:*:*:*:*;cpe:2.3:o:att:u-verse_firmware:9.2.2h0d83:*:*:*:*:*:*:*,Att,U-Verse Firmware
CVE-2017-14135,0.0,,0.21842,CWE-78,enigma2-plugins/blob/master/webadmin/src/WebChilds/Script.py in the webadmin plugin for opendreambox 2.0.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the command parameter to the /script URI.,2017-09-04,Nuclei,cpe:2.3:a:dreambox:opendreambox:2.0:*:*:*:*:*:*:*,Dreambox,Opendreambox
CVE-2017-14143,0.0,,0.75497,CWE-798,"The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass an intended protection mechanism and consequently conduct PHP object injection attacks and execute arbitrary PHP code via a crafted userzone cookie.",2017-09-19,Metasploit,cpe:2.3:a:kaltura:kaltura_server:*:*:*:*:*:*:*:*,Kaltura,Kaltura Server
CVE-2017-14186,0.0,,0.03718,CWE-79,"A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL VPN web portal allows a remote user to inject arbitrary web script or HTML in the context of the victim's browser via the login redir parameter. An URL Redirection attack may also be feasible by injecting an external URL via the affected parameter.",2017-11-29,Nuclei,cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*,Fortinet,Fortios
CVE-2017-14524,0.0,,0.0294,CWE-601,Multiple open redirect vulnerabilities in OpenText Documentum Administrator 7.2.0180.0055 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a (1) URL in the startat parameter to xda/help/en/default.htm or (2) /%09/ (slash encoded horizontal tab slash) followed by a domain in the redirectUrl parameter to xda/component/virtuallinkconnect.,2017-09-28,Nuclei,cpe:2.3:a:opentext:documentum_administrator:7.2.0180.0055:*:*:*:*:*:*:*;cpe:2.3:a:opentext:documentum_webtop:6.8.0160.0073:*:*:*:*:*:*:*,Opentext,Documentum Administrator
CVE-2017-14535,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.50069,CWE-78,trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.php.,2018-02-16,Nuclei,cpe:2.3:a:netfortris:trixbox:2.8.0.4:*:*:*:*:*:*:*,Netfortris,Trixbox
CVE-2017-14537,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.39486,CWE-22,trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php.,2018-02-16,Nuclei,cpe:2.3:a:netfortris:trixbox:2.8.0.4:*:*:*:*:*:*:*,Netfortris,Trixbox
CVE-2017-14622,0.0,,0.02892,CWE-79,Multiple cross-site scripting (XSS) vulnerabilities in the 2kb Amazon Affiliates Store plugin before 2.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter or (2) kbAction parameter in the kbAmz page to wp-admin/admin.php.,2017-09-28,Nuclei,cpe:2.3:a:2kblater:2kb_amazon_affiliates_store:*:*:*:*:*:wordpress:*:*,2Kblater,2Kb Amazon Affiliates Store
CVE-2017-14627,0.0,,0.19194,CWE-119,"Stack-based buffer overflows in CyberLink LabelPrint 2.5 allow remote attackers to execute arbitrary code via the (1) author (inside the INFORMATION tag), (2) name (inside the INFORMATION tag), (3) artist (inside the TRACK tag), or (4) default (inside the TEXT tag) parameter in an lpp project file.",2017-09-23,Metasploit,cpe:2.3:a:cyberlink:labelprint:2.5:*:*:*:*:*:*:*,Cyberlink,Labelprint
CVE-2017-14651,4.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N,0.03836,CWE-79,WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.,2017-09-21,Nuclei,cpe:2.3:a:wso2:api_manager:2.1.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:app_manager:1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:application_server:5.3.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:business_process_server:3.6.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:business_rules_server:2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:complex_event_processor:4.2.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:dashboard_server:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:data_analytics_server:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:data_services_server:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:wso2:enterprise_integrator:6.1.1:*:*:*:*:*:*:*;cpe:2.3:a:wso2:enterprise_mobility_manager:2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:governance_registry:5.4.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:5.3.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:iot_server:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:machine_learner:1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:message_broker:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:storage_server:1.5.0:*:*:*:*:*:*:*,Wso2,Api Manager
CVE-2017-14706,0.0,,0.28243,CWE-287,"DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /webservices/download/index.php, and then reading the iToken field in the reply. This affects DenyAll i-Suite LTS 5.5.0 through 5.5.12, i-Suite 5.6, Web Application Firewall 5.7, and Web Application Firewall 6.x before 6.4.1, with On Premises or AWS/Azure cloud deployments.",2017-09-22,Metasploit,cpe:2.3:a:denyall:i-suite:5.5.0:*:*:*:lts:*:*:*;cpe:2.3:a:denyall:i-suite:5.5.10:*:*:*:lts:*:*:*;cpe:2.3:a:denyall:i-suite:5.5.11:*:*:*:lts:*:*:*;cpe:2.3:a:denyall:i-suite:5.5.12:*:*:*:lts:*:*:*;cpe:2.3:a:denyall:i-suite:5.5.9:*:*:*:lts:*:*:*;cpe:2.3:a:denyall:i-suite:5.6.0:*:*:*:lts:*:*:*;cpe:2.3:a:denyall:web_application_firewall:5.7.0:*:*:*:*:*:*:*;cpe:2.3:a:denyall:web_application_firewall:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:denyall:web_application_firewall:6.1.0:*:*:*:*:*:*:*;cpe:2.3:a:denyall:web_application_firewall:6.2.0:*:*:*:*:*:*:*;cpe:2.3:a:denyall:web_application_firewall:6.3.0:*:*:*:*:*:*:*;cpe:2.3:a:denyall:web_application_firewall:6.4.0:*:*:*:*:*:*:*,Denyall,I-Suite
CVE-2017-14725,0.0,,0.02277,CWE-601,"Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php.",2017-09-23,Nuclei,cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*,Wordpress,Wordpress
CVE-2017-14849,0.0,,0.54389,CWE-22,"Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to "".."" handling was incompatible with the pathname validation used by unspecified community modules.",2017-09-28,Nuclei,cpe:2.3:a:nodejs:node.js:8.5.0:*:*:*:*:*:*:*,Nodejs,Node.Js
CVE-2017-14937,0.0,,0.00994,CWE-327,"The airbag detonation algorithm allows injury to passenger-car occupants via predictable Security Access (SA) data to the internal CAN bus (or the OBD connector). This affects the airbag control units (aka pyrotechnical control units or PCUs) of unspecified passenger vehicles manufactured in 2014 or later, when the ignition is on and the speed is less than 6 km/h. Specifically, there are only 256 possible key pairs, and authentication attempts have no rate limit. In addition, at least one manufacturer's interpretation of the ISO 26021 standard is that it must be possible to calculate the key directly (i.e., the other 255 key pairs must not be used). Exploitation would typically involve an attacker who has already gained access to the CAN bus, and sends a crafted Unified Diagnostic Service (UDS) message to detonate the pyrotechnical charges, resulting in the same passenger-injury risks as in any airbag deployment.",2017-10-20,Metasploit,cpe:2.3:h:pcu:pcu:2014:*:*:*:*:*:*:*,Pcu,Pcu
CVE-2017-14942,0.0,,0.60857,CWE-552,"Intelbras WRN 150 devices allow remote attackers to read the configuration file, and consequently bypass authentication, via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg containing an admin:language=pt cookie.",2017-09-30,Nuclei,cpe:2.3:h:intelbras:wrn_150:-:*:*:*:*:*:*:*;cpe:2.3:o:intelbras:wrn_150_firmware:1.0.1:*:*:*:*:*:*:*,Intelbras,Wrn 150 Firmware
CVE-2017-14980,0.0,,0.22483,CWE-119,Buffer overflow in Sync Breeze Enterprise 10.0.28 allows remote attackers to have unspecified impact via a long username parameter to /login.,2017-10-10,Metasploit,cpe:2.3:a:flexense:syncbreeze:10.0.28:*:*:*:enterprise:*:*:*,Flexense,Syncbreeze
CVE-2017-15222,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.60328,CWE-120,Buffer Overflow vulnerability in Ayukov NFTPD 2.0 and earlier allows remote attackers to execute arbitrary code.,2017-10-24,Metasploit,cpe:2.3:a:nftp_project:nftp:*:*:*:*:*:*:*:*,Nftp Project,Nftp
CVE-2017-15287,0.0,,0.06147,CWE-79,"There is XSS in the BouquetEditor WebPlugin for Dream Multimedia Dreambox devices, as demonstrated by the ""Name des Bouquets"" field, or the file parameter to the /file URI.",2017-10-12,Nuclei,cpe:2.3:a:bouqueteditor_project:bouqueteditor:2.0.0:*:*:*:*:dreambox:*:*,Bouqueteditor Project,Bouqueteditor
CVE-2017-15363,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.15212,CWE-22,"Directory traversal vulnerability in public/examples/resources/getsource.php in Luracast Restler through 3.0.0, as used in the restler extension before 1.7.1 for TYPO3, allows remote attackers to read arbitrary files via the file parameter.",2017-10-15,Nuclei,cpe:2.3:a:luracast:restler:*:*:*:*:*:-:*:*;cpe:2.3:a:luracast:restler:*:*:*:*:*:typo3:*:*,Luracast,Restler
CVE-2017-15647,0.0,,0.26619,CWE-22,"On FiberHome routers, Directory Traversal exists in /cgi-bin/webproc via the getpage parameter in conjunction with a crafted var:page value.",2017-10-19,Nuclei,cpe:2.3:o:fiberhome:routerfiberhome_firmware:*:*:*:*:*:*:*:*,Fiberhome,Routerfiberhome Firmware
CVE-2017-15715,0.0,,0.86006,CWE-20,"In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.",2018-03-26,Nuclei,cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:santricity_cloud_connector:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.6:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2017-15889,0.0,,0.72453,CWE-77,Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authenticated users to execute arbitrary commands via disk field.,2017-12-04,Metasploit,cpe:2.3:o:synology:diskstation_manager:*:*:*:*:*:*:*:*,Synology,Diskstation Manager
CVE-2017-15944,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9834,NVD-CWE-noinfo,"Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface.",2017-12-11,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*,Paloaltonetworks,Pan-Os
CVE-2017-16086,0.0,,0.09242,CWE-400,ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS (Regular Expression Denial of Service) attack when given a specially crafted UserAgent header.,2018-06-07,Metasploit,cpe:2.3:a:ua-parser_project:ua-parser:*:*:*:*:*:node.js:*:*,Ua-Parser Project,Ua-Parser
CVE-2017-16249,0.0,,0.59386,NVD-CWE-noinfo,"The Debut embedded http server contains a remotely exploitable denial of service where a single malformed HTTP POST request can cause the server to hang until eventually replying (~300 seconds) with an HTTP 500 error. While the server is hung, print jobs over the network are blocked and the web interface is inaccessible. An attacker can continuously send this malformed request to keep the device inaccessible to legitimate traffic.",2017-11-10,Metasploit,cpe:2.3:h:brother:dcp-j132w:-:*:*:*:*:*:*:*;cpe:2.3:o:brother:dcp-j132w_firmware:*:*:*:*:*:*:*:*,Brother,Dcp-J132W Firmware
CVE-2017-16524,0.0,,0.30296,CWE-434,"Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'network_ssl_upload.php' allows remote authenticated attackers to upload and execute arbitrary PHP code via a filename with a .php extension, which is then accessed via a direct request to the file in the upload/ directory. To authenticate for this attack, one can obtain web-interface credentials in cleartext by leveraging the existing Local File Read Vulnerability referenced as CVE-2015-8279, which allows remote attackers to read the web-interface credentials via a request for the cslog_export.php?path=/root/php_modules/lighttpd/sbin/userpw URI.",2017-11-06,Metasploit,cpe:2.3:a:hanwhasecurity:web_viewer:1.0.0.193:*:*:*:*:*:*:*;cpe:2.3:h:samsung:srn-1670d:-:*:*:*:*:*:*:*,Samsung,Srn-1670D
CVE-2017-16651,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.36919,CWE-552,"Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.",2017-11-09,CISA/Metasploit,cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*;cpe:2.3:a:roundcube:webmail:1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:roundcube:webmail:1.2.1:*:*:*:*:*:*:*;cpe:2.3:a:roundcube:webmail:1.2.2:*:*:*:*:*:*:*;cpe:2.3:a:roundcube:webmail:1.2.3:*:*:*:*:*:*:*;cpe:2.3:a:roundcube:webmail:1.2.4:*:*:*:*:*:*:*;cpe:2.3:a:roundcube:webmail:1.2.5:*:*:*:*:*:*:*;cpe:2.3:a:roundcube:webmail:1.2.6:*:*:*:*:*:*:*;cpe:2.3:a:roundcube:webmail:1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:roundcube:webmail:1.3.1:*:*:*:*:*:*:*;cpe:2.3:a:roundcube:webmail:1.3.2:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2017-16666,0.0,,0.80098,CWE-78,Xplico before 1.2.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the name of an uploaded PCAP file.  NOTE: this issue can be exploited without authentication by leveraging the user registration feature.,2018-01-05,Metasploit,cpe:2.3:a:xplico:xplico:*:*:*:*:*:*:*:*,Xplico,Xplico
CVE-2017-16709,0.0,,0.71963,NVD-CWE-noinfo,Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote authenticated administrators to execute arbitrary code via unspecified vectors.,2018-07-11,Metasploit,cpe:2.3:h:crestron:airmedia_am-100:-:*:*:*:*:*:*:*;cpe:2.3:h:crestron:airmedia_am-101:-:*:*:*:*:*:*:*;cpe:2.3:o:crestron:airmedia_am-100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:crestron:airmedia_am-101_firmware:*:*:*:*:*:*:*:*,Crestron,Airmedia Am-100 Firmware
CVE-2017-16806,0.0,,0.91496,CWE-22,The Process function in RemoteTaskServer/WebServer/HttpServer.cs in Ulterius before 1.9.5.0 allows HTTP server directory traversal.,2017-11-13,Metasploit/Nuclei,cpe:2.3:a:ulterius:ulterius_server:1.5.6.0:*:*:*:*:*:*:*;cpe:2.3:a:ulterius:ulterius_server:1.8.0.0:*:*:*:*:*:*:*,Ulterius,Ulterius Server
CVE-2017-16877,0.0,,0.14104,CWE-22,"ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information.",2017-11-17,Nuclei,cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*,Zeit,Next.Js
CVE-2017-16894,0.0,,0.8703,CWE-200,"In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework.",2017-11-20,Metasploit/Nuclei,cpe:2.3:a:laravel:laravel:*:*:*:*:*:*:*:*,Laravel,Laravel
CVE-2017-16995,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.30052,CWE-119,The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect sign extension.,2017-12-27,Metasploit,cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2017-17043,0.0,,0.05096,CWE-79,"The Emag Marketplace Connector plugin 1.0.0 for WordPress has reflected XSS because the parameter ""post"" to /wp-content/plugins/emag-marketplace-connector/templates/order/awb-meta-box.php is not filtered correctly.",2017-11-28,Nuclei,cpe:2.3:a:zitec:emag_marketplace_connector:1.0.0:*:*:*:*:wordpress:*:*,Zitec,Emag Marketplace Connector
CVE-2017-17059,0.0,,0.03419,CWE-79,XSS exists in the amtyThumb amty-thumb-recent-post (aka amtyThumb posts or wp-thumb-post) plugin 8.1.3 for WordPress via the query string to amtyThumbPostsAdminPg.php.,2017-11-29,Nuclei,cpe:2.3:a:amtythumb_project:amtythumb:*:*:*:*:*:wordpress:*:*,Amtythumb Project,Amtythumb
CVE-2017-17092,0.0,,0.04132,CWE-79,"wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers to conduct XSS attacks via a crafted file.",2017-12-02,Nuclei,cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2017-17105,0.0,,0.84558,CWE-78,"Zivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 (and possibly in-between versions) web cameras are vulnerable to unauthenticated, blind remote command injection via CGI scripts used as part of the web interface, as demonstrated by a cgi-bin/iptest.cgi?cmd=iptest.cgi&-time=""1504225666237""&-url=$(reboot) request.",2017-12-19,Metasploit,cpe:2.3:h:zivif:pr115-204-p-rs:-:*:*:*:*:*:*:*;cpe:2.3:o:zivif:pr115-204-p-rs_firmware:2.3.4.2103:*:*:*:*:*:*:*;cpe:2.3:o:zivif:pr115-204-p-rs_firmware:4.7.4.2121:*:*:*:*:*:*:*,Zivif,Pr115-204-P-Rs Firmware
CVE-2017-17382,0.0,,0.13817,CWE-327,"Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before build 56.19, and 12.0 before build 53.22 might allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack.",2017-12-13,Metasploit,cpe:2.3:o:citrix:application_delivery_controller_firmware:10.5:*:*:*:*:*:*:*;cpe:2.3:o:citrix:application_delivery_controller_firmware:11.0:*:*:*:*:*:*:*;cpe:2.3:o:citrix:application_delivery_controller_firmware:11.1:*:*:*:*:*:*:*;cpe:2.3:o:citrix:application_delivery_controller_firmware:12.0:*:*:*:*:*:*:*;cpe:2.3:o:citrix:netscaler_gateway_firmware:10.5:*:*:*:*:*:*:*;cpe:2.3:o:citrix:netscaler_gateway_firmware:11.0:*:*:*:*:*:*:*;cpe:2.3:o:citrix:netscaler_gateway_firmware:11.1:*:*:*:*:*:*:*;cpe:2.3:o:citrix:netscaler_gateway_firmware:12.0:*:*:*:*:*:*:*,Citrix,Application Delivery Controller Firmware
CVE-2017-17411,0.0,,0.87929,CWE-78,This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Linksys WVBR0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web management portal. The issue lies in the lack of proper validation of user data before executing a system call. An attacker could leverage this vulnerability to execute code with root privileges. Was ZDI-CAN-4892.,2017-12-21,Metasploit,cpe:2.3:h:linksys:wvbr0:-:*:*:*:*:*:*:*;cpe:2.3:o:linksys:wvbr0_firmware:*:*:*:*:*:*:*:*,Linksys,Wvbr0 Firmware
CVE-2017-17427,0.0,,0.15577,CWE-203,"Radware Alteon devices with a firmware version between 31.0.0.0-31.0.3.0 are vulnerable to an adaptive-chosen ciphertext attack (""Bleichenbacher attack""). This allows an attacker to decrypt observed traffic that has been encrypted with the RSA cipher and to perform other private key operations.",2017-12-13,Metasploit,cpe:2.3:h:radware:alteon:-:*:*:*:*:*:*:*;cpe:2.3:o:radware:alteon_firmware:*:*:*:*:*:*:*:*,Radware,Alteon Firmware
CVE-2017-17428,0.0,,0.14823,CWE-327,"Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack.",2018-03-05,Metasploit,cpe:2.3:a:cavium:nitrox_ssl_sdk:*:*:*:*:*:*:*:*;cpe:2.3:a:cavium:nitrox_v_ssl_sdk:*:*:*:*:*:*:*:*;cpe:2.3:a:cavium:octeon_sdk:*:*:*:*:*:*:*:*;cpe:2.3:a:cavium:octeon_ssl_sdk:*:*:*:*:*:*:*:*;cpe:2.3:a:cavium:turbossl_sdk:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_conect_im:7.24.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings:t31:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings:t32:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ace30_application_control_engine_module:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ace_4710_application_control_engine:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:adaptive_security_appliance_5505:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:adaptive_security_appliance_5510:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:adaptive_security_appliance_5520:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:adaptive_security_appliance_5540:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:adaptive_security_appliance_5550:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ace30_application_control_engine_module_firmware:3.0\(0\)a5\(2.0\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ace30_application_control_engine_module_firmware:3.0\(0\)a5\(3.0\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ace30_application_control_engine_module_firmware:3.0\(0\)a5\(3.5\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ace4710_application_control_engine_firmware:3.0\(0\)a5\(2.0\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ace4710_application_control_engine_firmware:3.0\(0\)a5\(3.0\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ace4710_application_control_engine_firmware:3.0\(0\)a5\(3.5\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_5505_firmware:9.1\(7.16\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_5510_firmware:9.1\(7.16\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_5520_firmware:9.1\(7.16\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_5540_firmware:9.1\(7.16\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_5550_firmware:9.1\(7.16\):*:*:*:*:*:*:*,Cisco,Ace4710 Application Control Engine Firmware
CVE-2017-17451,0.0,,0.05088,CWE-79,The WP Mailster plugin before 1.5.5 for WordPress has XSS in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php.,2017-12-07,Nuclei,cpe:2.3:a:wpmailster:wp_mailster:*:*:*:*:*:wordpress:*:*,Wpmailster,Wp Mailster
CVE-2017-17560,0.0,,0.73404,CWE-287,"An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component, /web/jquery/uploader/multi_uploadify.php, provides multipart upload functionality that is accessible without authentication and can be used to place a file anywhere on the device's file system. This allows an attacker the ability to upload a PHP shell onto the device and obtain arbitrary code execution as root.",2017-12-12,Metasploit,cpe:2.3:h:westerndigital:my_cloud_pr4100:-:*:*:*:*:*:*:*;cpe:2.3:o:westerndigital:my_cloud_pr4100_firmware:2.30.172:*:*:*:*:*:*:*,Westerndigital,My Cloud Pr4100 Firmware
CVE-2017-17562,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96327,NVD-CWE-noinfo,"Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.",2017-12-12,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:embedthis:goahead:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:integrated_lights_out_manager:3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:integrated_lights_out_manager:4.0:*:*:*:*:*:*:*,Embedthis,Goahead
CVE-2017-17692,0.0,,0.78843,CWE-200,Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that redirects to a child tab and rewrites the innerHTML property.,2017-12-21,Metasploit,cpe:2.3:a:samsung:internet_browser:5.4.02.3:*:*:*:*:*:*:*,Samsung,Internet Browser
CVE-2017-17731,0.0,,0.13194,CWE-89,DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.,2017-12-18,Nuclei,cpe:2.3:a:dedecms:dedecms:*:*:*:*:*:*:*:*,Dedecms,Dedecms
CVE-2017-17736,0.0,,0.6936,CWE-425,Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.,2018-03-23,Nuclei,cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:*,Kentico,Xperience
CVE-2017-17762,0.0,,0.04648,CWE-611,XML external entity (XXE) vulnerability in Episerver 7 patch 4 and earlier allows remote attackers to read arbitrary files via a crafted DTD in an XML request involving util/xmlrpc/Handler.ashx.,2018-08-29,Nuclei,cpe:2.3:a:episerver:episerver:*:*:*:*:*:*:*:*;cpe:2.3:a:episerver:episerver:7:*:*:*:*:*:*:*;cpe:2.3:a:episerver:episerver:7:patch_1:*:*:*:*:*:*;cpe:2.3:a:episerver:episerver:7:patch_2:*:*:*:*:*:*;cpe:2.3:a:episerver:episerver:7:patch_3:*:*:*:*:*:*;cpe:2.3:a:episerver:episerver:7:patch_4:*:*:*:*:*:*,Episerver,Episerver
CVE-2017-17932,0.0,,0.53597,CWE-119,A buffer overflow vulnerability exists in MediaServer.exe in ALLPlayer ALLMediaServer 0.95 and earlier that could allow remote attackers to execute arbitrary code and/or cause denial of service on the victim machine/computer via a long string to TCP port 888.,2017-12-28,Metasploit,cpe:2.3:a:allmediaserver:allmediaserver:*:*:*:*:*:*:*:*,Allmediaserver,Allmediaserver
CVE-2017-17968,0.0,,0.39634,CWE-119,A buffer overflow vulnerability in NetTransport.exe in NetTransport Download Manager 2.96L and earlier could allow remote HTTP servers to execute arbitrary code on NAS devices via a long HTTP response.,2017-12-29,Metasploit,cpe:2.3:a:xi-soft:nettransport_download_manager:*:*:*:*:*:*:*:*,Xi-Soft,Nettransport Download Manager
CVE-2017-18024,0.0,,0.04531,CWE-79,"AvantFAX 3.3.3 has XSS via an arbitrary parameter name to the default URI, as demonstrated by a parameter whose name contains a SCRIPT element and whose value is 1.",2018-01-10,Nuclei,cpe:2.3:a:avantfax:avantfax:3.3.3:*:*:*:*:*:*:*,Avantfax,Avantfax
CVE-2017-18044,0.0,,0.69753,CWE-78,"A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6. A certain message parsing function inside the Commvault service does not properly validate the input of an incoming string before passing it to CreateProcess. As a result, a specially crafted message can inject commands that will be executed on the target operating system. Exploitation of this vulnerability does not require authentication and can lead to SYSTEM level privilege on any system running the cvd daemon. This is a different vulnerability than CVE-2017-3195.",2018-01-19,Metasploit,cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*;cpe:2.3:a:commvault:commvault:11.0:sp1:*:*:*:*:*:*;cpe:2.3:a:commvault:commvault:11.0:sp2:*:*:*:*:*:*;cpe:2.3:a:commvault:commvault:11.0:sp3:*:*:*:*:*:*;cpe:2.3:a:commvault:commvault:11.0:sp4:*:*:*:*:*:*;cpe:2.3:a:commvault:commvault:11.0:sp5:*:*:*:*:*:*,Commvault,Commvault
CVE-2017-18047,0.0,,0.19727,CWE-119,Buffer Overflow in the FTP client in LabF nfsAxe 3.7 allows remote FTP servers to execute arbitrary code via a long reply.,2018-01-22,Metasploit,cpe:2.3:a:labf:nfsaxe:3.7:*:*:*:*:*:*:*,Labf,Nfsaxe
CVE-2017-18048,0.0,,0.63355,CWE-434,"Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (lowercase) is blocked but .PHP (uppercase) is not.",2018-01-23,Metasploit,cpe:2.3:a:monstra:monstra:3.0.4:*:*:*:*:*:*:*,Monstra,Monstra
CVE-2017-18349,0.0,,0.3897,CWE-20,"parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.",2018-10-23,Nuclei,cpe:2.3:a:alibaba:fastjson:*:*:*:*:*:*:*:*;cpe:2.3:a:pippo:pippo:1.11.0:*:*:*:*:*:*:*,Alibaba,Fastjson
CVE-2017-18357,0.0,,0.27074,CWE-610,"Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller, with resultant XXE via instantiation of a SimpleXMLElement object.",2019-01-15,Metasploit,cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*,Shopware,Shopware
CVE-2017-18362,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.86706,CWE-89,"ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.",2019-02-05,CISA/Nuclei,cpe:2.3:a:connectwise:manageditsync:*:*:*:*:*:kaseya_vsa:*:*,Connectwise,Manageditsync
CVE-2017-18365,0.0,,0.21238,CWE-502,"The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to execute arbitrary code. This occurs because the enterprise session secret is always the same, and can be found in the product's source code. By sending a crafted cookie signed with this secret, one can call Marshal.load with arbitrary data, which is a problem because the Marshal data format allows Ruby objects.",2019-03-28,Metasploit,cpe:2.3:a:github:github:*:*:*:*:enterprise:*:*:*;cpe:2.3:a:github:github:2.8.7:*:*:*:*:*:*:*,Github,Github
CVE-2017-18368,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.94508,CWE-78,"The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user. The vulnerability is in the ViewLog.asp page and can be exploited through the remote_host parameter.",2019-05-02,CISA/Metasploit,cpe:2.3:h:billion:5200w-t:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:p660hn-t1a_v1:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:p660hn-t1a_v2:-:*:*:*:*:*:*:*;cpe:2.3:o:billion:5200w-t_firmware:7.3.8.0:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:p660hn-t1a_v1_firmware:7.3.15.0:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:p660hn-t1a_v2_firmware:7.3.15.0:*:*:*:*:*:*:*,Billion,5200W-T Firmware
CVE-2017-18369,0.0,,0.67644,CWE-78,"The Billion 5200W-T 1.02b.rc5.dt49 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user. The vulnerability is in the adv_remotelog.asp page and can be exploited through the syslogServerAddr parameter.",2019-05-02,Metasploit,cpe:2.3:h:billion:5200w-t:-:*:*:*:*:*:*:*;cpe:2.3:o:billion:5200w-t_firmware:1.02b:rc5.dt49:*:*:*:*:*:*,Billion,5200W-T Firmware
CVE-2017-18370,0.0,,0.22909,CWE-78,"The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is only accessible by an authenticated user. The vulnerability is in the logSet.asp page and can be exploited through the ServerIP parameter. Authentication can be achieved by exploiting CVE-2017-18371.",2019-05-02,Metasploit,cpe:2.3:h:billion:5200w-t:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:p660hn-t1a_v1:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:p660hn-t1a_v2:-:*:*:*:*:*:*:*;cpe:2.3:o:billion:5200w-t_firmware:7.3.8.0:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:p660hn-t1a_v1_firmware:7.3.37.6:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:p660hn-t1a_v2_firmware:7.3.37.6:*:*:*:*:*:*:*,Billion,5200W-T Firmware
CVE-2017-18371,0.0,,0.22531,CWE-798,"The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default passwords, including two hardcoded service accounts: one with the username true and password true, and another with the username supervisor and password zyad1234. These accounts can be used to login to the web interface, exploit authenticated command injections, and change router settings for malicious purposes.",2019-05-02,Metasploit,cpe:2.3:h:billion:5200w-t:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:p660hn-t1a_v1:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:p660hn-t1a_v2:-:*:*:*:*:*:*:*;cpe:2.3:o:billion:5200w-t_firmware:7.3.8.0:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:p660hn-t1a_v1_firmware:7.3.37.6:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:p660hn-t1a_v2_firmware:7.3.37.6:*:*:*:*:*:*:*,Billion,5200W-T Firmware
CVE-2017-18372,0.0,,0.21887,CWE-78,"The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command injection vulnerability in the Time Setting function, which is only accessible by an authenticated user. The vulnerability is in the tools_time.asp page and can be exploited through the uiViewSNTPServer parameter. Authentication can be achieved by exploiting CVE-2017-18373.",2019-05-02,Metasploit,cpe:2.3:h:billion:5200w-t:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:p660hn-t1a_v1:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:p660hn-t1a_v2:-:*:*:*:*:*:*:*;cpe:2.3:o:billion:5200w-t_firmware:7.3.8.0:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:p660hn-t1a_v1_firmware:7.3.15.0:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:p660hn-t1a_v2_firmware:7.3.15.0:*:*:*:*:*:*:*,Billion,5200W-T Firmware
CVE-2017-18487,0.0,,0.01464,CWE-79,The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.,2019-08-13,Nuclei,cpe:2.3:a:google_adsense_project:google_adsense:*:*:*:*:*:wordpress:*:*,Google Adsense Project,Google Adsense
CVE-2017-18490,0.0,,0.01464,CWE-79,The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.,2019-08-13,Nuclei,cpe:2.3:a:bestwebsoft:contact_form_multi:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Contact Form Multi
CVE-2017-18491,0.0,,0.01464,CWE-79,The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.,2019-08-13,Nuclei,cpe:2.3:a:bestwebsoft:contact_form:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Contact Form
CVE-2017-18492,0.0,,0.01458,CWE-79,The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.,2019-08-13,Nuclei,cpe:2.3:a:bestwebsoft:contact_form_to_db:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Contact Form To Db
CVE-2017-18493,0.0,,0.014,CWE-79,The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.,2019-08-13,Nuclei,cpe:2.3:a:bestwebsoft:custom_admin_page:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Custom Admin Page
CVE-2017-18494,0.0,,0.014,CWE-79,The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues.,2019-08-13,Nuclei,cpe:2.3:a:bestwebsoft:custom_search:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Custom Search
CVE-2017-18496,0.0,,0.014,CWE-79,The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.,2019-08-13,Nuclei,cpe:2.3:a:bestwebsoft:htaccess:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Htaccess
CVE-2017-18500,0.0,,0.0141,CWE-79,The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.,2019-08-12,Nuclei,cpe:2.3:a:bestwebsoft:social_buttons_pack:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Social Buttons Pack
CVE-2017-18501,0.0,,0.0141,CWE-79,The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues.,2019-08-12,Nuclei,cpe:2.3:a:bestwebsoft:social_login:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Social Login
CVE-2017-18502,0.0,,0.01652,CWE-79,The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues.,2019-08-12,Nuclei,cpe:2.3:a:bestwebsoft:subscriber:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Subscriber
CVE-2017-18505,0.0,,0.01652,CWE-79,The twitter-plugin plugin before 2.55 for WordPress has XSS.,2019-08-12,Nuclei,cpe:2.3:a:bestwebsoft:twitter_button:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Twitter Button
CVE-2017-18516,0.0,,0.01688,CWE-79,The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues.,2019-08-21,Nuclei,cpe:2.3:a:bestwebsoft:linkedin:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Linkedin
CVE-2017-18517,0.0,,0.01621,CWE-79,The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues.,2019-08-20,Nuclei,cpe:2.3:a:bestwebsoft:pinterest:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Pinterest
CVE-2017-18518,0.0,,0.01621,CWE-79,The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.,2019-08-20,Nuclei,cpe:2.3:a:bestwebsoft:smtp:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Smtp
CVE-2017-18527,0.0,,0.01688,CWE-79,The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.,2019-08-20,Nuclei,cpe:2.3:a:bestwebsoft:pagination:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Pagination
CVE-2017-18528,0.0,,0.01757,CWE-79,The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.,2019-08-20,Nuclei,cpe:2.3:a:bestwebsoft:pdf_\&_print:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Pdf & Print
CVE-2017-18529,0.0,,0.01621,CWE-79,The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.,2019-08-20,Nuclei,cpe:2.3:a:bestwebsoft:promobar:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Promobar
CVE-2017-18530,0.0,,0.01384,CWE-79,The rating-bws plugin before 0.2 for WordPress has multiple XSS issues.,2019-08-20,Nuclei,cpe:2.3:a:bestwebsoft:rating:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Rating
CVE-2017-18532,0.0,,0.01441,CWE-79,The realty plugin before 1.1.0 for WordPress has multiple XSS issues.,2019-08-20,Nuclei,cpe:2.3:a:bestwebsoft:realty:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Realty
CVE-2017-18536,0.0,,0.0203,CWE-79,The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS.,2019-08-21,Nuclei,cpe:2.3:a:fullworksplugins:stop_user_enumeration:*:*:*:*:*:wordpress:*:*,Fullworksplugins,Stop User Enumeration
CVE-2017-18537,0.0,,0.01621,CWE-79,The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.,2019-08-21,Nuclei,cpe:2.3:a:bestwebsoft:visitors_online:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Visitors Online
CVE-2017-18542,0.0,,0.01388,CWE-79,The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.,2019-08-16,Nuclei,cpe:2.3:a:bestwebsoft:zendesk_help_center:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Zendesk Help Center
CVE-2017-18556,0.0,,0.01384,CWE-79,The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.,2019-08-21,Nuclei,cpe:2.3:a:bestwebsoft:google_analytics:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Google Analytics
CVE-2017-18557,0.0,,0.01384,CWE-79,The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues.,2019-08-21,Nuclei,cpe:2.3:a:bestwebsoft:google_maps:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Google Maps
CVE-2017-18558,0.0,,0.01384,CWE-79,The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.,2019-08-21,Nuclei,cpe:2.3:a:bestwebsoft:testimonials:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Testimonials
CVE-2017-18562,0.0,,0.01384,CWE-79,The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.,2019-08-21,Nuclei,cpe:2.3:a:bestwebsoft:error_log_viewer:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Error Log Viewer
CVE-2017-18564,0.0,,0.0139,CWE-79,The sender plugin before 1.2.1 for WordPress has multiple XSS issues.,2019-08-21,Nuclei,cpe:2.3:a:bestwebsoft:sender:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Sender
CVE-2017-18565,0.0,,0.0139,CWE-79,The updater plugin before 1.35 for WordPress has multiple XSS issues.,2019-08-21,Nuclei,cpe:2.3:a:bestwebsoft:updater:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Updater
CVE-2017-18566,0.0,,0.0139,CWE-79,The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.,2019-08-20,Nuclei,cpe:2.3:a:bestwebsoft:user_role:*:*:*:*:*:wordpress:*:*,Bestwebsoft,User Role
CVE-2017-18580,0.0,,0.12092,CWE-20,"The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.",2019-08-22,Nuclei,cpe:2.3:a:getshortcodes:shortcodes_ultimate:*:*:*:*:*:wordpress:*:*,Getshortcodes,Shortcodes Ultimate
CVE-2017-18590,0.0,,0.01404,CWE-79,The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.,2019-08-27,Nuclei,cpe:2.3:a:bestwebsoft:timesheet:*:*:*:*:*:wordpress:*:*,Bestwebsoft,Timesheet
CVE-2017-18598,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01933,CWE-79,The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php.,2019-09-10,Nuclei,cpe:2.3:a:designmodo:qards:*:*:*:*:*:wordpress:*:*,Designmodo,Qards
CVE-2017-18638,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.16948,CWE-918,"send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.",2019-10-11,Nuclei,cpe:2.3:a:graphite_project:graphite:*:*:*:*:*:*:*:*,Graphite Project,Graphite
CVE-2017-20192,8.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L,0.01026,CWE-79,The Formidable Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters submitted during form entries like 'after_html' in versions before 2.05.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.,2024-10-16,Nuclei,cpe:2.3:a:strategy11:formidable_form_builder:*:*:*:*:*:wordpress:*:*,Strategy11,Formidable Form Builder
CVE-2017-20194,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01128,CWE-200,"The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frm_forms_preview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form.",2024-10-16,Nuclei,cpe:2.3:a:strategy11:formidable_form_builder:*:*:*:*:*:wordpress:*:*,Strategy11,Formidable Form Builder
CVE-2017-20198,0.0,,0.0076,CWE-732,"The Marathon UI in DC/OS < 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper restriction of volume mount configurations, attackers can deploy a container that mounts the host's root filesystem (/) with read/write privileges. When using a malicious Docker image, the attacker can write to /etc/cron.d/ on the host, achieving arbitrary code execution with root privileges. This impacts any system where the Docker daemon honors Marathon container configurations without policy enforcement.",2025-07-23,Metasploit,,,
CVE-2017-2741,0.0,,0.84614,NVD-CWE-noinfo,"A potential security vulnerability has been identified with HP PageWide Printers, HP OfficeJet Pro Printers, with firmware before 1708D. This vulnerability could potentially be exploited to execute arbitrary code.",2018-01-23,Metasploit,cpe:2.3:h:hp:d3q15a:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:d3q15b:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:d3q15d:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:d3q16a:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:d3q16b:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:d3q16c:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:d3q16d:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:d3q17a:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:d3q17c:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:d3q17d:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:d3q19a:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:d3q19d:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:d3q20a:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:d3q20b:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:d3q20c:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:d3q20d:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:d3q21a:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:d3q21c:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:d3q21d:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:d9l20a:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:d9l21a:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:d9l63a:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:d9l64a:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:j3p68a:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:j6u55a:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:j6u55b:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:j6u55c:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:j6u55d:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:j6u57b:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:j9v80a:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:j9v80b:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:j9v82a:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:j9v82b:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:j9v82c:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:j9v82d:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:k9z76a:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:k9z76d:-:*:*:*:*:*:*:*;cpe:2.3:h:hp:t0g70a:-:*:*:*:*:*:*:*;cpe:2.3:o:hp:d3q15a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:d3q15b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:d3q15d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:d3q16a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:d3q16b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:d3q16c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:d3q16d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:d3q17a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:d3q17c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:d3q17d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:d3q19a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:d3q19d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:d3q20a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:d3q20b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:d3q20c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:d3q20d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:d3q21a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:d3q21c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:d3q21d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:d9l20a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:d9l21a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:d9l63a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:d9l64a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:j3p68a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:j6u55a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:j6u55b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:j6u55c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:j6u55d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:j6u57b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:j9v80a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:j9v80b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:j9v82a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:j9v82b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:j9v82c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:j9v82d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:k9z76a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:k9z76d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hp:t0g70a_firmware:*:*:*:*:*:*:*:*,Hp,J9V82A Firmware
CVE-2017-3066,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.90597,CWE-502,"Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.",2017-04-27,CISA,cpe:2.3:a:adobe:coldfusion:10.0:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:10.0:update10:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:10.0:update11:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:10.0:update12:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:10.0:update13:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:10.0:update14:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:10.0:update15:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:10.0:update16:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:10.0:update17:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:10.0:update18:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:10.0:update19:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:10.0:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:10.0:update20:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:10.0:update21:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:10.0:update22:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:10.0:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:10.0:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:10.0:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:10.0:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:10.0:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:10.0:update7:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:10.0:update8:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:10.0:update9:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update10:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update11:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update7:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update8:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update9:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update3:*:*:*:*:*:*,Adobe,Coldfusion
CVE-2017-3131,0.0,,0.07681,CWE-79,"A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to execute unauthorized code or commands via the filter input in ""Applications"" under FortiView.",2017-09-12,Nuclei,cpe:2.3:o:fortinet:fortios:5.4.0:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.4.1:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.4.2:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.4.3:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.4.4:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:5.6.0:*:*:*:*:*:*:*,Fortinet,Fortios
CVE-2017-3132,0.0,,0.08112,CWE-79,A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to Execute unauthorized code or commands via the action input during the activation of a FortiToken.,2017-09-12,Nuclei,cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*,Fortinet,Fortios
CVE-2017-3133,0.0,,0.10677,CWE-79,A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthorized code or commands via the Replacement Message HTML for SSL-VPN.,2017-09-12,Nuclei,cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*,Fortinet,Fortios
CVE-2017-3248,0.0,,0.97301,NVD-CWE-noinfo,"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0 and 12.2.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS v3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).",2017-01-27,EPSS/Metasploit,cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.1.0:*:*:*:*:*:*:*,Oracle,Weblogic Server
CVE-2017-3506,7.4,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N,0.96281,NVD-CWE-noinfo,"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).",2017-04-24,CISA/EPSS/Nuclei,cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.2.0:*:*:*:*:*:*:*,Oracle,Weblogic Server
CVE-2017-3528,0.0,,0.14558,CWE-601,"Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (lists of values, datepicker, etc.)). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily ""exploitable"" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).",2017-04-24,Nuclei,cpe:2.3:a:oracle:applications_framework:12.1.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:applications_framework:12.2.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:applications_framework:12.2.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:applications_framework:12.2.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:applications_framework:12.2.6:*:*:*:*:*:*:*,Oracle,Applications Framework
CVE-2017-3622,0.0,,0.05382,NVD-CWE-noinfo,"Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Common Desktop Environment (CDE)). The supported version that is affected is 10. Easily ""exploitable"" vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in takeover of Solaris. Note: CVE-2017-3622 is assigned for the ""Extremeparr"". CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",2017-04-24,Metasploit,cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*,Oracle,Solaris
CVE-2017-3629,0.0,,0.05085,CWE-119,"Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in takeover of Solaris. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",2017-06-22,Metasploit,cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*;cpe:2.3:o:oracle:solaris:11:*:*:*:*:*:*:*,Oracle,Solaris
CVE-2017-3630,0.0,,0.04531,CWE-787,"Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris accessible data as well as unauthorized read access to a subset of Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).",2017-06-22,Metasploit,cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*;cpe:2.3:o:oracle:solaris:11:*:*:*:*:*:*:*,Oracle,Solaris
CVE-2017-3631,0.0,,0.05989,CWE-119,"Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris accessible data as well as unauthorized read access to a subset of Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).",2017-06-22,Metasploit,cpe:2.3:o:oracle:solaris:11:*:*:*:*:*:*:*,Oracle,Solaris
CVE-2017-3823,0.0,,0.27231,CWE-119,"An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Container before 106 on Mozilla Firefox, the GpcContainer Class ActiveX control plugin before 10031.6.2017.0126 on Internet Explorer, and the Download Manager ActiveX control plugin before 2.1.0.10 on Internet Explorer. A vulnerability in these Cisco WebEx browser extensions could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system. This vulnerability affects the browser extensions for Cisco WebEx Meetings Server and Cisco WebEx Centers (Meeting Center, Event Center, Training Center, and Support Center) when they are running on Microsoft Windows. The vulnerability is a design defect in an application programing interface (API) response parser within the extension. An attacker that can convince an affected user to visit an attacker-controlled web page or follow an attacker-supplied link with an affected browser could exploit the vulnerability. If successful, the attacker could execute arbitrary code with the privileges of the affected browser.",2017-02-01,Metasploit,cpe:2.3:a:cisco:activetouch_general_plugin_container:105:*:*:*:*:firefox:*:*;cpe:2.3:a:cisco:download_manager:2.1.0.9:*:*:*:*:internet_explorer:*:*;cpe:2.3:a:cisco:gpccontainer_class:*:*:*:*:*:internet_explorer:*:*;cpe:2.3:a:cisco:webex:*:*:*:*:*:chrome:*:*;cpe:2.3:a:cisco:webex_meeting_center:2.6_base:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meeting_center:2.6_mr1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meeting_center:2.6_mr1:p1:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meeting_center:2.6_mr2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meeting_center:2.6_mr2:p1:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meeting_center:2.6_mr3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meeting_center:2.6_mr3:p1:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meeting_center:2.7_base:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meeting_center:2.7_mr1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meeting_center:2.7_mr1:p1:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meeting_center:2.7_mr2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meeting_center:t29_base:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meeting_center:t30_base:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meeting_center:t31_base:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.0_base:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.0_mr2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.0_mr3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.0_mr4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.0_mr5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.0_mr6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.0_mr7:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.0_mr8:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.0_mr8:p1:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.0_mr9:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.0_mr9:p1:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.0_mr9:p2:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.0_mr9:p3:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.5_base:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.5_mr1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.5_mr2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.5_mr2:p1:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.5_mr3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.5_mr4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.5_mr5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.5_mr5:p1:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.5_mr6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.5_mr6:p1:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.5_mr6:p2:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.5_mr6:p3:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.6_base:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.6_mr1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.6_mr1:p1:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.6_mr2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.6_mr2:p1:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.6_mr3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.6_mr3:p1:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.7_base:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.7_mr1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.7_mr1:p1:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:2.7_mr2:*:*:*:*:*:*:*,Cisco,Activetouch General Plugin Container
CVE-2017-3881,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98975,CWE-20,"A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members. The vulnerability is due to the combination of two factors: (1) the failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process such options over any Telnet connection to an affected device; and (2) the incorrect processing of malformed CMP-specific Telnet options. An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device. This affects Catalyst switches, Embedded Service 2020 switches, Enhanced Layer 2 EtherSwitch Service Module, Enhanced Layer 2/3 EtherSwitch Service Module, Gigabit Ethernet Switch Module (CGESM) for HP, IE Industrial Ethernet switches, ME 4924-10GE switch, RF Gateway 10, and SM-X Layer 2/3 EtherSwitch Service Module. Cisco Bug IDs: CSCvd48893.",2017-03-17,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:h:cisco:catalyst_2350-48td-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2350-48td-sd:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2360-48td-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2918-24tc-c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2918-24tt-c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2918-48tc-c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2918-48tt-c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2928-24tc-c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-24-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-24lc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-24lt-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-24pc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-24pc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-24tc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-24tc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-24tt-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-48pst-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-48pst-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-48tc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-48tc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-48tt-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-48tt-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-8tc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-8tc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-plus_24lc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-plus_24lc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-plus_24pc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-plus_24pc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-plus_24tc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-plus_24tc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-plus_48pst-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-plus_48pst-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-plus_48tc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-plus_48tc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960c-12pc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960c-8pc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960c-8tc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960c-8tc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960cg-8tc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960cpd-8pt-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960cpd-8tt-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960cx-8pc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960cx-8tc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960g-24tc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960g-48tc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960g-8tc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960l-16ps-ll:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960l-16ts-ll:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960l-24ps-ll:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960l-24ts-ll:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960l-48ps-ll:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960l-48ts-ll:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960l-8ps-ll:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960l-8ts-ll:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960pd-8tt-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-24pd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-24ps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-24td-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-24ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-24ts-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-48fpd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-48fps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-48lpd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-48lps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-48td-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-48ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-48ts-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-f24ps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-f24ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-f24ts-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-f48fps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-f48lps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-f48ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-f48ts-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-24pd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-24ps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-24psq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-24td-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-24ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-24ts-ll:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-48fpd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-48fps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-48lpd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-48lps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-48td-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-48ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-48ts-ll:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-24pd-i:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-24pd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-24ps-i:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-24ps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-24td-i:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-24td-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-24ts-i:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-24ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-48fpd-i:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-48fpd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-48fps-i:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-48fps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-48lpd-i:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-48lpd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-48lps-i:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-48lps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-48td-i:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-48td-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-48ts-i:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-48ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2970g-24t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2970g-24ts:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2975:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3550_12g:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3550_12t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3550_24_dc_smi:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3550_24_emi:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3550_24_fx_smi:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3550_24_pwr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3550_24_smi:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3550_48_emi:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3550_48_smi:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560-12pc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560-24ps:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560-24ts:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560-48ps:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560-48ts:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560-8pc:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560c-12pc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560c-8pc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560cg-8pc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560cg-8tc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560cpd-8pt-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560cx-12pc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560cx-12pd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560cx-12tc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560cx-8pc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560cx-8pt-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560cx-8tc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560cx-8xpd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560e-12d-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560e-12d-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560e-12sd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560e-12sd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560e-24pd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560e-24pd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560e-24td-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560e-24td-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560e-48pd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560e-48pd-ef:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560e-48pd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560e-48pd-sf:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560e-48td-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560e-48td-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560g-24ps:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560g-24ts:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560g-48ps:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560g-48ts:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560v2-24dc:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560v2-24ps:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560v2-24ts:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560v2-48ps:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560v2-48ts:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-24p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-24p-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-24p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-24t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-24t-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-24t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-24u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-24u-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-24u-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-48p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-48p-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-48p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-48pf-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-48pf-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-48pf-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-48t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-48t-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-48t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-48u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-48u-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-48u-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750-24fs:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750-24ps:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750-24ts:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750-48ps:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750-48ts:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750_metro_24-ac:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750_metro_24-dc:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750e-24pd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750e-24pd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750e-24td-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750e-24td-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750e-48pd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750e-48pd-ef:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750e-48pd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750e-48pd-sf:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750e-48td-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750e-48td-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750g-12s-sd:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750g-12s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750g-16td:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750g-24ps:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750g-24t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750g-24ts-1u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750g-24ts:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750g-48ps:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750g-48ts:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750v2-24fs:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750v2-24ps:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750v2-24ts:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750v2-48ps:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750v2-48ts:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-12s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-12s-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-24p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-24p-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-24p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-24s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-24s-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-24t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-24t-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-24t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-24u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-24u-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-24u-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-48p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-48p-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-48p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-48pf-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-48pf-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-48pf-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-48t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-48t-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-48t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-48u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-48u-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-48u-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4000_supervisor_engine_i:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4000_supervisor_engine_iv:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4000_supervisor_engine_v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4500_supervisor_engine_6-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4500_supervisor_engine_6l-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4500_supervisor_engine_ii-plus-ts:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4500_supervisor_engine_ii-plus:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4500_supervisor_engine_iv:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4500_supervisor_engine_v-10ge:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4500_supervisor_engine_v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4500_supervisor_ii-plus-10ge:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4500e_supervisor_engine_8-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4900m:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4928_10_gigabit_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4948:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4948_10_gigabit_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4948e-f_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4948e_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_blade_switch_3020:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_blade_switch_3030:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_blade_switch_3032:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_blade_switch_3040:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_blade_switch_3120:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_blade_switch_3120x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_blade_switch_3130:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_c2928-24lt-c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_c2928-48tc-c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_switch_module_3012:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_switch_module_3110:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_switch_module_3110x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:embedded_service_2020_24tc_con:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:embedded_service_2020_24tc_con_b:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:embedded_service_2020_24tc_ncp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:embedded_service_2020_24tc_ncp_b:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:embedded_service_2020_con:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:embedded_service_2020_con_b:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:embedded_service_2020_ncp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:embedded_service_2020_ncp_b:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:enhanced_layer_2\/3_etherswitch_service_module:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:enhanced_layer_2_etherswitch_service_module:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:gigabit_ethernet_switch_module_\(cgesm\):-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie-3010-16s-8pc_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie-3010-24tc_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie-4000-16gt4g-e_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie-4000-16t4g-e_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie-4000-4gc4gp4g-e_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie-4000-4gs8gp4g-e_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie-4000-4s8p4g-e_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie-4000-4t4p4g-e_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie-4000-4tc4g-e_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie-4000-8gs4g-e_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie-4000-8gt4g-e_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie-4000-8gt8gp4g-e_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie-4000-8s4g-e_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie-4000-8t4g-e_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie-4010-16s12p_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie-4010-4s24p_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie-5000-12s12p-10g_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie-5000-16s12p_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-16ptc-g_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-16t67_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-16t67p_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-16tc-g-e_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-16tc-g-n_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-16tc-g-x_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-16tc-g_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-16tc_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-24t67_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-4s-ts-g_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-4t-g_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-4t_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-4ts-g_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-4ts_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-8t67_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-8t67p_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-8tc-g-e_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-8tc-g-n_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-8tc-g_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-8tc_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_3000-4tc_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_3000-8tc_industrial_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:me_4924-10ge:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rf_gateway_10:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sm-x_layer_2\/3_etherswitch_service_module:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*,Cisco,Ios
CVE-2017-4011,0.0,,0.03271,CWE-79,Embedding Script (XSS) in HTTP Headers vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to get session/cookie information via modification of the HTTP request.,2017-05-17,Nuclei,cpe:2.3:a:mcafee:network_data_loss_prevention:*:*:*:*:*:*:*:*,Mcafee,Network Data Loss Prevention
CVE-2017-4915,0.0,,0.05413,CWE-863,VMware Workstation Pro/Player contains an insecure library loading vulnerability via ALSA sound driver configuration files. Successful exploitation of this issue may allow unprivileged host users to escalate their privileges to root in a Linux host machine.,2017-05-22,Metasploit,cpe:2.3:a:vmware:workstation_player:12.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workstation_pro:12.0.0:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2017-5030,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.41603,CWE-125,"Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page.",2017-04-24,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*,Apple,Macos
CVE-2017-5070,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.31212,CWE-843,"Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.",2017-10-27,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:google:android:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*,Apple,Macos
CVE-2017-5146,0.0,,0.09317,CWE-200,"An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. Sensitive information is stored in clear-text.",2017-02-13,Metasploit,cpe:2.3:h:carlosgavazzi:vmu-c_em:-:*:*:*:*:*:*:*;cpe:2.3:h:carlosgavazzi:vmu-c_pv:-:*:*:*:*:*:*:*;cpe:2.3:o:carlosgavazzi:vmu-c_em_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:carlosgavazzi:vmu-c_pv_firmware:-:*:*:*:*:*:*:*,Carlosgavazzi,Vmu-C Em Firmware
CVE-2017-5162,0.0,,0.1261,CWE-306,An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. Lack of authentication for remote service gives access to application set up and configuration.,2017-02-13,Metasploit,cpe:2.3:h:binom3:universal_multifunctional_electric_power_quality_meter:-:*:*:*:*:*:*:*;cpe:2.3:o:binom3:universal_multifunctional_electric_power_quality_meter_firmware:-:*:*:*:*:*:*:*,Binom3,Universal Multifunctional Electric Power Quality Meter Firmware
CVE-2017-5254,0.0,,0.53704,CWE-284,"In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the capability of changing passwords for other accounts, including admin, after disabling a client-side protection mechanism.",2017-12-20,Metasploit,cpe:2.3:h:cambiumnetworks:epmp_1000:-:*:*:*:*:*:*:*;cpe:2.3:h:cambiumnetworks:epmp_2000:-:*:*:*:*:*:*:*;cpe:2.3:o:cambiumnetworks:epmp_1000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cambiumnetworks:epmp_2000_firmware:*:*:*:*:*:*:*:*,Cambiumnetworks,Epmp 1000 Firmware
CVE-2017-5255,0.0,,0.74556,CWE-78,"In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console allows any authenticated user (including the otherwise low-privilege readonly user) to inject shell meta-characters as part of a specially-crafted POST request to the get_chart function and run OS-level commands, effectively as root.",2017-12-20,Metasploit,cpe:2.3:h:cambiumnetworks:epmp_1000:-:*:*:*:*:*:*:*;cpe:2.3:h:cambiumnetworks:epmp_2000:-:*:*:*:*:*:*:*;cpe:2.3:o:cambiumnetworks:epmp_1000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cambiumnetworks:epmp_2000_firmware:*:*:*:*:*:*:*:*,Cambiumnetworks,Epmp 1000 Firmware
CVE-2017-5259,0.0,,0.39181,CWE-489,"In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path https://<device-ip-or-hostname>/adm/syscmd.asp.",2017-12-20,Metasploit,cpe:2.3:h:cambiumnetworks:cnpilot_e400:-:*:*:*:*:*:*:*;cpe:2.3:h:cambiumnetworks:cnpilot_e410:-:*:*:*:*:*:*:*;cpe:2.3:h:cambiumnetworks:cnpilot_e600:-:*:*:*:*:*:*:*;cpe:2.3:h:cambiumnetworks:cnpilot_r190n:-:*:*:*:*:*:*:*;cpe:2.3:h:cambiumnetworks:cnpilot_r190v:-:*:*:*:*:*:*:*;cpe:2.3:o:cambiumnetworks:cnpilot_e400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cambiumnetworks:cnpilot_e410_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cambiumnetworks:cnpilot_e600_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cambiumnetworks:cnpilot_r190n_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cambiumnetworks:cnpilot_r190v_firmware:*:*:*:*:*:*:*:*,Cambiumnetworks,Cnpilot R190V Firmware
CVE-2017-5260,0.0,,0.08133,CWE-472,"In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web administrative console for the 'user' account, the configuration file is accessible via direct object reference (DRO) at http://<device-ip-or-hostname>/goform/down_cfg_file by this otherwise low privilege 'user' account.",2017-12-20,Metasploit,cpe:2.3:h:cambiumnetworks:cnpilot_e400:-:*:*:*:*:*:*:*;cpe:2.3:h:cambiumnetworks:cnpilot_e410:-:*:*:*:*:*:*:*;cpe:2.3:h:cambiumnetworks:cnpilot_e600:-:*:*:*:*:*:*:*;cpe:2.3:h:cambiumnetworks:cnpilot_r190n:-:*:*:*:*:*:*:*;cpe:2.3:h:cambiumnetworks:cnpilot_r190v:-:*:*:*:*:*:*:*;cpe:2.3:o:cambiumnetworks:cnpilot_e400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cambiumnetworks:cnpilot_e410_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cambiumnetworks:cnpilot_e600_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cambiumnetworks:cnpilot_r190n_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cambiumnetworks:cnpilot_r190v_firmware:*:*:*:*:*:*:*:*,Cambiumnetworks,Cnpilot R190V Firmware
CVE-2017-5261,0.0,,0.0889,CWE-472,"In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the 'ping' and 'traceroute' functions of the web administrative console expose a file path traversal vulnerability, accessible to all authenticated users.",2017-12-20,Metasploit,cpe:2.3:h:cambiumnetworks:cnpilot_e400:-:*:*:*:*:*:*:*;cpe:2.3:h:cambiumnetworks:cnpilot_e410:-:*:*:*:*:*:*:*;cpe:2.3:h:cambiumnetworks:cnpilot_e600:-:*:*:*:*:*:*:*;cpe:2.3:h:cambiumnetworks:cnpilot_r190n:-:*:*:*:*:*:*:*;cpe:2.3:h:cambiumnetworks:cnpilot_r190v:-:*:*:*:*:*:*:*;cpe:2.3:o:cambiumnetworks:cnpilot_e400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cambiumnetworks:cnpilot_e410_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cambiumnetworks:cnpilot_e600_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cambiumnetworks:cnpilot_r190n_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cambiumnetworks:cnpilot_r190v_firmware:*:*:*:*:*:*:*:*,Cambiumnetworks,Cnpilot R190V Firmware
CVE-2017-5262,0.0,,0.04858,CWE-200,"In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the SNMP read-only (RO) community string has access to sensitive information by OID reference.",2017-12-20,Metasploit,cpe:2.3:h:cambiumnetworks:cnpilot_e400:-:*:*:*:*:*:*:*;cpe:2.3:h:cambiumnetworks:cnpilot_e410:-:*:*:*:*:*:*:*;cpe:2.3:h:cambiumnetworks:cnpilot_e600:-:*:*:*:*:*:*:*;cpe:2.3:h:cambiumnetworks:cnpilot_r190n:-:*:*:*:*:*:*:*;cpe:2.3:h:cambiumnetworks:cnpilot_r190v:-:*:*:*:*:*:*:*;cpe:2.3:o:cambiumnetworks:cnpilot_e400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cambiumnetworks:cnpilot_e410_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cambiumnetworks:cnpilot_e600_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cambiumnetworks:cnpilot_r190n_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cambiumnetworks:cnpilot_r190v_firmware:*:*:*:*:*:*:*:*,Cambiumnetworks,Cnpilot R190V Firmware
CVE-2017-5521,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.89353,NVD-CWE-noinfo,"An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote management option is set, and can also be exploited given access to the router over LAN or WLAN. When trying to access the web panel, a user is asked to authenticate; if the authentication is canceled and password recovery is not enabled, the user is redirected to a page that exposes a password recovery token. If a user supplies the correct token to the page /passwordrecovered.cgi?id=TOKEN (and password recovery is not enabled), they will receive the admin password for the router. If password recovery is set the exploit will fail, as it will ask the user for the recovery questions that were previously set when enabling that feature. This is persistent (even after disabling the recovery option, the exploit will fail) because the router will ask for the security questions.",2017-01-17,CISA/Metasploit/Nuclei,cpe:2.3:h:netgear:ac1450:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:d6220:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:d6300:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:d6300b:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:d6400:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:dgn2200bv4:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6200:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6300:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:vegn2610:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wndr3700v3:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wndr4000:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wndr4500:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wnr1000v3:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:ac1450_firmware:1.0.0.34_10.0.16:*:*:*:*:*:*:*;cpe:2.3:o:netgear:d6220_firmware:1.0.0.12:*:*:*:*:*:*:*;cpe:2.3:o:netgear:d6300_firmware:1.0.0.96:*:*:*:*:*:*:*;cpe:2.3:o:netgear:d6300b_firmware:1.0.0.40:*:*:*:*:*:*:*;cpe:2.3:o:netgear:d6400_firmware:1.0.0.44:*:*:*:*:*:*:*;cpe:2.3:o:netgear:dgn2200bv4_firmware:1.0.0.68:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6200_firmware:1.0.1.56_1.0.43:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6300_firmware:1.0.2.78_1.0.58:*:*:*:*:*:*:*;cpe:2.3:o:netgear:vegn2610_firmware:1.0.0.36:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wndr3700v3_firmware:1.0.0.40_1.0.32:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wndr4000_firmware:1.0.2.4_9.1.86:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wndr4500_firmware:1.0.1.44_1.0.73:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wnr1000v3_firmware:1.0.2.68_60.0.93:*:*:*:*:*:*:*,Netgear,R6200 Firmware
CVE-2017-5631,0.0,,0.04487,CWE-79,"An issue was discovered in KMCIS CaseAware. Reflected cross site scripting is present in the user parameter (i.e., ""usr"") that is transmitted in the login.php query string.",2017-05-01,Nuclei,cpe:2.3:a:kmc_information_systems:caseaware:-:*:*:*:*:*:*:*,Kmc Information Systems,Caseaware
CVE-2017-5638,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99999,CWE-755,"The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.",2017-03-11,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*;cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:server_automation:10.0.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:server_automation:10.1.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:server_automation:10.2.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:server_automation:10.5.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:server_automation:9.1.0:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.2.0:*:*:*:*:*:*:*;cpe:2.3:h:ibm:storwize_v3500:-:*:*:*:*:*:*:*;cpe:2.3:h:ibm:storwize_v5000:-:*:*:*:*:*:*:*;cpe:2.3:h:ibm:storwize_v7000:-:*:*:*:*:*:*:*;cpe:2.3:h:lenovo:storage_v5030:-:*:*:*:*:*:*:*;cpe:2.3:o:ibm:storwize_v3500_firmware:7.7.1.6:*:*:*:*:*:*:*;cpe:2.3:o:ibm:storwize_v3500_firmware:7.8.1.0:*:*:*:*:*:*:*;cpe:2.3:o:ibm:storwize_v5000_firmware:7.7.1.6:*:*:*:*:*:*:*;cpe:2.3:o:ibm:storwize_v5000_firmware:7.8.1.0:*:*:*:*:*:*:*;cpe:2.3:o:ibm:storwize_v7000_firmware:7.7.1.6:*:*:*:*:*:*:*;cpe:2.3:o:ibm:storwize_v7000_firmware:7.8.1.0:*:*:*:*:*:*:*;cpe:2.3:o:lenovo:storage_v5030_firmware:7.7.1.6:*:*:*:*:*:*:*;cpe:2.3:o:lenovo:storage_v5030_firmware:7.8.1.0:*:*:*:*:*:*:*,Ibm,Storwize V3500 Firmware
CVE-2017-5645,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.8904,CWE-502,"In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.",2017-04-17,Nuclei,cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*;cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:autovue_vuelink_integration:21.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:autovue_vuelink_integration:21.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:bi_publisher:11.1.1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:bi_publisher:11.1.1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:bi_publisher:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_converged_application_server_-_service_controller:6.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_interactive_session_recorder:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_messaging_server:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_network_integrity:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_online_mediation_controller:6.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_pricing_design_center:11.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_pricing_design_center:12.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_service_broker:6.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_webrtc_session_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:configuration_manager:12.1.2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:configuration_manager:12.1.2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_data_quality:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_base_platform:12.1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_for_fusion_middleware:12.1.0.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_for_fusion_middleware:13.2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_for_mysql_database:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_for_oracle_database:12.1.0.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_for_oracle_database:13.2.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_for_peoplesoft:13.1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_for_peoplesoft:13.2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_behavior_detection_platform:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_behavior_detection_platform:6.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:8.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:8.0.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_lending_and_leasing:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_lending_and_leasing:12.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.0.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_profitability_management:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_profitability_management:6.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_regulatory_reporting_with_agilereporter:8.0.9.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:flexcube_investor_servicing:12.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:flexcube_investor_servicing:12.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:flexcube_investor_servicing:12.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:flexcube_investor_servicing:12.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:flexcube_investor_servicing:14.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:goldengate:12.3.2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:goldengate_application_adapters:12.3.2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:identity_analytics:11.1.1.5.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:identity_management_suite:11.1.2.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:identity_management_suite:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:identity_manager_connector:9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:in-memory_performance-driven_planning:12.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:in-memory_performance-driven_planning:12.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_calculation_engine:10.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_calculation_engine:10.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_policy_administration:10.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_policy_administration:10.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_policy_administration:10.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_policy_administration:11.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_rules_palette:10.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_rules_palette:10.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_rules_palette:10.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_rules_palette:11.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_rules_palette:11.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:4.0.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jdeveloper:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:peoplesoft_enterprise_fin_install:9.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation:10.4.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation:12.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation:12.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation:12.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation:12.2.10:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation:12.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation:12.2.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation:12.2.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation:12.2.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation:12.2.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation:12.2.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation:12.2.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation:12.2.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation:12.2.9:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation_connector_for_siebel:10.4.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation_for_mobile_devices:10.4.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.10:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation_for_mobile_devices:12.2.9:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:rapid_planning:12.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:rapid_planning:12.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_advanced_inventory_planning:15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_clearance_optimization_engine:14.0.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_extract_transform_and_load:13.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_extract_transform_and_load:13.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_extract_transform_and_load:13.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_extract_transform_and_load:19.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:14.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:14.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:16.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_open_commerce_platform:5.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_open_commerce_platform:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_open_commerce_platform:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_service_backbone:14.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_service_backbone:15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_service_backbone:16.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:siebel_ui_framework:18.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:siebel_ui_framework:18.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:siebel_ui_framework:18.9:*:*:*:*:*:*:*;cpe:2.3:a:oracle:soa_suite:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:soa_suite:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:soa_suite:12.2.2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:tape_library_acsls:8.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:timesten_in-memory_database:11.2.2.8.49:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_advanced_spatial_and_operational_analytics:2.7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_work_and_asset_management:1.9.1.2.12:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*,Redhat,Enterprise Linux
CVE-2017-5689,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.92189,NVD-CWE-noinfo,"An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).",2017-05-02,CISA/Metasploit/Nuclei,cpe:2.3:h:hpe:proliant_ml10_gen9_server:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_field_pg_m3:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_field_pg_m4:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_field_pg_m5:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_ipc427d:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_ipc427e:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_ipc477d:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_ipc477e:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_ipc547d:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_ipc547e:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_ipc547g:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_ipc627c:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_ipc627d:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_ipc647c:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_ipc647d:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_ipc677c:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_ipc677d:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_ipc827c:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_ipc827d:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_ipc847c:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_ipc847d:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_itp1000:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_pcs_7_ipc427e:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_pcs_7_ipc477d:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_pcs_7_ipc547d:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_pcs_7_ipc547e:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_pcs_7_ipc547g:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_pcs_7_ipc627c:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_pcs_7_ipc647c:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_pcs_7_ipc647d:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_pcs_7_ipc677c:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_pcs_7_ipc847c:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_pcs_7_ipc847d:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simotion_p320-4_s:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:sinumerik_pcu_50.5-p:-:*:*:*:*:*:*:*;cpe:2.3:o:hpe:proliant_ml10_gen9_server_firmware:5.0:*:*:*:*:*:*:*;cpe:2.3:o:intel:active_management_technology_firmware:10.0:*:*:*:*:*:*:*;cpe:2.3:o:intel:active_management_technology_firmware:11.0:*:*:*:*:*:*:*;cpe:2.3:o:intel:active_management_technology_firmware:11.5:*:*:*:*:*:*:*;cpe:2.3:o:intel:active_management_technology_firmware:11.6:*:*:*:*:*:*:*;cpe:2.3:o:intel:active_management_technology_firmware:6.0:*:*:*:*:*:*:*;cpe:2.3:o:intel:active_management_technology_firmware:6.1:*:*:*:*:*:*:*;cpe:2.3:o:intel:active_management_technology_firmware:6.2:*:*:*:*:*:*:*;cpe:2.3:o:intel:active_management_technology_firmware:7.0:*:*:*:*:*:*:*;cpe:2.3:o:intel:active_management_technology_firmware:7.1:*:*:*:*:*:*:*;cpe:2.3:o:intel:active_management_technology_firmware:8.0:*:*:*:*:*:*:*;cpe:2.3:o:intel:active_management_technology_firmware:8.1:*:*:*:*:*:*:*;cpe:2.3:o:intel:active_management_technology_firmware:9.0:*:*:*:*:*:*:*;cpe:2.3:o:intel:active_management_technology_firmware:9.1:*:*:*:*:*:*:*;cpe:2.3:o:intel:active_management_technology_firmware:9.5:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_field_pg_m3_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_field_pg_m4_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_field_pg_m5_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_ipc427d_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_ipc427e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_ipc477d_firmware:-:*:*:*:-:*:*:*;cpe:2.3:o:siemens:simatic_ipc477d_firmware:-:*:*:*:pro:*:*:*;cpe:2.3:o:siemens:simatic_ipc477e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_ipc547d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_ipc547e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_ipc547g_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_ipc627c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_ipc627d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_ipc647c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_ipc647d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_ipc677c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_ipc677d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_ipc827c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_ipc827d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_ipc847c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_ipc847d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_itp1000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_pcs_7_ipc427e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_pcs_7_ipc427e_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_pcs_7_ipc477d_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_pcs_7_ipc547d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_pcs_7_ipc547e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_pcs_7_ipc547g_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_pcs_7_ipc627c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_pcs_7_ipc647c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_pcs_7_ipc647d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_pcs_7_ipc677c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_pcs_7_ipc847c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_pcs_7_ipc847d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simotion_p320-4_s_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:sinumerik_pcu50.5-p_firmware:*:*:*:*:*:*:*:*,Hpe,Proliant Ml10 Gen9 Server Firmware
CVE-2017-5816,0.0,,0.86466,CWE-20,A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.,2018-02-15,Metasploit,cpe:2.3:a:hp:intelligent_management_center:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:7.3:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:7.3:e0503p02:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:7.3:e0504p02:*:*:*:*:*:*,Hp,Intelligent Management Center
CVE-2017-5817,0.0,,0.82877,CWE-20,A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.,2018-02-15,Metasploit,cpe:2.3:a:hp:intelligent_management_center:*:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:7.3:*:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:7.3:e0503p02:*:*:*:*:*:*;cpe:2.3:a:hp:intelligent_management_center:7.3:e0504p02:*:*:*:*:*:*,Hp,Intelligent Management Center
CVE-2017-5868,0.0,,0.04622,CWE-93,"CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via ""%0A"" characters in the PATH_INFO to __session_start__/.",2017-05-26,Nuclei,cpe:2.3:a:openvpn:openvpn_access_server:2.1.4:*:*:*:*:*:*:*,Openvpn,Openvpn Access Server
CVE-2017-5871,0.0,,0.02676,CWE-601,Odoo Version <= 8.0-20160726 and Version 9 is affected by: CWE-601: Open redirection. The impact is: obtain sensitive information (remote).,2019-05-22,Nuclei,cpe:2.3:a:odoo:odoo:10.0:*:*:*:*:*:*:*;cpe:2.3:a:odoo:odoo:8.0:*:*:*:*:*:*:*;cpe:2.3:a:odoo:odoo:8.0:20160726:*:*:*:*:*:*;cpe:2.3:a:odoo:odoo:9.0:*:*:*:*:*:*:*,Odoo,Odoo
CVE-2017-5930,2.7,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N,0.14953,CWE-862,"The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.",2017-03-20,Metasploit,cpe:2.3:a:postfixadmin_project:postfixadmin:*:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:42.2:*:*:*:*:*:*:*,Opensuse,Leap
CVE-2017-5982,0.0,,0.7763,CWE-22,"Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e (encoded dot dot slash) in the image path, as demonstrated by image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd.",2017-02-28,Metasploit/Nuclei,cpe:2.3:a:kodi:kodi:17.1:*:*:*:*:*:*:*,Kodi,Kodi
CVE-2017-5983,0.0,,0.16239,CWE-502,"The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object.",2017-04-10,Nuclei,cpe:2.3:a:atlassian:jira:4.2.4:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:4.3.1:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:4.3.2:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:4.3.3:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:4.3.4:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:4.3:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:4.4.1:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:4.4.2:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:4.4.3:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:4.4.4:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:4.4.5:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:4.4:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.0.4:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.0.5:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.0.7:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.0:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.1.1:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.1.2:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.1.3:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.1.4:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.1.5:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.1.6:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.1.7:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.1.8:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.1:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.2.10:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.2.11:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.2.1:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.2.2:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.2.3:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.2.4:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.2.5:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.2.6:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.2.7:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.2.8:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.2.9:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:5.2:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.0.3:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.0.4:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.0.5:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.0.7:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.0.8:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.0:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.1.1:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.1.2:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.1.3:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.1.4:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.1.5:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.1.6:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.1.7:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.1.8:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.1.9:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.1:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.2.1:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.2.2:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.2.3:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.2.4:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.2.5:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.2.6:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.2.7:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:6.2:*:*:*:*:*:*:*,Atlassian,Jira
CVE-2017-6048,0.0,,0.15538,CWE-77,"A Command Injection issue was discovered in Satel Iberia SenNet Data Logger and Electricity Meters: SenNet Optimal DataLogger V5.37c-1.43c and prior, SenNet Solar Datalogger V5.03-1.56a and prior, and SenNet Multitask Meter V5.21a-1.18b and prior. Successful exploitation of this vulnerability could result in the attacker breaking out of the jailed shell and gaining full access to the system.",2017-05-19,Metasploit,cpe:2.3:a:satel-iberia:sennet_multitask_meter:*:*:*:*:*:*:*:*;cpe:2.3:a:satel-iberia:sennet_optimal_datalogger:*:*:*:*:*:*:*:*;cpe:2.3:a:satel-iberia:sennet_solar_datalogger:*:*:*:*:*:*:*:*,Satel-Iberia,Sennet Multitask Meter
CVE-2017-6077,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.68201,CWE-78,ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping_IPAddr field of an HTTP POST request.,2017-02-22,CISA,cpe:2.3:h:netgear:dgn2200:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:dgn2200_firmware:*:*:*:*:*:*:*:*,Netgear,Dgn2200 Firmware
CVE-2017-6090,0.0,,0.96068,CWE-434,"Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in logos_clients/.",2017-10-03,EPSS/Metasploit/Nuclei,cpe:2.3:a:phpcollab:phpcollab:*:*:*:*:*:*:*:*,Phpcollab,Phpcollab
CVE-2017-6168,0.0,,0.19553,CWE-203,"On BIG-IP versions 11.6.0-11.6.2 (fixed in 11.6.2 HF1), 12.0.0-12.1.2 HF1 (fixed in 12.1.2 HF2), or 13.0.0-13.0.0 HF2 (fixed in 13.0.0 HF3) a virtual server configured with a Client SSL profile may be vulnerable to an Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) against RSA, which when exploited, may result in plaintext recovery of encrypted messages and/or a Man-in-the-middle (MiTM) attack, despite the attacker not having gained access to the server's private key itself, aka a ROBOT attack.",2017-11-17,Metasploit,cpe:2.3:a:f5:big-ip_afm:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_afm:13.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:13.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_apm:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_apm:13.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:13.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_asm:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_asm:13.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:13.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_ltm:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_ltm:13.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_pem:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_pem:13.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:websafe:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:websafe:11.6.2:*:*:*:*:*:*:*;cpe:2.3:a:f5:websafe:13.0.0:*:*:*:*:*:*:*,F5,Big-Ip Ltm
CVE-2017-6187,0.0,,0.33052,CWE-119,Buffer overflow in the built-in web server in DiskSavvy Enterprise 9.4.18 allows remote attackers to execute arbitrary code via a long URI in a GET request.,2017-02-22,Metasploit,cpe:2.3:a:disksavvy:disksavvy_enterprise:9.4.18:*:*:*:*:*:*:*,Disksavvy,Disksavvy Enterprise
CVE-2017-6316,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.72596,NVD-CWE-noinfo,"Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID cookie. On CloudBridge (the former name of NetScaler SD-WAN) devices, the cookie name was CAKEPHP rather than CGISESSID.",2017-07-20,CISA,cpe:2.3:a:citrix:netscaler_sd-wan:*:*:*:*:*:*:*:*,Citrix,Netscaler Sd-Wan
CVE-2017-6326,0.0,,0.72759,NVD-CWE-noinfo,"The Symantec Messaging Gateway can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the ability to execute commands remotely on a target machine or in a target process.",2017-06-26,Metasploit,cpe:2.3:a:symantec:messaging_gateway:*:*:*:*:*:*:*:*,Symantec,Messaging Gateway
CVE-2017-6327,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.35341,NVD-CWE-noinfo,"The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the ability to execute commands remotely on a target machine or in a target process. In this type of occurrence, after gaining access to the system, the attacker may attempt to elevate their privileges.",2017-08-11,CISA,cpe:2.3:a:symantec:message_gateway:*:*:*:*:*:*:*:*,Symantec,Message Gateway
CVE-2017-6334,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.72199,CWE-78,"dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_name field of an HTTP POST request, a different vulnerability than CVE-2017-6077.",2017-03-06,CISA/Metasploit,cpe:2.3:h:netgear:dgn2200v1:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:dgn2200v2:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:dgn2200v3:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:dgn2200v4:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:dgn2200_series_firmware:*:*:*:*:*:*:*:*,Netgear,Dgn2200 Series Firmware
CVE-2017-6398,0.0,,0.55,CWE-78,"An issue was discovered in Trend Micro InterScan Messaging Security (Virtual Appliance) 9.1-1600. An authenticated user can execute a terminal command in the context of the web server user (which is root). Besides, the default installation of IMSVA comes with default administrator credentials. The saveCert.imss endpoint takes several user inputs and performs blacklisting. After that, it uses them as arguments to a predefined operating-system command without proper sanitization. However, because of an improper blacklisting rule, it's possible to inject arbitrary commands into it.",2017-03-14,Metasploit,cpe:2.3:a:trendmicro:interscan_messaging_security_virtual_appliance:9.1-1600:*:*:*:*:*:*:*,Trendmicro,Interscan Messaging Security Virtual Appliance
CVE-2017-6416,0.0,,0.10857,CWE-119,"An issue was discovered in SysGauge 1.5.18. A buffer overflow vulnerability in SMTP connection verification leads to arbitrary code execution. The attack vector is a crafted SMTP daemon that sends a long 220 (aka ""Service ready"") string.",2017-03-06,Metasploit,cpe:2.3:a:flexense:sysgauge:1.5.18:*:*:*:*:*:*:*,Flexense,Sysgauge
CVE-2017-6465,0.0,,0.50315,CWE-119,"Remote Code Execution was discovered in FTPShell Client 6.53. By default, the client sends a PWD command to the FTP server it is connecting to; however, it doesn't check the response's length, leading to a buffer overflow situation.",2017-03-10,Metasploit,cpe:2.3:a:ftpshell:ftpshell_client:6.53:*:*:*:*:*:*:*,Ftpshell,Ftpshell Client
CVE-2017-6478,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02574,CWE-79,paintballrefjosh/MaNGOSWebV4 before 4.0.8 is vulnerable to a reflected XSS in install/index.php (step parameter).,2017-03-05,Nuclei,cpe:2.3:a:mangoswebv4_project:mangoswebv4:*:*:*:*:*:*:*:*,Mangoswebv4 Project,Mangoswebv4
CVE-2017-6510,0.0,,0.15348,CWE-22,Easy File Sharing FTP Server version 3.6 is vulnerable to a directory traversal vulnerability which allows an attacker to list and download any file from any folder outside the FTP root Directory.,2017-03-16,Metasploit,cpe:2.3:a:efssoft:easy_file_sharing_ftp_server:*:*:*:*:*:*:*:*,Efssoft,Easy File Sharing Ftp Server
CVE-2017-6516,0.0,,0.0529,CWE-20,A Local Privilege Escalation Vulnerability in MagniComp's Sysinfo before 10-H64 for Linux and UNIX platforms could allow a local attacker to gain elevated privileges. Parts of SysInfo require setuid-to-root access in order to access restricted system files and make restricted kernel calls. This access could be exploited by a local attacker to gain a root shell prompt using the right combination of environment variables and command line arguments.,2017-03-14,Metasploit,cpe:2.3:a:magnicomp:sysinfo:*:*:*:*:*:*:*:*,Magnicomp,Sysinfo
CVE-2017-6526,0.0,,0.574,CWE-287,An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to unauthenticated command execution through an improperly protected administrative web shell (cgi-bin/dna/sysAdmin.cgi POST requests).,2017-03-09,Metasploit,cpe:2.3:a:dnatools:dnalims:4-2015s13:*:*:*:*:*:*:*,Dnatools,Dnalims
CVE-2017-6527,0.0,,0.56647,CWE-22,An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to a NUL-terminated directory traversal attack allowing an unauthenticated attacker to access system files readable by the web server user (by using the viewAppletFsa.cgi seqID parameter).,2017-03-09,Metasploit,cpe:2.3:a:dnatools:dnalims:4-2015s13:*:*:*:*:*:*:*,Dnatools,Dnalims
CVE-2017-6553,0.0,,0.42292,CWE-119,Buffer Overflow in Quest One Identity Privilege Manager for Unix before 6.0.0.061 allows remote attackers to obtain full access to the policy server via an ACT_ALERT_EVENT request that causes memory corruption in the pmmasterd daemon.,2017-04-29,Metasploit,cpe:2.3:a:quest:privilege_manager_for_unix:*:*:*:*:*:*:*:*,Quest,Privilege Manager For Unix
CVE-2017-6627,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.06042,CWE-399,"A vulnerability in the UDP processing code of Cisco IOS 15.1, 15.2, and 15.4 and IOS XE 3.14 through 3.18 could allow an unauthenticated, remote attacker to cause the input queue of an affected system to hold UDP packets, causing an interface queue wedge and a denial of service (DoS) condition. The vulnerability is due to Cisco IOS Software application changes that create UDP sockets and leave the sockets idle without closing them. An attacker could exploit this vulnerability by sending UDP packets with a destination port of 0 to an affected device. A successful exploit could allow the attacker to cause UDP packets to be held in the input interfaces queue, resulting in a DoS condition. The input interface queue will stop holding UDP packets when it receives 250 packets. Cisco Bug IDs: CSCup10024, CSCva55744, CSCva95506.",2017-09-07,CISA,cpe:2.3:o:cisco:ios:15.1\(2\)gc1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)gc2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)gc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(4\)gc1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(4\)gc2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(4\)gc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)gc1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)gc2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)gc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)gc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)gc1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)gc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3r\)gca:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)gc1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)gc2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)gc3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)gc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m2.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m6a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.14.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.14.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.14.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.14.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.14.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.15.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.15.1cs:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.15.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.15.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.15.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.15.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.0cs:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.1as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.2as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.2bs:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.3as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.4as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.4bs:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.4ds:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.5s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.6s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.17.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.17.1as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.17.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.17.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.0as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.3vs:*:*:*:*:*:*:*,Cisco,Ios
CVE-2017-6663,6.5,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.02135,NVD-CWE-noinfo,"A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause autonomic nodes of an affected system to reload, resulting in a denial of service (DoS) condition. More Information: CSCvd88936. Known Affected Releases: Denali-16.2.1 Denali-16.3.1.",2017-08-07,CISA,cpe:2.3:o:cisco:ios:15.2\(3\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)e3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)e4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)e5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3a\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3a\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3m\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3m\)e3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3m\)e6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3m\)e8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5a\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5b\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s8a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s5a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s6a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s6b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s7a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s2b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s4b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s4d:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)sn:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)s1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)t0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)s0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sn:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp1c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.8as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.8s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.12.0as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.12.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.12.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.12.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.12.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.12.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.2as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.5as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.5s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.6as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.6s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.7as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.8s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.14.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.14.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.14.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.14.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.14.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.15.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.15.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.15.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.15.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.15.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.1as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.2as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.3as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.4as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.4ds:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.6s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.17.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.17.1as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.17.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.17.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.17.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.0as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.0sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.1bsp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.1sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.2asp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.2sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.3sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.7.0e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.7.1e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.7.3e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.0e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.0ex:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.1e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.2e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.3e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.9.0e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.9.1e:*:*:*:*:*:*:*,Cisco,Ios
CVE-2017-6736,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.70559,CWE-119,"The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabilities.

 The vulnerabilities are due to a buffer overflow condition in the SNMP subsystem of the affected software. The vulnerabilities affect all versions of SNMP - Versions 1, 2c, and 3. To exploit these vulnerabilities via SNMP Version 2c or earlier, the attacker must know the SNMP read-only community string for the affected system. To exploit these vulnerabilities via SNMP Version 3, the attacker must have user credentials for the affected system. A successful exploit could allow the attacker to execute arbitrary code and obtain full control of the affected system or cause the affected system to reload.

 Customers are advised to apply the workaround as contained in the Workarounds section below. Fixed software information is available via the Cisco IOS Software Checker. All devices that have enabled SNMP and have not explicitly excluded the affected MIBs or OIDs should be considered vulnerable.

   There are workarounds that address these vulnerabilities.",2017-07-17,CISA,cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*,Cisco,Ios
CVE-2017-6737,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.42632,CWE-119,"A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. An attacker could exploit this vulnerability by sending a crafted SNMP packet to the affected device.&nbsp;



The vulnerability is due to a buffer overflow in the affected code area. The vulnerability affects all versions of SNMP (versions 1, 2c, and 3). The attacker must know the SNMP read only community string (SNMP version 2c or earlier) or the user credentials (SNMPv3). An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or to cause a reload of the affected system.



Only traffic directed to the affected system can be used to exploit this vulnerability.",2017-07-17,CISA,cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*,Cisco,Ios
CVE-2017-6738,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.1055,CWE-119,"The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabilities.

 The vulnerabilities are due to a buffer overflow condition in the SNMP subsystem of the affected software. The vulnerabilities affect all versions of SNMP - Versions 1, 2c, and 3. To exploit these vulnerabilities via SNMP Version 2c or earlier, the attacker must know the SNMP read-only community string for the affected system. To exploit these vulnerabilities via SNMP Version 3, the attacker must have user credentials for the affected system. A successful exploit could allow the attacker to execute arbitrary code and obtain full control of the affected system or cause the affected system to reload.

 Customers are advised to apply the workaround as contained in the Workarounds section below. Fixed software information is available via the Cisco IOS Software Checker. All devices that have enabled SNMP and have not explicitly excluded the affected MIBs or OIDs should be considered vulnerable.

   There are workarounds that address these vulnerabilities.",2017-07-17,CISA,cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*,Cisco,Ios
CVE-2017-6739,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.1055,CWE-119,"A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. An attacker could exploit this vulnerability by sending a crafted SNMP packet to the affected device.&nbsp;



The vulnerability is due to a buffer overflow in the affected code area. The vulnerability affects all versions of SNMP (versions 1, 2c, and 3). The attacker must know the SNMP read only community string (SNMP version 2c or earlier) or the user credentials (SNMPv3). An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or to cause a reload of the affected system.



Only traffic directed to the affected system can be used to exploit this vulnerability.",2017-07-17,CISA,cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*,Cisco,Ios
CVE-2017-6740,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.10788,CWE-119,"The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabilities.

 The vulnerabilities are due to a buffer overflow condition in the SNMP subsystem of the affected software. The vulnerabilities affect all versions of SNMP - Versions 1, 2c, and 3. To exploit these vulnerabilities via SNMP Version 2c or earlier, the attacker must know the SNMP read-only community string for the affected system. To exploit these vulnerabilities via SNMP Version 3, the attacker must have user credentials for the affected system. A successful exploit could allow the attacker to execute arbitrary code and obtain full control of the affected system or cause the affected system to reload.

 Customers are advised to apply the workaround as contained in the Workarounds section below. Fixed software information is available via the Cisco IOS Software Checker. All devices that have enabled SNMP and have not explicitly excluded the affected MIBs or OIDs should be considered vulnerable.

   There are workarounds that address these vulnerabilities.",2017-07-17,CISA,cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*,Cisco,Ios
CVE-2017-6742,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.21424,CWE-119,"A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. An attacker could exploit this vulnerability by sending a crafted SNMP packet to the affected device.&nbsp;



The vulnerability is due to a buffer overflow in the affected code area. The vulnerability affects all versions of SNMP (versions 1, 2c, and 3). The attacker must know the SNMP read only community string (SNMP version 2c or earlier) or the user credentials (SNMPv3). An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or to cause a reload of the affected system.



Only traffic directed to the affected system can be used to exploit this vulnerability.",2017-07-17,CISA,cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*,Cisco,Ios
CVE-2017-6743,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.1055,CWE-119,"The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabilities.

The vulnerabilities are due to a buffer overflow condition in the SNMP subsystem of the affected software. The vulnerabilities affect all versions of SNMP - Versions 1, 2c, and 3. To exploit these vulnerabilities via SNMP Version 2c or earlier, the attacker must know the SNMP read-only community string for the affected system. To exploit these vulnerabilities via SNMP Version 3, the attacker must have user credentials for the affected system. A successful exploit could allow the attacker to execute arbitrary code and obtain full control of the affected system or cause the affected system to reload.

Customers are advised to apply the workaround as contained in the Workarounds section below. Fixed software information is available via the Cisco IOS Software Checker. All devices that have enabled SNMP and have not explicitly excluded the affected MIBs or OIDs should be considered vulnerable.

  There are workarounds that address these vulnerabilities.",2017-07-17,CISA,cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*,Cisco,Ios
CVE-2017-6744,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.07158,CWE-119,"The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabilities.

 The vulnerabilities are due to a buffer overflow condition in the SNMP subsystem of the affected software. The vulnerabilities affect all versions of SNMP - Versions 1, 2c, and 3. To exploit these vulnerabilities via SNMP Version 2c or earlier, the attacker must know the SNMP read-only community string for the affected system. To exploit these vulnerabilities via SNMP Version 3, the attacker must have user credentials for the affected system. A successful exploit could allow the attacker to execute arbitrary code and obtain full control of the affected system or cause the affected system to reload.

 Customers are advised to apply the workaround as contained in the Workarounds section below. Fixed software information is available via the Cisco IOS Software Checker. All devices that have enabled SNMP and have not explicitly excluded the affected MIBs or OIDs should be considered vulnerable.

   There are workarounds that address these vulnerabilities.",2017-07-17,CISA,cpe:2.3:o:cisco:ios:12.2\(33\)sxi1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxi:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)se1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)se2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)se3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)se4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)se5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)se:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sg1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sg2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sg3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sg4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sg5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sg6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sg7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sg8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sq1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sq2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sq3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sq4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sq5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sq6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sq7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sq:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(52\)ex1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(52\)ex:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(52\)ey1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(52\)ey1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(52\)ey1c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(52\)ey2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(52\)ey2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(52\)ey3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(52\)ey3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(52\)ey4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(52\)ey:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(52\)se1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(52\)se:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(52\)sg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(52\)xo:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(53\)ex:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(53\)ey:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(53\)ez:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(53\)se1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(53\)se2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(53\)se:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(53\)sg10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(53\)sg11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(53\)sg1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(53\)sg2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(53\)sg3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(53\)sg4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(53\)sg5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(53\)sg6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(53\)sg7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(53\)sg8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(53\)sg9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(53\)sg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(54\)se:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(54\)sg1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(54\)sg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(54\)wo:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(54\)xo:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)ex1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)ex2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)ex3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)ex:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)ey:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)ez:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(58\)ex:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(58\)ey1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(58\)ey2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(58\)ey:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(58\)ez:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(58\)se1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(58\)se2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(58\)se:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)ex:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)ey1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)ey2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)ey:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)se1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)se2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)se3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)se:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)xo1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)xo:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ea1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)eb:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ec:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ed1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ed:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)eh:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ej1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ej:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ek1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ek:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ex10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ex1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ex2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ex3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ex4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ex5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ex8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ex:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ey1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ey2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ey3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ey:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ez:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se10a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sg10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sg11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sg1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sg2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sg3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sg4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sg5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sg6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sg7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sg8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sg9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sqd1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sqd2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sqd3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sqd5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sqd6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sqd:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)xo:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2a\)ex5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2a\)se9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)sg1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)sg2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)sg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)e3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)ey:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e5a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)ea1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)ea2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)ea3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)eb1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)eb2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)eb:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)gc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)sy1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)sy2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)sy:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2a\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)e3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)ea:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)gc1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)gc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3a\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3m\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3m\)e3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ea1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ea3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ea4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ea:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ec1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)gc1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)gc2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)gc3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)gc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m6a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4m\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4m\)e3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4p\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5\)e2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5\)ea:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5\)ex:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5a\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5a\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5b\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5c\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)sy2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)sy:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(2\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(2\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(2\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(2\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(2\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)cg1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)cg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)sy1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)sy2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)sy:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)cg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m6a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)t0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m:*:*:*:*:*:*:*,Cisco,Ios
CVE-2017-6862,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.42696,CWE-120,"NETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices before 1.0.0.42 allow authentication bypass and remote code execution via a buffer overflow that uses a parameter in the administration webapp. The NETGEAR ID is PSV-2016-0261.",2017-05-26,CISA,cpe:2.3:h:netgear:wnr2000:v3:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wnr2000:v4:*:*:*:*:*:*:*;cpe:2.3:h:netgear:wnr2000:v5:*:*:*:*:*:*:*;cpe:2.3:o:netgear:wnr2000_firmware:*:*:*:*:*:*:*:*,Netgear,Wnr2000 Firmware
CVE-2017-6884,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.37634,CWE-78,"A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute arbitrary commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.",2017-04-06,CISA,cpe:2.3:h:zyxel:emg2926:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:emg2926_firmware:v1.00\(aaqt.4\)b8:*:*:*:*:*:*:*,Zyxel,Emg2926 Firmware
CVE-2017-7230,0.0,,0.13805,CWE-119,A buffer overflow vulnerability in Disk Sorter Enterprise 9.5.12 and earlier allows remote attackers to execute arbitrary code via a GET request.,2017-03-22,Metasploit,cpe:2.3:a:disksorter:disk_sorter:*:*:*:*:enterprise:*:*:*,Disksorter,Disk Sorter
CVE-2017-7269,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99823,CWE-120,"Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with ""If: <http://"" in a PROPFIND request, as exploited in the wild in July or August 2016.",2017-03-27,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:microsoft:internet_information_services:6.0:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2003:r2:*:*:*:*:*:*:*,Microsoft,Windows Server 2003
CVE-2017-7308,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.17827,CWE-681,"The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate certain block-size data, which allows local users to cause a denial of service (integer signedness error and out-of-bounds write), or gain privileges (if the CAP_NET_RAW capability is held), via crafted system calls.",2017-03-29,Metasploit,cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2017-7310,0.0,,0.53651,CWE-119,"A buffer overflow vulnerability in Import Command in SyncBreeze before 10.6, DiskSorter before 10.6, DiskBoss before 8.9, DiskPulse before 10.6, DiskSavvy before 10.6, DupScout before 10.6, and VX Search before 10.6 allows attackers to execute arbitrary code via a crafted XML file containing a long name attribute of a classify element.",2017-03-29,Metasploit,cpe:2.3:a:flexense:diskboss:7.8.16:*:*:*:enterprise:*:*:*;cpe:2.3:a:flexense:disksorter:9.5.12:*:*:*:enterprise:*:*:*;cpe:2.3:a:flexense:syncbreeze:9.5.16:*:*:*:enterprise:*:*:*,Flexense,Diskboss
CVE-2017-7391,0.0,,0.08173,CWE-79,A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.,2017-04-01,Nuclei,cpe:2.3:a:magmi_project:magmi:0.7.22:*:*:*:*:*:*:*,Magmi Project,Magmi
CVE-2017-7411,0.0,,0.66632,CWE-94,"An issue was discovered in Enalean Tuleap 9.6 and prior versions. The vulnerability exists because the User::getRecentElements() method is using the unserialize() function with a preference value that can be arbitrarily manipulated by malicious users through the REST API interface, and this can be exploited to inject arbitrary PHP objects into the application scope, allowing an attacker to perform a variety of attacks (including but not limited to Remote Code Execution).",2017-10-30,Metasploit,cpe:2.3:a:enalean:tuleap:*:*:*:*:*:*:*:*,Enalean,Tuleap
CVE-2017-7442,0.0,,0.40692,CWE-22,Nitro Pro 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory traversal sequences.,2017-08-03,Metasploit,cpe:2.3:a:gonitro:nitro_pro:11.0.3.173:*:*:*:*:*:*:*,Gonitro,Nitro Pro
CVE-2017-7494,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99448,CWE-94,"Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.",2017-05-30,CISA/EPSS/Metasploit,cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2017-7581,0.0,,0.48429,CWE-89,SQL injection vulnerability in NewsController.php in the News module 5.3.2 and earlier for TYPO3 allows unauthenticated users to execute arbitrary SQL commands via vectors involving overwriteDemand for order and OrderByAllowed.,2017-04-07,Metasploit,cpe:2.3:a:news_system_project:news_system:*:*:*:*:*:typo3:*:*,News System Project,News System
CVE-2017-7615,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.90856,CWE-640,MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.,2017-04-16,Metasploit/Nuclei,cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*,Mantisbt,Mantisbt
CVE-2017-7722,0.0,,0.1273,CWE-77,"In SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4, a menu system is encountered when the SSH service is accessed with ""cmc"" and ""password"" (the default username and password). By exploiting a vulnerability in the restrictssh feature of the menuing script, an attacker can escape from the restricted shell.",2017-04-12,Metasploit,cpe:2.3:a:solarwinds:log_\&_event_manager:6.3.1:*:*:*:*:*:*:*,Solarwinds,Log & Event Manager
CVE-2017-7855,0.0,,0.0201,CWE-79,"In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the ""language"" parameter.",2017-08-31,Nuclei,cpe:2.3:a:icewarp:server:11.3.1.5:*:*:*:*:*:*:*,Icewarp,Server
CVE-2017-7896,0.0,,0.04279,CWE-79,Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 before CP 1644 has XSS.,2017-04-18,Metasploit,cpe:2.3:a:trendmicro:interscan_messaging_security_virtual_appliance:*:*:*:*:*:*:*:*,Trendmicro,Interscan Messaging Security Virtual Appliance
CVE-2017-7918,0.0,,0.06653,CWE-284,"An Improper Access Control issue was discovered in Cambium Networks ePMP. After a valid user has used SNMP configuration export, an attacker is able to remotely trigger device configuration backups using specific MIBs. These backups lack proper access control and may allow access to sensitive information and possibly allow for configuration changes.",2017-06-21,Metasploit,cpe:2.3:h:cambium_networks:epmp_1000:-:*:*:*:*:*:*:*;cpe:2.3:h:cambium_networks:epmp_1000_hotspot:-:*:*:*:*:*:*:*;cpe:2.3:h:cambium_networks:epmp_2000:-:*:*:*:*:*:*:*;cpe:2.3:h:cambium_networks:epmp_elevate:-:*:*:*:*:*:*:*;cpe:2.3:o:cambium_networks:epmp_1000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cambium_networks:epmp_1000_hotspot_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cambium_networks:epmp_2000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cambium_networks:epmp_elevate_firmware:-:*:*:*:*:*:*:*,Cambium Networks,Epmp 1000 Firmware
CVE-2017-7921,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99998,CWE-287,"An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.",2017-05-06,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:h:hikvision:ds-2cd2032-i:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2112-i:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2132-i:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2212-i5:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2232-i5:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2312-i:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2332-i:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2412f-i\(w\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2432f-i\(w\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2512f-i\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2532f-i\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2612f-i\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2632f-i\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2712f-i\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2732f-i\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2t32-i3:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2t32-i5:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2t32-i8:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4012f-\(a\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4012f-\(p\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4012f-\(w\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4012fwd-\(a\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4012fwd-\(p\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4012fwd-\(w\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4024f-\(a\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4024f-\(p\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4024f-\(w\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4032fwd-\(a\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4032fwd-\(p\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4032fwd-\(w\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4112f-i\(z\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4112fwd-i\(z\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4124f-i\(z\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4132fwd-i\(z\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4212f-i\(h\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4212f-i\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4212f-i\(z\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4212fwd-i\(h\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4212fwd-i\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4212fwd-i\(z\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4224f-i\(h\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4224f-i\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4224f-i\(z\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4232fwd-i\(h\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4232fwd-i\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4232fwd-i\(z\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4312f-i\(h\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4312f-i\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4312f-i\(z\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4324f-i\(h\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4324f-i\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4324f-i\(z\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4332fwd-i\(h\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4332fwd-i\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd4332fwd-i\(z\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd63xx_series:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd6412fwd:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2dfx_series:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2032-i_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2112-i_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2132-i_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2212-i5_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2232-i5_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2312-i_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2332-i_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2412f-i\(w\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2432f-i\(w\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2512f-i\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2532f-i\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2612f-i\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2632f-i\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2712f-i\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2732f-i\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2t32-i3_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2t32-i5_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2t32-i8_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4012f-\(a\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4012f-\(p\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4012f-\(w\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4012fwd-\(a\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4012fwd-\(p\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4012fwd-\(w\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4024f-\(a\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4024f-\(p\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4024f-\(w\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4032fwd-\(a\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4032fwd-\(p\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4032fwd-\(w\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4112f-i\(z\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4112fwd-i\(z\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4124f-i\(z\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4132fwd-i\(z\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4212f-i\(h\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4212f-i\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4212f-i\(z\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4212fwd-i\(h\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4212fwd-i\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4212fwd-i\(z\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4224f-i\(h\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4224f-i\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4224f-i\(z\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4232fwd-i\(h\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4232fwd-i\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4232fwd-i\(z\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4312f-i\(h\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4312f-i\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4312f-i\(z\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4324f-i\(h\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4324f-i\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4324f-i\(z\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4332fwd-i\(h\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4332fwd-i\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd4332fwd-i\(z\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd63xx_series_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd6412fwd_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2dfx_series_firmware:-:*:*:*:*:*:*:*,Hikvision,Ds-2Cd2032-I Firmware
CVE-2017-7922,0.0,,0.09639,CWE-269,"An Improper Privilege Management issue was discovered in Cambium Networks ePMP. The privileges for SNMP community strings are not properly restricted, which may allow an attacker to gain access to sensitive information and possibly allow for configuration changes.",2017-06-21,Metasploit,cpe:2.3:h:cambium_networks:epmp_1000:-:*:*:*:*:*:*:*;cpe:2.3:h:cambium_networks:epmp_1000_hotspot:-:*:*:*:*:*:*:*;cpe:2.3:h:cambium_networks:epmp_2000:-:*:*:*:*:*:*:*;cpe:2.3:h:cambium_networks:epmp_elevate:-:*:*:*:*:*:*:*;cpe:2.3:o:cambium_networks:epmp_1000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cambium_networks:epmp_1000_hotspot_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cambium_networks:epmp_2000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cambium_networks:epmp_elevate_firmware:-:*:*:*:*:*:*:*,Cambium Networks,Epmp 1000 Firmware
CVE-2017-7924,0.0,,0.22182,CWE-20,"An Improper Input Validation issue was discovered in Rockwell Automation MicroLogix 1100 controllers 1763-L16BWA, 1763-L16AWA, 1763-L16BBB, and 1763-L16DWD. A remote, unauthenticated attacker could send a single, specially crafted Programmable Controller Communication Commands (PCCC) packet to the controller that could potentially cause the controller to enter a DoS condition.",2017-09-20,Metasploit,cpe:2.3:h:rockwellautomation:1763-l16awa:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:1763-l16bbb:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:1763-l16bwa:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:1763-l16dwd:-:*:*:*:*:*:*:*;cpe:2.3:o:rockwellautomation:1763-l16awa_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:rockwellautomation:1763-l16bbb_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:rockwellautomation:1763-l16bwa_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:rockwellautomation:1763-l16dwd_firmware:-:*:*:*:*:*:*:*,Rockwellautomation,1763-L16Bwa Firmware
CVE-2017-7925,0.0,,0.51418,CWE-260,"A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3, DHI-HCVR51A08HE-S3, and DHI-HCVR58A32S-S2 devices. The password in configuration file vulnerability was identified, which could lead to a malicious user assuming the identity of a privileged user and gaining access to sensitive information.",2017-05-06,Nuclei,cpe:2.3:h:dahuasecurity:ddh-hcvr4xxx:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:dh-hcvr5xxx:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:dh-ipc-hdbw13a0sn:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:dh-ipc-hdbw23a0rn-zs:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:dh-ipc-hdw1xxx:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:dh-ipc-hdw2xxx:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:dh-ipc-hdw4xxx:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:dh-ipc-hfw1xxx:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:dh-ipc-hfw2xxx:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:dh-ipc-hfw4xxx:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:dh-nvr1xxx:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:dh-sd6cxx:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:dhi-hcvr51a04he-s3:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:dhi-hcvr51a08he-s3:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:dhi-hcvr58a32s-s2:-:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:dh-hcvr4xxx_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:dh-hcvr5xxx_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:dh-ipc-hdbw13a0sn_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:dh-ipc-hdbw23a0rn-zs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:dh-ipc-hdw1xxx_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:dh-ipc-hdw2xxx_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:dh-ipc-hdw4xxx_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:dh-ipc-hfw1xxx_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:dh-ipc-hfw2xxx_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:dh-ipc-hfw4xxx_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:dh-nvr1xxx_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:dh-sd6cxx_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:dhi-hcvr51a04he-s3_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:dhi-hcvr51a08he-s3_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:dhi-hcvr58a32s-s2_firmware:-:*:*:*:*:*:*:*,Dahuasecurity,Dh-Ipc-Hdbw23A0Rn-Zs Firmware
CVE-2017-8046,0.0,,0.74355,CWE-20,"Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.",2018-01-04,Nuclei,cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m1:*:*:*:*:*:*;cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m2:*:*:*:*:*:*;cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m3:*:*:*:*:*:*;cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m4:*:*:*:*:*:*;cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:spring_boot:2.0.0:milestone1:*:*:*:*:*:*;cpe:2.3:a:vmware:spring_boot:2.0.0:milestone2:*:*:*:*:*:*;cpe:2.3:a:vmware:spring_boot:2.0.0:milestone3:*:*:*:*:*:*;cpe:2.3:a:vmware:spring_boot:2.0.0:milestone4:*:*:*:*:*:*;cpe:2.3:a:vmware:spring_boot:2.0.0:milestone5:*:*:*:*:*:*;cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:spring_data_rest:3.0.0:rc1:*:*:*:*:*:*;cpe:2.3:a:vmware:spring_data_rest:3.0.0:rc2:*:*:*:*:*:*;cpe:2.3:a:vmware:spring_data_rest:3.0.0:rc3:*:*:*:*:*:*,Vmware,Spring Boot
CVE-2017-8229,0.0,,0.73773,CWE-255,"Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative credentials. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that many of the binaries in the /usr folder. The binary ""sonia"" is the one that has the vulnerable function that sets up the default credentials on the device. If one opens this binary in IDA-pro one will notice that this follows a ARM little endian format. The function sub_436D6 in IDA pro is identified to be setting up the configuration for the device. If one scrolls to the address 0x000437C2 then one can see that /current_config is being set as an ALIAS for /mnt/mtd/Config folder on the device. If one TELNETs into the device and navigates to /mnt/mtd/Config folder, one can observe that it contains various files such as Account1, Account2, SHAACcount1, etc. This means that if one navigates to http://[IPofcamera]/current_config/Sha1Account1 then one should be able to view the content of the files. The security researchers assumed that this was only possible only after authentication to the device. However, when unauthenticated access tests were performed for the same URL as provided above, it was observed that the device file could be downloaded without any authentication.",2019-07-03,Nuclei,cpe:2.3:h:amcrest:ipm-721s:-:*:*:*:*:*:*:*;cpe:2.3:o:amcrest:ipm-721s_firmware:*:*:*:*:*:*:*:*,Amcrest,Ipm-721S Firmware
CVE-2017-8291,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.96968,CWE-843,"Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a ""/OutputFile (%pipe%"" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.",2017-04-27,CISA/EPSS/Metasploit,cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2017-8461,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.21108,NVD-CWE-noinfo,"Windows RPC with Routing and Remote Access enabled in Windows XP and Windows Server 2003 allows an attacker to execute code on a targeted RPC server which has Routing and Remote Access enabled via a specially crafted application, aka ""Windows RPC Remote Code Execution Vulnerability.""",2017-06-15,Metasploit,cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:*:*:*:*:*:*:*,Microsoft,Windows Server 2003
CVE-2017-8464,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.90026,NVD-CWE-noinfo,"Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows local users or remote attackers to execute arbitrary code via a crafted .LNK file, which is not properly handled during icon display in Windows Explorer or any other application that parses the icon of the shortcut. aka ""LNK Remote Code Execution Vulnerability.""",2017-06-15,CISA/Metasploit,cpe:2.3:o:microsoft:windows_10_1511:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1703:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1511
CVE-2017-8540,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.71961,CWE-787,"The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka ""Microsoft Malware Protection Engine Remote Code Execution Vulnerability"", a different vulnerability than CVE-2017-8538 and CVE-2017-8541.",2017-05-26,CISA,cpe:2.3:a:microsoft:endpoint_protection:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2013:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:forefront_endpoint_protection:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:forefront_endpoint_protection:2010:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:forefront_security:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:intune_endpoint_protection:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:malware_protection_engine:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:security_essentials:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:system_center_endpoint_protection:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:windows_defender:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2017-8543,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.7376,CWE-281,"Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to take control of the affected system when Windows Search fails to handle objects in memory, aka ""Windows Search Remote Code Execution Vulnerability"".",2017-06-15,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2017-8570,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.89889,NVD-CWE-noinfo,"Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka ""Microsoft Office Remote Code Execution Vulnerability"". This CVE ID is unique from CVE-2017-0243.",2017-07-11,CISA,cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2013:sp1:*:*:rt:*:*:*;cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x64:*;cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x86:*,Microsoft,Office
CVE-2017-8759,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.88698,NVD-CWE-noinfo,"Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious document or application, aka "".NET Framework Remote Code Execution Vulnerability.""",2017-09-13,CISA,cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.6.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.6:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:sp2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2017-8779,0.0,,0.81921,CWE-770,"rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no subsequent free) via a crafted UDP packet to port 111, aka rpcbomb.",2017-05-04,Metasploit,cpe:2.3:a:libtirpc_project:libtirpc:*:*:*:*:*:*:*:*;cpe:2.3:a:ntirpc_project:ntirpc:*:*:*:*:*:*:*:*;cpe:2.3:a:rpcbind_project:rpcbind:*:*:*:*:*:*:*:*,Rpcbind Project,Rpcbind
CVE-2017-8835,0.0,,0.61577,CWE-89,"SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. An attack vector is the bauth cookie to cgi-bin/MANGA/admin.cgi. One impact is enumeration of user accounts by observing whether a session ID can be retrieved from the sessions database.",2017-06-05,Metasploit,cpe:2.3:h:peplink:balance_1350:-:*:*:*:*:*:*:*;cpe:2.3:h:peplink:balance_2500:-:*:*:*:*:*:*:*;cpe:2.3:h:peplink:balance_305:-:*:*:*:*:*:*:*;cpe:2.3:h:peplink:balance_380:-:*:*:*:*:*:*:*;cpe:2.3:h:peplink:balance_580:-:*:*:*:*:*:*:*;cpe:2.3:h:peplink:balance_710:-:*:*:*:*:*:*:*;cpe:2.3:o:peplink:1350hw2_firmware:7.0.1:*:*:*:*:*:*:*;cpe:2.3:o:peplink:2500_firmware:7.0.1:*:*:*:*:*:*:*;cpe:2.3:o:peplink:380hw6_firmware:7.0.1:*:*:*:*:*:*:*;cpe:2.3:o:peplink:580hw2_firmware:7.0.1:*:*:*:*:*:*:*;cpe:2.3:o:peplink:710hw3_firmware:7.0.1:*:*:*:*:*:*:*;cpe:2.3:o:peplink:b305hw2_firmware:7.0.1:*:*:*:*:*:*:*,Peplink,B305Hw2 Firmware
CVE-2017-8869,0.0,,0.15892,CWE-119,Buffer overflow in MediaCoder 0.8.48.5888 allows remote attackers to execute arbitrary code via a crafted .m3u file.,2017-07-27,Metasploit,cpe:2.3:a:mediacoder:mediacoder:0.8.48.5888:*:*:*:*:*:*:*,Mediacoder,Mediacoder
CVE-2017-8870,0.0,,0.13674,CWE-119,Buffer overflow in AudioCoder 0.8.46 allows remote attackers to execute arbitrary code via a crafted .m3u file.,2017-07-27,Metasploit,cpe:2.3:a:mediacoderhq:audiocoder:0.8.46:*:*:*:*:*:*:*,Mediacoderhq,Audiocoder
CVE-2017-8895,0.0,,0.71003,CWE-416,"In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulnerability in multiple agents that can lead to a denial of service or remote code execution. An unauthenticated attacker can use this vulnerability to crash the agent or potentially take control of the agent process and then the system it is running on.",2017-05-10,Metasploit,cpe:2.3:a:veritas:backup_exec:*:*:*:*:*:*:*:*,Veritas,Backup Exec
CVE-2017-8917,0.0,,0.99826,CWE-89,SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.,2017-05-17,EPSS/Metasploit/Nuclei,cpe:2.3:a:joomla:joomla\!:3.7.0:*:*:*:*:*:*:*,Joomla,Joomla!
CVE-2017-9080,0.0,,0.62308,CWE-434,PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile.php has a combination of Unrestricted File Upload and Code Injection.,2017-05-19,Metasploit,cpe:2.3:a:playsms:playsms:1.4:*:*:*:*:*:*:*,Playsms,Playsms
CVE-2017-9101,0.0,,0.76742,CWE-434,import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file.,2017-05-21,Metasploit,cpe:2.3:a:playsms:playsms:1.4:*:*:*:*:*:*:*,Playsms,Playsms
CVE-2017-9140,0.0,,0.09642,CWE-79,Cross-site scripting (XSS) vulnerability in Telerik.ReportViewer.WebForms.dll in Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2 (11.0.17.406) allows remote attackers to inject arbitrary web script or HTML via the bgColor parameter to Telerik.ReportViewer.axd.,2017-05-22,Nuclei,cpe:2.3:a:progress:sitefinity_cms:*:*:*:*:*:*:*:*;cpe:2.3:a:progress:telerik_reporting:*:*:*:*:*:*:*:*,Progress,Telerik Reporting
CVE-2017-9232,0.0,,0.48501,CWE-862,"Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.",2017-05-28,Metasploit,cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.0:alpha1:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.0:alpha2:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.0:beta10:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.0:beta11:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.0:beta12:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.0:beta13:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.0:beta14:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.0:beta15:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.0:beta16:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.0:beta17:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.0:beta18:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.0:beta1:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.0:beta2:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.0:beta3:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.0:beta4:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.0:beta5:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.0:beta6:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.0:beta7:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.0:beta8:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.0:beta9:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.0:rc1:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.0:rc2:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.0:rc3:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.1.0:*:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.1.0:beta1:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.1.0:beta2:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.1.0:beta3:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.1.0:beta4:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.1.0:beta5:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.1.0:rc1:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.1.0:rc2:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:canonical:juju:2.1.2:*:*:*:*:*:*:*,Canonical,Juju
CVE-2017-9248,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.75098,CWE-522,"Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.",2017-07-03,CISA,cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*;cpe:2.3:a:telerik:ui_for_asp.net_ajax:*:*:*:*:*:*:*:*,Progress,Sitefinity
CVE-2017-9288,0.0,,0.03984,CWE-79,The Raygun4WP plugin 1.8.0 for WordPress is vulnerable to a reflected XSS in sendtesterror.php (backurl parameter).,2017-05-29,Nuclei,cpe:2.3:a:raygun:raygun4wp:1.8.0:*:*:*:*:wordpress:*:*,Raygun,Raygun4Wp
CVE-2017-9416,0.0,,0.05651,CWE-22,"Directory traversal vulnerability in tools.file_open in Odoo 8.0, 9.0, and 10.0 allows remote authenticated users to read arbitrary local files readable by the Odoo service.",2017-06-04,Nuclei,cpe:2.3:a:odoo:odoo:10.0:*:*:*:*:*:*:*;cpe:2.3:a:odoo:odoo:8.0:*:*:*:*:*:*:*;cpe:2.3:a:odoo:odoo:9.0:*:*:*:*:*:*:*,Odoo,Odoo
CVE-2017-9462,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.21512,CWE-732,"In Mercurial before 4.1.3, ""hg serve --stdio"" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.",2017-06-06,Metasploit,cpe:2.3:a:mercurial:mercurial:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2017-9506,0.0,,0.71601,CWE-918,The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).,2017-08-23,Nuclei,cpe:2.3:a:atlassian:oauth:1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.3.10:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.3.1:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.3.2:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.3.3:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.3.4:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.3.5:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.3.6:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.3.7:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.3.8:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.3.9:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.4.0:m1:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.4.0:m2:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.4.1:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.5.0:m1:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.5.0:m3:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.6.0:m1:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.6.0:m4:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.6.1:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.8.0:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.8.0:m1:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.8.1:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.8.2:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.8.3:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.8.4:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.8.5:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.9.0:m1:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.9.0:m2:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.9.10:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.9.11:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.9.1:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.9.2:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.9.3:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.9.4:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.9.5:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.9.6:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.9.7:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.9.8:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:1.9.9:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:oauth:2.0.3:*:*:*:*:*:*:*,Atlassian,Oauth
CVE-2017-9544,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.24118,CWE-787,"There is a remote stack-based buffer overflow (SEH) in register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1. By sending an overly long username string to registresult.htm for registering the user, an attacker may be able to execute arbitrary code.",2017-06-12,Metasploit,cpe:2.3:a:echatserver:easy_chat_server:*:*:*:*:*:*:*:*,Echatserver,Easy Chat Server
CVE-2017-9554,0.0,,0.75623,CWE-200,An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors.,2017-07-24,Metasploit,cpe:2.3:o:synology:diskstation_manager:*:*:*:*:*:*:*:*,Synology,Diskstation Manager
CVE-2017-9757,0.0,,0.38498,CWE-78,"IPFire 2.19 has a Remote Command Injection vulnerability in ids.cgi via the OINKCODE parameter, which is mishandled by a shell. This can be exploited directly by authenticated users, or through CSRF.",2017-06-19,Metasploit,cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:*,Ipfire,Ipfire
CVE-2017-9769,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.85539,NVD-CWE-noinfo,A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpenProcess allowing a handle to be opened to an arbitrary process.,2017-08-02,Metasploit,cpe:2.3:a:razer:synapse:2.20.15.1104:*:*:*:*:*:*:*,Razer,Synapse
CVE-2017-9791,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98931,CWE-20,The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.,2017-07-10,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.20.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.24.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.28.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.29:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.30:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.31:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.32:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:*,Apache,Struts
CVE-2017-9798,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.94651,CWE-416,"Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.",2017-09-18,Metasploit,cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.10:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.12:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.16:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.17:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.18:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.20:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.23:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.25:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.26:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.27:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.7:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.9:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2017-9805,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99461,CWE-502,"The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.",2017-09-15,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:digital_media_manager:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:hosted_collaboration_solution:10.5\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:hosted_collaboration_solution:11.0\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:hosted_collaboration_solution:11.5\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:hosted_collaboration_solution:11.6\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:media_experience_engine:3.5.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:media_experience_engine:3.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:network_performance_analysis:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:video_distribution_suite_for_internet_streaming:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*,Apache,Struts
CVE-2017-9822,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.94789,CWE-94,"DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka ""2017-08 (Critical) Possible remote code execution on DNN sites.""",2017-07-20,CISA/Metasploit/Nuclei,cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*,Dnnsoftware,Dotnetnuke
CVE-2017-9833,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.68243,CWE-22,"/cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of ""../.."" using the FILECAMERA variable (sent by GET) to read files with root privileges. NOTE: multiple third parties report that this is a system-integrator issue (e.g., a vulnerability on one type of camera) because Boa does not include any wapopen program or any code to read a FILECAMERA variable.",2017-06-24,Nuclei,cpe:2.3:a:boa:boa:0.94.14.21:*:*:*:*:*:*:*,Boa,Boa
CVE-2017-9841,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99999,CWE-94,"Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a ""<?php "" substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.",2017-06-27,CISA/EPSS/Nuclei,cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*;cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:*:*:*,Phpunit Project,Phpunit
CVE-2017-9965,0.0,,0.04612,CWE-22,"An exposure of sensitive information vulnerability exists in Schneider Electric's Pelco VideoXpert Enterprise versions 2.0 and prior. Using a directory traversal attack, an unauthorized person can view web server files.",2018-01-02,Nuclei,cpe:2.3:a:schneider-electric:pelco_videoxpert:*:*:*:*:enterprise:*:*:*,Schneider-Electric,Pelco Videoxpert
CVE-2018-0125,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.55186,CWE-20,"A vulnerability in the web interface of the Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system, including issuing commands with root privileges. The attacker could also cause an affected system to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to an incomplete input validation on user-controlled input in an HTTP request to the targeted device. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to execute arbitrary code as the root user and gain full control of the affected system or cause it to reload, resulting in a DoS condition. This vulnerability is fixed in firmware version 1.0.1.11 for the following Cisco products: RV132W ADSL2+ Wireless-N VPN Router and RV134W VDSL2 Wireless-AC VPN Router. Cisco Bug IDs: CSCvg92737, CSCvh60170.",2018-02-08,CISA,cpe:2.3:h:cisco:rv132w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv134w:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv132w_firmware:1.0:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv134w_firmware:1.0:*:*:*:*:*:*:*,Cisco,Rv132W Firmware
CVE-2018-0127,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.77484,CWE-200,"A vulnerability in the web interface of Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote attacker to view configuration parameters for an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to the absence of user authentication requirements for certain pages that are part of the web interface and contain confidential information for an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device and examining the HTTP response to the request. A successful exploit could allow the attacker to view configuration parameters, including the administrator password, for the affected device. Cisco Bug IDs: CSCvg92739, CSCvh60172.",2018-02-08,Nuclei,cpe:2.3:h:cisco:rv132w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv134w:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv132w_firmware:1.0.0.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv132w_firmware:1.0.1.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv134w_firmware:1.0.0.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv134w_firmware:1.0.1.8:*:*:*:*:*:*:*,Cisco,Rv132W Firmware
CVE-2018-0147,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.18326,CWE-20,"A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a crafted serialized Java object. An exploit could allow the attacker to execute arbitrary commands on the device with root privileges. Cisco Bug IDs: CSCvh25988.",2018-03-08,CISA,cpe:2.3:a:cisco:secure_access_control_system:5.2\(0.3\):*:*:*:*:*:*:*,Cisco,Secure Access Control System
CVE-2018-0151,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.14468,CWE-119,"A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges. The vulnerability is due to incorrect bounds checking of certain values in packets that are destined for UDP port 18999 of an affected device. An attacker could exploit this vulnerability by sending malicious packets to an affected device. When the packets are processed, an exploitable buffer overflow condition may occur. A successful exploit could allow the attacker to execute arbitrary code on the affected device with elevated privileges. The attacker could also leverage this vulnerability to cause the device to reload, causing a temporary DoS condition while the device is reloading. The malicious packets must be destined to and processed by an affected device. Traffic transiting a device will not trigger the vulnerability. Cisco Bug IDs: CSCvf73881.",2018-03-28,CISA,cpe:2.3:o:cisco:ios_xe:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.5.1:*:*:*:*:*:*:*,Cisco,Ios Xe
CVE-2018-0154,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.07209,CWE-399,"A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient handling of VPN traffic by the affected device. An attacker could exploit this vulnerability by sending crafted VPN traffic to an affected device. A successful exploit could allow the attacker to cause the affected device to hang or crash, resulting in a DoS condition. Cisco Bug IDs: CSCvd39267.",2018-03-28,CISA,cpe:2.3:h:cisco:1000_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4g\/6g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4gltegb_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4gltena_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-6g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-lte_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1101_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109-2p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1111x-8p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1111x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:111x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1120_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1131_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1160_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1801_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1802_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1803_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1811_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1812_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1841_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1861_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1905_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1906c_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1921_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1941_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1941w_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4000_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4221_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321\/k9_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331\/k9_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351\/k9_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4431_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:44461_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4451-x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4451_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4461_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8101-32fh:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8101-32h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8102-64h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8201-32fh:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8201:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8202:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8208:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8212:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8218:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_12-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_18-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_4-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_8-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8804:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8808:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8812:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8818:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8831:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:9800-40:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:9800-80:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:9800-cl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:9800-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-esp100-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-esp100:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-esp200-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-hx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-hx_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-x_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-hx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-hx_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-x_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1004:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1006-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1006:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1009-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1013:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1023:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12s-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12x48u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-16xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-16xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24p-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24pw-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24s-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24t-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xs:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-32xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-32xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48f-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48f-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48f-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48p-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48pw-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48t-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-f-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-f-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-nm-2-40g:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-nm-8-10g:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8200:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-1n1s-4t2x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-1n1s-6t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-2n2s-4t2x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-2n2s-6t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8500-4qc:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8500:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8500l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8510csr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8510msr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8540csr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8540msr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9200:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9200cx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9200l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24p-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24s-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24t-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24u-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24ux-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24ux-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48p-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48s-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48t-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48u-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48un-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48un-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48uxm-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48uxm-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24p-4g-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24p-4g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24p-4x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24p-4x-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24t-4g-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24t-4g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24t-4x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24t-4x-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48p-4g-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48p-4g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48p-4x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48p-4x-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48t-4g-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48t-4g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48t-4x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48t-4x-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l_stack:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300lm:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9400:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9400_supervisor_engine-1:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9407r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9410r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9500:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9500h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9600:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9600_supervisor_engine-1:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9600x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-40:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-40_wireless_controller:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-80:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-80_wireless_controller:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-cl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-l-c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-l-f:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800_embedded_wireless_controller:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3200_rugged_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3300_rugged_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3400_heavy_duty_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3400_rugged_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie9300:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:cbr8_converged_broadband_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:cloud_services_router_1000v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:esr-6300-con-k9:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:esr-6300-ncp-k9:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:esr6300:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:integrated_services_virtual_router:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:-:*:*:*:*:*:*:*,Cisco,Ios
CVE-2018-0155,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H,0.07894,CWE-388,"A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial of service (DoS) condition. The vulnerability is due to insufficient error handling when the BFD header in a BFD packet is incomplete. An attacker could exploit this vulnerability by sending a crafted BFD message to or across an affected switch. A successful exploit could allow the attacker to trigger a reload of the system. This vulnerability affects Catalyst 4500 Supervisor Engine 6-E (K5), Catalyst 4500 Supervisor Engine 6L-E (K10), Catalyst 4500 Supervisor Engine 7-E (K10), Catalyst 4500 Supervisor Engine 7L-E (K10), Catalyst 4500E Supervisor Engine 8-E (K10), Catalyst 4500E Supervisor Engine 8L-E (K10), Catalyst 4500E Supervisor Engine 9-E (K10), Catalyst 4500-X Series Switches (K10), Catalyst 4900M Switch (K5), Catalyst 4948E Ethernet Switch (K5). Cisco Bug IDs: CSCvc40729.",2018-03-28,CISA,cpe:2.3:h:cisco:catalyst_4500-x_series_switches_\(k10\):-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4500_supervisor_engine_6-e_\(k5\):-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4500_supervisor_engine_6l-e_\(k10\):-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4500_supervisor_engine_7-e_\(k10\):-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4500_supervisor_engine_7l-e_\(k10\):-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4500e_supervisor_engine_8-e_\(k10\):-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4500e_supervisor_engine_8l-e_\(k10\):-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4500e_supervisor_engine_9-e_\(k10\):-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4900m_switch_\(k5\):-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4948e_ethernet_switch_\(k5\):-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_8300_industrial_managed_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:3.6\(2\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6\(2\)e:*:*:*:*:*:*:*,Cisco,Ios
CVE-2018-0156,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.08302,CWE-399,"A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted packet to an affected device on TCP port 4786. Only Smart Install client switches are affected. Cisco devices that are configured as a Smart Install director are not affected by this vulnerability. Cisco Bug IDs: CSCvd40673.",2018-03-28,CISA,cpe:2.3:h:cisco:catalyst_2960-plus_24lc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-plus_24lc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-plus_24pc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-plus_24pc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-plus_24tc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-plus_24tc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-plus_48pst-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-plus_48pst-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-plus_48tc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960-plus_48tc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960c-12pc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960c-8pc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960c-8tc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960c-8tc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960cg-8tc-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960cpd-8pt-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960cpd-8tt-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-24pd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-24ps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-24td-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-24ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-24ts-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-48fpd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-48fps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-48lpd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-48lps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-48td-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-48ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-48ts-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-f24ps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-f24ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-f24ts-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-f48fps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-f48lps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-f48ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960s-f48ts-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-24pd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-24ps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-24psq-l_cool:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-24td-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-24ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-24ts-ll:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-48fpd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-48fps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-48lpd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-48lps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-48td-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-48ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960x-48ts-ll:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-24pd-i:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-24ps-i:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-24td-i:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-24ts-i:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-48fpd-i:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-48fps-i:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-48lpd-i:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-48lps-i:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-48td-i:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960xr-48ts-i:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560c-12pc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560c-8pc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560cg-8pc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560cg-8tc-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560cpd-8pt-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-24p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-24p-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-24p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-24t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-24t-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-24t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-24u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-24u-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-24u-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-48p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-48p-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-48p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-48pf-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-48pf-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-48pf-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-48t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-48t-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-48t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-48u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-48u-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3560x-48u-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-12s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-12s-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-24p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-24p-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-24p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-24s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-24s-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-24t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-24t-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-24t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-24u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-24u-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-24u-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-48p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-48p-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-48p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-48pf-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-48pf-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-48pf-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-48t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-48t-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-48t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-48u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-48u-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3750x-48u-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4500_supervisor_engine_6-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4500_supervisor_engine_6l-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4900m:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4948e-f:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_4948e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:embedded_service_2020_24tc_con:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:embedded_service_2020_24tc_con_b:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:embedded_service_2020_24tc_ncp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:embedded_service_2020_24tc_ncp_b:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:embedded_service_2020_con:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:embedded_service_2020_con_b:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:embedded_service_2020_ncp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:embedded_service_2020_ncp_b:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie-3010-16s-8pc:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie-3010-24tc:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-16ptc-g:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-16t67:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-16t67p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-16tc-g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-16tc-g-n:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-16tc-g-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-16tc-g:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-16tc:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-24t67:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-4s-ts-g:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-4t-g:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-4t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-4ts-g:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-4ts:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-8t67:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-8t67p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-8tc-g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-8tc-g-n:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-8tc-g:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_2000-8tc:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_3000-4tc:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ie_3000-8tc:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2a\)ja:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:15.2\(2\)e4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:15.2\(2a\)ja:*:*:*:*:*:*:*,Cisco,Ios
CVE-2018-0158,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H,0.07331,CWE-20,"A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to incorrect processing of certain IKEv2 packets. An attacker could exploit this vulnerability by sending crafted IKEv2 packets to an affected device to be processed. A successful exploit could cause an affected device to continuously consume memory and eventually reload, resulting in a DoS condition. Cisco Bug IDs: CSCvf22394.",2018-03-28,CISA,cpe:2.3:h:cisco:asr_1001-hx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-hx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1004:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1006-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1006:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1009-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1013:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_5900:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s1.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s1.11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s1.12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s1.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s1.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s1.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s1.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s1.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s1.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s1.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:15.5\(3\)s1.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:15.5\(3\)s1.11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:15.5\(3\)s1.12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:15.5\(3\)s1.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:15.5\(3\)s1.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:15.5\(3\)s1.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:15.5\(3\)s1.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:15.5\(3\)s1.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:15.5\(3\)s1.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:15.5\(3\)s1.9:*:*:*:*:*:*:*,Cisco,Ios
CVE-2018-0159,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.07005,CWE-20,"A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of specific IKEv1 packets. An attacker could exploit this vulnerability by sending crafted IKEv1 packets to an affected device during an IKE negotiation. A successful exploit could allow the attacker to cause an affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuj73916.",2018-03-28,CISA,cpe:2.3:h:cisco:asr_901-12c-f-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-12c-ft-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-4c-f-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-4c-ft-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-6cz-f-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-6cz-f-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-6cz-ft-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_901-6cz-ft-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:me_3600x-24cx-m:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:me_3600x-24fs-m:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:me_3600x-24ts-m:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:me_3800x-24fs-m:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:15.3\(3\)s:*:*:*:*:*:*:*,Cisco,Ios
CVE-2018-0161,6.3,CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H,0.04729,CWE-399,"A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to cause a denial of service (DoS) condition, aka a GET MIB Object ID Denial of Service Vulnerability. The vulnerability is due to a condition that could occur when the affected software processes an SNMP read request that contains a request for the ciscoFlashMIB object ID (OID). An attacker could trigger this vulnerability by issuing an SNMP GET request for the ciscoFlashMIB OID on an affected device. A successful exploit could cause the affected device to restart due to a SYS-3-CPUHOG. This vulnerability affects the following Cisco devices if they are running a vulnerable release of Cisco IOS Software and are configured to use SNMP Version 2 (SNMPv2) or SNMP Version 3 (SNMPv3): Cisco Catalyst 2960-L Series Switches, Cisco Catalyst Digital Building Series Switches 8P, Cisco Catalyst Digital Building Series Switches 8U. Cisco Bug IDs: CSCvd89541.",2018-03-28,CISA,cpe:2.3:h:cisco:catalyst_2960l-16ps-ll:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960l-16ts-ll:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960l-24pq-ll:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960l-24ps-ll:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960l-24tq-ll:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960l-24ts-ll:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960l-48pq-ll:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960l-48ps-ll:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960l-48tq-ll:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960l-48ts-ll:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960l-8ps-ll:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_2960l-8ts-ll:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_digital_building_series_switches-8p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_digital_building_series_switches-8u:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5\)e:*:*:*:*:*:*:*,Cisco,Ios
CVE-2018-0167,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03421,CWE-119,"Multiple Buffer Overflow vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCuo17183, CSCvd73487.",2018-03-28,CISA,cpe:2.3:h:cisco:asr_9001:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9006:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9010:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9904:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9906:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9910:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9912:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9922:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_armorstratix_5700:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_5400:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_5410:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_5700:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_5900:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_8000:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_8300:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:5.2.0.base:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:5.2.0.base:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*,Cisco,Ios
CVE-2018-0171,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99512,CWE-20,"A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786. A successful exploit could allow the attacker to cause a buffer overflow on the affected device, which could have the following impacts: Triggering a reload of the device, Allowing the attacker to execute arbitrary code on the device, Causing an indefinite loop on the affected device that triggers a watchdog crash. Cisco Bug IDs: CSCvg76186.",2018-03-28,CISA/EPSS/Nuclei,cpe:2.3:o:cisco:ios:15.2\(5\)e:*:*:*:*:*:*:*,Cisco,Ios
CVE-2018-0172,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H,0.07973,CWE-20,"A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of option 82 information that it receives in DHCP Version 4 (DHCPv4) packets from DHCP relay agents. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device. A successful exploit could allow the attacker to cause a heap overflow condition on the affected device, which will cause the device to reload and result in a DoS condition. Cisco Bug IDs: CSCvg62730.",2018-03-28,CISA,cpe:2.3:h:rockwellautomation:allen-bradley_armorstratix_5700:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_5400:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_5410:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_5700:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_8000:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_8300:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:-:*:*:*:*:*:*:*,Cisco,Ios
CVE-2018-0173,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H,0.07758,CWE-20,"A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a Relay Reply denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of encapsulated option 82 information that it receives in DHCPOFFER messages from DHCPv4 servers. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device, which the device would then forward to a DHCPv4 server. When the affected software processes the option 82 information that is encapsulated in the response from the server, an error could occur. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvg62754.",2018-03-28,CISA,cpe:2.3:h:cisco:4321_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4431_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4451-x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000_series_route_processor_\(rp2\):-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000_series_route_processor_\(rp3\):-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-hx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-hx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:cloud_services_router_1000v:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_armorstratix_5700:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_5400:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_5410:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_5700:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_8000:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_8300:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:denali-16.3.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:denali-16.3.4:*:*:*:*:*:*:*,Cisco,Ios
CVE-2018-0174,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H,0.07758,CWE-20,"A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of option 82 information that it receives in DHCP Version 4 (DHCPv4) packets from DHCP relay agents. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuh91645.",2018-03-28,CISA,cpe:2.3:h:cisco:7600_series_route_switch_processor_720:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:7600_series_supervisor_engine_32:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:7600_series_supervisor_engine_720:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_armorstratix_5700:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_5400:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_5410:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_5700:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_8000:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_8300:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sre7a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:12.2\(33\)sre7a:*:*:*:*:*:*:*,Cisco,Ios
CVE-2018-0175,8.0,CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.03547,CWE-119,"Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCvd73664.",2018-03-28,CISA,cpe:2.3:h:rockwellautomation:allen-bradley_armorstratix_5700:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_5400:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_5410:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_5700:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_5900_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_8000:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_8300_industrial_managed_ethernet_switch:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m4.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:15.4\(3\)m4.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:15.4\(3\)m4.1:*:*:*:*:*:*:*,Cisco,Ios
CVE-2018-0179,5.9,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H,0.05032,CWE-399,"Multiple vulnerabilities in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition. These vulnerabilities affect Cisco devices that are running Cisco IOS Software Release 15.4(2)T, 15.4(3)M, or 15.4(2)CG and later. Cisco Bug IDs: CSCuy32360, CSCuz60599.",2018-03-28,CISA,cpe:2.3:h:cisco:1000_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4g\/6g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4gltegb_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4gltena_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-6g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-lte_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1101_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109-2p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1111x-8p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1111x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:111x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1120_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1131_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1160_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1801_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1802_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1803_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1811_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1812_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1841_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1861_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1905_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1906c_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1921_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1941_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1941w_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:3925_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:3925e_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:3945_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:3945e_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4000_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4221_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:422_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321\/k9_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331\/k9_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351\/k9_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4431_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:44461_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4451-x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4451_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4461_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8101-32fh:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8101-32h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8102-64h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8201-32fh:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8201:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8202:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8208:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8212:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8218:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_12-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_18-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_4-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_8-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8804:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8808:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8812:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8818:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8831:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-esp100-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-esp100:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-esp200-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-hx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-hx_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-x_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-hx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-hx_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-x_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1004:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1006-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1006:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1009-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1013:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1023:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48fd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48fd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48fd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48ur-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48ur-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48ur-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48ur:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uz-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uz-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uz-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uz:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pd:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pdm-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pdm-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pdm-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pdm:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ps-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ps-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24td-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24td-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24td-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ts-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ts-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fqm-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fqm-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fqm-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fqm:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fs-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ps-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ps-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48td-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48td-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48td-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48tq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48tq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48tq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ts-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ts-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24pd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24pd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24pd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24uq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24uq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24uq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24uq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12s-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12x48u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-16xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-16xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24p-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24pw-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24s-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24t-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xs:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-32xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-32xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48f-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48f-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48f-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48p-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48pw-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48t-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-f-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-f-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-nm-2-40g:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-nm-8-10g:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8200:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-1n1s-4t2x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-1n1s-6t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-2n2s-4t2x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-2n2s-6t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8500-4qc:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8500:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8500l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8510csr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8510msr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8540csr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8540msr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9200:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9200cx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9200l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24p-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24s-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24t-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24u-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24ux-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24ux-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48p-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48s-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48t-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48u-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48un-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48un-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48uxm-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48uxm-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24p-4g-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24p-4g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24p-4x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24p-4x-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24t-4g-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24t-4g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24t-4x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24t-4x-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48p-4g-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48p-4g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48p-4x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48p-4x-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48t-4g-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48t-4g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48t-4x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48t-4x-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l_stack:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300lm:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9400:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9407r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9410r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9500:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9500h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9600:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9600x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-40:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-80:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-cl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-l-c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-l-f:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3300_rugged_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3400_heavy_duty_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3400_rugged_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:cloud_services_router_1000v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:esr-6300-con-k9:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:esr-6300-ncp-k9:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:integrated_services_virtual_router:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(00.00.19\)sy:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(01\)ia001.100:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(03\)m4.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)cg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(01.22\)t:*:*:*:*:*:*:*,Cisco,Ios
CVE-2018-0180,5.9,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H,0.05032,CWE-399,"Multiple vulnerabilities in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition. These vulnerabilities affect Cisco devices that are running Cisco IOS Software Release 15.4(2)T, 15.4(3)M, or 15.4(2)CG and later. Cisco Bug IDs: CSCuy32360, CSCuz60599.",2018-03-28,CISA,cpe:2.3:h:cisco:1000_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4g\/6g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4gltegb_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4gltena_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-6g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-lte_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1101_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109-2p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1111x-8p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1111x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:111x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1120_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1131_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1160_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1801_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1802_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1803_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1811_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1812_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1841_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1861_integrated_service_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1905_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1906c_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1921_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1941_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1941w_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:3925_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:3925e_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:3945_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:3945e_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4000_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4221_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:422_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321\/k9_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331\/k9_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351\/k9_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4431_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:44461_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4451-x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4451_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4461_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8101-32fh:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8101-32h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8102-64h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8201-32fh:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8201:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8202:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8208:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8212:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8218:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_12-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_18-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_4-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8800_8-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8804:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8808:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8812:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8818:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8831:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-esp100-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-esp100:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-esp200-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-hx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-hx_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-x_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-hx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-hx_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-x_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1004:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1006-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1006:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1009-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1013:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1023:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48fd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48fd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48fd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48ur-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48ur-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48ur-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48ur:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uz-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uz-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uz-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uz:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pd:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pdm-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pdm-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pdm-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pdm:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ps-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ps-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24td-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24td-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24td-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ts-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ts-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fqm-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fqm-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fqm-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fqm:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fs-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ps-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ps-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48td-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48td-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48td-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48tq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48tq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48tq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ts-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ts-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24pd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24pd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24pd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24uq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24uq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24uq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24uq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12s-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12x48u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-16xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-16xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24p-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24pw-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24s-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24t-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xs:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-32xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-32xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48f-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48f-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48f-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48p-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48pw-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48t-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-f-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-f-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-nm-2-40g:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-nm-8-10g:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8200:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-1n1s-4t2x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-1n1s-6t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-2n2s-4t2x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-2n2s-6t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8500-4qc:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8500:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8500l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8510csr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8510msr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8540csr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8540msr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9200:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9200cx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9200l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24p-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24s-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24t-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24u-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24ux-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-24ux-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48p-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48s-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48t-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48u-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48un-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48un-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48uxm-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300-48uxm-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24p-4g-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24p-4g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24p-4x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24p-4x-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24t-4g-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24t-4g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24t-4x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-24t-4x-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48p-4g-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48p-4g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48p-4x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48p-4x-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48t-4g-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48t-4g-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48t-4x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l-48t-4x-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300l_stack:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300lm:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9300x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9400:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9407r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9410r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9500:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9500h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9600:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9600x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-40:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-80:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-cl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-l-c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-l-f:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_9800:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3300_rugged_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3400_heavy_duty_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_ie3400_rugged_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:cloud_services_router_1000v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:esr-6300-con-k9:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:esr-6300-ncp-k9:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:integrated_services_virtual_router:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(00.00.19\)sy:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(01\)ia001.100:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(03\)m4.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)cg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(01.22\)t:*:*:*:*:*:*:*,Cisco,Ios
CVE-2018-0296,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.99903,CWE-20,"A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. It is also possible on certain software releases that the ASA will not reload, but an attacker could view sensitive system information without authentication by using directory traversal techniques. The vulnerability is due to lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to cause a DoS condition or unauthenticated disclosure of information. This vulnerability applies to IPv4 and IPv6 HTTP traffic. This vulnerability affects Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 1000V Cloud Firewall, ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4100 Series Security Appliance, Firepower 9300 ASA Security Module, FTD Virtual (FTDv). Cisco Bug IDs: CSCvi16029.",2018-06-07,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3-85.02:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3-851:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*,Cisco,Adaptive Security Appliance Software
CVE-2018-0706,0.0,,0.48688,NVD-CWE-noinfo,Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access sensitive information.,2018-07-17,Metasploit,cpe:2.3:a:qnap:q\'center:*:*:*:*:*:*:*:*,Qnap,Q'Center
CVE-2018-0707,0.0,,0.59215,CWE-78,Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.,2018-07-17,Metasploit,cpe:2.3:a:qnap:q\'center:*:*:*:*:*:*:*:*,Qnap,Q'Center
CVE-2018-0798,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.95121,CWE-787,"Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka ""Microsoft Office Memory Corruption Vulnerability"".",2018-01-10,CISA/EPSS,cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2016:*:*:*:click-to-run:*:*:*;cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2013:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2013:sp1:*:*:rt:*:*:*;cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:*:*,Microsoft,Office
CVE-2018-0802,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.93289,CWE-787,"Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects are handled in memory, aka ""Microsoft Office Memory Corruption Vulnerability"". This CVE is unique from CVE-2018-0797 and CVE-2018-0812.",2018-01-10,CISA,cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2013:sp1:*:*:-:*:*:*;cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2016:*:*:*:click-to-run:*:*:*;cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:word:2013:sp1:*:*:-:*:*:*;cpe:2.3:a:microsoft:word:2013:sp1:*:*:rt:*:*:*;cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:*:*,Microsoft,Office
CVE-2018-0824,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.73185,CWE-502,"A remote code execution vulnerability exists in ""Microsoft COM for Windows"" when it fails to properly handle serialized objects, aka ""Microsoft COM for Windows Remote Code Execution Vulnerability."" This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.",2018-05-09,CISA/Metasploit,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1709:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2018-1000001,0.0,,0.13368,CWE-787,In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.,2018-01-31,Metasploit,cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2018-1000006,0.0,,0.84434,CWE-78,"GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specifically Electron apps running on Windows 10, 7 or 2008 that register custom protocol handlers can be tricked in arbitrary command execution if the user clicks on a specially crafted URL. This has been fixed in versions 1.8.2-beta.4, 1.7.11, and 1.6.16.",2018-01-24,Metasploit,cpe:2.3:a:atom:electron:*:*:*:*:*:*:*:*;cpe:2.3:a:atom:electron:1.8.2:beta1:*:*:*:*:*:*;cpe:2.3:a:atom:electron:1.8.2:beta2:*:*:*:*:*:*;cpe:2.3:a:atom:electron:1.8.2:beta3:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:*:*,Microsoft,Windows 10
CVE-2018-1000049,0.0,,0.76944,CWE-20,Nanopool Claymore Dual Miner version 7.3 and earlier contains a remote code execution vulnerability by abusing the miner API. The flaw can be exploited only if the software is executed with read/write mode enabled.,2018-02-09,Metasploit,cpe:2.3:a:nanopool:claymore_dual_miner:*:*:*:*:*:*:*:*,Nanopool,Claymore Dual Miner
CVE-2018-1000094,0.0,,0.39396,CWE-434,CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admin that has access to the file manager to execute code on the server. This attack appear to be exploitable via File upload -> copy to any extension.,2018-03-13,Metasploit,cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.5:*:*:*:*:*:*:*,Cmsmadesimple,Cms Made Simple
CVE-2018-1000115,0.0,,0.88368,CWE-400,"Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.",2018-03-05,Metasploit,cpe:2.3:a:memcached:memcached:1.5.5:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openstack:11:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openstack:12:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2018-1000129,0.0,,0.25103,CWE-79,An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.,2018-03-14,Nuclei,cpe:2.3:a:jolokia:jolokia:1.3.7:*:*:*:*:*:*:*,Jolokia,Jolokia
CVE-2018-1000130,0.0,,0.73224,CWE-74,A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java code on the server.,2018-03-14,Nuclei,cpe:2.3:a:jolokia:webarchive_agent:1.3.7:*:*:*:*:*:*:*,Jolokia,Webarchive Agent
CVE-2018-1000226,0.0,,0.12484,CWE-732,"Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API (/cobbler_api) that can result in Privilege escalation, data manipulation or exfiltration, LDAP credential harvesting. This attack appear to be exploitable via ""network connectivity"". Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931.",2018-08-20,Nuclei,cpe:2.3:a:cobblerd:cobbler:*:*:*:*:*:*:*:*,Cobblerd,Cobbler
CVE-2018-1000533,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.72967,CWE-20,klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` function that can result in Execute any code as PHP user. This attack appear to be exploitable via Send POST request using search form. This vulnerability appears to have been fixed in 0.7 after commit 87b8c26b023c3fc37f0796b14bb13710f397b322.,2018-06-26,Metasploit/Nuclei,cpe:2.3:a:gitlist:gitlist:*:*:*:*:*:*:*:*,Gitlist,Gitlist
CVE-2018-1000600,0.0,,0.90894,CWE-200,"A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attackers to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.",2018-06-26,Nuclei,cpe:2.3:a:jenkins:github:*:*:*:*:*:jenkins:*:*,Jenkins,Github
CVE-2018-1000671,0.0,,0.03982,CWE-601,"sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The ""referer"" parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via data URIs. This attack appear to be exploitable via Victim's browser must follow a URL supplied by the attacker. This vulnerability appears to have been fixed in none available.",2018-09-06,Nuclei,cpe:2.3:a:sympa:sympa:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2018-1000856,0.0,,0.01424,CWE-79,DomainMOD version 4.09.03 and above. Also verified in the latest version 4.11.01 contains a Cross Site Scripting (XSS) vulnerability in Segment Name field in the segments page that can result in Arbitrary script can be executed on all users browsers who visit the affected page. This attack appear to be exploitable via Victim must visit the vulnerable page. This vulnerability appears to have been fixed in No fix yet.,2018-12-20,Nuclei,cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:*,Domainmod,Domainmod
CVE-2018-1000861,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98481,CWE-502,"A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.",2018-12-10,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*;cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*;cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*,Jenkins,Jenkins
CVE-2018-10054,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.34986,CWE-20,"H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code. NOTE: the vendor's position is ""h2 is not designed to be run outside of a secure environment.""",2018-04-11,Metasploit,cpe:2.3:a:cognitect:datomic:*:*:*:*:*:*:*:*;cpe:2.3:a:h2database:h2:1.4.197:*:*:*:*:*:*:*,Cognitect,Datomic
CVE-2018-10088,0.0,,0.40386,CWE-119,"Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE-2017-16725.",2018-06-08,Nuclei,cpe:2.3:a:xiongmaitech:uc-httpd:1.0.0:*:*:*:*:*:*:*,Xiongmaitech,Uc-Httpd
CVE-2018-10093,0.0,,0.6819,CWE-862,AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution.,2019-03-21,Nuclei,cpe:2.3:h:audiocodes:420hd_ip_phone:-:*:*:*:*:*:*:*;cpe:2.3:o:audiocodes:420hd_ip_phone_firmware:2.2.12.126:*:*:*:*:*:*:*,Audiocodes,420Hd Ip Phone Firmware
CVE-2018-10094,0.0,,0.71242,CWE-89,SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes.,2018-05-22,Metasploit,cpe:2.3:a:dolibarr:dolibarr:*:*:*:*:*:*:*:*,Dolibarr,Dolibarr
CVE-2018-10095,0.0,,0.86988,CWE-79,Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php.,2018-05-22,Nuclei,cpe:2.3:a:dolibarr:dolibarr:*:*:*:*:*:*:*:*,Dolibarr,Dolibarr
CVE-2018-10141,0.0,,0.03883,CWE-79,GlobalProtect Portal Login page in Palo Alto Networks PAN-OS before 8.1.4 allows an unauthenticated attacker to inject arbitrary JavaScript or HTML.,2018-10-12,Nuclei,cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*,Paloaltonetworks,Pan-Os
CVE-2018-10201,0.0,,0.45627,CWE-22,"An issue was discovered in NcMonitorServer.exe in NC Monitor Server in NComputing vSpace Pro 10 and 11. It is possible to read arbitrary files outside the root directory of the web server. This vulnerability could be exploited remotely by a crafted URL without credentials, with .../ or ...\ or ..../ or ....\ as a directory-traversal pattern to TCP port 8667.",2018-04-20,Nuclei,cpe:2.3:a:ncomputing:vspace_pro:10:*:*:*:*:*:*:*;cpe:2.3:a:ncomputing:vspace_pro:11:*:*:*:*:*:*:*,Ncomputing,Vspace Pro
CVE-2018-10230,0.0,,0.02705,CWE-79,"Zend Debugger in Zend Server before 9.1.3 has XSS, aka ZSR-2455.",2018-04-19,Nuclei,cpe:2.3:a:zend:zend_server:*:*:*:*:*:*:*:*,Zend,Zend Server
CVE-2018-10245,0.0,,0.01917,CWE-200,"A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining the full path of the server, a similar issue to CVE-2006-3682. The attack can, for example, use the awstats.pl framename and update parameters.",2018-04-20,Nuclei,cpe:2.3:a:awstats:awstats:*:*:*:*:*:*:*:*,Awstats,Awstats
CVE-2018-10383,0.0,,0.01912,CWE-79,Lantronix SecureLinx Spider (SLS) 2.2+ devices have XSS in the auth.asp login page.,2019-05-02,Nuclei,cpe:2.3:h:lantronix:securelinx_spider:-:*:*:*:*:*:*:*;cpe:2.3:o:lantronix:securelinx_spider_firmware:*:*:*:*:*:*:*:*,Lantronix,Securelinx Spider Firmware
CVE-2018-10561,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.92887,CWE-287,"An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending ""?images"" to any URL of the device that requires authentication, as demonstrated by the /menu.html?images/ or /GponForm/diag_FORM?images/ URI. One can then manage the device.",2018-05-04,CISA,cpe:2.3:h:dasannetworks:gpon_router:-:*:*:*:*:*:*:*;cpe:2.3:o:dasannetworks:gpon_router_firmware:-:*:*:*:*:*:*:*,Dasannetworks,Gpon Router Firmware
CVE-2018-10562,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99948,CWE-78,"An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.",2018-05-04,CISA/EPSS/Nuclei,cpe:2.3:h:dasannetworks:gpon_router:-:*:*:*:*:*:*:*;cpe:2.3:o:dasannetworks:gpon_router_firmware:-:*:*:*:*:*:*:*,Dasannetworks,Gpon Router Firmware
CVE-2018-10583,0.0,,0.78683,CWE-200,"An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document.",2018-05-01,Metasploit,cpe:2.3:a:apache:openoffice:4.1.5:*:*:*:*:*:*:*;cpe:2.3:a:libreoffice:libreoffice:6.0.3:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2018-10594,0.0,,0.68957,CWE-121,"Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVPSimulator EH2, EH3, ES2, SE, SS2 and AHSIM_5x0, AHSIM_5x1) utilize a fixed-length stack buffer where an unverified length value can be read from the network packets via a specific network port, causing the buffer to be overwritten. This may allow remote code execution, cause the application to crash, or result in a denial-of-service condition in the application server.",2018-06-26,Metasploit,cpe:2.3:a:deltaww:commgr:*:*:*:*:*:*:*:*;cpe:2.3:h:deltaww:dvpsimulator_ahsim_5x0:-:*:*:*:*:*:*:*;cpe:2.3:h:deltaww:dvpsimulator_ahsim_5x1:-:*:*:*:*:*:*:*;cpe:2.3:h:deltaww:dvpsimulator_eh2:-:*:*:*:*:*:*:*;cpe:2.3:h:deltaww:dvpsimulator_es2:-:*:*:*:*:*:*:*;cpe:2.3:h:deltaww:dvpsimulator_h3:-:*:*:*:*:*:*:*;cpe:2.3:h:deltaww:dvpsimulator_se:-:*:*:*:*:*:*:*;cpe:2.3:h:deltaww:dvpsimulator_ss2:-:*:*:*:*:*:*:*,Deltaww,Dvpsimulator Ahsim 5X0
CVE-2018-10660,0.0,,0.82152,CWE-78,An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection.,2018-06-26,Metasploit,cpe:2.3:h:axis:a1001:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:a8004-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:a8105-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:a9161:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:a9188-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:a9188:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:c1004-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:c2005:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:c3003-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:c8033:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_bullet_le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_c360:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_cube_l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_cube_lw:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_dome_v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_dome_wv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_eye_l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_eye_lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_recorder_4ch:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_recorder_8ch:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:d201-s_xpt_q6055:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:d2050-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:f34_main_unit:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:f41_main_unit:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:f44_dual_audio_input:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:f44_main_unit:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:fa54_main_unit:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1004-w:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1013:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1014:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1025:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1033-w:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1034-w:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1045-lw:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1054:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1065-l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1065-lw:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1103:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1104:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1113-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1113:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1114-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1114:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1124-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1124:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1125-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1125:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1143-l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1144-l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1145-l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1145:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m2014-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m2025-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m2026-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m2026-le_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3004-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3005-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3006-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3007-p:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3007-pv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3014:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3015:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3016:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3024-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3025-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3026-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3027-pve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3037-pve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3044-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3044-wv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3045-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3045-wv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3046-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3046-v_1.8mm:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3047-p:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3048-p:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3104-l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3104-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3105-l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3105-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3106-l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3106-l_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3106-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3106-lve_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3113-r:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3113-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3114-r:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3114-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3203-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3203:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3204-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3204:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m5013-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m5013:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m5014-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m5014:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m5054:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m5055:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m5065:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m5525-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m7010:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m7011:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m7014:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m7016:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1125-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1125-zl:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1126-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1126-zl:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1204:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1214-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1214:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1224-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1244:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1245:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1254:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1264:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1265:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1275:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1280:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1290:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1325-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1343-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1343:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1344-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1344:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1346-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1346:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1347-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1347:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1353-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1353:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1354-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1354:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1355-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1355:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1357-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1357:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1364-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1364:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1365-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1365-e_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1365:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1365_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1367-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1367:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1368-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1405-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1405-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1405-le_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1425-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1425-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1425-le_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1427-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1427-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1428-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1435-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1435-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1447-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1448-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3114-i:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3114-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3115-i:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3115-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3125-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3214-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3214-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3215-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3215-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3224-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3224-lv_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3224-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3224-lve_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3224-v_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3224-ve_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3225-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3225-lv_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3225-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3225-lve_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3225-v_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3225-ve_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3227-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3227-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3228-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3228-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3301-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3301:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3304-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3304:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3314-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3314-zl:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3315-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3315-zl:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3343-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3343-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3343:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3344-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3344-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3344:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3346-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3346-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3346:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3353:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3354:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3363-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3363-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3364-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3364-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3364-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3364-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3365-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3365-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3367-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3367-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3374-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3374-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3375-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3375-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3375-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3375-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3384-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3384-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3705-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3706-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3707-pe:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3904-r:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3904-r_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3905-r:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3905-r_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3905-re:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3915-r:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3915-r_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5414-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5415-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5512-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5512:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5514-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5514:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5515-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5515:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5522-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5522:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5532-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5532:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5534-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5534:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5544:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5624-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5624-e_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5635-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5635-e_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5635-ze:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p7210:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p7214:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p7216:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p7224_blade:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p8513:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p8514:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p8524:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1602-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1602:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1604-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1604:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1605-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1614-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1614:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1615-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1615-e_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1615:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1615_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1635-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1635-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1635:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1645:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1647:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1659:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1755-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1755:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1765-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1765-le_pt_mount:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1775-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1775:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1910-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1910:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1921-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1921:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1922-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1922:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1931-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1931-e_pt_mount:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1932-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1932-e_pt_mount:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1941-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1941-e_pt_mount:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1942-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1942-e_pt_mount:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q2901-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q2901-e_pt_mount:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3504-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3504-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3505-sve_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3505-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3505-v_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3505-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3505-ve_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3515-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3515-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3517-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3517-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3615-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3617-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3708-pve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3709-pve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6000-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6000-e_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6032-c:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6032-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6032:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6034-c:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6034-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6034:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6035-c:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6035-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6035:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6042-c:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6042-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6042-s:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6042:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6044-c:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6044-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6044-s:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6044:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6045-c:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6045-c_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6045-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6045-e_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6045-s:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6045-s_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6045:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6045_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6052-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6052:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6054-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6054-e_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6054:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6054_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6055-c:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6055-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6055-s:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6055:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6114-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6115-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6124-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6125-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6128-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6155-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q7401:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q7404:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q7406_blade:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q7411:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q7414_blade:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q7424-r:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q7424-r_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q7436_blade:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8414-lvs:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8631-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8632-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8641-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8642-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8655-zle:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8665-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8665-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8675-ze:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8685-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8685-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8721-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8722-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8741-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8741-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8742-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8742-e_zoom:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8742-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8742-le_zoom:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:v5914:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:v5915:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:xf40-q1765:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:xf40-q2901:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:xf60-q2901:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:xp40-q1765:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:xp40-q1942:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:xp60-q1765:-:*:*:*:*:*:*:*;cpe:2.3:o:axis:a1001_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:a8004-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:a8105-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:a9161_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:a9188-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:a9188_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:c1004-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:c2005_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:c3003-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:c8033_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_bullet_le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_c360_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_cube_l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_cube_lw_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_dome_v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_dome_wv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_eye_l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_eye_lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_recorder_4ch_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_recorder_8ch_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:d201-s_xpt_q6055_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:d2050-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:f34_main_unit_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:f41_main_unit_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:f44_dual_audio_input_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:f44_main_unit_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:fa54_main_unit_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1004-w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1013_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1014_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1025_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1033-w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1034-w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1045-lw_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1054_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1065-l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1065-lw_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1103_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1104_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1113-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1113_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1114-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1114_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1124-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1124_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1125-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1125_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1143-l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1144-l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1145-l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1145_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m2014-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m2025-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m2026-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m2026-le_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3004-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3005-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3006-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3007-p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3007-pv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3014_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3015_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3016_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3024-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3025-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3026-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3027-pve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3037-pve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3044-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3044-wv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3045-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3045-wv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3046-v_1.8mm_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3046-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3047-p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3048-p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3104-l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3104-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3105-l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3105-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3106-l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3106-l_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3106-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3106-lve_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3113-r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3113-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3114-r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3114-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3203-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3203_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3204-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3204_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m5013-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m5013_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m5014-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m5014_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m5054_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m5055_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m5065_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m5525-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m7010_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m7011_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m7014_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m7016_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1125-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1125-zl_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1126-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1126-zl_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1204_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1214-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1214_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1224-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1244_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1245_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1254_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1264_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1265_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1275_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1280_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1290_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1325-z_firmware:7.10.1.1:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1343-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1343_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1344-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1344_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1346-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1346_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1347-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1347_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1353-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1353_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1354-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1354_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1355-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1355_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1357-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1357_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1364-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1364_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1365-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1365-e_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1365_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1365_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1367-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1367_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1368-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1405-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1405-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1405-le_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1425-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1425-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1425-le_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1427-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1427-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1428-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1435-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1435-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1447-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1448-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3114-i_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3114-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3115-i_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3115-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3125-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3214-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3214-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3215-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3215-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3224-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3224-lv_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3224-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3224-lve_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3224-v_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3224-ve_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3225-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3225-lv_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3225-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3225-lve_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3225-v_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3225-ve_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3227-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3227-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3228-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3228-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3301-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3301_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3304-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3304_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3314-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3314-zl_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3315-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3315-zl_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3343-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3343-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3343_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3344-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3344-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3344_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3346-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3346-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3346_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3353_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3354_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3363-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3363-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3364-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3364-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3364-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3364-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3365-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3365-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3367-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3367-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3374-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3374-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3375-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3375-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3375-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3375-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3384-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3384-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3705-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3706-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3707-pe_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3904-r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3904-r_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3905-r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3905-r_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3905-re_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3915-r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3915-r_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5414-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5415-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5512-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5512_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5514-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5514_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5515-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5515_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5522-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5522_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5532-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5532_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5534-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5534_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5544_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5624-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5624-e_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5635-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5635-e_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5635-ze_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p7210_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p7214_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p7216_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p7224_blade_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p8513_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p8514_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p8524_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1602-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1602_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1604-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1604_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1605-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1614-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1614_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1615-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1615-e_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1615_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1615_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1635-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1635-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1635_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1645_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1647_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1659_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1755-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1755_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1765-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1765-le_pt_mount_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1775-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1775_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1910-e_firmware:5.51.5:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1910_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1921-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1921_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1922-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1922_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1931-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1931-e_pt_mount_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1932-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1932-e_pt_mount_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1941-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1941-e_pt_mount_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1942-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1942-e_pt_mount_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q2901-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q2901-e_pt_mount_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3504-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3504-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3505-sve_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3505-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3505-v_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3505-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3505-ve_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3515-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3515-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3517-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3517-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3615-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3617-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3708-pve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3709-pve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6000-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6000-e_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6032-c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6032-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6032_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6034-c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6034-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6034_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6035-c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6035-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6035_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6042-c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6042-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6042-s_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6042_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6044-c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6044-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6044-s_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6044_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6045-c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6045-c_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6045-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6045-e_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6045-s_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6045-s_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6045_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6045_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6052-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6052_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6054-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6054-e_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6054_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6054_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6055-c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6055-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6055-s_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6055_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6114-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6115-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6124-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6125-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6128-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6155-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q7401_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q7404_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q7406_blade_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q7411_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q7414_blade_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q7424-r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q7424-r_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q7436_blade_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8414-lvs_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8631-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8632-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8641-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8642-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8655-zle_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8665-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8665-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8675-ze_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8685-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8685-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8721-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8722-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8741-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8741-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8742-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8742-e_zoom_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8742-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8742-le_zoom_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:v5914_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:v5915_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:xf40-q1765_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:xf40-q2901_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:xf60-q2901_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:xp40-q1765_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:xp40-q1942_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:xp60-q1765_firmware:*:*:*:*:*:*:*:*,Axis,A1001 Firmware
CVE-2018-10661,0.0,,0.86682,NVD-CWE-noinfo,An issue was discovered in multiple models of Axis IP Cameras. There is a bypass of access control.,2018-06-26,Metasploit,cpe:2.3:h:axis:a1001:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:a8004-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:a8105-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:a9161:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:a9188-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:a9188:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:c1004-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:c2005:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:c3003-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:c8033:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_bullet_le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_c360:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_cube_l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_cube_lw:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_dome_v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_dome_wv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_eye_l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_eye_lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_recorder_4ch:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_recorder_8ch:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:d201-s_xpt_q6055:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:d2050-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:f34_main_unit:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:f41_main_unit:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:f44_dual_audio_input:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:f44_main_unit:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:fa54_main_unit:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1004-w:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1013:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1014:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1025:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1033-w:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1034-w:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1045-lw:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1054:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1065-l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1065-lw:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1103:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1104:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1113-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1113:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1114-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1114:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1124-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1124:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1125-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1125:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1143-l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1144-l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1145-l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1145:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m2014-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m2025-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m2026-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m2026-le_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3004-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3005-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3006-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3007-p:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3007-pv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3014:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3015:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3016:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3024-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3025-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3026-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3027-pve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3037-pve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3044-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3044-wv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3045-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3045-wv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3046-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3046-v_1.8mm:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3047-p:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3048-p:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3104-l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3104-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3105-l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3105-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3106-l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3106-l_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3106-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3106-lve_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3113-r:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3113-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3114-r:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3114-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3203-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3203:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3204-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3204:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m5013-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m5013:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m5014-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m5014:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m5054:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m5055:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m5065:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m5525-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m7010:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m7011:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m7014:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m7016:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1125-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1125-zl:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1126-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1126-zl:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1204:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1214-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1214:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1224-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1244:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1245:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1254:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1264:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1265:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1275:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1280:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1290:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1325-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1343-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1343:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1344-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1344:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1346-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1346:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1347-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1347:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1353-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1353:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1354-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1354:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1355-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1355:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1357-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1357:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1364-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1364:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1365-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1365-e_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1365:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1365_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1367-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1367:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1368-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1405-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1405-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1405-le_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1425-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1425-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1425-le_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1427-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1427-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1428-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1435-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1435-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1447-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1448-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3114-i:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3114-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3115-i:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3115-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3125-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3214-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3214-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3215-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3215-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3224-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3224-lv_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3224-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3224-lve_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3224-v_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3224-ve_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3225-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3225-lv_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3225-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3225-lve_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3225-v_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3225-ve_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3227-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3227-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3228-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3228-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3301-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3301:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3304-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3304:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3314-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3314-zl:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3315-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3315-zl:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3343-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3343-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3343:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3344-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3344-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3344:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3346-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3346-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3346:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3353:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3354:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3363-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3363-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3364-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3364-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3364-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3364-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3365-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3365-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3367-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3367-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3374-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3374-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3375-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3375-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3375-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3375-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3384-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3384-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3705-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3706-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3707-pe:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3904-r:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3904-r_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3905-r:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3905-r_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3905-re:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3915-r:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3915-r_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5414-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5415-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5512-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5512:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5514-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5514:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5515-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5515:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5522-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5522:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5532-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5532:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5534-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5534:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5544:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5624-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5624-e_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5635-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5635-e_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5635-ze:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p7210:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p7214:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p7216:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p7224_blade:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p8513:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p8514:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p8524:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1602-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1602:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1604-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1604:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1605-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1614-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1614:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1615-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1615-e_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1615:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1615_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1635-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1635-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1635:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1645:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1647:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1659:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1755-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1755:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1765-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1765-le_pt_mount:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1775-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1775:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1910-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1910:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1921-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1921:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1922-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1922:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1931-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1931-e_pt_mount:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1932-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1932-e_pt_mount:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1941-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1941-e_pt_mount:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1942-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1942-e_pt_mount:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q2901-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q2901-e_pt_mount:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3504-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3504-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3505-sve_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3505-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3505-v_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3505-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3505-ve_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3515-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3515-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3517-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3517-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3615-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3617-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3708-pve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3709-pve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6000-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6000-e_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6032-c:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6032-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6032:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6034-c:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6034-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6034:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6035-c:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6035-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6035:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6042-c:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6042-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6042-s:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6042:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6044-c:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6044-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6044-s:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6044:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6045-c:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6045-c_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6045-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6045-e_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6045-s:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6045-s_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6045:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6045_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6052-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6052:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6054-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6054-e_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6054:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6054_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6055-c:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6055-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6055-s:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6055:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6114-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6115-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6124-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6125-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6128-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6155-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q7401:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q7404:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q7406_blade:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q7411:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q7414_blade:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q7424-r:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q7424-r_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q7436_blade:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8414-lvs:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8631-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8632-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8641-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8642-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8655-zle:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8665-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8665-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8675-ze:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8685-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8685-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8721-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8722-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8741-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8741-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8742-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8742-e_zoom:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8742-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8742-le_zoom:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:v5914:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:v5915:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:xf40-q1765:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:xf40-q2901:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:xf60-q2901:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:xp40-q1765:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:xp40-q1942:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:xp60-q1765:-:*:*:*:*:*:*:*;cpe:2.3:o:axis:a1001_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:a8004-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:a8105-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:a9161_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:a9188-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:a9188_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:c1004-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:c2005_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:c3003-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:c8033_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_bullet_le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_c360_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_cube_l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_cube_lw_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_dome_v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_dome_wv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_eye_l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_eye_lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_recorder_4ch_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_recorder_8ch_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:d201-s_xpt_q6055_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:d2050-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:f34_main_unit_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:f41_main_unit_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:f44_dual_audio_input_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:f44_main_unit_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:fa54_main_unit_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1004-w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1013_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1014_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1025_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1033-w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1034-w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1045-lw_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1054_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1065-l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1065-lw_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1103_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1104_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1113-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1113_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1114-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1114_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1124-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1124_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1125-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1125_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1143-l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1144-l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1145-l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1145_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m2014-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m2025-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m2026-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m2026-le_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3004-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3005-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3006-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3007-p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3007-pv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3014_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3015_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3016_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3024-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3025-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3026-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3027-pve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3037-pve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3044-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3044-wv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3045-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3045-wv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3046-v_1.8mm_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3046-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3047-p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3048-p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3104-l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3104-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3105-l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3105-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3106-l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3106-l_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3106-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3106-lve_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3113-r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3113-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3114-r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3114-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3203-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3203_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3204-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3204_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m5013-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m5013_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m5014-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m5014_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m5054_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m5055_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m5065_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m5525-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m7010_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m7011_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m7014_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m7016_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1125-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1125-zl_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1126-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1126-zl_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1204_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1214-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1214_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1224-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1244_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1245_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1254_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1264_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1265_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1275_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1280_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1290_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1325-z_firmware:7.10.1.1:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1343-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1343_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1344-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1344_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1346-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1346_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1347-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1347_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1353-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1353_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1354-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1354_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1355-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1355_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1357-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1357_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1364-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1364_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1365-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1365-e_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1365_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1365_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1367-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1367_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1368-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1405-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1405-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1405-le_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1425-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1425-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1425-le_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1427-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1427-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1428-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1435-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1435-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1447-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1448-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3114-i_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3114-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3115-i_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3115-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3125-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3214-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3214-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3215-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3215-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3224-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3224-lv_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3224-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3224-lve_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3224-v_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3224-ve_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3225-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3225-lv_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3225-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3225-lve_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3225-v_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3225-ve_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3227-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3227-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3228-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3228-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3301-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3301_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3304-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3304_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3314-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3314-zl_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3315-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3315-zl_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3343-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3343-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3343_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3344-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3344-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3344_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3346-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3346-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3346_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3353_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3354_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3363-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3363-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3364-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3364-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3364-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3364-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3365-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3365-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3367-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3367-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3374-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3374-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3375-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3375-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3375-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3375-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3384-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3384-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3705-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3706-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3707-pe_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3904-r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3904-r_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3905-r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3905-r_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3905-re_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3915-r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3915-r_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5414-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5415-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5512-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5512_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5514-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5514_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5515-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5515_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5522-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5522_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5532-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5532_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5534-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5534_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5544_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5624-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5624-e_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5635-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5635-e_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5635-ze_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p7210_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p7214_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p7216_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p7224_blade_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p8513_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p8514_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p8524_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1602-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1602_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1604-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1604_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1605-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1614-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1614_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1615-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1615-e_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1615_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1615_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1635-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1635-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1635_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1645_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1647_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1659_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1755-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1755_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1765-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1765-le_pt_mount_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1775-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1775_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1910-e_firmware:5.51.5:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1910_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1921-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1921_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1922-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1922_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1931-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1931-e_pt_mount_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1932-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1932-e_pt_mount_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1941-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1941-e_pt_mount_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1942-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1942-e_pt_mount_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q2901-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q2901-e_pt_mount_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3504-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3504-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3505-sve_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3505-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3505-v_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3505-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3505-ve_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3515-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3515-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3517-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3517-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3615-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3617-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3708-pve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3709-pve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6000-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6000-e_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6032-c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6032-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6032_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6034-c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6034-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6034_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6035-c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6035-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6035_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6042-c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6042-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6042-s_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6042_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6044-c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6044-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6044-s_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6044_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6045-c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6045-c_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6045-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6045-e_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6045-s_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6045-s_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6045_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6045_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6052-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6052_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6054-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6054-e_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6054_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6054_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6055-c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6055-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6055-s_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6055_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6114-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6115-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6124-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6125-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6128-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6155-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q7401_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q7404_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q7406_blade_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q7411_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q7414_blade_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q7424-r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q7424-r_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q7436_blade_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8414-lvs_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8631-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8632-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8641-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8642-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8655-zle_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8665-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8665-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8675-ze_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8685-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8685-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8721-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8722-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8741-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8741-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8742-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8742-e_zoom_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8742-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8742-le_zoom_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:v5914_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:v5915_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:xf40-q1765_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:xf40-q2901_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:xf60-q2901_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:xp40-q1765_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:xp40-q1942_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:xp60-q1765_firmware:*:*:*:*:*:*:*:*,Axis,A1001 Firmware
CVE-2018-10662,0.0,,0.79752,NVD-CWE-noinfo,An issue was discovered in multiple models of Axis IP Cameras. There is an Exposed Insecure Interface.,2018-06-26,Metasploit,cpe:2.3:h:axis:a1001:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:a8004-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:a8105-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:a9161:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:a9188-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:a9188:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:c1004-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:c2005:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:c3003-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:c8033:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_bullet_le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_c360:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_cube_l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_cube_lw:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_dome_v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_dome_wv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_eye_l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_eye_lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_recorder_4ch:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:companion_recorder_8ch:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:d201-s_xpt_q6055:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:d2050-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:f34_main_unit:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:f41_main_unit:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:f44_dual_audio_input:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:f44_main_unit:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:fa54_main_unit:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1004-w:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1013:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1014:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1025:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1033-w:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1034-w:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1045-lw:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1054:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1065-l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1065-lw:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1103:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1104:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1113-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1113:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1114-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1114:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1124-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1124:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1125-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1125:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1143-l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1144-l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1145-l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m1145:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m2014-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m2025-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m2026-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m2026-le_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3004-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3005-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3006-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3007-p:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3007-pv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3014:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3015:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3016:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3024-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3025-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3026-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3027-pve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3037-pve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3044-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3044-wv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3045-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3045-wv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3046-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3046-v_1.8mm:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3047-p:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3048-p:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3104-l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3104-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3105-l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3105-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3106-l:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3106-l_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3106-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3106-lve_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3113-r:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3113-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3114-r:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3114-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3203-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3203:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3204-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m3204:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m5013-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m5013:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m5014-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m5014:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m5054:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m5055:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m5065:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m5525-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m7010:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m7011:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m7014:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:m7016:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1125-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1125-zl:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1126-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1126-zl:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1204:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1214-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1214:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1224-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1244:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1245:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1254:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1264:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1265:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1275:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1280:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1290:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1325-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1343-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1343:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1344-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1344:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1346-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1346:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1347-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1347:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1353-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1353:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1354-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1354:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1355-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1355:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1357-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1357:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1364-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1364:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1365-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1365-e_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1365:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1365_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1367-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1367:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1368-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1405-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1405-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1405-le_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1425-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1425-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1425-le_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1427-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1427-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1428-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1435-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1435-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1447-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p1448-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3114-i:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3114-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3115-i:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3115-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3125-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3214-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3214-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3215-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3215-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3224-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3224-lv_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3224-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3224-lve_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3224-v_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3224-ve_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3225-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3225-lv_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3225-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3225-lve_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3225-v_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3225-ve_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3227-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3227-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3228-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3228-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3301-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3301:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3304-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3304:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3314-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3314-zl:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3315-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3315-zl:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3343-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3343-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3343:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3344-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3344-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3344:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3346-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3346-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3346:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3353:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3354:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3363-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3363-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3364-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3364-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3364-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3364-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3365-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3365-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3367-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3367-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3374-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3374-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3375-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3375-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3375-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3375-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3384-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3384-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3705-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3706-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3707-pe:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3904-r:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3904-r_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3905-r:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3905-r_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3905-re:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3915-r:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p3915-r_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5414-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5415-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5512-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5512:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5514-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5514:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5515-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5515:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5522-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5522:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5532-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5532:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5534-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5534:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5544:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5624-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5624-e_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5635-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5635-e_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p5635-ze:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p7210:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p7214:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p7216:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p7224_blade:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p8513:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p8514:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:p8524:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1602-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1602:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1604-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1604:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1605-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1614-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1614:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1615-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1615-e_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1615:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1615_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1635-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1635-z:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1635:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1645:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1647:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1659:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1755-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1755:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1765-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1765-le_pt_mount:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1775-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1775:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1910-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1910:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1921-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1921:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1922-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1922:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1931-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1931-e_pt_mount:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1932-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1932-e_pt_mount:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1941-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1941-e_pt_mount:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1942-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q1942-e_pt_mount:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q2901-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q2901-e_pt_mount:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3504-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3504-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3505-sve_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3505-v:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3505-v_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3505-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3505-ve_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3515-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3515-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3517-lv:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3517-lve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3615-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3617-ve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3708-pve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q3709-pve:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6000-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6000-e_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6032-c:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6032-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6032:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6034-c:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6034-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6034:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6035-c:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6035-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6035:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6042-c:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6042-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6042-s:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6042:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6044-c:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6044-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6044-s:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6044:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6045-c:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6045-c_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6045-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6045-e_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6045-s:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6045-s_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6045:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6045_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6052-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6052:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6054-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6054-e_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6054:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6054_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6055-c:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6055-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6055-s:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6055:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6114-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6115-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6124-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6125-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6128-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q6155-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q7401:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q7404:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q7406_blade:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q7411:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q7414_blade:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q7424-r:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q7424-r_mk_ii:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q7436_blade:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8414-lvs:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8631-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8632-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8641-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8642-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8655-zle:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8665-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8665-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8675-ze:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8685-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8685-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8721-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8722-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8741-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8741-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8742-e:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8742-e_zoom:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8742-le:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:q8742-le_zoom:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:v5914:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:v5915:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:xf40-q1765:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:xf40-q2901:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:xf60-q2901:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:xp40-q1765:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:xp40-q1942:-:*:*:*:*:*:*:*;cpe:2.3:h:axis:xp60-q1765:-:*:*:*:*:*:*:*;cpe:2.3:o:axis:a1001_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:a8004-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:a8105-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:a9161_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:a9188-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:a9188_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:c1004-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:c2005_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:c3003-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:c8033_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_bullet_le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_c360_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_cube_l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_cube_lw_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_dome_v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_dome_wv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_eye_l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_eye_lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_recorder_4ch_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:companion_recorder_8ch_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:d201-s_xpt_q6055_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:d2050-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:f34_main_unit_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:f41_main_unit_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:f44_dual_audio_input_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:f44_main_unit_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:fa54_main_unit_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1004-w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1013_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1014_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1025_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1033-w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1034-w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1045-lw_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1054_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1065-l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1065-lw_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1103_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1104_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1113-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1113_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1114-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1114_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1124-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1124_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1125-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1125_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1143-l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1144-l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1145-l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m1145_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m2014-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m2025-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m2026-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m2026-le_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3004-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3005-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3006-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3007-p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3007-pv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3014_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3015_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3016_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3024-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3025-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3026-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3027-pve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3037-pve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3044-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3044-wv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3045-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3045-wv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3046-v_1.8mm_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3046-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3047-p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3048-p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3104-l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3104-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3105-l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3105-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3106-l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3106-l_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3106-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3106-lve_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3113-r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3113-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3114-r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3114-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3203-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3203_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3204-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m3204_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m5013-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m5013_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m5014-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m5014_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m5054_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m5055_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m5065_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m5525-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m7010_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m7011_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m7014_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:m7016_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1125-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1125-zl_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1126-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1126-zl_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1204_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1214-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1214_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1224-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1244_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1245_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1254_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1264_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1265_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1275_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1280_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1290_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1325-z_firmware:7.10.1.1:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1343-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1343_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1344-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1344_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1346-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1346_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1347-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1347_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1353-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1353_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1354-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1354_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1355-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1355_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1357-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1357_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1364-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1364_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1365-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1365-e_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1365_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1365_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1367-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1367_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1368-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1405-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1405-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1405-le_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1425-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1425-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1425-le_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1427-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1427-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1428-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1435-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1435-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1447-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p1448-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3114-i_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3114-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3115-i_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3115-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3125-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3214-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3214-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3215-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3215-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3224-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3224-lv_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3224-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3224-lve_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3224-v_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3224-ve_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3225-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3225-lv_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3225-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3225-lve_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3225-v_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3225-ve_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3227-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3227-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3228-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3228-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3301-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3301_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3304-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3304_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3314-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3314-zl_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3315-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3315-zl_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3343-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3343-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3343_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3344-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3344-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3344_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3346-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3346-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3346_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3353_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3354_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3363-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3363-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3364-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3364-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3364-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3364-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3365-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3365-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3367-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3367-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3374-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3374-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3375-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3375-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3375-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3375-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3384-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3384-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3705-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3706-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3707-pe_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3904-r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3904-r_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3905-r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3905-r_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3905-re_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3915-r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p3915-r_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5414-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5415-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5512-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5512_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5514-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5514_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5515-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5515_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5522-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5522_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5532-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5532_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5534-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5534_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5544_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5624-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5624-e_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5635-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5635-e_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p5635-ze_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p7210_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p7214_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p7216_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p7224_blade_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p8513_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p8514_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:p8524_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1602-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1602_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1604-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1604_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1605-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1614-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1614_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1615-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1615-e_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1615_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1615_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1635-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1635-z_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1635_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1645_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1647_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1659_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1755-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1755_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1765-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1765-le_pt_mount_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1775-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1775_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1910-e_firmware:5.51.5:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1910_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1921-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1921_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1922-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1922_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1931-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1931-e_pt_mount_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1932-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1932-e_pt_mount_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1941-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1941-e_pt_mount_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1942-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q1942-e_pt_mount_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q2901-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q2901-e_pt_mount_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3504-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3504-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3505-sve_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3505-v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3505-v_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3505-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3505-ve_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3515-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3515-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3517-lv_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3517-lve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3615-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3617-ve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3708-pve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q3709-pve_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6000-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6000-e_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6032-c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6032-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6032_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6034-c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6034-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6034_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6035-c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6035-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6035_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6042-c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6042-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6042-s_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6042_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6044-c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6044-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6044-s_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6044_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6045-c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6045-c_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6045-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6045-e_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6045-s_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6045-s_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6045_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6045_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6052-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6052_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6054-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6054-e_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6054_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6054_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6055-c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6055-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6055-s_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6055_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6114-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6115-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6124-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6125-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6128-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q6155-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q7401_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q7404_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q7406_blade_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q7411_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q7414_blade_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q7424-r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q7424-r_mk_ii_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q7436_blade_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8414-lvs_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8631-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8632-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8641-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8642-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8655-zle_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8665-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8665-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8675-ze_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8685-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8685-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8721-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8722-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8741-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8741-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8742-e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8742-e_zoom_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8742-le_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:q8742-le_zoom_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:v5914_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:v5915_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:xf40-q1765_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:xf40-q2901_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:xf60-q2901_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:xp40-q1765_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:xp40-q1942_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:axis:xp60-q1765_firmware:*:*:*:*:*:*:*:*,Axis,A1001 Firmware
CVE-2018-10735,0.0,,0.42556,CWE-89,A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/commandline.php cname parameter.,2018-05-16,Nuclei,cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*,Nagios,Nagios Xi
CVE-2018-10736,0.0,,0.42556,CWE-89,A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/info.php key1 parameter.,2018-05-16,Nuclei,cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*,Nagios,Nagios Xi
CVE-2018-10737,0.0,,0.42556,CWE-89,A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/logbook.php txtSearch parameter.,2018-05-16,Nuclei,cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*,Nagios,Nagios Xi
CVE-2018-10738,0.0,,0.42556,CWE-89,A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/menuaccess.php chbKey1 parameter.,2018-05-16,Nuclei,cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*,Nagios,Nagios Xi
CVE-2018-10822,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.39268,CWE-22,"Directory traversal vulnerability in the web interface on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices allows remote attackers to read arbitrary files via a /.. or // after ""GET /uir"" in an HTTP request.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-6190.",2018-10-17,Nuclei,cpe:2.3:h:dlink:dir-140l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-640l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dwr-111:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dwr-116:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dwr-512:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dwr-712:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dwr-921:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-140l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-640l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dwr-111_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dwr-116_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dwr-512_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dwr-712_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dwr-912_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dwr-921_firmware:*:*:*:*:*:*:*:*,D-Link,Dwr-116 Firmware
CVE-2018-10823,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.77699,CWE-78,"An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. An authenticated attacker may execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for full control over the device internals.",2018-10-17,Nuclei,cpe:2.3:h:dlink:dwr-111:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dwr-116:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dwr-512:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dwr-921:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dwr-111_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dwr-116_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dwr-512_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dwr-912_firmware:*:*:*:*:*:*:*:*,D-Link,Dwr-116 Firmware
CVE-2018-10900,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.05059,CWE-78,"Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line character can be used to inject a Password helper parameter into the configuration data passed to VPNC, allowing an attacker to execute arbitrary commands as root.",2018-07-26,Metasploit,cpe:2.3:a:gnome:network_manager_vpnc:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2018-10933,0.0,,0.91789,CWE-592,"A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.",2018-10-17,Metasploit,cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:vsphere:*:*;cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:windows:*:*;cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2018-10942,0.0,,0.12744,CWE-434,modules/attributewizardpro/file_upload.php in the Attribute Wizard addon 1.6.9 for PrestaShop 1.4.0.1 through 1.6.1.18 allows remote attackers to execute arbitrary code by uploading a .phtml file.,2018-05-10,Nuclei,cpe:2.3:a:attribute_wizard_project:attribute_wizard:1.6.9:*:*:*:*:prestashop:*:*;cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:*,Attribute Wizard Project,Attribute Wizard
CVE-2018-10956,0.0,,0.55399,CWE-22,IPConfigure Orchid Core VMS 2.0.5 allows Directory Traversal.,2018-06-25,Nuclei,cpe:2.3:a:ipconfigure:orchid_core_vms:2.0.5:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2018-1111,0.0,,0.9797,CWE-77,"DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.",2018-05-17,EPSS/Metasploit,cpe:2.3:a:redhat:enterprise_virtualization:4.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:enterprise_virtualization:4.2:*:*:*:*:*:*:*;cpe:2.3:a:redhat:enterprise_virtualization_host:4.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:26:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:27:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2018-11133,0.0,,0.07271,CWE-79,The 'fmt' parameter of the '/common/run_cross_report.php' script in the the Quest KACE System Management Appliance 8.0.318 is vulnerable to cross-site scripting.,2018-05-31,Nuclei,cpe:2.3:a:quest:kace_system_management_appliance:8.0.318:*:*:*:*:*:*:*,Quest,Kace System Management Appliance
CVE-2018-11138,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.91931,CWE-78,The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.,2018-05-31,CISA/Metasploit/Nuclei,cpe:2.3:a:quest:kace_system_management_appliance:8.0.318:*:*:*:*:*:*:*,Quest,Kace System Management Appliance
CVE-2018-11218,0.0,,0.59422,CWE-787,"Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.",2018-06-17,Metasploit,cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_operations_monitor:4.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*;cpe:2.3:a:redislabs:redis:*:*:*:*:*:*:*:*;cpe:2.3:a:redislabs:redis:5.0:rc1:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2018-11222,0.0,,0.06714,CWE-20,Local File Inclusion (LFI) in Artica Pandora FMS through version 7.23 allows an attacker to call any php file via the /pandora_console/ajax.php ajax endpoint.,2018-06-16,Nuclei,cpe:2.3:a:artica:pandora_fms:*:*:*:*:*:*:*:*,Artica,Pandora Fms
CVE-2018-11227,0.0,,0.04733,CWE-79,Monstra CMS 3.0.4 and earlier has XSS via index.php.,2019-07-03,Nuclei,cpe:2.3:a:monstra:monstra_cms:*:*:*:*:*:*:*:*,Monstra,Monstra Cms
CVE-2018-11231,0.0,,0.09054,CWE-89,"In the Divido plugin for OpenCart, there is SQL injection. Attackers can use SQL injection to get some confidential information.",2018-05-23,Nuclei,cpe:2.3:a:divido:divido:-:*:*:*:*:opencart:*:*,Divido,Divido
CVE-2018-11409,0.0,,0.98371,CWE-200,"Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key.",2018-06-08,EPSS/Metasploit/Nuclei,cpe:2.3:a:splunk:splunk:*:*:*:*:*:*:*:*,Splunk,Splunk
CVE-2018-11473,0.0,,0.02273,CWE-79,"Monstra CMS 3.0.4 has XSS in the registration Form (i.e., the login parameter to users/registration).",2018-05-25,Nuclei,cpe:2.3:a:monstra:monstra:3.0.4:*:*:*:*:*:*:*,Monstra,Monstra
CVE-2018-11479,0.0,,0.09905,CWE-20,"The VPN component in Windscribe 1.81 uses the OpenVPN client for connections. Also, it creates a WindScribeService.exe system process that establishes a \\.\pipe\WindscribeService named pipe endpoint that allows the Windscribe VPN process to connect and execute an OpenVPN process or other processes (like taskkill, etc.). There is no validation of the program name before constructing the lpCommandLine argument for a CreateProcess call. An attacker can run any malicious process with SYSTEM privileges through this named pipe.",2018-05-25,Metasploit,cpe:2.3:a:windscribe:windscribe:1.81:*:*:*:*:*:*:*,Windscribe,Windscribe
CVE-2018-11511,0.0,,0.11176,CWE-89,The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'album_id' or 'scope' parameter via a photo-gallery/api/album/tree_lists/ URI.,2018-08-16,Nuclei,cpe:2.3:a:asustor:asustor_data_master:3.1.0:*:*:*:*:*:*:*,Asustor,Asustor Data Master
CVE-2018-11529,0.0,,0.40877,CWE-416,VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. Failed exploit attempts will likely result in denial of service conditions.,2018-07-11,Metasploit,cpe:2.3:a:videolan:vlc_media_player:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2018-11646,0.0,,0.68684,NVD-CWE-noinfo,"webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as used in WebKitGTK+ through 2.21.3, mishandle an unset pageURL, leading to an application crash.",2018-06-01,Metasploit,cpe:2.3:a:webkitgtk:webkitgtk\+:*:*:*:*:*:*:*:*,Webkitgtk,Webkitgtk+
CVE-2018-11686,0.0,,0.49787,CWE-20,The Publish Service in FlexPaper (later renamed FlowPaper) 2.3.6 allows remote code execution via setup.php and change_config.php.,2019-07-03,Nuclei,cpe:2.3:a:flowpaper:flexpaper:*:*:*:*:*:*:*:*,Flowpaper,Flexpaper
CVE-2018-11709,0.0,,0.0363,CWE-79,wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site Scripting (XSS) via the URI.,2018-06-04,Nuclei,cpe:2.3:a:gvectors:wpforo_forum:*:*:*:*:*:wordpress:*:*,Gvectors,Wpforo Forum
CVE-2018-11759,0.0,,0.90647,CWE-22,"The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical.",2018-10-31,Nuclei,cpe:2.3:a:apache:tomcat_jk_connector:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2018-11770,4.2,CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N,0.6583,CWE-287,"From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting 'spark.authenticate.secret' when running the REST APIs, to make this clear. Future versions will also disable the REST API by default in the standalone master by changing the default value of 'spark.master.rest.enabled' to 'false'.",2018-08-13,Metasploit,cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*,Apache,Spark
CVE-2018-11776,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99993,NVD-CWE-noinfo,"Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.",2018-08-22,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*;cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_policy_management:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*,Apache,Struts
CVE-2018-11784,0.0,,0.94494,CWE-601,"When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.",2018-10-04,Nuclei,cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*;cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_application_session_controller:3.7.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_application_session_controller:3.8.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_order_broker:5.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_order_broker:5.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:secure_global_desktop:5.4:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2018-12031,0.0,,0.17313,CWE-22,Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/node_upgrade_srv.js directory traversal with the firmware parameter in a downloadFirmware action.,2018-06-07,Nuclei,cpe:2.3:a:eaton:intelligent_power_manager:1.6:*:*:*:*:*:*:*,Eaton,Intelligent Power Manager
CVE-2018-12054,0.0,,0.39391,CWE-22,"Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal.",2018-06-08,Nuclei,cpe:2.3:a:schools_alert_management_script_project:schools_alert_management_script:-:*:*:*:*:*:*:*,Schools Alert Management Script Project,Schools Alert Management Script
CVE-2018-1207,0.0,,0.9079,CWE-94,"Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability which could be used to execute remote code. A remote unauthenticated attacker may potentially be able to use CGI variables to execute remote code.",2018-03-23,Nuclei,cpe:2.3:a:dell:emc_idrac7:*:*:*:*:*:*:*:*;cpe:2.3:a:dell:emc_idrac8:*:*:*:*:*:*:*:*,Dell,Emc Idrac7
CVE-2018-12095,0.0,,0.05634,CWE-79,A Reflected Cross-Site Scripting web vulnerability has been discovered in the OEcms v3.1 web-application. The vulnerability is located in the mod parameter of info.php.,2018-06-11,Nuclei,cpe:2.3:a:oecms_project:oecms:3.1:*:*:*:*:*:*:*,Oecms Project,Oecms
CVE-2018-1217,0.0,,0.46642,CWE-862,"Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1, is affected by a missing access control check vulnerability which could potentially allow a remote unauthenticated attacker to read or change the Local Download Service (LDLS) credentials. The LDLS credentials are used to connect to Dell EMC Online Support. If the LDLS configuration was changed to an invalid configuration, then Avamar Installation Manager may not be able to connect to Dell EMC Online Support web site successfully. The remote unauthenticated attacker can also read and use the credentials to login to Dell EMC Online Support, impersonating the AVI service actions using those credentials.",2018-04-09,Nuclei,cpe:2.3:a:dell:emc_avamar:7.3.1:*:*:*:*:*:*:*;cpe:2.3:a:dell:emc_avamar:7.4.1:*:*:*:*:*:*:*;cpe:2.3:a:dell:emc_avamar:7.5.0:*:*:*:*:*:*:*;cpe:2.3:a:dell:emc_integrated_data_protection_appliance:2.0:*:*:*:*:*:*:*;cpe:2.3:a:dell:emc_integrated_data_protection_appliance:2.1:*:*:*:*:*:*:*,Dell,Emc Avamar
CVE-2018-12296,0.0,,0.10905,CWE-732,Insufficient access control in /api/external/7.0/system.System.get_infos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain information about the NAS without authentication via empty POST requests.,2019-05-13,Nuclei,cpe:2.3:o:seagate:nas_os:4.3.15.1:*:*:*:*:*:*:*,Seagate,Nas Os
CVE-2018-12300,0.0,,0.03127,CWE-601,Arbitrary Redirect in echo-server.html in Seagate NAS OS version 4.3.15.1 allows attackers to disclose information in the Referer header via the 'state' URL parameter.,2019-05-13,Nuclei,cpe:2.3:o:seagate:nas_os:4.3.15.1:*:*:*:*:*:*:*,Seagate,Nas Os
CVE-2018-12455,0.0,,0.05867,CWE-287,"Intelbras NPLUG 1.0.0.14 wireless repeater devices have a critical vulnerability that allows an attacker to authenticate in the web interface just by using ""admin:"" as the name of a cookie.",2018-10-10,Nuclei,cpe:2.3:h:intelbras:nplug:-:*:*:*:*:*:*:*;cpe:2.3:o:intelbras:nplug_firmware:1.0.0.14:*:*:*:*:*:*:*,Intelbras,Nplug Firmware
CVE-2018-12464,0.0,,0.80539,CWE-89,A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute arbitrary SQL statements against the database. This can be exploited to create an administrative account and used in conjunction with CVE-2018-12465 to achieve unauthenticated remote code execution. Affects Micro Focus Secure Messaging Gateway versions prior to 471. It does not affect previous versions of the product that use the GWAVA product name (i.e. GWAVA 6.5).,2018-06-29,Metasploit,cpe:2.3:a:microfocus:secure_messaging_gateway:*:*:*:*:*:*:*:*,Microfocus,Secure Messaging Gateway
CVE-2018-12465,0.0,,0.78955,CWE-77,An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authenticated as a privileged user to execute arbitrary OS commands on the SMG server. This can be exploited in conjunction with CVE-2018-12464 to achieve unauthenticated remote code execution. Affects Micro Focus Secure Messaging Gateway versions prior to 471. It does not affect previous versions of the product that used GWAVA product name (i.e. GWAVA 6.5).,2018-06-29,Metasploit,cpe:2.3:a:microfocus:secure_messaging_gateway:*:*:*:*:*:*:*:*,Microfocus,Secure Messaging Gateway
CVE-2018-12613,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.98462,CWE-287,"An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the ""$cfg['AllowArbitraryServer'] = true"" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the ""$cfg['ServerDefault'] = 0"" case (which bypasses the login requirement and runs the vulnerable code without any authentication).",2018-06-21,EPSS/Metasploit/Nuclei,cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*,Phpmyadmin,Phpmyadmin
CVE-2018-12634,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.56829,CWE-200,CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system/info.html URI.,2018-06-22,Nuclei,cpe:2.3:a:circontrol:circarlife_scada:*:*:*:*:*:*:*:*,Circontrol,Circarlife Scada
CVE-2018-12675,0.0,,0.03125,CWE-601,The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) does not perform origin checks on URLs that the camera's web interface redirects a user to. This can be leveraged to send a user to an unexpected endpoint.,2018-10-19,Nuclei,cpe:2.3:h:sv3c:sv-b01poe-1080p-l:-:*:*:*:*:*:*:*;cpe:2.3:h:sv3c:sv-b11vpoe-1080p-l:-:*:*:*:*:*:*:*;cpe:2.3:h:sv3c:sv-d02poe-1080p-l:-:*:*:*:*:*:*:*;cpe:2.3:o:sv3c:h.264_poe_ip_camera_firmware:v2.3.4.2103-s50-ntd-b20170508b:*:*:*:*:*:*:*;cpe:2.3:o:sv3c:h.264_poe_ip_camera_firmware:v2.3.4.2103-s50-ntd-b20170823b:*:*:*:*:*:*:*,Sv3C,H.264 Poe Ip Camera Firmware
CVE-2018-1271,5.9,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N,0.35681,CWE-22,"Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.",2018-04-06,Nuclei,cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:application_testing_suite:13.1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:application_testing_suite:13.2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:big_data_discovery:1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_converged_application_server:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_performance_intelligence_center:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_services_gatekeeper:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:goldengate_for_big_data:12.2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:goldengate_for_big_data:12.3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:goldengate_for_big_data:12.3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:health_sciences_information_manager:3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:healthcare_master_person_index:3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:healthcare_master_person_index:4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_calculation_engine:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_calculation_engine:10.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_calculation_engine:10.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_calculation_engine:10.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_rules_palette:10.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_rules_palette:10.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_rules_palette:10.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_rules_palette:11.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_rules_palette:11.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_gateway:15.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_gateway:16.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_gateway:17.12:*:*:*:*:*:*:*;cpe:2.3:a:oracle:rapid_planning:12.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:rapid_planning:12.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_customer_insights:15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_customer_insights:16.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:14.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:14.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:14.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:14.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:14.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:14.1.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:14.1.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:15.0.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:15.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:15.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:16.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:16.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:16.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_open_commerce_platform:5.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_open_commerce_platform:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_open_commerce_platform:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_order_broker:5.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_order_broker:5.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_point-of-sale:14.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_point-of-sale:14.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_predictive_application_server:14.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_predictive_application_server:14.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_predictive_application_server:15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_predictive_application_server:16.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:service_architecture_leveraging_tuxedo:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:service_architecture_leveraging_tuxedo:12.2.2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:tape_library_acsls:8.4:*:*:*:*:*:*:*;cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*,Vmware,Spring Framework
CVE-2018-1273,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.95649,CWE-94,"Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.",2018-04-11,CISA/EPSS/Nuclei,cpe:2.3:a:apache:ignite:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:ignite:1.0.0:-:*:*:*:*:*:*;cpe:2.3:a:apache:ignite:1.0.0:rc3:*:*:*:*:*:*;cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*;cpe:2.3:a:pivotal_software:spring_data_rest:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*,Broadcom,Spring Data Commons
CVE-2018-12895,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.62558,CWE-22,"WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the wp-includes/post.php wp_delete_attachment function. The attacker must have capabilities for files and posts that are normally available only to the Author, Editor, and Administrator roles. The attack methodology is to delete wp-config.php and then launch a new installation process to increase the attacker's privileges.",2018-06-26,Metasploit,cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2018-12909,0.0,,0.18568,CWE-22,"Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem (that the webserver user has access to) via an index.php?op=fileviewer&file= URI. NOTE: the vendor indicates that the product is not intended for a ""publicly accessible environment.",2018-06-27,Nuclei,cpe:2.3:a:webgrind_project:webgrind:1.5.0:*:*:*:*:*:*:*,Webgrind Project,Webgrind
CVE-2018-12998,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.98463,CWE-79,"A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.",2018-06-29,EPSS/Nuclei,cpe:2.3:a:zohocorp:firewall_analyzer:-:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:-:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:-:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:-:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:-:*:*:*:*:*:*:*,Zohocorp,Firewall Analyzer
CVE-2018-13317,0.0,,0.00991,CWE-79,Password disclosure in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to obtain the plaintext password for the admin user by making a GET request for password.htm.,2018-11-26,Nuclei,cpe:2.3:h:totolink:a3002ru:-:*:*:*:*:*:*:*;cpe:2.3:o:totolink:a3002ru_firmware:1.0.8:*:*:*:*:*:*:*,Totolink,A3002Ru Firmware
CVE-2018-1335,0.0,,0.93972,NVD-CWE-noinfo,"From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.",2018-04-25,Metasploit/Nuclei,cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:*,Apache,Tika
CVE-2018-13374,4.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N,0.38088,CWE-732,"A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.",2019-01-22,CISA,cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortiadc:6.1.0:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*,Fortinet,Fortios
CVE-2018-13379,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H,0.99999,CWE-22,"An Improper Limitation of a Pathname to a Restricted Directory (""Path Traversal"") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.",2019-06-04,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortiproxy:2.0.0:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*,Fortinet,Fortios
CVE-2018-13380,4.7,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N,0.62474,CWE-79,"A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below and Fortinet FortiProxy 2.0.0, 1.2.8 and below under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling parameters.",2019-06-04,Nuclei,cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortiproxy:2.0.0:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*,Fortinet,Fortios
CVE-2018-13382,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.81691,CWE-863,"An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests",2019-06-04,CISA,cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortiproxy:2.0.0:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*,Fortinet,Fortios
CVE-2018-13383,4.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L,0.33647,CWE-787,"A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.",2019-05-29,CISA,cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortiproxy:2.0.0:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*,Fortinet,Fortios
CVE-2018-13980,5.5,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.06902,CWE-22,"The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclosure if the plugin ""filebrowser"" is installed, because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal.",2018-07-16,Nuclei,cpe:2.3:a:zeta-producer:zeta_producer:*:*:*:*:*:*:*:*,Zeta-Producer,Zeta Producer
CVE-2018-14013,0.0,,0.07376,CWE-79,Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.,2019-05-29,Nuclei,cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p5:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p6:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.10:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.10:p2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.10:p3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.10:p4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.11:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p7:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p8:*:*:*:*:*:*,Synacor,Zimbra Collaboration Suite
CVE-2018-14058,0.0,,0.2895,CWE-89,Pimcore before 5.3.0 allows SQL Injection via the REST web service API.,2018-08-17,Metasploit,cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*,Pimcore,Pimcore
CVE-2018-14064,0.0,,0.3757,CWE-22,"The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal, as demonstrated by /../../etc/passwd on TCP port 80.",2018-07-15,Nuclei,cpe:2.3:h:velotismart_project:velotismart_wifi:-:*:*:*:*:*:*:*;cpe:2.3:o:velotismart_project:velotismart_wifi_firmware:b-380:*:*:*:*:*:*:*,Velotismart Project,Velotismart Wifi Firmware
CVE-2018-1418,0.0,,0.52072,CWE-287,IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution. IBM X-Force ID: 138824.,2018-04-26,Metasploit,cpe:2.3:a:ibm:qradar_security_information_and_event_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p10:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p11:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p4:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p5:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p6:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p7:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p8:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p9:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.1:-:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.1:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.1:p2:*:*:*:*:*:*,Ibm,Qradar Security Information And Event Manager
CVE-2018-14474,0.0,,0.02257,CWE-601,views/auth.go in Orange Forum 1.4.0 allows Open Redirection via the next parameter to /login or /signup.,2018-07-20,Nuclei,cpe:2.3:a:goodoldweb:orange_forum:1.4.0:*:*:*:*:*:*:*,Goodoldweb,Orange Forum
CVE-2018-14558,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.08672,CWE-78,"An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03.06.23_CN(AC10). A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted goform/setUsbUnload request. This occurs because the ""formsetUsbUnload"" function executes a dosystemCmd function with untrusted input.",2018-10-30,CISA,cpe:2.3:h:tenda:ac10:-:*:*:*:*:*:*:*;cpe:2.3:h:tenda:ac7:-:*:*:*:*:*:*:*;cpe:2.3:h:tenda:ac9:-:*:*:*:*:*:*:*;cpe:2.3:o:tenda:ac10_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tenda:ac7_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tenda:ac9_firmware:*:*:*:*:*:*:*:*,Tenda,Ac7 Firmware
CVE-2018-14574,0.0,,0.2549,CWE-601,django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.,2018-08-03,Nuclei,cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2018-14634,0.0,,0.14806,CWE-190,"An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable.",2018-09-25,CISA,cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_centralized_management:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_centralized_management:4.6.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_cloud_and_orchestration:1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:enterprise_manager:3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:iworkflow:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:traffix_signaling_delivery_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:traffix_signaling_delivery_controller:4.4.0:*:*:*:*:*:*:*;cpe:2.3:a:netapp:snapprotect:-:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:6.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:6.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*,Paloaltonetworks,Pan-Os
CVE-2018-14665,0.0,,0.2704,CWE-863,A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.,2018-10-25,Metasploit,cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*,Redhat,Enterprise Linux Desktop
CVE-2018-14667,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.74171,CWE-94,"The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.",2018-11-06,CISA,cpe:2.3:a:redhat:richfaces:*:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*,Redhat,Enterprise Linux
CVE-2018-14728,0.0,,0.76511,CWE-918,upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter.,2018-08-03,Nuclei,cpe:2.3:a:tecrail:responsive_filemanager:9.13.1:*:*:*:*:*:*:*,Tecrail,Responsive Filemanager
CVE-2018-14839,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.89354,CWE-78,LG N1A1 NAS 3718.510 is affected by: Remote Command Execution. The impact is: execute arbitrary code (remote). The attack vector is: HTTP POST with parameters.,2019-05-14,CISA,cpe:2.3:h:lg:n1a1:-:*:*:*:*:*:*:*;cpe:2.3:o:lg:n1a1_firmware:3718.510:*:*:*:*:*:*:*,Lg,N1A1 Firmware
CVE-2018-14847,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.96087,CWE-22,MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.,2018-08-02,CISA/EPSS/Metasploit,cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*,Mikrotik,Routeros
CVE-2018-14912,0.0,,0.93188,CWE-22,"cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.",2018-08-03,Metasploit/Nuclei,cpe:2.3:a:cgit_project:cgit:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2018-14916,0.0,,0.17195,CWE-732,LOYTEC LGATE-902 6.3.2 devices allow Arbitrary file deletion.,2019-06-28,Nuclei,cpe:2.3:h:loytec:lgate-902:-:*:*:*:*:*:*:*;cpe:2.3:o:loytec:lgate-902_firmware:*:*:*:*:*:*:*:*,Loytec,Lgate-902 Firmware
CVE-2018-14918,0.0,,0.17982,CWE-22,LOYTEC LGATE-902 6.3.2 devices allow Directory Traversal.,2019-06-28,Nuclei,cpe:2.3:h:loytec:lgate-902:-:*:*:*:*:*:*:*;cpe:2.3:o:loytec:lgate-902_firmware:*:*:*:*:*:*:*:*,Loytec,Lgate-902 Firmware
CVE-2018-14931,0.0,,0.02398,CWE-601,An issue was discovered in the Core and Portal modules in Polaris FT Intellect Core Banking 9.7.1. An open redirect exists via a /IntellectMain.jsp?IntellectSystem= URI.,2019-04-30,Nuclei,cpe:2.3:a:polarisft:intellect_core_banking:9.7.1:*:*:*:*:*:*:*,Polarisft,Intellect Core Banking
CVE-2018-14933,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.93746,CWE-78,upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.,2018-08-04,CISA/Metasploit/Nuclei,cpe:2.3:h:nuuo:nvrmini:-:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrmini_firmware:2016:*:*:*:*:*:*:*,Nuuo,Nvrmini Firmware
CVE-2018-15133,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.76814,CWE-502,"In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.",2018-08-09,CISA/Metasploit,cpe:2.3:a:laravel:laravel:*:*:*:*:*:*:*:*,Laravel,Laravel
CVE-2018-15138,0.0,,0.12851,CWE-22,Ericsson-LG iPECS NMS 30M allows directory traversal via ipecs-cm/download?filename=../ URIs.,2018-08-15,Nuclei,cpe:2.3:a:ericssonlg:ipecs_nms:30m-2.3gn:*:*:*:*:*:*:*;cpe:2.3:a:ericssonlg:ipecs_nms:30m-b.2ia:*:*:*:*:*:*:*,Ericssonlg,Ipecs Nms
CVE-2018-15379,0.0,,0.86221,CWE-275,"A vulnerability in which the HTTP web server for Cisco Prime Infrastructure (PI) has unrestricted directory permissions could allow an unauthenticated, remote attacker to upload an arbitrary file. This file could allow the attacker to execute commands at the privilege level of the user prime. This user does not have administrative or root privileges. The vulnerability is due to an incorrect permission setting for important system directories. An attacker could exploit this vulnerability by uploading a malicious file by using TFTP, which can be accessed via the web-interface GUI. A successful exploit could allow the attacker to run commands on the targeted application without authentication.",2018-10-05,Metasploit,cpe:2.3:a:cisco:prime_infrastructure:3.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_infrastructure:3.2:fips:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_infrastructure:3.2\(0.0\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_infrastructure:3.2\(1.0\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_infrastructure:3.2\(2.0\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_infrastructure:3.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_infrastructure:3.3\(0.0\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_infrastructure:3.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_infrastructure:3.4\(0.0\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_infrastructure:3.5\(0.0\):*:*:*:*:*:*:*,Cisco,Prime Infrastructure
CVE-2018-15439,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.49742,CWE-798,"A vulnerability in the Cisco Small Business Switches software could allow an unauthenticated, remote attacker to bypass the user authentication mechanism of an affected device. The vulnerability exists because under specific circumstances, the affected software enables a privileged user account without notifying administrators of the system. An attacker could exploit this vulnerability by using this account to log in to an affected device and execute commands with full admin rights. Cisco has not released software updates that address this vulnerability. This advisory will be updated with fixed software information once fixed software becomes available. There is a workaround to address this vulnerability.",2018-11-08,Metasploit,cpe:2.3:h:cisco:sf200-24:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf200-24fp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf200-24p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf200-48:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf200-48p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf250-24:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf250-24p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf250-48:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf250-48hp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf300-08:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf300-24:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf300-24mp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf300-24p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf300-24pp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf300-48:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf300-48p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf300-48pp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf302-08:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf302-08mp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf302-08mpp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf302-08p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf302-08pp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf350-48:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf350-48mp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf350-48p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf500-24:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf500-24p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf500-48:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf500-48p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf550x-24:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf550x-24mp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf550x-24p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf550x-48:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf550x-48mp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf550x-48p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg200-08:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg200-08p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg200-10fp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg200-18:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg200-26:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg200-26fp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg200-26p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg200-50:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg200-50fp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg200-50p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg250-08:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg250-08hp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg250-10p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg250-18:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg250-26:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg250-26hp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg250-26p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg250-50:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg250-50hp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg250-50p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg250x-24:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg250x-24p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg250x-48:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg250x-48p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-10:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-10mp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-10mpp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-10p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-10pp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-10sfp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-20:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-28:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-28mp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-28p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-28pp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-52:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-52mp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-52p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg350-10:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg350-10mp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg350-10p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg350-28:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg350-28mp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg350-28p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg350x-24:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg350x-24mp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg350x-24p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg350x-48:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg350x-48mp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg350x-48p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg350xg-24f:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg350xg-24t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg350xg-2f10:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg350xg-48t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg355-10p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg500-28:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg500-28mpp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg500-28p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg500-52:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg500-52mp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg500-52p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg500x-24:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg500x-24p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg500x-48:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg500x-48p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg500xg-8f8t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg550x-24:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg550x-24mp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg550x-24mpp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg550x-24p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg550x-48:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg550x-48mp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg550x-48p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sx550x-12f:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sx550x-16ft:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sx550x-24:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sx550x-24f:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sx550x-24ft:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sx550x-52:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf200-24_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf200-24fp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf200-24p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf200-48_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf200-48p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf250-24_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf250-24p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf250-48_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf250-48hp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf300-08_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf300-24_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf300-24mp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf300-24p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf300-24pp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf300-48_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf300-48p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf300-48pp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf302-08_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf302-08mp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf302-08mpp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf302-08p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf302-08pp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf350-48_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf350-48mp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf350-48p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf500-24_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf500-24p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf500-48_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf500-48p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf550x-24_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf550x-24mp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf550x-24p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf550x-48_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf550x-48mp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf550x-48p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg200-08_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg200-08p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg200-10fp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg200-18_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg200-26_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg200-26fp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg200-26p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg200-50_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg200-50fp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg200-50p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg250-08_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg250-08hp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg250-10p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg250-18_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg250-26_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg250-26hp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg250-26p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg250-50_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg250-50hp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg250-50p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg250x-24_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg250x-24p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg250x-48_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg250x-48p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-10_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-10mp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-10mpp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-10p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-10pp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-10sfp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-20_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-28_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-28mp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-28p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-28pp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-52_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-52mp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-52p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg350-10_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg350-10mp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg350-10p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg350-28_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg350-28mp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg350-28p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg350x-24_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg350x-24mp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg350x-24p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg350x-48_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg350x-48mp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg350x-48p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg350xg-24f_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg350xg-24t_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg350xg-2f10_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg350xg-48t_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg355-10p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg500-28_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg500-28mpp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg500-28p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg500-52_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg500-52mp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg500-52p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg500x-24_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg500x-24p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg500x-48_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg500x-48p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg500xg-8f8t_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg550x-24_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg550x-24mp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg550x-24mpp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg550x-24p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg550x-48_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg550x-48mp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg550x-48p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sx550x-12f_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sx550x-16ft_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sx550x-24_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sx550x-24f_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sx550x-24ft_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sx550x-52_firmware:-:*:*:*:*:*:*:*,Cisco,Sg200-50 Firmware
CVE-2018-15442,0.0,,0.1602,CWE-78,"A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated, local attacker to execute arbitrary commands as a privileged user. The vulnerability is due to insufficient validation of user-supplied parameters. An attacker could exploit this vulnerability by invoking the update service command with a crafted argument. An exploit could allow the attacker to run arbitrary commands with SYSTEM user privileges. While the CVSS Attack Vector metric denotes the requirement for an attacker to have local access, administrators should be aware that in Active Directory deployments, the vulnerability could be exploited remotely by leveraging the operating system remote management tools.",2018-10-24,Metasploit,cpe:2.3:a:cisco:webex_meetings_desktop:*:*:*:*:*:windows:*:*;cpe:2.3:a:cisco:webex_productivity_tools:*:*:*:*:*:*:*:*,Cisco,Webex Meetings Desktop
CVE-2018-15473,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.98631,CWE-362,"OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.",2018-08-17,EPSS/Metasploit,cpe:2.3:a:netapp:aff_baseboard_management_controller:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:data_ontap_edge:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:fas_baseboard_management_controller:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:vsphere:*:*;cpe:2.3:a:netapp:ontap_select_deploy:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:service_processor:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:storage_replication_adapter:*:*:*:*:*:vsphere:*:*;cpe:2.3:a:netapp:vasa_provider:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vsphere:*:*;cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:sun_zfs_storage_appliance_kit:8.8.6:*:*:*:*:*:*:*;cpe:2.3:h:netapp:cn1610:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_x204rna:-:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:cn1610_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:data_ontap:-:*:*:*:*:7-mode:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*;cpe:2.3:o:siemens:scalance_x204rna_firmware:*:*:*:*:*:*:*:*,Netapp,Cn1610 Firmware
CVE-2018-15517,0.0,,0.44101,CWE-918,"The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, leading to SSRF, as demonstrated by an index.php/System/MailConnect/host/127.0.0.1/port/22/secure/ URI.",2019-01-31,Nuclei,cpe:2.3:a:dlink:central_wifimanager:1.03:r0098:*:*:*:*:*:*,D-Link,Central Wifimanager
CVE-2018-15535,0.0,,0.45242,CWE-22,"/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize get_file sequences such as "".."" that can resolve to a location that is outside of that directory, aka Directory Traversal.",2018-08-24,Nuclei,cpe:2.3:a:tecrail:responsive_filemanager:*:*:*:*:*:*:*:*,Tecrail,Responsive Filemanager
CVE-2018-15708,0.0,,0.89362,NVD-CWE-noinfo,Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request.,2018-11-14,Metasploit,cpe:2.3:a:nagios:nagios_xi:5.5.6:*:*:*:*:*:*:*,Nagios,Nagios Xi
CVE-2018-15710,0.0,,0.44094,CWE-78,Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php.,2018-11-14,Metasploit,cpe:2.3:a:nagios:nagios_xi:5.5.6:*:*:*:*:*:*:*,Nagios,Nagios Xi
CVE-2018-15727,0.0,,0.64284,CWE-287,"Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid ""remember me"" cookie knowing only a username of an LDAP or OAuth user.",2018-08-29,Metasploit,cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:*,Grafana,Grafana
CVE-2018-15745,0.0,,0.97709,CWE-22,"Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, leading to File Disclosure via a ..%2F in the WEBACCOUNT.CGI RESULTPAGE parameter.",2018-08-30,EPSS/Metasploit/Nuclei,cpe:2.3:a:argussurveillance:dvr:4.0.0.0:*:*:*:*:*:*:*,Argussurveillance,Dvr
CVE-2018-15811,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.74048,CWE-326,DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.,2019-07-03,CISA/Metasploit/Nuclei,cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*,Dnnsoftware,Dotnetnuke
CVE-2018-15812,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.46547,CWE-331,"DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.",2019-07-03,Metasploit,cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*,Dnnsoftware,Dotnetnuke
CVE-2018-15877,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.7699,CWE-78,The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the ip parameter of a wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools request.,2018-08-26,Metasploit,cpe:2.3:a:plainview_activity_monitor_project:plainview_activity_monitor:*:*:*:*:*:wordpress:*:*,Plainview Activity Monitor Project,Plainview Activity Monitor
CVE-2018-15917,0.0,,0.06483,CWE-79,Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the language parameter to session/language.,2018-09-05,Nuclei,cpe:2.3:a:jorani_project:jorani:0.6.5:*:*:*:*:*:*:*,Jorani Project,Jorani
CVE-2018-15961,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9995,CWE-434,"Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.",2018-09-25,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:adobe:coldfusion:11.0:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update10:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update11:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update12:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update13:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update14:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update7:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update8:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update9:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:-:*:*:*:*:*:*,Adobe,Coldfusion
CVE-2018-15982,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.82456,CWE-416,"Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.",2019-01-18,CISA,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer_11:*:*;cpe:2.3:a:adobe:flash_player_installer:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:google:chrome_os:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2018-16059,0.0,,0.29816,CWE-22,Endress+Hauser WirelessHART Fieldgate SWG70 3.x devices allow Directory Traversal via the fcgi-bin/wgsetcgi filename parameter.,2018-09-07,Nuclei,cpe:2.3:h:endress:wirelesshart_fieldgate_swg70:-:*:*:*:*:*:*:*;cpe:2.3:o:endress:wirelesshart_fieldgate_swg70_firmware:3.00.07:*:*:*:*:*:*:*,Endress,Wirelesshart Fieldgate Swg70 Firmware
CVE-2018-1612,0.0,,0.56952,CWE-200,"IBM QRadar Incident Forensics (IBM QRadar SIEM 7.2, and 7.3) could allow a remote attacker to bypass authentication and obtain sensitive information. IBM X-Force ID: 144164.",2018-07-17,Metasploit,cpe:2.3:a:ibm:qradar_security_information_and_event_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p10:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p11:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p4:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p5:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p6:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p7:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p8:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p9:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.0:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.1:p1:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.1:p2:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.1:p3:*:*:*:*:*:*;cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.1:p4:*:*:*:*:*:*,Ibm,Qradar Security Information And Event Manager
CVE-2018-16133,0.0,,0.39279,CWE-22,Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.,2018-08-29,Nuclei,cpe:2.3:a:cybrotech:cybrohttpserver:1.0.3:*:*:*:*:*:*:*,Cybrotech,Cybrohttpserver
CVE-2018-16139,0.0,,0.02285,CWE-79,Cross-site scripting (XSS) vulnerability in BIBLIOsoft BIBLIOpac 2008 allows remote attackers to inject arbitrary web script or HTML via the db or action parameter to to bin/wxis.exe/bibliopac/.,2019-05-13,Nuclei,cpe:2.3:a:bibliosoft:bibliopac:2008:*:*:*:*:*:*:*,Bibliosoft,Bibliopac
CVE-2018-16158,0.0,,0.34929,CWE-798,"Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins (to uid 0) via the PubkeyAuthentication option.",2018-08-30,Metasploit,cpe:2.3:h:eaton:power_xpert_meter_4000:-:*:*:*:*:*:*:*;cpe:2.3:h:eaton:power_xpert_meter_6000:-:*:*:*:*:*:*:*;cpe:2.3:h:eaton:power_xpert_meter_8000:-:*:*:*:*:*:*:*;cpe:2.3:o:eaton:power_xpert_meter_4000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:eaton:power_xpert_meter_6000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:eaton:power_xpert_meter_8000_firmware:*:*:*:*:*:*:*:*,Eaton,Power Xpert Meter 4000 Firmware
CVE-2018-16159,0.0,,0.49918,CWE-89,The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the template_id parameter in a wp-admin/admin-ajax.php wpgv_doajax_front_template request.,2018-08-30,Nuclei,cpe:2.3:a:codemenschen:gift_vouchers:*:*:*:*:*:wordpress:*:*,Codemenschen,Gift Vouchers
CVE-2018-16167,0.0,,0.74745,CWE-78,LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.,2019-01-09,Nuclei,cpe:2.3:a:jpcert:logontracer:*:*:*:*:*:*:*:*,Jpcert,Logontracer
CVE-2018-16283,0.0,,0.6307,CWE-22,The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.,2018-09-24,Nuclei,cpe:2.3:a:wechat_brodcast_project:wechat_brodcast:*:*:*:*:*:wordpress:*:*,Wechat Brodcast Project,Wechat Brodcast
CVE-2018-16288,0.0,,0.35828,CWE-200,LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs.,2018-09-14,Nuclei,cpe:2.3:a:lg:supersign_cms:2.5:*:*:*:*:*:*:*,Lg,Supersign Cms
CVE-2018-16299,0.0,,0.44358,CWE-22,The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter.,2018-09-24,Nuclei,cpe:2.3:a:localize_my_post_project:localize_my_post:1.0:*:*:*:*:wordpress:*:*,Localize My Post Project,Localize My Post
CVE-2018-16363,0.0,,0.01378,CWE-79,The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php and there is an echo of lang in lib\wpfilemanager.php.,2018-09-07,Nuclei,cpe:2.3:a:filemanagerpro:file_manager:2.9:*:*:*:*:wordpress:*:*,Filemanagerpro,File Manager
CVE-2018-16509,0.0,,0.92499,NVD-CWE-noinfo,"An issue was discovered in Artifex Ghostscript before 9.24. Incorrect ""restoration of privilege"" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the ""pipe"" instruction.",2018-09-05,Metasploit,cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*;cpe:2.3:a:artifex:gpl_ghostscript:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2018-16660,0.0,,0.18567,CWE-78,A command injection vulnerability in PWS in Imperva SecureSphere 13.0.0.10 and 13.1.0.10 Gateway allows an attacker with authenticated access to execute arbitrary OS commands on a vulnerable installation.,2019-04-25,Metasploit,cpe:2.3:a:imperva:securesphere:13.0.10:*:*:*:*:*:*:*;cpe:2.3:a:imperva:securesphere:13.1.10:*:*:*:*:*:*:*;cpe:2.3:a:imperva:securesphere:13.2.10:*:*:*:*:*:*:*,Imperva,Securesphere
CVE-2018-16668,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.09512,CWE-287,An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is internal installation path disclosure due to the lack of authentication for /html/repository.,2018-09-18,Nuclei,cpe:2.3:a:circontrol:circarlife_scada:*:*:*:*:*:*:*:*,Circontrol,Circarlife Scada
CVE-2018-16670,0.0,,0.24568,CWE-287,An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is PLC status disclosure due to lack of authentication for /html/devstat.html.,2018-09-18,Nuclei,cpe:2.3:a:circontrol:circarlife_scada:*:*:*:*:*:*:*:*,Circontrol,Circarlife Scada
CVE-2018-16671,0.0,,0.08851,CWE-200,An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is system software information disclosure due to lack of authentication for /html/device-id.,2018-09-18,Nuclei,cpe:2.3:a:circontrol:circarlife_scada:*:*:*:*:*:*:*:*,Circontrol,Circarlife Scada
CVE-2018-16716,0.0,,0.0857,CWE-22,"A path traversal vulnerability exists in viewcgi.c in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox, which may result in reading of arbitrary files (i.e., significant information disclosure) or file deletion via the nph-viewgif.cgi query string.",2019-05-02,Nuclei,cpe:2.3:a:nih:ncbi_toolbox:*:*:*:*:*:*:*:*,Nih,Ncbi Toolbox
CVE-2018-16761,0.0,,0.02201,CWE-601,Eventum before 3.4.0 has an open redirect vulnerability.,2018-09-09,Nuclei,cpe:2.3:a:eventum_project:eventum:*:*:*:*:*:*:*:*,Eventum Project,Eventum
CVE-2018-16763,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.82937,CWE-74,FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution.,2018-09-09,Nuclei,cpe:2.3:a:thedaylightstudio:fuel_cms:*:*:*:*:*:*:*:*,Thedaylightstudio,Fuel Cms
CVE-2018-16836,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.61437,CWE-22,"Rubedo through 3.4.0 contains a Directory Traversal vulnerability in the theme component, allowing unauthenticated attackers to read and execute arbitrary files outside of the service root path, as demonstrated by a /theme/default/img/%2e%2e/..//etc/passwd URI.",2018-09-11,Nuclei,cpe:2.3:a:rubedo_project:rubedo:*:*:*:*:*:*:*:*,Rubedo Project,Rubedo
CVE-2018-16858,0.0,,0.67321,CWE-356,"It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a document. An attacker could craft a document, which when opened by LibreOffice, would execute a Python method from a script in any arbitrary file system location, specified relative to the LibreOffice install location.",2019-03-25,Metasploit,cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*,Libreoffice,Libreoffice
CVE-2018-16979,0.0,,0.0302,CWE-113,"Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related issue to CVE-2012-2943.",2018-09-12,Nuclei,cpe:2.3:a:monstra:monstra:3.0.4:*:*:*:*:*:*:*,Monstra,Monstra
CVE-2018-17082,0.0,,0.04103,CWE-79,"The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a ""Transfer-Encoding: chunked"" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.",2018-09-16,Nuclei,cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*;cpe:2.3:a:php:php:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2018-17153,0.0,,0.86586,CWE-287,"It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker can exploit this vulnerability to authenticate as an admin user without needing to provide a password, thereby gaining full control of the device. (Whenever an admin logs into My Cloud, a server-side session is created that is bound to the user's IP address. After the session is created, it is possible to call authenticated CGI modules by sending the cookie username=admin in the HTTP request. The invoked CGI will check if a valid session is present and bound to the user's IP address.) It was found that it is possible for an unauthenticated attacker to create a valid session without a login. The network_mgr.cgi CGI module contains a command called ""cgi_get_ipv6"" that starts an admin session -- tied to the IP address of the user making the request -- if the additional parameter ""flag"" with the value ""1"" is provided. Subsequent invocation of commands that would normally require admin privileges now succeed if an attacker sets the username=admin cookie.",2018-09-18,Metasploit/Nuclei,cpe:2.3:h:western_digital:my_cloud_dl2100:-:*:*:*:*:*:*:*;cpe:2.3:h:western_digital:my_cloud_dl4100:-:*:*:*:*:*:*:*;cpe:2.3:h:western_digital:my_cloud_ex2100:-:*:*:*:*:*:*:*;cpe:2.3:h:western_digital:my_cloud_ex2:-:*:*:*:*:*:*:*;cpe:2.3:h:western_digital:my_cloud_ex2_ultra:-:*:*:*:*:*:*:*;cpe:2.3:h:western_digital:my_cloud_ex4100:-:*:*:*:*:*:*:*;cpe:2.3:h:western_digital:my_cloud_ex4:-:*:*:*:*:*:*:*;cpe:2.3:h:western_digital:my_cloud_mirror:-:*:*:*:*:*:*:*;cpe:2.3:h:western_digital:my_cloud_mirror_gen_2:-:*:*:*:*:*:*:*;cpe:2.3:h:western_digital:my_cloud_pr2100:-:*:*:*:*:*:*:*;cpe:2.3:h:western_digital:my_cloud_pr4100:-:*:*:*:*:*:*:*;cpe:2.3:h:western_digital:my_cloud_wdbctl0020hwt:*:*:*:*:*:*:*:*;cpe:2.3:o:western_digital:my_cloud_dl2100:*:*:*:*:*:*:*:*;cpe:2.3:o:western_digital:my_cloud_dl4100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:western_digital:my_cloud_ex2100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:western_digital:my_cloud_ex2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:western_digital:my_cloud_ex2_ultra_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:western_digital:my_cloud_ex4100:*:*:*:*:*:*:*:*;cpe:2.3:o:western_digital:my_cloud_ex4_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:western_digital:my_cloud_mirror_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:western_digital:my_cloud_mirror_gen_2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:western_digital:my_cloud_pr2100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:western_digital:my_cloud_pr4100:*:*:*:*:*:*:*:*;cpe:2.3:o:western_digital:my_cloud_wdbctl0020hwt_firmware:*:*:*:*:*:*:*:*,Western Digital,My Cloud Wdbctl0020Hwt Firmware
CVE-2018-17173,0.0,,0.56237,CWE-94,LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getThumbnail.,2018-09-21,Nuclei,cpe:2.3:a:lg:supersign_cms:2.5:*:*:*:*:*:*:*,Lg,Supersign Cms
CVE-2018-17179,0.0,,0.1278,CWE-89,An issue was discovered in OpenEMR before 5.0.1 Patch 7. There is SQL Injection in the make_task function in /interface/forms/eye_mag/php/taskman_functions.php via /interface/forms/eye_mag/taskman.php.,2019-05-17,Metasploit,cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*,Open-Emr,Openemr
CVE-2018-17207,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.58794,CWE-94,"An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files (installer.php and installer-backup.php), an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution.",2018-09-19,Metasploit/Nuclei,cpe:2.3:a:awesomemotive:duplicator:*:*:*:*:lite:wordpress:*:*,Awesomemotive,Duplicator
CVE-2018-17246,0.0,,0.82251,CWE-73,Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.,2018-12-20,Nuclei,cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*,Elastic,Kibana
CVE-2018-17254,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.82976,CWE-89,The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.,2018-09-20,Nuclei,cpe:2.3:a:arkextensions:jck_editor:6.4.4:*:*:*:*:joomla\!:*:*,Arkextensions,Jck Editor
CVE-2018-17283,0.0,,0.66347,CWE-89,"Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Injection attack via the /api/json/device/setManaged name parameter.",2018-09-21,Nuclei,cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*,Zohocorp,Manageengine Opmanager
CVE-2018-17408,0.0,,0.18968,CWE-787,Stack-based buffer overflows in Zahir Accounting Enterprise Plus 6 through build 10b allow remote attackers to execute arbitrary code via a crafted CSV file that is accessed through the Import CSV File menu.,2018-10-03,Metasploit,cpe:2.3:a:zahiraccounting:zahir_enterprise_plus:6:*:*:*:*:*:*:*,Zahiraccounting,Zahir Enterprise Plus
CVE-2018-17422,0.0,,0.03717,CWE-601,dotCMS before 5.0.2 has open redirects via the html/common/forward_js.jsp FORWARD_URL parameter or the html/portlet/ext/common/page_preview_popup.jsp hostname parameter.,2019-03-07,Nuclei,cpe:2.3:a:dotcms:dotcms:*:*:*:*:*:*:*:*,Dotcms,Dotcms
CVE-2018-17431,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.83912,CWE-287,Web Console in Comodo UTM Firewall before 2.7.0 allows remote attackers to execute arbitrary code without authentication via a crafted URL.,2019-01-30,Nuclei,cpe:2.3:a:comodo:unified_threat_management_firewall:*:*:*:*:*:*:*:*,Comodo,Unified Threat Management Firewall
CVE-2018-17456,0.0,,0.97356,CWE-88,"Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive ""git clone"" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.",2018-10-06,EPSS/Metasploit,cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:ansible_tower:3.3:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*,Redhat,Enterprise Linux
CVE-2018-17463,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.84564,NVD-CWE-noinfo,Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.,2018-11-14,CISA/Metasploit,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*,Redhat,Enterprise Linux Desktop
CVE-2018-17480,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.34292,CWE-787,Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.,2018-12-11,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*,Redhat,Enterprise Linux Desktop
CVE-2018-17552,0.0,,0.84063,CWE-89,SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie.,2018-10-03,Metasploit,cpe:2.3:a:naviwebs:navigate_cms:2.8:*:*:*:*:*:*:*,Naviwebs,Navigate Cms
CVE-2018-17553,0.0,,0.78994,CWE-22,"An ""Unrestricted Upload of File with Dangerous Type"" issue with directory traversal in navigate_upload.php in Naviwebs Navigate CMS 2.8 allows authenticated attackers to achieve remote code execution via a POST request with engine=picnik and id=../../../navigate_info.php.",2018-10-03,Metasploit,cpe:2.3:a:naviwebs:navigate_cms:2.8:*:*:*:*:*:*:*,Naviwebs,Navigate Cms
CVE-2018-17888,0.0,,0.29639,CWE-330,"NUUO CMS all versions 3.1 and prior, The application uses a session identification mechanism that could allow attackers to obtain the active session ID, which could allow arbitrary remote code execution.",2018-10-12,Metasploit,cpe:2.3:a:nuuo:nuuo_cms:*:*:*:*:*:*:*:*,Nuuo,Nuuo Cms
CVE-2018-17934,0.0,,0.19653,CWE-22,"NUUO CMS All versions 3.3 and prior the application allows external input to construct a pathname that is able to be resolved outside the intended directory. This could allow an attacker to impersonate a legitimate user, obtain restricted information, or execute arbitrary code.",2018-11-27,Metasploit,cpe:2.3:a:nuuo:nuuo_cms:*:*:*:*:*:*:*:*,Nuuo,Nuuo Cms
CVE-2018-17936,0.0,,0.15312,CWE-434,"NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite configuration files to the server, which could allow remote code execution.",2018-11-27,Metasploit,cpe:2.3:a:nuuo:nuuo_cms:*:*:*:*:*:*:*:*,Nuuo,Nuuo Cms
CVE-2018-18069,0.0,,0.13207,CWE-79,process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-localization.php request to wp-admin/admin.php.,2018-10-08,Nuclei,cpe:2.3:a:wpml:wpml:*:*:*:*:*:wordpress:*:*,Wpml,Wpml
CVE-2018-18264,0.0,,0.70372,CWE-306,Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster.,2019-01-03,Nuclei,cpe:2.3:a:kubernetes:dashboard:*:*:*:*:*:*:*:*,Kubernetes,Dashboard
CVE-2018-18323,0.0,,0.70736,CWE-22,CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/index.php?module=file_editor&file=/../ URI.,2018-10-15,Nuclei,cpe:2.3:a:control-webpanel:webpanel:0.9.8.480:*:*:*:*:*:*:*,Control-Webpanel,Webpanel
CVE-2018-18325,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.74048,CWE-326,DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.,2019-07-03,CISA/Metasploit/Nuclei,cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*,Dnnsoftware,Dotnetnuke
CVE-2018-18326,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.53618,CWE-331,"DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplete fix for CVE-2018-15812.",2019-07-03,Metasploit,cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*,Dnnsoftware,Dotnetnuke
CVE-2018-18556,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.15411,NVD-CWE-noinfo,A privilege escalation issue was discovered in VyOS 1.1.8. The default configuration also allows operator users to execute the pppd binary with elevated (sudo) permissions. Certain input parameters are not properly validated. A malicious operator user can run the binary with elevated permissions and leverage its improper input validation condition to spawn an attacker-controlled shell with root privileges.,2018-12-17,Metasploit,cpe:2.3:o:vyos:vyos:1.1.8:*:*:*:*:*:*:*,Vyos,Vyos
CVE-2018-18570,0.0,,0.02465,CWE-79,Planon before Live Build 41 has XSS.,2019-07-29,Nuclei,cpe:2.3:a:planonsoftware:planon:*:*:*:*:*:*:*:*,Planonsoftware,Planon
CVE-2018-18608,0.0,,0.02625,CWE-79,"DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATH_INFO to /member/index.php, /member/pm.php, /member/content_list.php, or /plus/feedback.php.",2018-10-23,Nuclei,cpe:2.3:a:dedecms:dedecms:5.7:sp2:*:*:*:*:*:*,Dedecms,Dedecms
CVE-2018-18775,0.0,,0.06555,CWE-79,"Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the Login.asp Msg parameter.  NOTE: this is a deprecated product.",2018-11-01,Nuclei,cpe:2.3:a:microstrategy:microstrategy_web:7:*:*:*:*:*:*:*,Microstrategy,Microstrategy Web
CVE-2018-18777,0.0,,0.19551,CWE-22,"Directory traversal vulnerability in Microstrategy Web, version 7, in ""/WebMstr7/servlet/mstrWeb"" (in the parameter subpage) allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application.  NOTE: this is a deprecated product.",2018-11-01,Nuclei,cpe:2.3:a:microstrategy:microstrategy_web:7:*:*:*:*:*:*:*,Microstrategy,Microstrategy Web
CVE-2018-18778,0.0,,0.74036,CWE-200,ACME mini_httpd before 1.30 lets remote users read arbitrary files.,2018-10-29,Nuclei,cpe:2.3:a:acme:mini-httpd:*:*:*:*:*:*:*:*,Acme,Mini-Httpd
CVE-2018-18809,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.79064,CWE-22,"The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: versions up to and including 6.3.4; 6.4.1; 6.4.2; 6.4.21; 7.1.0; 7.2.0, TIBCO JasperReports Library Community Edition: versions up to and including 6.7.0, TIBCO JasperReports Library for ActiveMatrix BPM: versions up to and including 6.4.21, TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.3; 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.",2019-03-07,CISA/Nuclei,cpe:2.3:a:tibco:jasperreports_library:*:*:*:*:activematrix_bpm:*:*:*;cpe:2.3:a:tibco:jasperreports_library:*:*:*:*:community:*:*:*;cpe:2.3:a:tibco:jasperreports_library:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:tibco:jasperreports_library:7.2.0:*:*:*:*:*:*:*;cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:activematrix_bpm:*:*;cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:community:*:*:*;cpe:2.3:a:tibco:jasperreports_server:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:tibco:jaspersoft:*:*:*:*:*:aws_with_multi-tenancy:*:*;cpe:2.3:a:tibco:jaspersoft_reporting_and_analytics:*:*:*:*:*:aws:*:*,Tibco,Jasperreports Library
CVE-2018-18850,0.0,,0.12475,NVD-CWE-noinfo,"In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could upload a maliciously crafted YAML configuration, potentially allowing for remote execution of arbitrary code, running in the same context as the Octopus Server (for self-hosted installations by default, SYSTEM).",2018-10-31,Metasploit,cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*,Octopus,Octopus Server
CVE-2018-18925,0.0,,0.31882,CWE-384,"Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a "".."" session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron.",2018-11-04,Nuclei,cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*,Gogs,Gogs
CVE-2018-18955,0.0,,0.07611,CWE-863,"In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.",2018-11-16,Metasploit,cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2018-18982,0.0,,0.60791,CWE-89,"NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can be used to inject SQL into an executing statement and allow arbitrary code execution.",2018-11-27,Metasploit,cpe:2.3:a:nuuo:nuuo_cms:*:*:*:*:*:*:*:*,Nuuo,Nuuo Cms
CVE-2018-19127,0.0,,0.20766,CWE-94,"A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename, leading to arbitrary code execution. The PHP code is sent via the template parameter, and is written to a data/cache_template/*.tpl.php file along with a ""<?php function "" substring.",2018-11-09,Nuclei,cpe:2.3:a:phpcms:phpcms:2008:*:*:*:*:*:*:*,Phpcms,Phpcms
CVE-2018-19136,0.0,,0.06653,CWE-79,DomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid parameter.,2018-11-09,Nuclei,cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:*,Domainmod,Domainmod
CVE-2018-19137,0.0,,0.02891,CWE-79,DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter.,2018-11-09,Nuclei,cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:*,Domainmod,Domainmod
CVE-2018-19207,0.0,,0.87294,CWE-425,"The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code because $wpdb->prepare() input is mishandled, as exploited in the wild in November 2018.",2018-11-12,Metasploit/Nuclei,cpe:2.3:a:van-ons:wp-gdpr-compliance:*:*:*:*:*:wordpress:*:*,Van-Ons,Wp-Gdpr-Compliance
CVE-2018-19276,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98811,CWE-502,OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.,2019-03-21,EPSS/Metasploit/Nuclei,cpe:2.3:a:openmrs:openmrs:*:*:*:*:*:*:*:*,Openmrs,Openmrs
CVE-2018-19287,0.0,,0.08903,CWE-79,"XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submissions.php (aka submissions page) begin_date, end_date, or form_id parameter.",2018-11-15,Nuclei,cpe:2.3:a:ninjaforma:ninja_forms:*:*:*:*:*:wordpress:*:*,Ninjaforma,Ninja Forms
CVE-2018-19320,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03597,NVD-CWE-noinfo,"The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.",2018-12-21,CISA,cpe:2.3:a:gigabyte:aorus_graphics_engine:*:*:*:*:*:*:*:*;cpe:2.3:a:gigabyte:app_center:*:*:*:*:*:*:*:*;cpe:2.3:a:gigabyte:oc_guru_ii:2.08:*:*:*:*:*:*:*;cpe:2.3:a:gigabyte:xtreme_gaming_engine:*:*:*:*:*:*:*:*,Gigabyte,Aorus Graphics Engine
CVE-2018-19321,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03671,NVD-CWE-noinfo,"The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.",2018-12-21,CISA,cpe:2.3:a:gigabyte:aorus_graphics_engine:*:*:*:*:*:*:*:*;cpe:2.3:a:gigabyte:app_center:*:*:*:*:*:*:*:*;cpe:2.3:a:gigabyte:oc_guru_ii:2.08:*:*:*:*:*:*:*;cpe:2.3:a:gigabyte:xtreme_gaming_engine:*:*:*:*:*:*:*:*,Gigabyte,Aorus Graphics Engine
CVE-2018-19322,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01872,CWE-749,"The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.",2018-12-21,CISA,cpe:2.3:a:gigabyte:aorus_graphics_engine:*:*:*:*:*:*:*:*;cpe:2.3:a:gigabyte:app_center:*:*:*:*:*:*:*:*;cpe:2.3:a:gigabyte:oc_guru_ii:2.08:*:*:*:*:*:*:*;cpe:2.3:a:gigabyte:xtreme_gaming_engine:*:*:*:*:*:*:*:*,Gigabyte,Aorus Graphics Engine
CVE-2018-19323,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.08523,NVD-CWE-noinfo,"The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs).",2018-12-21,CISA,cpe:2.3:a:gigabyte:aorus_graphics_engine:*:*:*:*:*:*:*:*;cpe:2.3:a:gigabyte:gigabyte_app_center:*:*:*:*:*:*:*:*;cpe:2.3:a:gigabyte:oc_guru_ii:2.08:*:*:*:*:*:*:*;cpe:2.3:a:gigabyte:xtreme_gaming_engine:*:*:*:*:*:*:*:*,Gigabyte,Aorus Graphics Engine
CVE-2018-19326,0.0,,0.09759,CWE-22,"Zyxel VMG1312-B10D devices before 5.13(AAXA.8)C0 allow ../ Directory Traversal, as demonstrated by reading /etc/passwd.",2018-11-17,Nuclei,cpe:2.3:h:zyxel:vmg1312-b10d:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vmg1312-b10d_firmware:*:*:*:*:*:*:*:*,Zyxel,Vmg1312-B10D Firmware
CVE-2018-19365,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H,0.22292,CWE-22,"The REST API in Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request.",2019-03-21,Nuclei,cpe:2.3:a:wowza:streaming_engine:4.7.4.0.1:*:*:*:*:*:*:*,Wowza,Streaming Engine
CVE-2018-19386,0.0,,0.09044,CWE-79,"SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI.",2019-08-14,Nuclei,cpe:2.3:a:solarwinds:database_performance_analyzer:11.1.457:*:*:*:*:*:*:*,Solarwinds,Database Performance Analyzer
CVE-2018-19410,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.8646,NVD-CWE-noinfo,"PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator).",2018-11-21,CISA/Nuclei,cpe:2.3:a:paessler:prtg_network_monitor:*:*:*:*:*:*:*:*,Paessler,Prtg Network Monitor
CVE-2018-19422,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.64261,CWE-434,"/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.",2018-11-21,Metasploit,cpe:2.3:a:intelliants:subrion_cms:4.2.1:*:*:*:*:*:*:*,Intelliants,Subrion Cms
CVE-2018-19439,0.0,,0.20457,CWE-79,"XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4). helpwindow.jsp has reflected XSS via all parameters, as demonstrated by the sgdadmin/faces/com_sun_web_ui/help/helpwindow.jsp windowTitle parameter.",2018-12-13,Nuclei,cpe:2.3:a:oracle:secure_global_desktop:4.4:*:*:*:*:*:*:*,Oracle,Secure Global Desktop
CVE-2018-19458,0.0,,0.32885,CWE-287,"In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnerability than CVE-2018-19246.",2018-11-22,Nuclei,cpe:2.3:a:php-proxy:php-proxy:3.0.3:*:*:*:*:*:*:*,Php-Proxy,Php-Proxy
CVE-2018-19518,7.5,CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.9523,CWE-88,"University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a ""-oProxyCommand"" argument.",2018-11-25,EPSS/Metasploit,cpe:2.3:a:php:php:*:*:*:*:*:*:*:*;cpe:2.3:a:uw-imap_project:uw-imap:2007f:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2018-19749,0.0,,0.03316,CWE-79,DomainMOD through 4.11.01 has XSS via the assets/add/account-owner.php Owner name field.,2018-11-29,Nuclei,cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:*,Domainmod,Domainmod
CVE-2018-19751,0.0,,0.03316,CWE-79,DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL Fields.,2018-11-29,Nuclei,cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:*,Domainmod,Domainmod
CVE-2018-19752,0.0,,0.03316,CWE-79,DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar.,2018-11-29,Nuclei,cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:*,Domainmod,Domainmod
CVE-2018-19753,0.0,,0.16564,CWE-22,Tarantella Enterprise before 3.11 allows Directory Traversal.,2018-12-05,Nuclei,cpe:2.3:a:oracle:tarantella_enterprise:*:*:*:*:*:*:*:*,Oracle,Tarantella Enterprise
CVE-2018-19877,0.0,,0.18563,CWE-79,login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field.,2018-12-05,Nuclei,cpe:2.3:a:adiscon:loganalyzer:*:*:*:*:*:*:*:*,Adiscon,Loganalyzer
CVE-2018-19892,0.0,,0.01514,CWE-79,"DomainMOD through 4.11.01 has XSS via the admin/dw/add-server.php DisplayName, HostName, or UserName field.",2018-12-06,Nuclei,cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:*,Domainmod,Domainmod
CVE-2018-19914,0.0,,0.03316,CWE-79,DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field.,2018-12-06,Nuclei,cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:*,Domainmod,Domainmod
CVE-2018-19915,0.0,,0.04008,CWE-79,DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field.,2018-12-06,Nuclei,cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:*,Domainmod,Domainmod
CVE-2018-19943,8.0,CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H,0.17705,CWE-79,"If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later",2020-10-28,CISA,cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:-:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:*,Qnap,Qts
CVE-2018-19949,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.24449,CWE-20,"If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.",2020-10-28,CISA,cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:-:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:*,Qnap,Qts
CVE-2018-19953,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.23894,CWE-79,"If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.",2020-10-28,CISA,cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:-:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:*,Qnap,Qts
CVE-2018-20009,0.0,,0.04428,CWE-79,DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider.php SSL Provider Name or SSL Provider URL field.,2018-12-10,Nuclei,cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:*,Domainmod,Domainmod
CVE-2018-20010,0.0,,0.04428,CWE-79,DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider-account.php username field.,2018-12-10,Nuclei,cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:*,Domainmod,Domainmod
CVE-2018-20011,0.0,,0.04428,CWE-79,DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field.,2018-12-10,Nuclei,cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:*,Domainmod,Domainmod
CVE-2018-20062,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9953,NVD-CWE-noinfo,"An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\think\Request/input&filter=phpinfo&data=1 query string.",2018-12-11,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:5none:nonecms:1.3.0:*:*:*:*:*:*:*,5None,Nonecms
CVE-2018-20250,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.96274,CWE-36,"In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.",2019-02-05,CISA/EPSS/Metasploit,cpe:2.3:a:rarlab:winrar:*:*:*:*:*:*:*:*,Rarlab,Winrar
CVE-2018-20323,0.0,,0.54498,CWE-78,www/soap/application/MCSoap/Logs.php in MailCleaner Community Edition 2018.08 allows remote attackers to execute arbitrary OS commands.,2019-03-21,Metasploit,cpe:2.3:a:mailcleaner:mailcleaner:2018.08:*:*:*:community:*:*:*,Mailcleaner,Mailcleaner
CVE-2018-20434,0.0,,0.71487,CWE-78,"LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $_POST['community'] parameter to html/pages/addhost.inc.php during creation of a new device, and then making a /ajax_output.php?id=capture&format=text&type=snmpwalk&hostname=localhost request that triggers html/includes/output/capture.inc.php command mishandling.",2019-04-24,Metasploit,cpe:2.3:a:librenms:librenms:1.46:*:*:*:*:*:*:*,Librenms,Librenms
CVE-2018-20462,0.0,,0.0397,CWE-79,An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the jsmol.php data parameter.,2018-12-25,Nuclei,cpe:2.3:a:jsmol2wp_project:jsmol2wp:1.07:*:*:*:*:wordpress:*:*,Jsmol2Wp Project,Jsmol2Wp
CVE-2018-20463,0.0,,0.13078,CWE-22,An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. There is an arbitrary file read vulnerability via ../ directory traversal in query=php://filter/resource= in the jsmol.php query string. This can also be used for SSRF.,2018-12-25,Nuclei,cpe:2.3:a:jsmol2wp_project:jsmol2wp:1.07:*:*:*:*:wordpress:*:*,Jsmol2Wp Project,Jsmol2Wp
CVE-2018-20470,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.45055,CWE-22,An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal (arbitrary file access) vulnerability exists in the web reports module. This allows an outside attacker to view contents of sensitive files.,2019-06-17,Nuclei,cpe:2.3:a:sahipro:sahi_pro:*:*:*:*:*:*:*:*,Sahipro,Sahi Pro
CVE-2018-20526,0.0,,0.73056,CWE-434,Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.,2019-03-21,Nuclei,cpe:2.3:a:roxyfileman:roxy_fileman:1.4.5:*:*:*:*:*:*:*,Roxyfileman,Roxy Fileman
CVE-2018-20608,0.0,,0.12434,CWE-200,imcat 4.4 allows remote attackers to read phpinfo output via the root/tools/adbug/binfo.php?phpinfo1 URI.,2018-12-30,Nuclei,cpe:2.3:a:txjia:imcat:4.4:*:*:*:*:*:*:*,Txjia,Imcat
CVE-2018-20735,0.0,,0.07488,CWE-287,"An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only verifies if the password provided for the given username is correct; it does not verify the permissions of the user on the network. This means if you have PATROL Agent installed on a high value target (domain controller), you can use a low privileged domain user to authenticate with PatrolCli and then connect to the domain controller and run commands as SYSTEM. This means any user on a domain can escalate to domain admin through PATROL Agent. NOTE: the vendor disputes this because they believe it is adequate to prevent this escalation by means of a custom, non-default configuration",2019-01-17,Metasploit,cpe:2.3:a:bmc:patrol_agent:*:*:*:*:*:*:*:*,Bmc,Patrol Agent
CVE-2018-20753,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.29336,NVD-CWE-noinfo,"Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.",2019-02-05,CISA,cpe:2.3:a:kaseya:virtual_system_administrator:*:*:*:*:*:*:*:*,Kaseya,Virtual System Administrator
CVE-2018-20781,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01483,CWE-522,"In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext.",2019-02-12,Metasploit,cpe:2.3:a:gnome:gnome_keyring:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*,Canonical,Ubuntu Linux
CVE-2018-20824,0.0,,0.37577,CWE-79,The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the cyclePeriod parameter.,2019-05-03,Nuclei,cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*,Atlassian,Jira
CVE-2018-20985,0.0,,0.07606,CWE-20,"The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pay-rec.",2019-08-22,Nuclei,cpe:2.3:a:payeezy:wp_payeezy_pay:*:*:*:*:*:wordpress:*:*,Payeezy,Wp Payeezy Pay
CVE-2018-2380,6.6,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L,0.28892,CWE-22,"SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing ""traverse to parent directory"" are passed through to the file APIs.",2018-03-01,CISA,cpe:2.3:a:sap:customer_relationship_management:7.01:*:*:*:*:*:*:*;cpe:2.3:a:sap:customer_relationship_management:7.02:*:*:*:*:*:*:*;cpe:2.3:a:sap:customer_relationship_management:7.30:*:*:*:*:*:*:*;cpe:2.3:a:sap:customer_relationship_management:7.31:*:*:*:*:*:*:*;cpe:2.3:a:sap:customer_relationship_management:7.33:*:*:*:*:*:*:*;cpe:2.3:a:sap:customer_relationship_management:7.54:*:*:*:*:*:*:*,Sap,Customer Relationship Management
CVE-2018-2392,0.0,,0.40993,CWE-611,"Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SAP Internet Graphics Server (IGS) to become unavailable.",2018-02-14,Metasploit/Nuclei,cpe:2.3:a:sap:internet_graphics_server:7.20:*:*:*:*:*:*:*;cpe:2.3:a:sap:internet_graphics_server:7.20ext:*:*:*:*:*:*:*;cpe:2.3:a:sap:internet_graphics_server:7.45:*:*:*:*:*:*:*;cpe:2.3:a:sap:internet_graphics_server:7.49:*:*:*:*:*:*:*;cpe:2.3:a:sap:internet_graphics_server:7.53:*:*:*:*:*:*:*,Sap,Internet Graphics Server
CVE-2018-2393,0.0,,0.18204,CWE-611,"Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SAP Internet Graphics Server (IGS) to become unavailable.",2018-02-14,Metasploit,cpe:2.3:a:sap:internet_graphics_server:7.20:*:*:*:*:*:*:*;cpe:2.3:a:sap:internet_graphics_server:7.20ext:*:*:*:*:*:*:*;cpe:2.3:a:sap:internet_graphics_server:7.45:*:*:*:*:*:*:*;cpe:2.3:a:sap:internet_graphics_server:7.49:*:*:*:*:*:*:*;cpe:2.3:a:sap:internet_graphics_server:7.53:*:*:*:*:*:*:*,Sap,Internet Graphics Server
CVE-2018-25113,0.0,,0.01197,CWE-22,An unauthenticated path traversal vulnerability exists in Dicoogle PACS Web Server version 2.5.0 and possibly earlier. The vulnerability allows remote attackers to read arbitrary files on the underlying system by sending a crafted request to the /exportFile endpoint using the UID parameter. Successful exploitation can reveal sensitive files accessible by the web server user.,2025-07-23,Metasploit,,,
CVE-2018-25114,0.0,,0.0282,CWE-94,"A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and missing authentication in the installer workflow. By default, the /install/ directory remains accessible after installation. An unauthenticated attacker can invoke install_4.php, submit crafted POST data, and inject arbitrary PHP code into the configure.php file. When the application later includes this file, the injected payload is executed, resulting in full server-side compromise.",2025-07-23,Metasploit/Nuclei,,,
CVE-2018-2628,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99448,CWE-502,"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",2018-04-19,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.3:*:*:*:*:*:*:*,Oracle,Weblogic Server
CVE-2018-2791,0.0,,0.3945,NVD-CWE-noinfo,"Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported versions that are affected are 11.1.1.8.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).",2018-04-19,Nuclei,cpe:2.3:a:oracle:webcenter_sites:11.1.1.8.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_sites:12.2.1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*,Oracle,Webcenter Sites
CVE-2018-2893,0.0,,0.71196,NVD-CWE-noinfo,"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",2018-07-18,Nuclei,cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.3:*:*:*:*:*:*:*,Oracle,Weblogic Server
CVE-2018-2894,0.0,,0.50224,NVD-CWE-noinfo,"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",2018-07-18,Nuclei,cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.3:*:*:*:*:*:*:*,Oracle,Weblogic Server
CVE-2018-3167,0.0,,0.17118,NVD-CWE-noinfo,"Vulnerability in the Application Management Pack for Oracle E-Business Suite component of Oracle E-Business Suite (subcomponent: User Monitoring). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Application Management Pack for Oracle E-Business Suite. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Application Management Pack for Oracle E-Business Suite accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).",2018-10-17,Nuclei,cpe:2.3:a:oracle:application_management_pack:12.1.3:*:*:*:*:e-business_suite:*:*;cpe:2.3:a:oracle:application_management_pack:12.2.3:*:*:*:*:e-business_suite:*:*;cpe:2.3:a:oracle:application_management_pack:12.2.4:*:*:*:*:e-business_suite:*:*;cpe:2.3:a:oracle:application_management_pack:12.2.5:*:*:*:*:e-business_suite:*:*;cpe:2.3:a:oracle:application_management_pack:12.2.6:*:*:*:*:e-business_suite:*:*;cpe:2.3:a:oracle:application_management_pack:12.2.7:*:*:*:*:e-business_suite:*:*,Oracle,Application Management Pack
CVE-2018-3238,0.0,,0.04579,NVD-CWE-noinfo,"Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). The supported version that is affected is 11.1.1.8.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 6.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N).",2018-10-17,Nuclei,cpe:2.3:a:oracle:webcenter_sites:11.1.1.8.0:*:*:*:*:*:*:*,Oracle,Webcenter Sites
CVE-2018-3714,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.08632,CWE-22,"node-srv node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read content of any file with known path.",2018-06-07,Nuclei,cpe:2.3:a:node-srv_project:node-srv:*:*:*:*:*:node.js:*:*,Node-Srv Project,Node-Srv
CVE-2018-3760,0.0,,0.26717,CWE-22,"There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.",2018-06-26,Nuclei,cpe:2.3:a:redhat:cloudforms:4.5:*:*:*:*:*:*:*;cpe:2.3:a:redhat:cloudforms:4.6:*:*:*:*:*:*:*;cpe:2.3:a:sprockets_project:sprockets:*:*:*:*:*:*:*:*;cpe:2.3:a:sprockets_project:sprockets:4.0.0:beta1:*:*:*:*:*:*;cpe:2.3:a:sprockets_project:sprockets:4.0.0:beta2:*:*:*:*:*:*;cpe:2.3:a:sprockets_project:sprockets:4.0.0:beta3:*:*:*:*:*:*;cpe:2.3:a:sprockets_project:sprockets:4.0.0:beta4:*:*:*:*:*:*;cpe:2.3:a:sprockets_project:sprockets:4.0.0:beta5:*:*:*:*:*:*;cpe:2.3:a:sprockets_project:sprockets:4.0.0:beta6:*:*:*:*:*:*;cpe:2.3:a:sprockets_project:sprockets:4.0.0:beta7:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.6:*:*:*:*:*:*:*,Redhat,Enterprise Linux
CVE-2018-3810,0.0,,0.91477,CWE-287,"Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code (via the sgcgoogleanalytic parameter) that runs on all pages served by WordPress. The saveGoogleCode() function in smartgooglecode.php does not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update the inserted code.",2018-01-01,Nuclei,cpe:2.3:a:oturia:smart_google_code_inserter:*:*:*:*:*:wordpress:*:*,Oturia,Smart Google Code Inserter
CVE-2018-3953,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.13335,CWE-78,"Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04) are susceptible to OS command injection vulnerabilities due to improper filtering of data passed to and retrieved from NVRAM. Data entered into the 'Router Name' input field through the web portal is submitted to apply.cgi as the value to the 'machine_name' POST parameter. When the 'preinit' binary receives the SIGHUP signal, it enters a code path that continues until it reaches offset 0x0042B5C4 in the 'start_lltd' function. Within the 'start_lltd' function, a 'nvram_get' call is used to obtain the value of the user-controlled 'machine_name' NVRAM entry. This value is then entered directly into a command intended to write the host name to a file and subsequently executed.",2018-10-17,Metasploit,cpe:2.3:h:linksys:e1200:-:*:*:*:*:*:*:*;cpe:2.3:h:linksys:e2500:-:*:*:*:*:*:*:*;cpe:2.3:o:linksys:e1200_firmware:2.0.09:*:*:*:*:*:*:*;cpe:2.3:o:linksys:e2500_firmware:3.0.04:*:*:*:*:*:*:*,Linksys,E1200 Firmware
CVE-2018-4063,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.27851,CWE-434,"An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability.",2019-05-06,CISA,cpe:2.3:h:sierrawireless:airlink_es440:-:*:*:*:*:*:*:*;cpe:2.3:h:sierrawireless:airlink_es450:-:*:*:*:*:*:*:*;cpe:2.3:h:sierrawireless:airlink_gx400:-:*:*:*:*:*:*:*;cpe:2.3:h:sierrawireless:airlink_gx440:-:*:*:*:*:*:*:*;cpe:2.3:h:sierrawireless:airlink_gx450:-:*:*:*:*:*:*:*;cpe:2.3:h:sierrawireless:airlink_ls300:-:*:*:*:*:*:*:*;cpe:2.3:h:sierrawireless:airlink_lx40:-:*:*:*:*:*:*:*;cpe:2.3:h:sierrawireless:airlink_lx60:-:*:*:*:*:*:*:*;cpe:2.3:h:sierrawireless:airlink_mp70:-:*:*:*:*:*:*:*;cpe:2.3:h:sierrawireless:airlink_mp70e:-:*:*:*:*:*:*:*;cpe:2.3:h:sierrawireless:airlink_rv50:-:*:*:*:*:*:*:*;cpe:2.3:h:sierrawireless:airlink_rv50x:-:*:*:*:*:*:*:*;cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*,Sierrawireless,Aleos
CVE-2018-4162,0.0,,0.38602,CWE-119,"An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the ""WebKit"" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.",2018-04-03,Metasploit,cpe:2.3:a:apple:icloud:*:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:*:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:a:webkitgtk:webkitgtk\+:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Apple,Iphone Os
CVE-2018-4233,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.53772,CWE-119,"An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the ""WebKit"" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.",2018-06-08,Metasploit,cpe:2.3:a:apple:icloud:*:*:*:*:*:*:*:*;cpe:2.3:a:apple:itunes:*:*:*:*:*:*:*:*;cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Apple,Iphone Os
CVE-2018-4237,0.0,,0.1392,NVD-CWE-noinfo,"An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the ""libxpc"" component. It allows attackers to gain privileges via a crafted app that leverages a logic error.",2018-06-08,Metasploit,cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Iphone Os
CVE-2018-4344,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.02939,CWE-119,"A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5.",2019-04-03,CISA,cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Iphone Os
CVE-2018-4404,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.13919,CWE-119,"In iOS before 11.4 and macOS High Sierra before 10.13.5, a memory corruption issue exists and was addressed with improved memory handling.",2019-01-11,Metasploit,cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*,Apple,Iphone Os
CVE-2018-4878,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.89532,CWE-416,A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.,2018-02-06,CISA,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer_11:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:google:chrome_os:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*,Apple,Macos
CVE-2018-4939,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.63304,CWE-502,"Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.",2018-05-19,CISA,cpe:2.3:a:adobe:coldfusion:11.0:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update10:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update11:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update12:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update13:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update7:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update8:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:11.0:update9:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update5:*:*:*:*:*:*,Adobe,Coldfusion
CVE-2018-4990,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.36365,CWE-415,"Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.",2018-07-09,CISA,cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:*;cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*;cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:*;cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2018-4993,0.0,,0.86898,CWE-200,"Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an NTLM SSO hash theft vulnerability. Successful exploitation could lead to information disclosure.",2018-07-09,Metasploit,cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:*;cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*;cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:*;cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2018-5002,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.25353,CWE-787,Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.,2018-07-09,CISA,cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:*;cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer_11:*:*;cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*;cpe:2.3:o:google:chrome_os:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2018-5230,0.0,,0.37611,CWE-79,"The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4 and from version 7.9.0 before version 7.9.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the error message of custom fields when an invalid value is specified.",2018-05-14,Nuclei,cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*,Atlassian,Jira
CVE-2018-5233,0.0,,0.03401,CWE-79,Cross-site scripting (XSS) vulnerability in system/src/Grav/Common/Twig/Twig.php in Grav CMS before 1.3.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/tools.,2018-03-19,Nuclei,cpe:2.3:a:getgrav:grav_cms:*:*:*:*:*:*:*:*,Getgrav,Grav Cms
CVE-2018-5316,0.0,,0.03685,CWE-79,"The ""SagePay Server Gateway for WooCommerce"" plugin before 1.0.9 for WordPress has XSS via the includes/pages/redirect.php page parameter.",2018-01-09,Nuclei,cpe:2.3:a:patsatech:sagepay_server_gateway_for_woocommerce:*:*:*:*:*:wordpress:*:*,Patsatech,Sagepay Server Gateway For Woocommerce
CVE-2018-5333,0.0,,0.07679,CWE-476,"In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference.",2018-01-11,Metasploit,cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2018-5430,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.48753,CWE-22,"The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.",2018-04-17,CISA,cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:*:*:*;cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:activematrix_bpm:*:*;cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:community:*:*:*;cpe:2.3:a:tibco:jasperreports_server:6.3.0:*:*:*:*:*:*:*;cpe:2.3:a:tibco:jasperreports_server:6.3.2:*:*:*:*:*:*:*;cpe:2.3:a:tibco:jasperreports_server:6.3.3:*:*:*:*:*:*:*;cpe:2.3:a:tibco:jasperreports_server:6.4.0:*:*:*:*:*:*:*;cpe:2.3:a:tibco:jasperreports_server:6.4.2:*:*:*:*:*:*:*;cpe:2.3:a:tibco:jaspersoft:*:*:*:*:*:aws_with_multi-tenancy:*:*;cpe:2.3:a:tibco:jaspersoft_reporting_and_analytics:*:*:*:*:*:aws:*:*,Tibco,Jasperreports Server
CVE-2018-5715,0.0,,0.06914,CWE-79,phprint.php in SugarCRM 3.5.1 has XSS via a parameter name in the query string (aka a $key variable).,2018-01-16,Nuclei,cpe:2.3:a:sugarcrm:sugarcrm:3.5.1:*:*:*:*:*:*:*,Sugarcrm,Sugarcrm
CVE-2018-5955,0.0,,0.80982,CWE-20,"An issue was discovered in GitStack through 2.3.10. User controlled input is not sufficiently filtered, allowing an unauthenticated attacker to add a user to the server via the username and password fields to the rest/user/ URI.",2018-01-21,Metasploit,cpe:2.3:a:smartmobilesoftware:gitstack:*:*:*:*:*:*:*:*,Smartmobilesoftware,Gitstack
CVE-2018-5999,0.0,,0.87264,NVD-CWE-noinfo,"An issue was discovered in AsusWRT before 3.0.0.4.384_10007. In the handle_request function in router/httpd/httpd.c, processing of POST requests continues even if authentication fails.",2018-01-22,Metasploit,cpe:2.3:o:asus:asuswrt:*:*:*:*:*:*:*:*,Asus,Asuswrt
CVE-2018-6000,0.0,,0.84197,CWE-862,"An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpnupload.cgi provides functionality for setting NVRAM configuration values, which allows attackers to set the admin password and launch an SSH daemon (or enable infosvr command mode), and consequently obtain remote administrative access, via a crafted request. This is available to unauthenticated attackers in conjunction with CVE-2018-5999.",2018-01-22,Metasploit,cpe:2.3:o:asus:asuswrt:*:*:*:*:*:*:*:*,Asus,Asuswrt
CVE-2018-6008,0.0,,0.36823,CWE-200,Arbitrary File Download exists in the Jtag Members Directory 5.3.7 component for Joomla! via the download_file parameter.,2018-01-29,Nuclei,cpe:2.3:a:joomlatag:jtag_members_directory:5.3.7:*:*:*:*:joomla\!:*:*,Joomlatag,Jtag Members Directory
CVE-2018-6065,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.60304,CWE-190,Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2018-11-14,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:a:mi:mi6_browser:-:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*,Redhat,Enterprise Linux Desktop
CVE-2018-6184,0.0,,0.0906,CWE-22,ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace.,2018-01-24,Nuclei,cpe:2.3:a:zeit:next.js:4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:zeit:next.js:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:zeit:next.js:4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:zeit:next.js:4.0.3:*:*:*:*:*:*:*;cpe:2.3:a:zeit:next.js:4.0.4:*:*:*:*:*:*:*;cpe:2.3:a:zeit:next.js:4.0.5:*:*:*:*:*:*:*;cpe:2.3:a:zeit:next.js:4.1.0:*:*:*:*:*:*:*;cpe:2.3:a:zeit:next.js:4.1.1:*:*:*:*:*:*:*;cpe:2.3:a:zeit:next.js:4.1.2:*:*:*:*:*:*:*;cpe:2.3:a:zeit:next.js:4.1.3:*:*:*:*:*:*:*;cpe:2.3:a:zeit:next.js:4.1.4:*:*:*:*:*:*:*;cpe:2.3:a:zeit:next.js:4.1.4:canary_1:*:*:*:*:*:*;cpe:2.3:a:zeit:next.js:4.1.4:canary_2:*:*:*:*:*:*;cpe:2.3:a:zeit:next.js:4.2.0:*:*:*:*:*:*:*;cpe:2.3:a:zeit:next.js:4.2.0:canary_1:*:*:*:*:*:*;cpe:2.3:a:zeit:next.js:4.2.1:*:*:*:*:*:*:*;cpe:2.3:a:zeit:next.js:4.2.2:*:*:*:*:*:*:*,Zeit,Next.Js
CVE-2018-6200,0.0,,0.0316,CWE-601,vBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter.,2018-01-25,Nuclei,cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:*,Vbulletin,Vbulletin
CVE-2018-6317,0.0,,0.43679,CWE-134,"The remote management interface in Claymore Dual Miner 10.5 and earlier is vulnerable to an unauthenticated format string vulnerability, allowing remote attackers to read memory or cause a denial of service.",2018-02-02,Metasploit,cpe:2.3:a:claymore_dual_miner_project:claymore_dual_miner:*:*:*:*:*:*:*:*,Claymore Dual Miner Project,Claymore Dual Miner
CVE-2018-6328,0.0,,0.64927,CWE-287,"It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allow an unauthenticated user to inject arbitrary commands into its /api/hosts parameters using backquotes.",2018-03-14,Metasploit,cpe:2.3:a:kaseya:unitrends_backup:*:*:*:*:*:*:*:*,Kaseya,Unitrends Backup
CVE-2018-6329,0.0,,0.61833,CWE-89,"It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection, allowing a remote attacker to place a privilege escalation exploit on the target system and subsequently execute arbitrary commands.",2018-03-14,Metasploit,cpe:2.3:a:unitrends:backup:*:*:*:*:*:*:*:*,Unitrends,Backup
CVE-2018-6530,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96682,CWE-78,"OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service parameter.",2018-03-06,CISA/EPSS/Nuclei,cpe:2.3:h:dlink:dir-860l:a1:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-865l:a1:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-868l:a1:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-880l:a1:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-860l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-865l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-868l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-880l_firmware:*:*:*:*:*:*:*:*,D-Link,Dir-860L Firmware
CVE-2018-6605,0.0,,0.57702,CWE-89,"SQL Injection exists in the Zh BaiduMap 3.0.0.1 component for Joomla! via the id parameter in a getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText, or getPathDetails request.",2018-02-05,Nuclei,cpe:2.3:a:zh_baidumap_project:zh_baidumap:3.0.0.1:*:*:*:*:joomla\!:*:*,Zh Baidumap Project,Zh Baidumap
CVE-2018-6789,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.82137,CWE-120,"An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.",2018-02-08,CISA,cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2018-6849,0.0,,0.30144,CWE-200,"In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com), the browser can disclose a private IP address in a STUN request.",2018-04-01,Metasploit,cpe:2.3:a:duckduckgo:duckduckgo:4.2.0:*:*:*:*:*:*:*,Duckduckgo,Duckduckgo
CVE-2018-6882,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.23717,CWE-79,Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.,2018-03-27,CISA/Nuclei,cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.0:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.0:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.1:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.2:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.3:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.4:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.5:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.6:*:*:*:*:*:*:*,Synacor,Zimbra Collaboration Suite
CVE-2018-6892,0.0,,0.93392,CWE-119,"An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the ""CloudMe Sync"" client application listening on port 8888 can send a malicious payload causing a buffer overflow condition. This will result in an attacker controlling the program's execution flow and allowing arbitrary code execution.",2018-02-11,Metasploit,cpe:2.3:a:cloudme:sync:*:*:*:*:*:*:*:*,Cloudme,Sync
CVE-2018-6910,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.18955,CWE-668,DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/inc_archives_functions.php.,2018-02-13,Nuclei,cpe:2.3:a:dedecms:dedecms:5.7:*:*:*:*:*:*:*,Dedecms,Dedecms
CVE-2018-6961,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.86431,CWE-78,VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future releases. Successful exploitation of this issue could result in remote code execution.,2018-06-11,CISA/Nuclei,cpe:2.3:a:vmware:nsx_sd-wan_by_velocloud:*:*:*:*:*:*:*:*,Vmware,Nsx Sd-Wan By Velocloud
CVE-2018-7192,0.0,,0.02073,CWE-79,"Cross-site scripting (XSS) vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the ""message"" parameter.",2018-03-27,Nuclei,cpe:2.3:a:enhancesoft:osticket:*:*:*:*:*:*:*:*,Enhancesoft,Osticket
CVE-2018-7193,0.0,,0.02482,CWE-79,"Cross-site scripting (XSS) vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the ""order"" parameter.",2018-03-27,Nuclei,cpe:2.3:a:enhancesoft:osticket:*:*:*:*:*:*:*:*,Enhancesoft,Osticket
CVE-2018-7196,0.0,,0.02482,CWE-79,"Cross-site scripting (XSS) vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the ""sort"" parameter.",2018-03-27,Nuclei,cpe:2.3:a:enhancesoft:osticket:*:*:*:*:*:*:*:*,Enhancesoft,Osticket
CVE-2018-7251,0.0,,0.72272,CWE-200,"An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as ""Too many connections"") has occurred.",2018-02-19,Nuclei,cpe:2.3:a:anchorcms:anchor:0.12.3:*:*:*:*:*:*:*,Anchorcms,Anchor
CVE-2018-7282,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.10095,CWE-89,The username parameter of the TITool PrintMonitor solution during the login request is vulnerable to and/or time-based blind SQLi.,2019-12-06,Nuclei,cpe:2.3:a:titool:printmonitor:*:*:*:*:*:*:*:*,Titool,Printmonitor
CVE-2018-7314,0.0,,0.58373,CWE-89,"SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla! via the sessionid parameter, a different vulnerability than CVE-2008-6429.",2018-02-22,Nuclei,cpe:2.3:a:mlwebtechnologies:prayercenter:3.0.2:*:*:*:*:joomla\!:*:*,Mlwebtechnologies,Prayercenter
CVE-2018-7422,0.0,,0.63102,CWE-22,"A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php, aka absolute path traversal.",2018-03-19,Nuclei,cpe:2.3:a:siteeditor:site_editor:*:*:*:*:*:wordpress:*:*,Siteeditor,Site Editor
CVE-2018-7445,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.61018,CWE-119,"A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. The overflow occurs before authentication takes place, so it is possible for an unauthenticated remote attacker to exploit it. All architectures and all devices running RouterOS before versions 6.41.3/6.42rc27 are vulnerable.",2018-03-19,CISA,cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*;cpe:2.3:o:mikrotik:routeros:6.42:rc11:*:*:*:*:*:*;cpe:2.3:o:mikrotik:routeros:6.42:rc12:*:*:*:*:*:*;cpe:2.3:o:mikrotik:routeros:6.42:rc14:*:*:*:*:*:*;cpe:2.3:o:mikrotik:routeros:6.42:rc15:*:*:*:*:*:*;cpe:2.3:o:mikrotik:routeros:6.42:rc18:*:*:*:*:*:*;cpe:2.3:o:mikrotik:routeros:6.42:rc20:*:*:*:*:*:*;cpe:2.3:o:mikrotik:routeros:6.42:rc23:*:*:*:*:*:*;cpe:2.3:o:mikrotik:routeros:6.42:rc24:*:*:*:*:*:*;cpe:2.3:o:mikrotik:routeros:6.42:rc2:*:*:*:*:*:*;cpe:2.3:o:mikrotik:routeros:6.42:rc5:*:*:*:*:*:*;cpe:2.3:o:mikrotik:routeros:6.42:rc6:*:*:*:*:*:*;cpe:2.3:o:mikrotik:routeros:6.42:rc9:*:*:*:*:*:*,Mikrotik,Routeros
CVE-2018-7467,0.0,,0.10358,CWE-22,AxxonSoft Axxon Next has Directory Traversal via an initial /css//..%2f substring in a URI.,2018-02-27,Nuclei,cpe:2.3:a:axxonsoft:next:-:*:*:*:*:*:*:*,Axxonsoft,Next
CVE-2018-7490,0.0,,0.69907,CWE-22,"uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.",2018-02-26,Nuclei,cpe:2.3:a:unbit:uwsgi:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2018-7573,0.0,,0.69692,CWE-119,"An issue was discovered in FTPShell Client 6.7. A remote FTP server can send 400 characters of 'F' in conjunction with the FTP 220 response code to crash the application; after this overflow, one can run arbitrary code on the victim machine. This is similar to CVE-2009-3364 and CVE-2017-6465.",2018-03-01,Metasploit,cpe:2.3:a:ftpshell:ftpshell_client:6.70:*:*:*:*:*:*:*,Ftpshell,Ftpshell Client
CVE-2018-7600,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99993,CWE-20,"Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.",2018-03-29,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2018-7602,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99236,NVD-CWE-noinfo,"A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.",2018-07-19,CISA/EPSS/Nuclei,cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2018-7653,0.0,,0.08686,CWE-79,"In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter.",2018-03-04,Nuclei,cpe:2.3:a:yzmcms:yzmcms:3.6:*:*:*:*:*:*:*,Yzmcms,Yzmcms
CVE-2018-7662,0.0,,0.43004,CWE-200,Couch through 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpmailer/phpmailer.php.,2018-03-04,Nuclei,cpe:2.3:a:couchcms:couch:*:*:*:*:*:*:*:*,Couchcms,Couch
CVE-2018-7665,0.0,,0.16173,CWE-434,"An issue was discovered in ClipBucket before 4.0.0 Release 4902. A malicious file can be uploaded via the name parameter to actions/beats_uploader.php or actions/photo_uploader.php, or the coverPhoto parameter to edit_account.php.",2018-03-05,Metasploit,cpe:2.3:a:clip-bucket:clipbucket:*:*:*:*:*:*:*:*,Clip-Bucket,Clipbucket
CVE-2018-7700,0.0,,0.74842,CWE-352,"DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php request can specify a runphp field in conjunction with PHP code.",2018-03-27,Nuclei,cpe:2.3:a:dedecms:dedecms:5.7:*:*:*:*:*:*:*,Dedecms,Dedecms
CVE-2018-7719,0.0,,0.48744,CWE-22,Acrolinx Server before 5.2.5 on Windows allows Directory Traversal.,2018-03-25,Nuclei,cpe:2.3:a:acrolinx:acrolinx_server:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2018-7765,0.0,,0.02917,CWE-89,The vulnerability exists within processing of track_import_export.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the object_id input parameter.,2018-07-03,Nuclei,cpe:2.3:a:schneider-electric:u.motion_builder:*:*:*:*:*:*:*:*,Schneider-Electric,U.Motion Builder
CVE-2018-7841,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.72675,CWE-89,A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.,2019-05-22,CISA/Nuclei,cpe:2.3:a:schneider-electric:u.motion_builder:1.3.4:*:*:*:*:*:*:*,Schneider-Electric,U.Motion Builder
CVE-2018-7890,0.0,,0.78815,CWE-78,"A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640). The publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing a specified system. This endpoint calls several internal classes, and then executes a PowerShell script. If the specified system is OfficeSharePointServer, then the username and password parameters to this script are not validated, leading to Command Injection.",2018-03-08,Metasploit,cpe:2.3:a:zohocorp:manageengine_applications_manager:*:*:*:*:*:*:*:*,Zohocorp,Manageengine Applications Manager
CVE-2018-8006,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.57227,CWE-79,An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.,2018-10-10,Nuclei,cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*,Apache,Activemq
CVE-2018-8011,0.0,,0.51714,CWE-476,"By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).",2018-07-18,Nuclei,cpe:2.3:a:apache:http_server:2.4.33:*:*:*:*:*:*:*;cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*,Apache,Http Server
CVE-2018-8024,0.0,,0.05251,CWE-200,"In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster's UI's job and stage info pages, and if a user can be tricked into accessing the URL, can be used to cause script to execute and expose information from the user's view of the Spark UI. While some browsers like recent versions of Chrome and Safari are able to block this type of attack, current versions of Firefox (and possibly others) do not.",2018-07-12,Nuclei,cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:spark:2.3.0:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:-:*:*:*:*:*:*:*,Apache,Spark
CVE-2018-8033,0.0,,0.25743,CWE-200,"In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName, serviceMode, and serviceContext. The exploitation occurs by having DOCTYPEs pointing to external references that trigger a payload that returns secret information from the host.",2018-12-13,Nuclei,cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*,Apache,Ofbiz
CVE-2018-8065,0.0,,0.76245,CWE-20,An issue was discovered in the web server in Flexense SyncBreeze Enterprise 10.6.24. There is a user mode write access violation on the syncbrs.exe memory region that can be triggered by rapidly sending a variety of HTTP requests with long HTTP header values or long URIs.,2018-03-12,Metasploit,cpe:2.3:a:flexense:syncbreeze:10.6.24:*:*:*:enterprise:*:*:*,Flexense,Syncbreeze
CVE-2018-8120,7.0,CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.73721,CWE-404,"An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka ""Win32k Elevation of Privilege Vulnerability."" This affects Windows Server 2008, Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8124, CVE-2018-8164, CVE-2018-8166.",2018-05-09,CISA/Metasploit,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*,Microsoft,Windows 7
CVE-2018-8174,7.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.87639,CWE-787,"A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka ""Windows VBScript Engine Remote Code Execution Vulnerability."" This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.",2018-05-09,CISA,cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1607
CVE-2018-8298,7.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.75339,CWE-843,"A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka ""Scripting Engine Memory Corruption Vulnerability."" This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.",2018-07-11,CISA,cpe:2.3:a:microsoft:chakracore:*:*:*:*:*:*:*:*,Microsoft,Chakracore
CVE-2018-8373,7.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.61912,CWE-787,"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka ""Scripting Engine Memory Corruption Vulnerability."" This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-8353, CVE-2018-8355, CVE-2018-8359, CVE-2018-8371, CVE-2018-8372, CVE-2018-8385, CVE-2018-8389, CVE-2018-8390.",2018-08-15,CISA,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2018-8405,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03444,CWE-404,"An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka ""DirectX Graphics Kernel Elevation of Privilege Vulnerability."" This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8400, CVE-2018-8401, CVE-2018-8406.",2018-08-15,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1709:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2018-8406,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03444,CWE-404,"An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka ""DirectX Graphics Kernel Elevation of Privilege Vulnerability."" This affects Windows Server 2016, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8400, CVE-2018-8401, CVE-2018-8405.",2018-08-15,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2018-8414,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.73968,CWE-20,"A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka ""Windows Shell Remote Code Execution Vulnerability."" This affects Windows 10 Servers, Windows 10.",2018-08-15,CISA,cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:x64:*,Microsoft,Windows 10 1703
CVE-2018-8440,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.18386,NVD-CWE-noinfo,"An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka ""Windows ALPC Elevation of Privilege Vulnerability."" This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.",2018-09-13,CISA/Metasploit,cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1607
CVE-2018-8453,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.70042,NVD-CWE-noinfo,"An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka ""Win32k Elevation of Privilege Vulnerability."" This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.",2018-10-10,CISA/Metasploit,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1709:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2018-8581,7.4,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N,0.27355,NVD-CWE-noinfo,"An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka ""Microsoft Exchange Server Elevation of Privilege Vulnerability."" This affects Microsoft Exchange Server.",2018-11-14,CISA,cpe:2.3:a:microsoft:exchange_server:2010:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2013:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2018-8589,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03023,NVD-CWE-noinfo,"An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka ""Windows Win32k Elevation of Privilege Vulnerability."" This affects Windows Server 2008, Windows 7, Windows Server 2008 R2.",2018-11-14,CISA,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*,Microsoft,Windows 7
CVE-2018-8611,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.04196,CWE-404,"An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka ""Windows Kernel Elevation of Privilege Vulnerability."" This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.",2018-12-12,CISA,cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:pro_n:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1607
CVE-2018-8639,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.22349,CWE-404,"An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka ""Win32k Elevation of Privilege Vulnerability."" This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8641.",2018-12-12,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:pro_n:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2018-8653,7.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.29822,CWE-787,"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka ""Scripting Engine Memory Corruption Vulnerability."" This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-8643.",2018-12-20,CISA,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1703:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1709:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1803:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:pro_n:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows Server 2008
CVE-2018-8715,0.0,,0.23287,CWE-287,"The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c. With a forged HTTP request, it is possible to bypass authentication for the form and digest login types.",2018-03-15,Nuclei,cpe:2.3:a:embedthis:appweb:*:*:*:*:*:*:*:*,Embedthis,Appweb
CVE-2018-8719,0.0,,0.16898,CWE-532,"An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-security-audit-log/* files is not restricted. For example, these files are indexed by Google and allows for attackers to possibly find sensitive information.",2018-04-04,Nuclei,cpe:2.3:a:wpsecurityauditlog:wp_security_audit_log:3.1.1:*:*:*:*:wordpress:*:*,Wpsecurityauditlog,Wp Security Audit Log
CVE-2018-8727,0.0,,0.078,CWE-22,Path Traversal in Gateway in Mirasys DVMS Workstation 5.12.6 and earlier allows an attacker to traverse the file system to access files or directories via the Web Client webserver.,2018-06-19,Nuclei,cpe:2.3:a:mirasys:dvms_workstation:*:*:*:*:*:*:*:*,Mirasys,Dvms Workstation
CVE-2018-8733,0.0,,0.27508,CWE-89,Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an unauthenticated attacker to make configuration changes and leverage an authenticated SQL injection vulnerability.,2018-04-18,Metasploit,cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*,Nagios,Nagios Xi
CVE-2018-8734,0.0,,0.53247,CWE-89,SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter.,2018-04-18,Metasploit,cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*,Nagios,Nagios Xi
CVE-2018-8735,0.0,,0.64172,CWE-78,"Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands on the target system, aka OS command injection.",2018-04-18,Metasploit,cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*,Nagios,Nagios Xi
CVE-2018-8736,0.0,,0.46949,NVD-CWE-noinfo,A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RCE vulnerability escalating to root.,2018-04-18,Metasploit,cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*,Nagios,Nagios Xi
CVE-2018-8770,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.60586,CWE-200,"Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via generate.php, controllers/getConfigTest.php, controllers/getUpdateTest.php, controllers/postclientdataTest.php, controllers/posterrorTest.php, controllers/posteventTest.php, controllers/posttagTest.php, controllers/postusinglogTest.php, fixtures/Controller_fixt.php, fixtures/Controller_fixt2.php, fixtures/view_fixt2.php, libs/ipTest.php, or models/commonDbfix.php in tests/.",2018-03-18,Nuclei,cpe:2.3:a:cobub:razor:0.8.0:*:*:*:*:*:*:*,Cobub,Razor
CVE-2018-8823,0.0,,0.51572,CWE-94,modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to execute arbitrary PHP code via the code parameter.,2018-03-28,Nuclei,cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:*;cpe:2.3:a:responsive_mega_menu_pro_project:responsive_mega_menu_pro:1.0.32:*:*:*:*:prestashop:*:*,Responsive Mega Menu Pro Project,Responsive Mega Menu Pro
CVE-2018-8897,0.0,,0.18842,CWE-362,"A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3 is complete. OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs.",2018-05-08,Metasploit,cpe:2.3:a:citrix:xenserver:6.0.2:*:*:*:*:*:*:*;cpe:2.3:a:citrix:xenserver:6.2.0:*:*:*:*:*:*:*;cpe:2.3:a:citrix:xenserver:6.5:*:*:*:*:*:*:*;cpe:2.3:a:citrix:xenserver:7.0:*:*:*:*:*:*:*;cpe:2.3:a:citrix:xenserver:7.1:*:*:*:*:*:*:*;cpe:2.3:a:citrix:xenserver:7.2:*:*:*:*:*:*:*;cpe:2.3:a:citrix:xenserver:7.3:*:*:*:*:*:*:*;cpe:2.3:a:citrix:xenserver:7.4:*:*:*:*:*:*:*;cpe:2.3:a:synology:skynas:-:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_virtualization_manager:3.0:*:*:*:*:*:*:*;cpe:2.3:o:synology:diskstation_manager:5.2:*:*:*:*:*:*:*;cpe:2.3:o:synology:diskstation_manager:6.0:*:*:*:*:*:*:*;cpe:2.3:o:synology:diskstation_manager:6.1:*:*:*:*:*:*:*;cpe:2.3:o:xen:xen:-:*:*:*:*:*:x86:*,Debian,Debian Linux
CVE-2018-9059,0.0,,0.77319,CWE-119,Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 7.2 allows remote attackers to execute arbitrary code via a malicious login request to forum.ghp.  NOTE: this may overlap CVE-2014-3791.,2018-04-20,Metasploit,cpe:2.3:a:sharing-file:easy_file_sharing_web_server:7.2:*:*:*:*:*:*:*,Sharing-File,Easy File Sharing Web Server
CVE-2018-9118,0.0,,0.48158,CWE-22,exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a .. in the filename parameter.,2018-04-12,Nuclei,cpe:2.3:a:99robots:wp_background_takeover_advertisements:*:*:*:*:*:wordpress:*:*,99Robots,Wp Background Takeover Advertisements
CVE-2018-9160,0.0,,0.76519,CWE-522,SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses.,2018-03-31,Metasploit,cpe:2.3:a:sickrage:sickrage:*:*:*:*:*:*:*:*,Sickrage,Sickrage
CVE-2018-9161,0.0,,0.58528,CWE-798,Prisma Industriale Checkweigher PrismaWEB 1.21 allows remote attackers to discover the hardcoded prisma password for the prismaweb account by reading user/scripts/login_par.js.,2018-03-31,Nuclei,cpe:2.3:a:prismaindustriale:checkweigher_prismaweb:1.21:*:*:*:*:*:*:*,Prismaindustriale,Checkweigher Prismaweb
CVE-2018-9205,0.0,,0.56924,CWE-22,"Vulnerability in avatar_uploader v7.x-1.0-beta8 , The code in view.php doesn't verify users or sanitize the file path.",2018-04-04,Nuclei,cpe:2.3:a:drupal:avatar_uploader:7.x-1.0:beta8:*:*:*:*:*:*,Drupal,Avatar Uploader
CVE-2018-9206,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97107,CWE-434,Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0,2018-10-11,EPSS/Metasploit/Nuclei,cpe:2.3:a:jquery_file_upload_project:jquery_file_upload:*:*:*:*:*:*:*:*,Jquery File Upload Project,Jquery File Upload
CVE-2018-9276,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.87173,CWE-78,An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.,2018-07-02,CISA/Metasploit,cpe:2.3:a:paessler:prtg_network_monitor:*:*:*:*:*:*:*:*,Paessler,Prtg Network Monitor
CVE-2018-9845,0.0,,0.13132,CWE-178,Etherpad Lite before 1.6.4 is exploitable for admin access.,2018-04-29,Nuclei,cpe:2.3:a:etherpad:etherpad_lite:*:*:*:*:*:*:*:*,Etherpad,Etherpad Lite
CVE-2018-9948,0.0,,0.63689,CWE-824,This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of typed arrays. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5380.,2018-05-17,Metasploit,cpe:2.3:a:foxitsoftware:foxit_reader:*:*:*:*:*:*:*:*;cpe:2.3:a:foxitsoftware:phantompdf:*:*:*:*:*:*:*:*,Foxitsoftware,Foxit Reader
CVE-2018-9958,0.0,,0.62922,CWE-416,"This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Text Annotations. When setting the point attribute, the process does not properly validate the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5620.",2018-05-17,Metasploit,cpe:2.3:a:foxitsoftware:foxit_reader:*:*:*:*:*:*:*:*;cpe:2.3:a:foxitsoftware:phantompdf:*:*:*:*:*:*:*:*,Foxitsoftware,Foxit Reader
CVE-2018-9995,0.0,,0.83151,NVD-CWE-noinfo,"TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a ""Cookie: uid=admin"" header, as demonstrated by a device.rsp?opt=user&cmd=list request that provides credentials within JSON data in a response.",2018-04-10,Nuclei,cpe:2.3:h:tbkvision:tbk-dvr4104:-:*:*:*:*:*:*:*;cpe:2.3:h:tbkvision:tbk-dvr4216:-:*:*:*:*:*:*:*;cpe:2.3:o:tbkvision:tbk-dvr4104_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:tbkvision:tbk-dvr4216_firmware:-:*:*:*:*:*:*:*,Tbkvision,Tbk-Dvr4216 Firmware
CVE-2019-0192,0.0,,0.77508,CWE-502,"In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.",2019-03-07,Nuclei,cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*,Apache,Solr
CVE-2019-0193,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.83547,CWE-94,"In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's ""dataConfig"" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property ""enable.dih.dataConfigParam"" to true.",2019-08-01,CISA/Nuclei,cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2019-0211,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.65005,CWE-416,"In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.",2019-04-08,CISA,cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:7-mode:*:*;cpe:2.3:a:oracle:communications_session_report_manager:8.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_report_manager:8.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_route_manager:8.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_route_manager:8.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_container_platform_for_power:3.11_ppc64le:*:*:*:*:*:*:*;cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.1_aarch64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.2_aarch64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.4_aarch64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.6_aarch64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.8_aarch64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.1_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.2_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.1_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:8.8:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2019-0221,0.0,,0.45571,CWE-79,"The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.",2019-05-28,Nuclei,cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*,Apache,Tomcat
CVE-2019-0230,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97112,CWE-1321,"Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.",2020-09-14,EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*,Apache,Struts
CVE-2019-0232,0.0,,0.99652,CWE-78,"When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange's blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).",2019-04-15,EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2019-0307,0.0,,0.02089,CWE-311,"Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP Secure Storage file which is not encrypted by default. By decoding these credentials, an attacker with admin privileges could gain access to the entire configuration, but no system sensitive information can be gained.",2019-06-12,Metasploit,cpe:2.3:a:sap:solution_manager:7.2:*:*:*:*:*:*:*,Sap,Solution Manager
CVE-2019-0344,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07079,CWE-502,"Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.",2019-08-14,CISA,cpe:2.3:a:sap:commerce_cloud:1808:*:*:*:*:*:*:*;cpe:2.3:a:sap:commerce_cloud:1811:*:*:*:*:*:*:*;cpe:2.3:a:sap:commerce_cloud:1905:*:*:*:*:*:*:*;cpe:2.3:a:sap:commerce_cloud:6.4:*:*:*:*:*:*:*;cpe:2.3:a:sap:commerce_cloud:6.5:*:*:*:*:*:*:*;cpe:2.3:a:sap:commerce_cloud:6.6:*:*:*:*:*:*:*;cpe:2.3:a:sap:commerce_cloud:6.7:*:*:*:*:*:*:*,Sap,Commerce Cloud
CVE-2019-0541,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.53202,CWE-77,"A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka ""MSHTML Engine Remote Code Execution Vulnerability."" This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, Internet Explorer 11, Microsoft Excel Viewer, Internet Explorer 10, Office 365 ProPlus.",2019-01-08,CISA,cpe:2.3:a:microsoft:excel_viewer:2007:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2013:sp1:*:*:rt:*:*:*;cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_365_proplus:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_word_viewer:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2019-0543,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.04679,CWE-287,"An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka ""Microsoft Windows Elevation of Privilege Vulnerability."" This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.",2019-01-08,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2019-0604,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99913,CWE-20,"A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.",2019-03-05,CISA/EPSS,cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*,Microsoft,Sharepoint Enterprise Server
CVE-2019-0676,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.07505,NVD-CWE-noinfo,"An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker who successfully exploited this vulnerability could test for the presence of files on disk, aka 'Internet Explorer Information Disclosure Vulnerability'.",2019-03-05,CISA,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows Server 2012
CVE-2019-0703,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.0964,NVD-CWE-noinfo,"An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0704, CVE-2019-0821.",2019-04-09,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1709:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2019-0708,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99999,CWE-416,"A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.",2019-05-16,CISA/EPSS/Metasploit,cpe:2.3:a:siemens:syngo_lab_process_manager:*:*:*:*:*:*:*:*;cpe:2.3:h:huawei:agile_controller-campus:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:bh620_v2:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:bh621_v2:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:bh622_v2:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:bh640_v2:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:ch121:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:ch140:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:ch220:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:ch221:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:ch222:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:ch240:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:ch242:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:ch242_v3:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:e6000:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:e6000_chassis:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:elog:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:espace_ecs:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:gtsoftx3000:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:oceanstor_18500:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:oceanstor_18800:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:oceanstor_18800f:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:oceanstor_hvs85t:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:oceanstor_hvs88t:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:rh1288_v2:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:rh1288a_v2:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:rh2265_v2:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:rh2268_v2:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:rh2285_v2:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:rh2285h_v2:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:rh2288_v2:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:rh2288a_v2:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:rh2288e_v2:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:rh2288h_v2:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:rh2485_v2:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:rh5885_v2:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:rh5885_v3:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:seco_vsm:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:smc2.0:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:uma:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:x6000:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:x8000:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:aptio:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:atellica_solution:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:axiom_multix_m:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:axiom_vertix_md_trauma:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:axiom_vertix_solitaire_m:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:centralink:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:lantis:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:mobilett_xp_digital:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:multix_pro:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:multix_pro_acss:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:multix_pro_acss_p:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:multix_pro_navy:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:multix_pro_p:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:multix_swing:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:multix_top:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:multix_top_acss:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:multix_top_acss_p:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:multix_top_p:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:rapidpoint_500:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:streamlab:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:vertix_solitaire:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:viva_e:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:viva_twin:-:*:*:*:*:*:*:*;cpe:2.3:o:huawei:agile_controller-campus_firmware:v100r002c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:agile_controller-campus_firmware:v100r002c10:*:*:*:*:*:*:*;cpe:2.3:o:huawei:bh620_v2_firmware:v100r002c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:bh621_v2_firmware:v100r002c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:bh622_v2_firmware:v100r001c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:bh640_v2_firmware:v100r002c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:ch121_firmware:v100r001c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:ch140_firmware:v100r001c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:ch220_firmware:v100r001c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:ch221_firmware:v100r001c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:ch222_firmware:v100r002c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:ch240_firmware:v100r001c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:ch242_firmware:v100r001c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:ch242_v3_firmware:v100r001c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:e6000_chassis_firmware:v100r001c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:e6000_firmware:v100r002c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:elog_firmware:v200r003c10:*:*:*:*:*:*:*;cpe:2.3:o:huawei:espace_ecs_firmware:v300r001c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:gtsoftx3000_firmware:v200r001c01spc100:*:*:*:*:*:*:*;cpe:2.3:o:huawei:gtsoftx3000_firmware:v200r002c00spc300:*:*:*:*:*:*:*;cpe:2.3:o:huawei:gtsoftx3000_firmware:v200r002c10spc100:*:*:*:*:*:*:*;cpe:2.3:o:huawei:oceanstor_18500_firmware:v100r001c30spc300:*:*:*:*:*:*:*;cpe:2.3:o:huawei:oceanstor_18800_firmware:v100r001c30spc300:*:*:*:*:*:*:*;cpe:2.3:o:huawei:oceanstor_18800f_firmware:v100r001c30spc300:*:*:*:*:*:*:*;cpe:2.3:o:huawei:oceanstor_hvs85t_firmware:v100r001c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:oceanstor_hvs85t_firmware:v100r001c30spc200:*:*:*:*:*:*:*;cpe:2.3:o:huawei:oceanstor_hvs88t_firmware:v100r001c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:oceanstor_hvs88t_firmware:v100r001c30spc200:*:*:*:*:*:*:*;cpe:2.3:o:huawei:rh1288_v2_firmware:v100r002c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:rh1288a_v2_firmware:v100r002c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:rh2265_v2_firmware:v100r002c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:rh2268_v2_firmware:v100r002c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:rh2285_v2_firmware:v100r002c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:rh2285h_v2_firmware:v100r002c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:rh2288_v2_firmware:v100r002c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:rh2288a_v2_firmware:v100r002c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:rh2288e_v2_firmware:v100r002c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:rh2288h_v2_firmware:v100r002c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:rh2485_v2_firmware:v100r002c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:rh5885_v2_firmware:v100r001c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:rh5885_v3_firmware:v100r003c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:seco_vsm_firmware:v200r002c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:smc2.0_firmware:v500r002c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:smc2.0_firmware:v600r006c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:uma_firmware:v200r001c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:uma_firmware:v300r001c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:x6000_firmware:v100r002c00:*:*:*:*:*:*:*;cpe:2.3:o:huawei:x8000_firmware:v100r002c20:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:siemens:aptio_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:atellica_solution_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:axiom_multix_m_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:axiom_vertix_md_trauma_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:axiom_vertix_solitaire_m_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:centralink_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:lantis_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:mobilett_xp_digital_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:multix_pro_acss_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:multix_pro_acss_p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:multix_pro_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:multix_pro_navy_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:multix_pro_p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:multix_swing_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:multix_top_acss_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:multix_top_acss_p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:multix_top_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:multix_top_p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:rapidpoint_500_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:streamlab_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:vertix_solitaire_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:viva_e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:viva_twin_firmware:*:*:*:*:*:*:*:*,Siemens,Axiom Multix M Firmware
CVE-2019-0724,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.23799,NVD-CWE-noinfo,"An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0686.",2019-03-05,Metasploit,cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup_26:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_22:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2019-0752,7.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.81551,CWE-843,"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0739, CVE-2019-0753, CVE-2019-0862.",2019-04-09,CISA,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2019-0797,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.0189,NVD-CWE-noinfo,"An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0808.",2019-04-09,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1709:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2019-0803,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.4523,NVD-CWE-noinfo,"An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0685, CVE-2019-0859.",2019-04-09,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2019-0808,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.53298,NVD-CWE-noinfo,"An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0797.",2019-04-09,CISA/Metasploit,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2019-0841,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.414,CWE-59,"An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836.",2019-04-09,CISA/Metasploit,cpe:2.3:o:microsoft:windows_10_1703:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1709:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1803:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:1803:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1703
CVE-2019-0859,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.04151,NVD-CWE-noinfo,"An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0685, CVE-2019-0803.",2019-04-09,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1709:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2019-0863,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.05207,NVD-CWE-noinfo,"An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'.",2019-05-16,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2019-0880,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02404,NVD-CWE-noinfo,"A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privilege Vulnerability'.",2019-07-15,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2019-0903,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.21713,NVD-CWE-noinfo,"A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'.",2019-05-16,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2019-1003000,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.98428,NVD-CWE-Other,A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.,2019-01-22,EPSS/Metasploit/Nuclei,cpe:2.3:a:jenkins:script_security:*:*:*:*:*:jenkins:*:*;cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*,Jenkins,Script Security
CVE-2019-1003001,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.86224,NVD-CWE-Other,"A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.",2019-01-22,Metasploit,cpe:2.3:a:jenkins:pipeline\:_groovy:*:*:*:*:*:jenkins:*:*;cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*,Jenkins,Pipeline
CVE-2019-1003002,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.81552,NVD-CWE-Other,A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.,2019-01-22,Metasploit,cpe:2.3:a:jenkins:pipeline\:_declarative:*:*:*:*:*:jenkins:*:*;cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*,Jenkins,Pipeline
CVE-2019-1003005,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.19042,NVD-CWE-Other,A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.,2019-02-06,Metasploit,cpe:2.3:a:jenkins:script_security:*:*:*:*:*:jenkins:*:*,Jenkins,Script Security
CVE-2019-1003029,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.73854,NVD-CWE-noinfo,"A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.",2019-03-08,CISA/Metasploit,cpe:2.3:a:jenkins:script_security:*:*:*:*:*:jenkins:*:*;cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*,Jenkins,Script Security
CVE-2019-1003030,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.75594,NVD-CWE-noinfo,"A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.",2019-03-08,CISA,cpe:2.3:a:jenkins:pipeline\:_groovy:*:*:*:*:*:jenkins:*:*;cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*,Jenkins,Pipeline
CVE-2019-10068,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96031,CWE-502,"An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security headers, it was possible for a specially crafted request to the staging service to bypass the initial authentication and proceed to deserialize user-controlled .NET object input. This deserialization then led to unauthenticated remote code execution on the server where the Kentico instance was hosted.",2019-03-26,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:*,Kentico,Xperience
CVE-2019-10092,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.81466,CWE-79,"In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.",2019-09-26,Nuclei,cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_element_manager:8.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_element_manager:8.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:secure_global_desktop:5.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:secure_global_desktop:5.5:*:*:*:*:*:*:*;cpe:2.3:a:redhat:software_collection:1.0:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*;cpe:2.3:o:netapp:clustered_data_ontap:*:*:*:*:*:*:*:*;cpe:2.3:o:netapp:clustered_data_ontap:9.6:-:*:*:*:*:*:*;cpe:2.3:o:netapp:clustered_data_ontap:9.6:p1:*:*:*:*:*:*;cpe:2.3:o:netapp:clustered_data_ontap:9.6:p3:*:*:*:*:*:*;cpe:2.3:o:netapp:clustered_data_ontap:9.6:p4:*:*:*:*:*:*;cpe:2.3:o:netapp:clustered_data_ontap:9.6:p7:*:*:*:*:*:*;cpe:2.3:o:netapp:clustered_data_ontap:9.6:p8:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*,Opensuse,Leap
CVE-2019-10098,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.73981,CWE-601,"In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.",2019-09-25,Nuclei,cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*,Apache,Http Server
CVE-2019-1010287,0.0,,0.043,CWE-79,"Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a ""redirect"" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the malicious url.",2019-07-17,Nuclei,cpe:2.3:a:timesheet_next_gen_project:timesheet_next_gen:*:*:*:*:*:*:*:*,Timesheet Next Gen Project,Timesheet Next Gen
CVE-2019-1010290,0.0,,0.04059,CWE-601,"Babel: Multilingual site Babel All is affected by: Open Redirection. The impact is: Redirection to any URL, which is supplied to redirect.php in a ""newurl"" parameter. The component is: redirect.php. The attack vector is: The victim must open a link created by an attacker. Attacker may use any legitimate site using Babel to redirect user to a URL of his/her choosing.",2019-07-16,Nuclei,cpe:2.3:a:cmsmadesimple:bable\:multilingual_site:*:*:*:*:*:cms_made_simple:*:*,Cmsmadesimple,Bable
CVE-2019-10123,0.0,,0.6585,CWE-89,SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app) allows an anonymous attacker to execute arbitrary code in the context of the user of the MSSQL database. The default user for the database is the 'sa' user.,2019-05-31,Metasploit,cpe:2.3:h:ais:esel-server:-:*:*:*:*:*:*:*;cpe:2.3:o:ais:logistic_software:*:*:*:*:*:*:*:*,Ais,Logistic Software
CVE-2019-10149,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99961,CWE-78,A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.,2019-06-05,CISA/EPSS/Metasploit,cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2019-10232,0.0,,0.23211,CWE-89,"Teclib GLPI through 9.3.3 has SQL injection via the ""cycle"" parameter in /scripts/unlock_tasks.php.",2019-03-27,Nuclei,cpe:2.3:a:teclib-edition:gestionnaire_libre_de_parc_informatique:*:*:*:*:*:*:*:*,Teclib-Edition,Gestionnaire Libre De Parc Informatique
CVE-2019-10267,0.0,,0.75171,CWE-434,"An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50. It is possible to upload a file into any directory of the server. One can insert a JSP shell into the web server's directory and execute it. This leads to full access to the system, as the configured user (e.g., Administrator).",2019-07-26,Metasploit,cpe:2.3:a:ahsay:cloud_backup_suite:*:*:*:*:*:*:*:*,Ahsay,Cloud Backup Suite
CVE-2019-10405,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N,0.65753,CWE-79,"Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the ""Cookie"" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.",2019-09-25,Nuclei,cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*;cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*,Jenkins,Jenkins
CVE-2019-10475,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.57735,CWE-79,A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.,2019-10-23,Nuclei,cpe:2.3:a:jenkins:build-metrics:*:*:*:*:*:jenkins:*:*,Jenkins,Build-Metrics
CVE-2019-1064,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.06886,CWE-59,"An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install programs; view, change or delete data.
To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system.
The security update addresses the vulnerability by correcting how Windows AppX Deployment Service handles hard links.",2019-06-12,CISA,cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1607
CVE-2019-10647,0.0,,0.06589,CWE-434,"ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/controller.php?action=catchimage source[] parameter because of a lack of inc/zzz_file.php restrictions. For example, source%5B%5D=http%3A%2F%2F192.168.0.1%2Ftest.php can be used if the 192.168.0.1 web server sends the contents of a .php file (i.e., it does not interpret a .php file).",2019-03-30,Nuclei,cpe:2.3:a:zzzcms:zzzphp:1.6.3:*:*:*:*:*:*:*,Zzzcms,Zzzphp
CVE-2019-10655,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.15353,CWE-78,"Grandstream GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, and GXV3240 before 1.0.3.219 Beta devices allow unauthenticated remote code execution via shell metacharacters in a /manager?action=getlogcat priority field, in conjunction with a buffer overflow (via the phonecookie cookie) to overwrite a data structure and consequently bypass authentication. This can be exploited remotely or via CSRF because the cookie can be placed in an Accept HTTP header in an XMLHttpRequest call to lighttpd.",2019-03-30,Metasploit,cpe:2.3:h:grandstream:gac2500:-:*:*:*:*:*:*:*;cpe:2.3:h:grandstream:gvc3202:-:*:*:*:*:*:*:*;cpe:2.3:h:grandstream:gxp2200:-:*:*:*:*:*:*:*;cpe:2.3:h:grandstream:gxv3240:-:*:*:*:*:*:*:*;cpe:2.3:h:grandstream:gxv3275:-:*:*:*:*:*:*:*;cpe:2.3:o:grandstream:gac2500_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:grandstream:gvc3202_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:grandstream:gxp2200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:grandstream:gxv3240_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:grandstream:gxv3275_firmware:*:*:*:*:*:*:*:*,Grandstream,Gac2500 Firmware
CVE-2019-10669,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.80662,CWE-78,"An issue was discovered in LibreNMS through 1.47. There is a command injection vulnerability in html/includes/graphs/device/collectd.inc.php where user supplied parameters are filtered with the mysqli_escape_real_string function. This function is not the appropriate function to sanitize command arguments as it does not escape a number of command line syntax characters such as ` (backtick), allowing an attacker to inject commands into the variable $rrd_cmd, which gets executed via passthru().",2019-09-09,Metasploit,cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*,Librenms,Librenms
CVE-2019-1069,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.06117,CWE-59,"An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system.
To exploit the vulnerability, an attacker would require unprivileged code execution on a victim system.
The security update addresses the vulnerability by correctly validating file operations.",2019-06-12,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2019-10692,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.78699,CWE-89,"In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement.",2019-04-02,Metasploit/Nuclei,cpe:2.3:a:codecabin:wp_go_maps:*:*:*:*:*:wordpress:*:*,Codecabin,Wp Go Maps
CVE-2019-10717,0.0,,0.05399,CWE-22,BlogEngine.NET 3.3.7.0 allows /api/filemanager Directory Traversal via the path parameter.,2019-07-03,Nuclei,cpe:2.3:a:dotnetblogengine:blogengine.net:3.3.7.0:*:*:*:*:*:*:*,Dotnetblogengine,Blogengine.Net
CVE-2019-10758,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.84845,NVD-CWE-noinfo,mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.,2019-12-24,CISA/Nuclei,cpe:2.3:a:mongo-express_project:mongo-express:*:*:*:*:*:node.js:*:*,Mongo-Express Project,Mongo-Express
CVE-2019-10867,0.0,,0.69356,CWE-502,"An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.",2019-04-04,Metasploit,cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*,Pimcore,Pimcore
CVE-2019-11001,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.38369,CWE-78,"On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the ""TestEmail"" functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field.",2019-04-08,CISA,cpe:2.3:h:reolink:c1_pro:-:*:*:*:*:*:*:*;cpe:2.3:h:reolink:c2_pro:-:*:*:*:*:*:*:*;cpe:2.3:h:reolink:rlc-410w:-:*:*:*:*:*:*:*;cpe:2.3:h:reolink:rlc-422w:-:*:*:*:*:*:*:*;cpe:2.3:h:reolink:rlc-511w:-:*:*:*:*:*:*:*;cpe:2.3:o:reolink:c1_pro_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:reolink:c2_pro_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:reolink:rlc-410w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:reolink:rlc-422w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:reolink:rlc-511w_firmware:*:*:*:*:*:*:*:*,Reolink,Rlc-410W Firmware
CVE-2019-11013,0.0,,0.23978,CWE-22,Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability. Successful exploitation could allow an attacker to traverse the file system to access files or directories that are outside of the restricted directory on the remote server.,2019-08-22,Nuclei,cpe:2.3:a:softvelum:nimble_streamer:*:*:*:*:*:*:*:*,Softvelum,Nimble Streamer
CVE-2019-11043,8.7,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N,0.9947,CWE-120,"In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.",2019-10-28,CISA/EPSS/Metasploit,cpe:2.3:a:php:php:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*;cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus_compute_node:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.1_aarch64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.2_aarch64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.4_aarch64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.6_aarch64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.8_aarch64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.0_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.7_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.1_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.2_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.7_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.7_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.1_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:8.8:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2019-11231,0.0,,0.71598,CWE-22,"An issue was discovered in GetSimple CMS through 3.3.15. insufficient input sanitation in the theme-edit.php file allows upload of files with arbitrary content (PHP code, for example). This vulnerability is triggered by an authenticated user; however, authentication can be bypassed. According to the official documentation for installation step 10, an admin is required to upload all the files, including the .htaccess files, and run a health check. However, what is overlooked is that the Apache HTTP Server by default no longer enables the AllowOverride directive, leading to data/users/admin.xml password exposure. The passwords are hashed but this can be bypassed by starting with the data/other/authorization.xml API key. This allows one to target the session state, since they decided to roll their own implementation. The cookie_name is crafted information that can be leaked from the frontend (site name and version). If a someone leaks the API key and the admin username, then they can bypass authentication. To do so, they need to supply a cookie based on an SHA-1 computation of this known information. The vulnerability exists in the admin/theme-edit.php file. This file checks for forms submissions via POST requests, and for the csrf nonce. If the nonce sent is correct, then the file provided by the user is uploaded. There is a path traversal allowing write access outside the jailed themes directory root. Exploiting the traversal is not necessary because the .htaccess file is ignored. A contributing factor is that there isn't another check on the extension before saving the file, with the assumption that the parameter content is safe. This allows the creation of web accessible and executable files with arbitrary content.",2019-05-22,Metasploit,cpe:2.3:a:get-simple:getsimple_cms:*:*:*:*:*:*:*:*,Get-Simple,Getsimple Cms
CVE-2019-11248,8.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L,0.61139,CWE-419,"The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.",2019-08-29,Nuclei,cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.0:-:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.0:alpha0:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.0:alpha1:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.0:alpha2:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.0:alpha3:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.0:beta0:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.0:beta1:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.0:beta2:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.0:rc1:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.0:rc2:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.1:-:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.1:beta0:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.2:-:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.2:beta0:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.3:-:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.3:beta0:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.4:-:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.4:beta0:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.5:-:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.5:beta0:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.6:-:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.6:beta0:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.7:-:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.7:beta.0:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.13.8:beta.0:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.14.0:-:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.14.0:alpha0:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.14.0:alpha1:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.14.0:alpha2:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.14.0:alpha3:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.14.0:beta0:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.14.0:beta1:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.14.0:beta2:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.14.0:rc1:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.14.1:-:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.14.1:beta0:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.14.2:-:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.14.2:beta0:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.14.3:-:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.14.3:beta0:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.14.4:beta.0:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.15.0:alpha0:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.15.0:alpha1:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.15.0:alpha2:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.15.0:alpha3:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.15.0:beta0:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.15.0:beta1:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.15.0:beta2:*:*:*:*:*:*;cpe:2.3:a:kubernetes:kubernetes:1.15.0:rc1:*:*:*:*:*:*,Kubernetes,Kubernetes
CVE-2019-11253,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.25939,CWE-20,"Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.",2019-10-17,Nuclei,cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_container_platform:3.10:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_container_platform:3.9:*:*:*:*:*:*:*,Kubernetes,Kubernetes
CVE-2019-1129,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01782,CWE-59,"An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1130.",2019-07-15,CISA,cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1703
CVE-2019-1130,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02284,CWE-59,"An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1129.",2019-07-15,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2019-1132,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.09788,NVD-CWE-noinfo,"An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.",2019-07-15,CISA,cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*,Microsoft,Windows 7
CVE-2019-11370,0.0,,0.03977,CWE-79,"Stored XSS was discovered in Carel pCOWeb prior to B1.2.4, as demonstrated by the config/pw_snmp.html ""System contact"" field.",2019-06-03,Nuclei,cpe:2.3:h:carel:pcoweb_card:-:*:*:*:*:*:*:*;cpe:2.3:o:carel:pcoweb_card_firmware:*:*:*:*:*:*:*:*,Carel,Pcoweb Card Firmware
CVE-2019-11409,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.8748,CWE-78,app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host. This can further lead to remote code execution when combined with an XSS vulnerability also present in the FusionPBX Operator Panel module.,2019-06-17,Metasploit,cpe:2.3:a:fusionpbx:fusionpbx:4.4.3:*:*:*:*:*:*:*,Fusionpbx,Fusionpbx
CVE-2019-11477,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.98745,CWE-190,"Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff.",2019-06-19,EPSS,cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_access_policy_manager:15.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:15.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:15.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:15.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:15.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_domain_name_system:15.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_edge_gateway:15.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_fraud_protection_service:15.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:15.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:15.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:15.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:15.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:15.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:traffix_signaling_delivery_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:-:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:-:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_secure_virtual_application_delivery_controller:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:enterprise_linux_atomic_host:-:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_aus:6.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_aus:6.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2019-11507,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.04055,CWE-79,"In Pulse Secure Pulse Connect Secure (PCS) 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3, an XSS issue has been found on the Application Launcher page.",2019-05-08,Nuclei,cpe:2.3:a:ivanti:connect_secure:8.3:r1.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r5.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r5.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r6.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r6:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r7:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:*,Ivanti,Connect Secure
CVE-2019-11510,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.99999,CWE-22,"In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .",2019-05-08,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:ivanti:connect_secure:8.2:r1.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r1.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r10.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r11.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r12.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r2.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r3.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r3.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r4.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r4.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r5.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r5.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r6.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r7.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r7.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r8.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r8.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r8.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r9.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r5.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r5.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r6.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r6:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r7:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3:*:*:*:*:*:*,Ivanti,Connect Secure
CVE-2019-11539,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.98617,CWE-78,"In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.",2019-04-26,CISA/EPSS/Metasploit,cpe:2.3:a:ivanti:connect_secure:8.1:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.1:r1.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.1:r1.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.1:r10.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.1:r11.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.1:r11.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.1:r12.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.1:r12.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.1:r13.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.1:r14.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.1:r2.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.1:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.1:r3.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.1:r3.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.1:r3.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.1:r4.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.1:r4.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.1:r5.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.1:r6.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.1:r7.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.1:r7:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.1:r8.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.1:r9.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.1:r9.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.1:r9.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r1.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r1.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r10.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r11.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r12.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r2.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r3.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r3.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r4.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r4.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r5.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r5.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r6.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r7.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r7.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r7.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r8.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r8.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r8.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.2:r9.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r1.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r5.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r5.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r6.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r6:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:8.3:r7:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.0:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.0:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.0:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.0:r3.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.0:r3:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r1.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r1.1:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r10.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r11.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r11.1:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r12.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r12.1:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r13.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r14.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r2.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r2.1:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r3.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r3.2:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r4.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r5.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r6.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r7.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r8.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r9.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r9.1:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r1.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r10.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r11.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r2.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r3.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r3.2:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r4.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r5.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r6.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r7.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r7.1:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r8.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r9.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r9.1:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2rx:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r1.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r1.1:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r10.:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r11.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r12.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r2.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r3.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r3.1:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r4.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r4.1:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r5.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r5.1:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r5.2:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r6.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r7.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r8.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r8.1:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r8.2:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r9.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3rx:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4r1:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4r2.1:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4r2:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4r3:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4r4:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4r5.2:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4r5:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4r6.1:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4r6:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4r7:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4rx:*:*:*:*:*:*:*,Ivanti,Connect Secure
CVE-2019-11580,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.95355,NVD-CWE-noinfo,"Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x), from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x), from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x), from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x), and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.",2019-06-03,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*,Atlassian,Crowd
CVE-2019-11581,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.84621,CWE-74,"There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.",2019-08-09,CISA/Nuclei,cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*,Atlassian,Jira Server
CVE-2019-11634,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.08091,NVD-CWE-noinfo,Citrix Workspace App before 1904 for Windows has Incorrect Access Control.,2019-05-22,CISA,cpe:2.3:a:citrix:receiver:4.9:cumulative_update_6:*:*:windows:*:*:*;cpe:2.3:a:citrix:workspace:*:*:*:*:*:windows:*:*,Citrix,Receiver
CVE-2019-11660,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.07847,CWE-426,"Privileges manipulation in Micro Focus Data Protector, versions 10.00, 10.01, 10.02, 10.03, 10.04, 10.10, 10.20, 10.30, 10.40. This vulnerability could be exploited by a low-privileged user to execute a custom binary with higher privileges.",2019-09-13,Metasploit,cpe:2.3:a:microfocus:data_protector:*:*:*:*:*:*:*:*,Microfocus,Data Protector
CVE-2019-11707,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.37951,CWE-843,"A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.",2019-07-23,CISA,cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*;cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*,Mozilla,Firefox
CVE-2019-11708,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.55874,CWE-20,"Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.",2019-07-23,CISA,cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*;cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*,Mozilla,Firefox
CVE-2019-11869,0.0,,0.05331,CWE-79,"The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes from an admin user (it actually only verifies that the request is for an admin page). An unauthenticated attacker can inject a payload into the plugin settings, such as the yuzo_related_post_css_and_style setting.",2019-05-09,Nuclei,cpe:2.3:a:yuzopro:yuzo:5.12.94:*:*:*:*:wordpress:*:*,Yuzopro,Yuzo
CVE-2019-11886,0.0,,0.0189,CWE-352,"The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstrated by use of yp_remote_get to obtain admin access.",2019-05-13,Nuclei,cpe:2.3:a:yellowpencil:visual_css_style_editor:*:*:*:*:*:wordpress:*:*,Yellowpencil,Visual Css Style Editor
CVE-2019-1214,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01419,NVD-CWE-noinfo,"An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common Log File System Driver Elevation of Privilege Vulnerability'.",2019-09-11,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2019-1215,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.19254,NVD-CWE-noinfo,"An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1253, CVE-2019-1278, CVE-2019-1303.",2019-09-11,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2019-12169,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.73317,CWE-22,"ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal, resulting in remote code execution via a "".."" pathname in a ZIP archive to the mods/_core/languages/language_import.php (aka Import New Language) or mods/_standard/patcher/index_admin.php (aka Patcher) component.",2019-06-03,Metasploit,cpe:2.3:a:atutor:atutor:*:*:*:*:*:*:*:*,Atutor,Atutor
CVE-2019-12181,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.65981,CWE-78,A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux.,2019-06-17,Metasploit,cpe:2.3:a:solarwinds:serv-u_ftp_server:*:*:*:*:*:linux:*:*;cpe:2.3:a:solarwinds:serv-u_mft_server:*:*:*:*:*:linux:*:*,Solarwinds,Serv-U Ftp Server
CVE-2019-12258,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.23354,CWE-384,Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP options.,2019-08-09,Metasploit,cpe:2.3:h:belden:garrettcom_magnum_dx940e:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_dragon_mach4000:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_dragon_mach4500:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_eagle20:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_eagle30:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_eagle_one:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_ees20:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_ees25:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_eesx20:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_eesx30:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_grs1020:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_grs1030:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_grs1042:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_grs1120:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_grs1130:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_grs1142:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_msp30:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_msp32:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_msp40:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_octopus_os3:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_rail_switch_power_lite:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_rail_switch_power_smart:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_red25:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_rsp20:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_rsp25:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_rsp30:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_rsp35:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_rspe30:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_rspe32:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_rspe35:-:*:*:*:*:*:*:*;cpe:2.3:h:belden:hirschmann_rspe37:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:power_meter_9410:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:power_meter_9810:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:ruggedcom_win7000:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:ruggedcom_win7018:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:ruggedcom_win7025:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:ruggedcom_win7200:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:siprotec_5:-:*:*:*:*:*:*:*;cpe:2.3:o:belden:garrettcom_magnum_dx940e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:belden:hirschmann_hios:*:*:*:*:*:*:*:*;cpe:2.3:o:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:power_meter_9410_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:power_meter_9810_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:ruggedcom_win7000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:ruggedcom_win7018_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:ruggedcom_win7025_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:ruggedcom_win7200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:siprotec_5_firmware:*:*:*:*:*:*:*:cp200;cpe:2.3:o:siemens:siprotec_5_firmware:*:*:*:*:*:*:*:cp300;cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sonicos:6.2.7.0:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sonicos:6.2.7.1:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sonicos:6.2.7.7:*:*:*:*:*:*:*;cpe:2.3:o:windriver:vxworks:*:*:*:*:*:*:*:*;cpe:2.3:o:windriver:vxworks:7.0:-:*:*:*:*:*:*,Siemens,Siprotec 5 Firmware
CVE-2019-12276,0.0,,0.53705,CWE-22,"A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests. A patch for this issue was made on 2019-05-30 in GrandNode 4.40.",2019-06-05,Nuclei,cpe:2.3:a:grandnode:grandnode:4.40:*:*:*:*:*:*:*,Grandnode,Grandnode
CVE-2019-12314,0.0,,0.8422,CWE-22,"Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as demonstrated by a cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS/etc/passwd URI.",2019-05-24,Nuclei,cpe:2.3:a:deltek:maconomy:2.2.5:*:*:*:*:*:*:*,Deltek,Maconomy
CVE-2019-12461,0.0,,0.09916,CWE-79,Web Port 1.19.1 allows XSS via the /log type parameter.,2019-05-30,Nuclei,cpe:2.3:a:webport:web_port:1.19.1:*:*:*:*:*:*:*,Webport,Web Port
CVE-2019-12477,0.0,,0.13318,CWE-22,"Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a local attacker to broadcast fake video without any authentication via a /remote/media_control?action=setUri&uri= URI.",2019-06-07,Metasploit,cpe:2.3:h:supra:stv-lc40lt0020f:-:*:*:*:*:*:*:*;cpe:2.3:o:supra:stv-lc40lt0020f_firmware:-:*:*:*:*:*:*:*,Supra,Stv-Lc40Lt0020F Firmware
CVE-2019-12518,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.50738,CWE-120,Anviz CrossChex access control management software 4.3.8.0 and 4.3.12 is vulnerable to a buffer overflow vulnerability.,2019-12-02,Metasploit,cpe:2.3:a:anviz:crosschex:4.3.12:*:*:*:*:*:*:*;cpe:2.3:a:anviz:crosschex:4.3.8.0:*:*:*:*:*:*:*,Anviz,Crosschex
CVE-2019-1253,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.11616,NVD-CWE-noinfo,"An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1215, CVE-2019-1278, CVE-2019-1303.",2019-09-11,CISA,cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1703
CVE-2019-12581,0.0,,0.064,CWE-79,"A reflective Cross-site scripting (XSS) vulnerability in the free_time_failed.cgi CGI program in selected Zyxel ZyWall, USG, and UAG devices allows remote attackers to inject arbitrary web script or HTML via the err_msg parameter.",2019-06-27,Nuclei,cpe:2.3:h:zyxel:uag2100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:uag4100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:uag5100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg1100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg110:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg1900:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg210:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg2200-vpn:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg310:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:uag2100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:uag4100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:uag5100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg1100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg110_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg1900_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg210_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg2200-vpn_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg310_firmware:*:*:*:*:*:*:*:*,Zyxel,Uag2100 Firmware
CVE-2019-12583,0.0,,0.43926,CWE-425,"Missing Access Control in the ""Free Time"" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service.",2019-06-27,Nuclei,cpe:2.3:h:zyxel:uag2100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:uag4100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:uag5100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg1100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg110:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg1900:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg210:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg2200-vpn:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg310:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_1100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_110:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_310:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_vpn100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_vpn300:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:uag2100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:uag4100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:uag5100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg1100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg110_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg1900_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg210_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg2200-vpn_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg310_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_1100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_110_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_310_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_vpn100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_vpn300_firmware:*:*:*:*:*:*:*:*,Zyxel,Uag2100 Firmware
CVE-2019-12593,0.0,,0.40965,CWE-22,IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c directory traversal.,2019-06-03,Nuclei,cpe:2.3:a:icewarp:mail_server:*:*:*:*:*:*:*:*,Icewarp,Mail Server
CVE-2019-12725,0.0,,0.89849,CWE-78,"Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters.",2019-07-19,Nuclei,cpe:2.3:o:zeroshell:zeroshell:3.9.0:*:*:*:*:*:*:*,Zeroshell,Zeroshell
CVE-2019-12780,0.0,,0.71992,CWE-78,The Belkin Wemo Enabled Crock-Pot allows command injection in the Wemo UPnP API via the SmartDevURL argument to the SetSmartDevInfo action. A simple POST request to /upnp/control/basicevent1 can allow an attacker to execute commands without authentication.,2019-06-10,Metasploit,cpe:2.3:h:belkin:crock-pot_smart_slow_cooker_with_wemo:-:*:*:*:*:*:*:*;cpe:2.3:o:belkin:crock-pot_smart_slow_cooker_with_wemo_firmware:-:*:*:*:*:*:*:*,Belkin,Crock-Pot Smart Slow Cooker With Wemo Firmware
CVE-2019-12799,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.54681,CWE-502,"In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution. NOTE: this issue is a bypass for a CVE-2017-18357 whitelist patch.",2019-06-13,Metasploit,cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*,Shopware,Shopware
CVE-2019-12840,0.0,,0.77835,CWE-78,"In Webmin through 1.910, any user authorized to the ""Package Updates"" module can execute arbitrary commands with root privileges via the data parameter to update.cgi.",2019-06-15,Metasploit,cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*,Webmin,Webmin
CVE-2019-12928,0.0,,0.23036,CWE-78,"The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users. If one is able to access this interface via a tcp socket open to the internet, then it is an insecure configuration issue",2019-06-24,Metasploit,cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*,Qemu,Qemu
CVE-2019-12935,0.0,,0.02734,CWE-79,Shopware before 5.5.8 has XSS via the Query String to the backend/Login or backend/Login/load/ URI.,2019-06-23,Nuclei,cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*,Shopware,Shopware
CVE-2019-12962,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.09052,CWE-79,LiveZilla Server before 8.0.1.1 is vulnerable to XSS in mobile/index.php via the Accept-Language HTTP header.,2019-06-25,Nuclei,cpe:2.3:a:livezilla:livezilla:*:*:*:*:*:*:*:*,Livezilla,Livezilla
CVE-2019-1297,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.21805,NVD-CWE-noinfo,"A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.",2019-09-11,CISA,cpe:2.3:a:microsoft:excel:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:excel:2013:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:excel:2013:sp1:*:*:rt:*:*:*;cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2016:*:*:*:*:macos:*:*;cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2019:*:*:*:*:macos:*:*;cpe:2.3:a:microsoft:office_365_proplus:-:*:*:*:*:*:*:*,Microsoft,Excel
CVE-2019-12985,0.0,,0.39544,CWE-78,Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 1 of 6).,2019-07-16,Nuclei,cpe:2.3:a:citrix:netscaler_sd-wan:*:*:*:*:*:*:*:*;cpe:2.3:a:citrix:sd-wan:*:*:*:*:*:*:*:*,Citrix,Netscaler Sd-Wan
CVE-2019-12986,0.0,,0.39544,CWE-78,Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 2 of 6).,2019-07-16,Nuclei,cpe:2.3:a:citrix:netscaler_sd-wan:*:*:*:*:*:*:*:*;cpe:2.3:a:citrix:sd-wan:*:*:*:*:*:*:*:*,Citrix,Netscaler Sd-Wan
CVE-2019-12987,0.0,,0.42551,CWE-78,Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 3 of 6).,2019-07-16,Nuclei,cpe:2.3:a:citrix:netscaler_sd-wan:*:*:*:*:*:*:*:*;cpe:2.3:a:citrix:sd-wan:*:*:*:*:*:*:*:*,Citrix,Netscaler Sd-Wan
CVE-2019-12988,0.0,,0.42551,CWE-78,Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 4 of 6).,2019-07-16,Nuclei,cpe:2.3:a:citrix:netscaler_sd-wan:*:*:*:*:*:*:*:*;cpe:2.3:a:citrix:sd-wan:*:*:*:*:*:*:*:*,Citrix,Netscaler Sd-Wan
CVE-2019-12989,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.94131,CWE-89,Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.,2019-07-16,CISA/Nuclei,cpe:2.3:a:citrix:netscaler_sd-wan:*:*:*:*:*:*:*:*;cpe:2.3:a:citrix:sd-wan:*:*:*:*:*:*:*:*,Citrix,Netscaler Sd-Wan
CVE-2019-12990,0.0,,0.39335,CWE-22,Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow Directory Traversal.,2019-07-16,Nuclei,cpe:2.3:a:citrix:netscaler_sd-wan:*:*:*:*:*:*:*:*;cpe:2.3:a:citrix:sd-wan:*:*:*:*:*:*:*:*,Citrix,Netscaler Sd-Wan
CVE-2019-12991,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.74052,CWE-78,Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).,2019-07-16,CISA,cpe:2.3:a:citrix:netscaler_sd-wan:*:*:*:*:*:*:*:*;cpe:2.3:a:citrix:sd-wan:*:*:*:*:*:*:*:*,Citrix,Netscaler Sd-Wan
CVE-2019-13101,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.67091,CWE-306,"An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and can also be leveraged by an attacker to modify the data fields of the page.",2019-08-08,Nuclei,cpe:2.3:h:dlink:dir-600m:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-600m_firmware:3.02:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-600m_firmware:3.03:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-600m_firmware:3.04:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-600m_firmware:3.06:*:*:*:*:*:*:*,D-Link,Dir-600M Firmware
CVE-2019-1315,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03478,CWE-59,"An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manager Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1339, CVE-2019-1342.",2019-10-10,CISA,cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1607
CVE-2019-1322,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.19205,NVD-CWE-noinfo,"An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1320, CVE-2019-1340.",2019-10-10,CISA/Metasploit,cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1803
CVE-2019-13272,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.52199,NVD-CWE-noinfo,"In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.",2019-07-17,CISA/Metasploit,cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*;cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:service_processor:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:aff_a700s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:netapp:aff_a700s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_arm_64:7.0_aarch64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_real_time:8:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv_tus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv_tus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv_tus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv_tus:8.8:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_real_time_tus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_real_time_tus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_real_time_tus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_real_time_tus:8.8:*:*:*:*:*:*:*,Netapp,Aff A700S Firmware
CVE-2019-13372,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.8249,CWE-94,"/web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to execute arbitrary PHP code via a cookie because a cookie's username field allows eval injection, and an empty password bypasses authentication.",2019-07-06,Metasploit/Nuclei,cpe:2.3:a:dlink:central_wifimanager:*:*:*:*:*:*:*:*,D-Link,Central Wifimanager
CVE-2019-13373,0.0,,0.68019,CWE-89,An issue was discovered in the D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6. Input does not get validated and arbitrary SQL statements can be executed in the database via the /web/Public/Conn.php parameter dbSQL.,2019-07-06,Metasploit,cpe:2.3:a:dlink:central_wifimanager:1.03:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2019-13392,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.04019,CWE-79,"A reflected Cross-Site Scripting (XSS) vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that this array is keyed via integers by default, so any string input will be invalid.",2019-10-16,Nuclei,cpe:2.3:a:mindpalette:natemail:3.0.15:*:*:*:*:*:*:*,Mindpalette,Natemail
CVE-2019-13396,0.0,,0.62572,CWE-22,FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an index.php?q=system-handle-form-submit POST request because of an include_once in system_handle_form_submit in modules/system/system.module.,2019-07-10,Nuclei,cpe:2.3:a:getflightpath:flightpath:*:*:*:*:*:*:*:*;cpe:2.3:a:getflightpath:flightpath:5.0:beta1:*:*:*:*:*:*;cpe:2.3:a:getflightpath:flightpath:5.0:beta2:*:*:*:*:*:*;cpe:2.3:a:getflightpath:flightpath:5.0:dev1:*:*:*:*:*:*;cpe:2.3:a:getflightpath:flightpath:5.0:dev2:*:*:*:*:*:*;cpe:2.3:a:getflightpath:flightpath:5.0:rc1:*:*:*:*:*:*;cpe:2.3:a:getflightpath:flightpath:5.0:rc2:*:*:*:*:*:*;cpe:2.3:a:getflightpath:flightpath:5.0:rc3:*:*:*:*:*:*,Getflightpath,Flightpath
CVE-2019-13462,0.0,,0.1131,CWE-89,Lansweeper before 7.1.117.4 allows unauthenticated SQL injection.,2019-08-12,Nuclei,cpe:2.3:a:lansweeper:lansweeper:*:*:*:*:*:*:*:*,Lansweeper,Lansweeper
CVE-2019-13608,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.30041,CWE-611,"Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.",2019-08-29,CISA/Nuclei,cpe:2.3:a:citrix:storefront_server:*:*:*:*:*:*:*:*,Citrix,Storefront Server
CVE-2019-1367,7.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.52729,CWE-787,"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1221.",2019-09-23,CISA,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows Server 2012
CVE-2019-13720,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.72977,CWE-416,Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2019-11-25,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*,Opensuse,Leap
CVE-2019-1385,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03595,CWE-59,"An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.To exploit this vulnerability, an authenticated attacker would need to run a specially crafted application to elevate privileges.The security update addresses the vulnerability by correcting how AppX Deployment Extensions manages privileges., aka 'Windows AppX Deployment Extensions Elevation of Privilege Vulnerability'.",2019-11-12,CISA,cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1709
CVE-2019-1388,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.08589,CWE-269,"An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Dialog Elevation of Privilege Vulnerability'.",2019-11-12,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:1803:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2019-1405,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.2995,NVD-CWE-noinfo,"An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'.",2019-11-12,CISA/Metasploit,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2019-14205,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.63375,CWE-22,A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via the $REQUEST['adaptive-images-settings']['source_file'] parameter in adaptive-images-script.php.,2019-07-21,Nuclei,cpe:2.3:a:nevma:adaptive_images:*:*:*:*:*:wordpress:*:*,Nevma,Adaptive Images
CVE-2019-14206,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N,0.04728,CWE-22,An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to delete arbitrary files via the $REQUEST['adaptive-images-settings'] parameter in adaptive-images-script.php.,2019-07-21,Nuclei,cpe:2.3:a:nevma:adaptive_images:*:*:*:*:*:wordpress:*:*,Nevma,Adaptive Images
CVE-2019-14223,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.04474,CWE-601,"An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and 6.1.N. The Alfresco Share application is vulnerable to an Open Redirect attack via a crafted POST request. By manipulating the POST parameters, an attacker can redirect a victim to a malicious website over any protocol the attacker desires (e.g.,http, https, ftp, smb, etc.).",2019-09-06,Nuclei,cpe:2.3:a:alfresco:alfresco:*:*:*:*:community:*:*:*;cpe:2.3:a:alfresco:alfresco:6.0:*:*:*:community:*:*:*;cpe:2.3:a:alfresco:alfresco:6.1:*:*:*:community:*:*:*,Alfresco,Alfresco
CVE-2019-14251,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.07849,CWE-22,"An issue was discovered in T24 in TEMENOS Channels R15.01. The login page presents JavaScript functions to access a document on the server once successfully authenticated. However, an attacker can leverage downloadDocServer() to traverse the file system and access files or directories that are outside of the restricted directory because WealthT24/GetImage is used with the docDownloadPath and uploadLocation parameters.",2019-12-09,Nuclei,cpe:2.3:a:temenos:t24:r15.01:*:*:*:*:*:*:*,Temenos,T24
CVE-2019-1429,7.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.72626,CWE-416,"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1426, CVE-2019-1427, CVE-2019-1428.",2019-11-12,CISA,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows Server 2008
CVE-2019-14312,0.0,,0.20586,CWE-22,Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. This vulnerability allows a remote attacker to read internal files on the server via a tools/sourceViewer/index.html?filename=../ URI.,2019-08-09,Nuclei,cpe:2.3:a:aptana:jaxer:1.0.3.4547:*:*:*:*:*:*:*,Aptana,Jaxer
CVE-2019-14322,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.55526,CWE-22,"In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.",2019-07-28,Nuclei,cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2019-14470,0.0,,0.82962,CWE-79,"cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_description parameter.",2019-09-04,Nuclei,cpe:2.3:a:instagram-php-api_project:instagram-php-api:-:*:*:*:*:*:*:*;cpe:2.3:a:userproplugin:user_pro:*:*:*:*:*:wordpress:*:*,Instagram-Php-Api Project,Instagram-Php-Api
CVE-2019-14530,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.66891,CWE-22,"An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (that is readable by the user www-data) from server storage. If the requested file is writable for the www-data user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, it will be deleted from server.",2019-08-13,Nuclei,cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*,Open-Emr,Openemr
CVE-2019-1458,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.73856,NVD-CWE-noinfo,"An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.",2019-12-10,CISA/Metasploit,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2019-14696,0.0,,0.15682,CWE-79,"Open-School 3.0, and Community Edition 2.3, allows XSS via the osv/index.php?r=students/guardians/create id parameter.",2019-08-06,Nuclei,cpe:2.3:a:open-school:open-school:2.3:*:*:*:community:*:*:*;cpe:2.3:a:open-school:open-school:3.0:*:*:*:-:*:*:*,Open-School,Open-School
CVE-2019-14750,0.0,,0.11687,CWE-79,An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the execution of those queries. This can further lead to cookie stealing or other malicious actions.,2019-08-07,Nuclei,cpe:2.3:a:enhancesoft:osticket:*:*:*:*:*:*:*:*,Enhancesoft,Osticket
CVE-2019-14789,0.0,,0.01611,CWE-79,The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter.,2019-08-15,Nuclei,cpe:2.3:a:kunalnagar:custom_404_pro:3.2.8:*:*:*:*:wordpress:*:*,Kunalnagar,Custom 404 Pro
CVE-2019-14950,0.0,,0.01211,CWE-79,The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.,2019-08-12,Nuclei,cpe:2.3:a:3cx:live_chat:*:*:*:*:*:wordpress:*:*,3Cx,Live Chat
CVE-2019-14974,0.0,,0.31043,CWE-79,SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS.,2019-08-14,Nuclei,cpe:2.3:a:sugarcrm:sugarcrm:9.0.0:*:*:*:enterprise:*:*:*,Sugarcrm,Sugarcrm
CVE-2019-15043,0.0,,0.63388,CWE-306,"In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana.",2019-09-03,Nuclei,cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*,Grafana,Grafana
CVE-2019-15107,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99766,CWE-78,An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.,2019-08-16,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*,Webmin,Webmin
CVE-2019-15271,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.05979,CWE-502,"A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web-based management interface of the targeted device. A successful exploit could allow the attacker to execute commands with root privileges.",2019-11-26,CISA,cpe:2.3:h:cisco:rv016_multi-wan_vpn:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv042_dual_wan_vpn:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv042g_dual_gigabit_wan_vpn:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv082_dual_wan_vpn:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv016_multi-wan_vpn_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv042_dual_wan_vpn_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv042g_dual_gigabit_wan_vpn_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv082_dual_wan_vpn_firmware:*:*:*:*:*:*:*:*,Cisco,Rv016 Multi-Wan Vpn Firmware
CVE-2019-15501,0.0,,0.08182,CWE-79,Reflected cross site scripting (XSS) in L-Soft LISTSERV before 16.5-2018a exists via the /scripts/wa.exe OK parameter.,2019-08-26,Nuclei,cpe:2.3:a:lsoft:listserv:*:*:*:*:*:*:*:*,Lsoft,Listserv
CVE-2019-15642,0.0,,0.38038,CWE-94,"rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call. NOTE: the Webmin_Servers_Index documentation states ""RPC can be used to run any command or modify any file on a server, which is why access to it must not be granted to un-trusted Webmin users.""",2019-08-26,Nuclei,cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*,Webmin,Webmin
CVE-2019-15713,0.0,,0.02542,CWE-79,The my-calendar plugin before 3.1.10 for WordPress has XSS.,2019-08-28,Nuclei,cpe:2.3:a:my_calendar_project:my_calendar:*:*:*:*:*:wordpress:*:*,My Calendar Project,My Calendar
CVE-2019-15742,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.04979,NVD-CWE-noinfo,A local privilege-escalation vulnerability exists in the Poly Plantronics Hub before 3.14 for Windows client application. A local attacker can exploit this issue to gain elevated privileges.,2020-01-17,Metasploit,cpe:2.3:a:plantronics:plantronics_hub:*:*:*:*:*:windows:*:*,Plantronics,Plantronics Hub
CVE-2019-15752,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.29628,CWE-732,"Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restart Docker, or run 'docker login' to force the command.",2019-08-28,CISA/Metasploit,cpe:2.3:a:apache:geode:1.12.0:*:*:*:*:*:*:*;cpe:2.3:a:docker:docker:*:*:*:*:community:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2019-15774,0.0,,0.01731,CWE-601,The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.,2019-08-29,Nuclei,cpe:2.3:a:booking_project:booking:*:*:*:*:*:wordpress:*:*,Booking Project,Booking
CVE-2019-1579,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.39317,CWE-134,"Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.",2019-07-19,CISA,cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*,Paloaltonetworks,Pan-Os
CVE-2019-15811,0.0,,0.06395,CWE-79,"In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS.",2019-08-29,Nuclei,cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:*,Domainmod,Domainmod
CVE-2019-15823,0.0,,0.08584,NVD-CWE-noinfo,The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.,2019-08-30,Nuclei,cpe:2.3:a:wpserveur:wps_hide_login:*:*:*:*:*:wordpress:*:*,Wpserveur,Wps Hide Login
CVE-2019-15829,0.0,,0.01318,CWE-79,The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS.,2019-08-30,Nuclei,cpe:2.3:a:greentreelabs:gallery_photoblocks:*:*:*:*:*:wordpress:*:*,Greentreelabs,Gallery Photoblocks
CVE-2019-15858,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.20813,CWE-306,"admin/includes/class.import.snippet.php in the ""Woody ad snippets"" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.",2019-09-03,Nuclei,cpe:2.3:a:webcraftic:woody_ad_snippets:*:*:*:*:*:wordpress:*:*,Webcraftic,Woody Ad Snippets
CVE-2019-15859,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.34113,CWE-200,Password disclosure in the web interface on socomec DIRIS A-40 devices before 48250501 allows a remote attacker to get full access to a device via the /password.jsn URI.,2019-10-09,Nuclei,cpe:2.3:h:socomec:diris_a-40:-:*:*:*:*:*:*:*;cpe:2.3:o:socomec:diris_a-40_firmware:*:*:*:*:*:*:*:*,Socomec,Diris A-40 Firmware
CVE-2019-15889,0.0,,0.12531,CWE-79,"The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] parameter.",2019-09-03,Nuclei,cpe:2.3:a:w3eden:download_manager:*:*:*:*:*:wordpress:*:*,W3Eden,Download Manager
CVE-2019-15949,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.77741,CWE-78,"Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile (profile.php?cmd=download), is executed as root via a passwordless sudo entry; the script executes check_plugin, which is owned by the nagios user. A user logged into Nagios XI with permissions to modify plugins, or the nagios user on the server, can modify the check_plugin executable and insert malicious commands to execute as root.",2019-09-05,CISA/Metasploit,cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*,Nagios,Nagios Xi
CVE-2019-15954,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.79204,CWE-862,"An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution (RCE) on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of evaluating the tag by the back-end, it is possible to escape the sandbox object by using the following payload: <script total>global.process.mainModule.require(child_process).exec(RCE);</script>",2019-09-05,Metasploit,cpe:2.3:a:totaljs:total.js_cms:12.0.0:*:*:*:*:*:*:*,Totaljs,Total.Js Cms
CVE-2019-15975,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.85649,CWE-798,"Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.",2020-01-06,Metasploit,cpe:2.3:a:cisco:data_center_network_manager:*:*:*:*:*:*:*:*,Cisco,Data Center Network Manager
CVE-2019-16057,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.8721,CWE-78,The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.,2019-09-16,CISA/Nuclei,cpe:2.3:h:dlink:dns-320:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-320_firmware:*:*:*:*:*:*:*:*,D-Link,Dns-320 Firmware
CVE-2019-16072,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.25279,CWE-78,An OS command injection vulnerability in the discover_and_manage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows an attacker to execute arbitrary code because of improper neutralization of shell metacharacters in the ip_address variable within an snmp_browser action.,2020-03-20,Nuclei,cpe:2.3:a:netsas:enigma_network_management_solution:*:*:*:*:*:*:*:*,Netsas,Enigma Network Management Solution
CVE-2019-16097,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N,0.23284,CWE-862,"core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix: configure Harbor to use non-DB authentication backend such as LDAP.",2019-09-08,Nuclei,cpe:2.3:a:linuxfoundation:harbor:1.7.0:-:*:*:*:*:*:*;cpe:2.3:a:linuxfoundation:harbor:1.7.0:rc1:*:*:*:*:*:*;cpe:2.3:a:linuxfoundation:harbor:1.7.0:rc2:*:*:*:*:*:*;cpe:2.3:a:linuxfoundation:harbor:1.7.1:*:*:*:*:*:*:*;cpe:2.3:a:linuxfoundation:harbor:1.7.2:*:*:*:*:*:*:*;cpe:2.3:a:linuxfoundation:harbor:1.7.3:*:*:*:*:*:*:*;cpe:2.3:a:linuxfoundation:harbor:1.7.4:*:*:*:*:*:*:*;cpe:2.3:a:linuxfoundation:harbor:1.7.5:*:*:*:*:*:*:*;cpe:2.3:a:linuxfoundation:harbor:1.8.0:-:*:*:*:*:*:*;cpe:2.3:a:linuxfoundation:harbor:1.8.0:rc1:*:*:*:*:*:*;cpe:2.3:a:linuxfoundation:harbor:1.8.0:rc2:*:*:*:*:*:*;cpe:2.3:a:linuxfoundation:harbor:1.8.1:*:*:*:*:*:*:*;cpe:2.3:a:linuxfoundation:harbor:1.8.2:-:*:*:*:*:*:*;cpe:2.3:a:linuxfoundation:harbor:1.8.2:rc1:*:*:*:*:*:*;cpe:2.3:a:linuxfoundation:harbor:1.8.2:rc2:*:*:*:*:*:*;cpe:2.3:a:linuxfoundation:harbor:1.9.0:rc1:*:*:*:*:*:*,Linuxfoundation,Harbor
CVE-2019-16113,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.77962,CWE-22,"Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname.",2019-09-08,Metasploit,cpe:2.3:a:bludit:bludit:3.9.2:*:*:*:*:*:*:*,Bludit,Bludit
CVE-2019-16123,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.16484,CWE-22,"In Kartatopia PilusCart 1.4.1, the parameter filename in the file catalog.php is mishandled, leading to ../ Local File Disclosure.",2019-09-09,Nuclei,cpe:2.3:a:kartatopia:piluscart:*:*:*:*:*:*:*:*,Kartatopia,Piluscart
CVE-2019-1619,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.82815,CWE-284,"A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. The vulnerability is due to improper session management on affected DCNM software. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to gain administrative access on the affected device.",2019-06-27,Metasploit,cpe:2.3:a:cisco:data_center_network_manager:10.4\(2\):*:*:*:*:*:*:*,Cisco,Data Center Network Manager
CVE-2019-1620,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.8378,CWE-264,"A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to upload arbitrary files on an affected device. The vulnerability is due to incorrect permission settings in affected DCNM software. An attacker could exploit this vulnerability by uploading specially crafted data to the affected device. A successful exploit could allow the attacker to write arbitrary files on the filesystem and execute code with root privileges on the affected device.",2019-06-27,Metasploit,cpe:2.3:a:cisco:data_center_network_manager:11.0\(1\):*:*:*:*:*:*:*,Cisco,Data Center Network Manager
CVE-2019-1621,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.29816,CWE-264,"A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to gain access to sensitive files on an affected device. The vulnerability is due to incorrect permissions settings on affected DCNM software. An attacker could exploit this vulnerability by connecting to the web-based management interface of an affected device and requesting specific URLs. A successful exploit could allow the attacker to download arbitrary files from the underlying filesystem of the affected device.",2019-06-27,Metasploit,cpe:2.3:a:cisco:data_center_network_manager:11.0\(1\):*:*:*:*:*:*:*,Cisco,Data Center Network Manager
CVE-2019-1622,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.78858,CWE-284,"A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. The vulnerability is due to improper access controls for certain URLs on affected DCNM software. An attacker could exploit this vulnerability by connecting to the web-based management interface of an affected device and requesting specific URLs. A successful exploit could allow the attacker to download log files and diagnostic information from the affected device.",2019-06-27,Metasploit,cpe:2.3:a:cisco:data_center_network_manager:11.0\(1\):*:*:*:*:*:*:*,Cisco,Data Center Network Manager
CVE-2019-16256,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04949,NVD-CWE-noinfo,"Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker.",2019-09-12,CISA,cpe:2.3:a:trustedconnectivityalliance:s\@t_browser:-:*:*:*:*:*:*:*,Trustedconnectivityalliance,S@T Browser
CVE-2019-16278,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99057,CWE-22,Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.,2019-10-14,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:nazgul:nostromo_nhttpd:*:*:*:*:*:*:*:*,Nazgul,Nostromo Nhttpd
CVE-2019-16313,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.47034,CWE-798,ifw8 Router ROM v4.31 allows credential disclosure by reading the action/usermanager.htm HTML source code.,2019-09-14,Nuclei,cpe:2.3:h:ifw8:fr5-e:-:*:*:*:*:*:*:*;cpe:2.3:h:ifw8:fr5:-:*:*:*:*:*:*:*;cpe:2.3:h:ifw8:fr6-s:-:*:*:*:*:*:*:*;cpe:2.3:h:ifw8:fr6:-:*:*:*:*:*:*:*;cpe:2.3:h:ifw8:fr8:-:*:*:*:*:*:*:*;cpe:2.3:o:ifw8:fr5-e_firmware:4.31:*:*:*:*:*:*:*;cpe:2.3:o:ifw8:fr5_firmware:4.31:*:*:*:*:*:*:*;cpe:2.3:o:ifw8:fr6-s_firmware:4.31:*:*:*:*:*:*:*;cpe:2.3:o:ifw8:fr6_firmware:4.31:*:*:*:*:*:*:*;cpe:2.3:o:ifw8:fr8_firmware:4.31:*:*:*:*:*:*:*,Ifw8,Fr6 Firmware
CVE-2019-16328,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N,0.13049,CWE-1321,"In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.",2019-10-03,Metasploit,cpe:2.3:a:rpyc_project:rpyc:*:*:*:*:*:*:*:*,Rpyc Project,Rpyc
CVE-2019-16332,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.05698,CWE-79,"In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS.",2019-09-15,Nuclei,cpe:2.3:a:api_bearer_auth_project:api_bearer_auth:*:*:*:*:*:wordpress:*:*,Api Bearer Auth Project,Api Bearer Auth
CVE-2019-16469,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.17186,CWE-917,"Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have an expression language injection vulnerability. Successful exploitation could lead to sensitive information disclosure.",2020-01-15,Nuclei,cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*,Adobe,Experience Manager
CVE-2019-1652,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.95923,CWE-20,"A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux shell as root. Cisco has released firmware updates that address this vulnerability.",2019-01-24,CISA/EPSS/Metasploit,cpe:2.3:h:cisco:rv320:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv325:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv320_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv325_firmware:*:*:*:*:*:*:*:*,Cisco,Rv320 Firmware
CVE-2019-16525,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.05549,CWE-79,"An XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress. The fill parameter is not correctly filtered in the checklist-icon.php file, and it is possible to inject JavaScript code.",2019-09-19,Nuclei,cpe:2.3:a:checklist:checklist:*:*:*:*:*:wordpress:*:*,Checklist,Checklist
CVE-2019-1653,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.99876,CWE-284,"A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and requesting specific URLs. A successful exploit could allow the attacker to download the router configuration or detailed diagnostic information. Cisco has released firmware updates that address this vulnerability.",2019-01-24,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:h:cisco:rv320:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv325:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv320_firmware:1.4.2.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv320_firmware:1.4.2.17:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv325_firmware:1.4.2.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv325_firmware:1.4.2.17:*:*:*:*:*:*:*,Cisco,Rv320 Firmware
CVE-2019-1663,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.95707,CWE-119,"A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The vulnerability is due to improper validation of user-supplied data in the web-based management interface. An attacker could exploit this vulnerability by sending malicious HTTP requests to a targeted device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system of the affected device as a high-privilege user. RV110W Wireless-N VPN Firewall versions prior to 1.2.2.1 are affected. RV130W Wireless-N Multifunction VPN Router versions prior to 1.0.3.45 are affected. RV215W Wireless-N VPN Router versions prior to 1.3.1.1 are affected.",2019-02-28,EPSS/Metasploit,cpe:2.3:h:cisco:rv110w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv130w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv215w:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv110w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv130w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv215w_firmware:*:*:*:*:*:*:*:*,Cisco,Rv110W Firmware
CVE-2019-16662,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97702,CWE-78,"An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution.",2019-10-28,EPSS/Metasploit/Nuclei,cpe:2.3:a:rconfig:rconfig:3.9.2:*:*:*:*:*:*:*,Rconfig,Rconfig
CVE-2019-16724,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.72158,CWE-120,"File Sharing Wizard 1.5.0 allows a remote attacker to obtain arbitrary code execution by exploiting a Structured Exception Handler (SEH) based buffer overflow in an HTTP POST parameter, a similar issue to CVE-2010-2330 and CVE-2010-2331.",2019-09-24,Metasploit,cpe:2.3:a:upredsun:file_sharing_wizard:1.5.0:*:*:*:*:*:*:*,Upredsun,File Sharing Wizard
CVE-2019-16759,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99728,CWE-94,vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.,2019-09-24,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:*,Vbulletin,Vbulletin
CVE-2019-16920,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99996,CWE-78,"Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a ""PingTest"" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.",2019-09-27,CISA/EPSS/Nuclei,cpe:2.3:h:dlink:dap-1533:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dhp-1565:ax:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-615:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-652:ax:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-655:cx:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-825:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-835:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-855l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-862l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-866l:ax:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dap-1533_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dhp-1565_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-615_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-652_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-655_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-825_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-835_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-855l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-862l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-866l_firmware:*:*:*:*:*:*:*:*,D-Link,Dir-655 Firmware
CVE-2019-16928,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.41589,CWE-787,"Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.",2019-09-27,CISA,cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2019-16931,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03342,CWE-79,"A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers wp-json/visualizer/v1/update-chart with no access control, and classes/Visualizer/Render/Page/Data.php lacks output sanitization.",2019-10-03,Nuclei,cpe:2.3:a:themeisle:visualizer:*:*:*:*:*:wordpress:*:*,Themeisle,Visualizer
CVE-2019-16932,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N,0.39137,CWE-918,A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data.,2019-09-30,Nuclei,cpe:2.3:a:themeisle:visualizer:*:*:*:*:*:wordpress:*:*,Themeisle,Visualizer
CVE-2019-16996,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.12443,CWE-89,"In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_type=shop id parameter.",2019-09-30,Nuclei,cpe:2.3:a:metinfo:metinfo:7.0.0:beta:*:*:*:*:*:*,Metinfo,Metinfo
CVE-2019-16997,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.49398,CWE-89,"In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the admin/?n=language&c=language_general&a=doExportPack appno parameter.",2019-09-30,Nuclei,cpe:2.3:a:metinfo:metinfo:7.0.0:beta:*:*:*:*:*:*,Metinfo,Metinfo
CVE-2019-17026,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.43422,CWE-843,"Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.",2020-03-02,CISA,cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*;cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*,Canonical,Ubuntu Linux
CVE-2019-17181,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.48705,CWE-120,A remote SEH buffer overflow has been discovered in IntraSrv 1.0 (2007-06-03). An attacker may send a crafted HTTP GET or HEAD request that can result in a compromise of the hosting system.,2019-10-28,Metasploit,cpe:2.3:a:intrasrv_project:intrasrv:1.0:*:*:*:*:*:*:*,Intrasrv Project,Intrasrv
CVE-2019-17199,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.09957,CWE-22,"www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal (for reading arbitrary files) because of an unanchored regular expression, as demonstrated by the a.jpg\.. substring.",2019-10-05,Metasploit,cpe:2.3:a:webpagetest:webpagetest:19.04:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2019-17228,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.01153,CWE-345,includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unauthenticated options changes.,2020-02-24,Nuclei,"cpe:2.3:a:stylemixthemes:motors_-_car_dealer\,_classifieds_\&_listing:*:*:*:*:*:wordpress:*:*",Stylemixthemes,"Motors - Car Dealer, Classifieds & Listing"
CVE-2019-17230,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.02362,NVD-CWE-noinfo,includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.,2020-04-03,Nuclei,cpe:2.3:a:mageewp:onetone:*:*:*:*:*:wordpress:*:*,Mageewp,Onetone
CVE-2019-17231,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01216,CWE-79,includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.,2020-04-03,Nuclei,cpe:2.3:a:mageewp:onetone:*:*:*:*:*:wordpress:*:*,Mageewp,Onetone
CVE-2019-17232,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N,0.03518,CWE-306,Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import.,2019-10-07,Nuclei,cpe:2.3:a:etoilewebdesign:ultimate_faq:*:*:*:*:*:wordpress:*:*,Etoilewebdesign,Ultimate Faq
CVE-2019-17233,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01843,CWE-79,Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.,2019-10-07,Nuclei,cpe:2.3:a:etoilewebdesign:ultimate_faq:*:*:*:*:*:wordpress:*:*,Etoilewebdesign,Ultimate Faq
CVE-2019-17270,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.58879,CWE-78,"Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the ""/pages/systemcall.php?command={COMMAND}"" page and parameter, where {COMMAND} will be executed and returning the results to the client. Affects Yachtcontrol webservers disclosed via Dutch GPRS/4G mobile IP-ranges. IP addresses vary due to DHCP client leasing of telco's.",2019-12-10,Nuclei,cpe:2.3:a:yachtcontrol:yachtcontrol:*:*:*:*:*:*:*:*,Yachtcontrol,Yachtcontrol
CVE-2019-17382,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.5415,CWE-639,"An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin.",2019-10-09,Nuclei,cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*,Zabbix,Zabbix
CVE-2019-17418,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.49299,CWE-89,"An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=language&c=language_general&a=doSearchParameter appno parameter, a different issue than CVE-2019-16997.",2019-10-10,Nuclei,cpe:2.3:a:metinfo:metinfo:7.0.0:beta:*:*:*:*:*:*,Metinfo,Metinfo
CVE-2019-17444,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.69445,CWE-521,"Jfrog Artifactory uses default passwords (such as ""password"") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. This issue affects Jfrog Artifactory versions prior to 6.17.0.",2020-10-12,Nuclei,cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*,Jfrog,Artifactory
CVE-2019-17503,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.49236,CWE-425,"An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. An unauthenticated user can access /osm/REGISTER.cmd (aka /osm_tiles/REGISTER.cmd) directly: it contains sensitive information about the database through the SQL queries within this batch file. This file exposes SQL database information such as database version, table name, column name, etc.",2019-10-11,Nuclei,cpe:2.3:a:kirona:dynamic_resource_scheduling:5.5.3.5:*:*:*:*:*:*:*,Kirona,Dynamic Resource Scheduling
CVE-2019-17506,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.57298,CWE-306,There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers. An attacker can get the router's username and password (and other information) via a DEVICE.ACCOUNT value for SERVICES in conjunction with AUTHORIZED_GROUP=1%0a to getcfg.php. This could be used to control the router remotely.,2019-10-11,Nuclei,cpe:2.3:h:dlink:dir-817lw_a1:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-868l_b1:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-817lw_a1_firmware:1.04:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-868l_b1_firmware:2.03:*:*:*:*:*:*:*,D-Link,Dir-868L B1 Firmware
CVE-2019-17508,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.15838,CWE-78,"On D-Link DIR-859 A3-1.06 and DIR-850 A1.13 devices, /etc/services/DEVICE.TIME.php allows command injection via the $SERVER variable.",2019-10-11,Metasploit,cpe:2.3:h:dlink:dir-850l_a:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-859_a3:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-850l_a_firmware:1.13:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-859_a3_firmware:1.06:*:*:*:*:*:*:*,D-Link,Dir-859 A3 Firmware
CVE-2019-17538,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.11458,CWE-22,Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file reading via the web/polygon/problem/viewfile?id=1&name=../ substring.,2019-10-13,Nuclei,cpe:2.3:a:jnoj:jiangnan_online_judge:0.8.0:*:*:*:*:*:*:*,Jnoj,Jiangnan Online Judge
CVE-2019-17558,7.5,CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.98567,CWE-74,"Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).",2019-12-30,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*,Apache,Solr
CVE-2019-17564,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.35319,CWE-502,"Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.",2020-04-01,Nuclei,cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*,Apache,Dubbo
CVE-2019-17574,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.0931,CWE-639,"An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially control the arguments of the do_action function to invoke certain popmake_ or pum_ methods, as demonstrated by controlling content and delivery of popmake-system-info.txt (aka the ""support debug text file"").",2019-10-14,Nuclei,cpe:2.3:a:code-atlantic:popup_maker:*:*:*:*:*:wordpress:*:*,Code-Atlantic,Popup Maker
CVE-2019-17621,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.89624,CWE-78,"The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.",2019-12-30,CISA/Metasploit,cpe:2.3:h:dlink:dir-818lx:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-822:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-823:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-859:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-865l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-868l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-869:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-880l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-885l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-885r:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-890l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-890r:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-895l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-895r:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-818lx_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-822_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-823_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-823_firmware:1.00b06:beta:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-859_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-859_firmware:1.06b01:beta1:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-865l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-868l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-869_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-869_firmware:1.03b02:beta02:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-880l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-885l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-885r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-890l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-890l_firmware:1.11b01:beta01:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-890r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-890r_firmware:1.11b01:beta01:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-895l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-895r_firmware:*:*:*:*:*:*:*:*,D-Link,Dir-859 Firmware
CVE-2019-17662,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96758,CWE-22,"ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. The vulnerability exists even when authentication is turned on during the deployment of the VNC server. The password for authentication is stored in cleartext in a file that can be read via a ../../ThinVnc.ini directory traversal attack vector.",2019-10-16,EPSS/Metasploit/Nuclei,cpe:2.3:a:cybelsoft:thinvnc:1.0:b1:*:*:*:*:*:*,Cybelsoft,Thinvnc
CVE-2019-17671,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.36054,CWE-200,"In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled.",2019-10-17,Nuclei,cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2019-18187,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.25125,CWE-22,"Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution (RCE). The remote process execution is bound to a web service account, which depending on the web platform used may have restricted permissions. An attempted attack requires user authentication.",2019-10-28,CISA,cpe:2.3:a:trendmicro:officescan:11.0:sp1:*:*:*:*:*:*;cpe:2.3:a:trendmicro:officescan:xg:*:*:*:*:*:*:*;cpe:2.3:a:trendmicro:officescan:xg:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2019-1821,0.0,,0.98092,CWE-20,"A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system.",2019-05-16,EPSS/Metasploit/Nuclei,cpe:2.3:a:cisco:evolved_programmable_network_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:network_level_service:3.0\(0.0.83b\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_infrastructure:*:*:*:*:*:*:*:*,Cisco,Evolved Programmable Network Manager
CVE-2019-18217,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.19507,CWE-835,ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long commands because main.c in a child process enters an infinite loop.,2019-10-21,Nuclei,cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.6:-:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.6:a:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.6:rc1:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.6:rc2:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.6:rc3:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.6:rc4:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:1.3.7:rc1:*:*:*:*:*:*,Proftpd,Proftpd
CVE-2019-18371,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.55872,CWE-22,"An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. There is a directory traversal vulnerability to read arbitrary files via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can bypass authentication.",2019-10-23,Nuclei,cpe:2.3:h:mi:millet_router_3g:-:*:*:*:*:*:*:*;cpe:2.3:o:mi:millet_router_3g_firmware:*:*:*:*:*:*:*:*,Mi,Millet Router 3G Firmware
CVE-2019-18393,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.13945,CWE-22,"PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability.",2019-10-24,Nuclei,cpe:2.3:a:igniterealtime:openfire:*:*:*:*:*:*:*:*,Igniterealtime,Openfire
CVE-2019-18394,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.32304,CWE-918,A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.,2019-10-24,Nuclei,cpe:2.3:a:igniterealtime:openfire:*:*:*:*:*:*:*:*,Igniterealtime,Openfire
CVE-2019-18426,8.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N,0.67859,CWE-79,A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.,2020-01-21,CISA,cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:iphone_os:*:*;cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:desktop:*:*:*,Whatsapp,Whatsapp
CVE-2019-18665,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.14855,CWE-22,The Log module in SECUDOS DOMOS before 5.6 allows local file inclusion.,2019-11-02,Nuclei,cpe:2.3:a:secudos:domos:*:*:*:*:*:*:*:*,Secudos,Domos
CVE-2019-18818,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97639,CWE-640,strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.,2019-11-07,EPSS/Metasploit/Nuclei,cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha10.1:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha10.2:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha10.3:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha11.1:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha11.2:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha11.3:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha11:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1.3:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha12.2:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha12.3:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha12.4:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha12.5:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha12.6:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7.1:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha12:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha13.0.1:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha13.1:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha13:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1.1:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha14.2:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha14.3:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha14.4.0:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha14.5:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha14:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha15:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha16:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha17:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha18:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha19:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha20:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha21:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha22:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha23.1:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha23:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha24.1:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha24:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha25.1:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha25.2:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha25:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha26.1:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha26.2:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha26:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha4.8:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha4:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha5.3:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha5.5:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha6.3:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha6.4:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha6.7:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha7.2:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha7.3:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha8.3:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha8:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha9.1:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha9.2:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:alpha9:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta0:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta10:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta11:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta12:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta13:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta14:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta15:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta16.1:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta16.2:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta16.3:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta16.4:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta16.5:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta16.6:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta16.7:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta16.8:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta16:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta17.1:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta17.2:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta17.3:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta17.4:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta17:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta1:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta2:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta3:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta4:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta5:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta6:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta7:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta8:*:*:*:*:*:*;cpe:2.3:a:strapi:strapi:3.0.0:beta9:*:*:*:*:*:*,Strapi,Strapi
CVE-2019-18922,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.24742,CWE-22,A Directory Traversal in the Web interface of the Allied Telesis AT-GS950/8 until Firmware AT-S107 V.1.1.3 [1.00.047] allows unauthenticated attackers to read arbitrary system files via a GET request. NOTE: This is an End-of-Life product.,2019-11-29,Nuclei,cpe:2.3:h:alliedtelesis:at-gs950\/8:-:*:*:*:*:*:*:*;cpe:2.3:o:alliedtelesis:at-gs950\/8_firmware:*:*:*:*:*:*:*:*,Alliedtelesis,At-Gs950/8 Firmware
CVE-2019-18935,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99737,CWE-502,"Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)",2019-12-11,CISA/EPSS/Metasploit,cpe:2.3:a:telerik:ui_for_asp.net_ajax:*:*:*:*:*:*:*:*,Telerik,Ui For Asp.Net Ajax
CVE-2019-18952,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.45361,CWE-434,"SibSoft Xfilesharing through 2.5.1 allows cgi-bin/up.cgi arbitrary file upload. This can be combined with CVE-2019-18951 to achieve remote code execution via a .html file, containing short codes, that is served over HTTP.",2019-11-13,Nuclei,cpe:2.3:a:sibsoft:xfilesharing:*:*:*:*:*:*:*:*,Sibsoft,Xfilesharing
CVE-2019-18957,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0454,CWE-79,Microstrategy Library in MicroStrategy before 2019 before 11.1.3 has reflected XSS.,2019-11-14,Nuclei,cpe:2.3:a:microstrategy:microstrategy_library:*:*:*:*:*:*:*:*,Microstrategy,Microstrategy Library
CVE-2019-1898,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.40951,CWE-285,"A vulnerability in the web-based management interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to access the syslog file on an affected device. The vulnerability is due to improper authorization of an HTTP request. An attacker could exploit this vulnerability by accessing the URL for the syslog file. A successful exploit could allow the attacker to access the information contained in the file.",2019-06-20,Nuclei,cpe:2.3:h:cisco:rv110w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv130w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv215w:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv110w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv130w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv215w_firmware:-:*:*:*:*:*:*:*,Cisco,Rv110W Firmware
CVE-2019-18988,7.0,CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.04707,CWE-521,"TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' installations. It used a shared AES key for all installations since at least as far back as v7.0.43148, and used it for at least OptionsPasswordAES in the current version of the product. If an attacker were to know this key, they could decrypt protect information stored in the registry or configuration files of TeamViewer. With versions before v9.x , this allowed for attackers to decrypt the Unattended Access password to the system (which allows for remote login to the system as well as headless file browsing). The latest version still uses the same key for OptionPasswordAES but appears to have changed how the Unattended Access password is stored. While in most cases an attacker requires an existing session on a system, if the registry/configuration keys were stored off of the machine (such as in a file share or online), an attacker could then decrypt the required password to login to the system.",2020-02-07,CISA/Metasploit,cpe:2.3:a:teamviewer:teamviewer:*:*:*:*:*:*:*:*,Teamviewer,Teamviewer
CVE-2019-19006,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.36615,CWE-287,"Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.",2019-11-21,CISA,cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*,Sangoma,Freepbx
CVE-2019-19134,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.05651,CWE-79,The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to inject HTML or arbitrary JavaScript within the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based tokens or to launch other attacks.,2020-02-26,Nuclei,cpe:2.3:a:heroplugins:hero_maps_premium:*:*:*:*:*:wordpress:*:*,Heroplugins,Hero Maps Premium
CVE-2019-1935,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.83386,CWE-798,"A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to log in to the CLI of an affected system by using the SCP User account (scpuser), which has default user credentials. The vulnerability is due to the presence of a documented default account with an undocumented default password and incorrect permission settings for that account. Changing the default password for this account is not enforced during the installation of the product. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the scpuser account. This includes full read and write access to the system's database.",2019-08-21,Metasploit,cpe:2.3:a:cisco:integrated_management_controller_supervisor:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:integrated_management_controller_supervisor:2.1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.6.1.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.7\(0.0.67265\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director_express_for_big_data:3.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director_express_for_big_data:3.5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director_express_for_big_data:3.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director_express_for_big_data:3.7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director_express_for_big_data:3.7.1.0:*:*:*:*:*:*:*,Cisco,Integrated Management Controller Supervisor
CVE-2019-19356,7.5,CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.28168,CWE-78,"Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. The vulnerability has been found in firmware version V1.2.31805 and V2.2.36123. After one is connected to this page, it is possible to execute system commands as root through the tracert diagnostic tool because of lack of user input sanitizing.",2020-02-07,CISA,cpe:2.3:h:netis-systems:wf2419:-:*:*:*:*:*:*:*;cpe:2.3:o:netis-systems:wf2419_firmware:1.2.31805:*:*:*:*:*:*:*;cpe:2.3:o:netis-systems:wf2419_firmware:2.2.36123:*:*:*:*:*:*:*,Netis-Systems,Wf2419 Firmware
CVE-2019-1936,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.39475,CWE-20,"A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an authenticated, remote attacker to execute arbitrary commands on the underlying Linux shell as the root user. Exploitation of this vulnerability requires privileged access to an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by logging in to the web-based management interface with administrator privileges and then sending a malicious request to a certain part of the interface.",2019-08-21,Metasploit,cpe:2.3:a:cisco:integrated_management_controller_supervisor:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:integrated_management_controller_supervisor:2.1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.6.1.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.7\(0.0.67265\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director_express_for_big_data:3.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director_express_for_big_data:3.5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director_express_for_big_data:3.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director_express_for_big_data:3.7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director_express_for_big_data:3.7.1.0:*:*:*:*:*:*:*,Cisco,Integrated Management Controller Supervisor
CVE-2019-19363,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.04529,CWE-732,An issue was discovered in Ricoh (including Savin and Lanier) Windows printer drivers prior to 2020 that allows attackers local privilege escalation. Affected drivers and versions are: PCL6 Driver for Universal Print - Version 4.0 or later PS Driver for Universal Print - Version 4.0 or later PC FAX Generic Driver - All versions Generic PCL5 Driver - All versions RPCS Driver - All versions PostScript3 Driver - All versions PCL6 (PCL XL) Driver - All versions RPCS Raster Driver - All version,2020-01-24,Metasploit,cpe:2.3:a:ricoh:generic_pcl5_driver:-:*:*:*:*:*:*:*;cpe:2.3:a:ricoh:pc_fax_generic_driver:-:*:*:*:*:*:*:*;cpe:2.3:a:ricoh:pcl6_\(pcl_xl\)_driver:-:*:*:*:*:*:*:*;cpe:2.3:a:ricoh:pcl6_driver_for_universal_print:*:*:*:*:*:*:*:*;cpe:2.3:a:ricoh:postscript3_driver:-:*:*:*:*:*:*:*;cpe:2.3:a:ricoh:ps_driver_for_universal_print:*:*:*:*:*:*:*:*;cpe:2.3:a:ricoh:rpcs_driver:-:*:*:*:*:*:*:*;cpe:2.3:a:ricoh:rpcs_raster_driver:-:*:*:*:*:*:*:*,Ricoh,Generic Pcl5 Driver
CVE-2019-19368,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.2102,CWE-79,A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1. An attacker can exploit it by sending a crafted link to end users and can execute arbitrary Javascripts,2019-12-16,Nuclei,cpe:2.3:a:maxum:rumpus:8.2.9.1:*:*:*:*:*:*:*,Maxum,Rumpus
CVE-2019-1937,0.0,,0.75863,CWE-287,"A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token with administrator privileges, bypassing user authentication. The vulnerability is due to insufficient request header validation during the authentication process. An attacker could exploit this vulnerability by sending a series of malicious requests to an affected device. An exploit could allow the attacker to use the acquired session token to gain full administrator access to the affected device.",2019-08-21,Metasploit,cpe:2.3:a:cisco:integrated_management_controller_supervisor:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.7\(0.0.67265\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director_express_for_big_data:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director_express_for_big_data:3.6.0.0:*:*:*:*:*:*:*,Cisco,Integrated Management Controller Supervisor
CVE-2019-19411,3.7,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01238,CWE-665,"USG9500 with versions of V500R001C30SPC100, V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200 have an information leakage vulnerability. Due to improper processing of the initialization vector used in a specific encryption algorithm, an attacker who gains access to this cryptographic primitive may exploit this vulnerability to cause the value of the confidentiality associated with its use to be diminished.",2020-01-21,Nuclei,cpe:2.3:h:huawei:usg9500:-:*:*:*:*:*:*:*;cpe:2.3:o:huawei:usg9500_firmware:v500r001c30spc100:*:*:*:*:*:*:*;cpe:2.3:o:huawei:usg9500_firmware:v500r001c30spc200:*:*:*:*:*:*:*;cpe:2.3:o:huawei:usg9500_firmware:v500r001c30spc600:*:*:*:*:*:*:*;cpe:2.3:o:huawei:usg9500_firmware:v500r001c60spc500:*:*:*:*:*:*:*;cpe:2.3:o:huawei:usg9500_firmware:v500r005c00spc100:*:*:*:*:*:*:*;cpe:2.3:o:huawei:usg9500_firmware:v500r005c00spc200:*:*:*:*:*:*:*,Huawei,Usg9500 Firmware
CVE-2019-1943,0.0,,0.10678,CWE-601,"A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Switches software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attacker could exploit this vulnerability by intercepting a user's HTTP request and modifying it into a request that causes the web interface to redirect the user to a specific malicious URL. This type of vulnerability is known as an open redirect attack and is used in phishing attacks that get users to unknowingly visit malicious sites.",2019-07-17,Nuclei,cpe:2.3:h:cisco:sf200-24:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf200-24fp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf200-24p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf200-48:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf200-48p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf300-08:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf300-24:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf300-24mp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf300-24p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf300-24pp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf300-48:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf300-48p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf300-48pp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf302-08:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf302-08mp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf302-08mpp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf302-08p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf302-08pp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf500-24:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf500-24p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf500-48:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sf500-48p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg200-08:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg200-08p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg200-10fp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg200-18:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg200-26:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg200-26fp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg200-26p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg200-50:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg200-50fp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg200-50p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-10:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-10mp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-10mpp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-10p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-10pp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-10sfp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-20:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-28:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-28mp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-28p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-28pp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-52:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-52mp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg300-52p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg500-28:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg500-28mpp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg500-28p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg500-52:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg500-52mp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg500-52p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg500x-24:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg500x-24p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg500x-48:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg500x-48p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:sg500xg-8f8t:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf200-24_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf200-24fp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf200-24p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf200-48_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf200-48p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf300-08_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf300-24_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf300-24mp_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf300-24p_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf300-24pp_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf300-48_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf300-48p_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf300-48pp_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf302-08_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf302-08mp_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf302-08mpp_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf302-08p_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf302-08pp_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf500-24_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf500-24p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf500-48_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sf500-48p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg200-08_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg200-08p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg200-10fp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg200-18_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg200-26_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg200-26fp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg200-26p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg200-50_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg200-50fp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg200-50p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-10_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-10mp_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-10mpp_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-10p_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-10pp_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-10sfp_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-20_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-28_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-28mp_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-28p_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-28pp_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-52_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-52mp_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg300-52p_firmware:1.3.7.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg500-28_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg500-28mpp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg500-28p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg500-52_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg500-52mp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg500-52p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg500x-24_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg500x-24p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg500x-48_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg500x-48p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:sg500xg-8f8t_firmware:-:*:*:*:*:*:*:*,Cisco,Sg200-50 Firmware
CVE-2019-19492,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.28953,CWE-798,FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml.,2019-12-02,Metasploit,cpe:2.3:a:freeswitch:freeswitch:*:*:*:*:*:*:*:*,Freeswitch,Freeswitch
CVE-2019-19494,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.22924,CWE-120,"Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary code at the kernel level via JavaScript run in a victim's browser. Examples of affected products include Sagemcom F@st 3890 prior to 50.10.21_T4, Sagemcom F@st 3890 prior to 05.76.6.3f, Sagemcom F@st 3686 3.428.0, Sagemcom F@st 3686 4.83.0, NETGEAR CG3700EMR 2.01.05, NETGEAR CG3700EMR 2.01.03, NETGEAR C6250EMR 2.01.05, NETGEAR C6250EMR 2.01.03, Technicolor TC7230 STEB 01.25, COMPAL 7284E 5.510.5.11, and COMPAL 7486E 5.510.5.11.",2020-01-09,Metasploit,cpe:2.3:h:compal:7284e:-:*:*:*:*:*:*:*;cpe:2.3:h:compal:7486e:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:c6250emr:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:cg3700emr:-:*:*:*:*:*:*:*;cpe:2.3:h:sagemcom:f\@st_3686:-:*:*:*:*:*:*:*;cpe:2.3:h:sagemcom:f\@st_3890:-:*:*:*:*:*:*:*;cpe:2.3:h:technicolor:tc7230_steb:-:*:*:*:*:*:*:*;cpe:2.3:o:compal:7284e_firmware:5.510.5.11:*:*:*:*:*:*:*;cpe:2.3:o:compal:7486e_firmware:5.510.5.11:*:*:*:*:*:*:*;cpe:2.3:o:netgear:c6250emr_firmware:2.01.03:*:*:*:*:*:*:*;cpe:2.3:o:netgear:c6250emr_firmware:2.01.05:*:*:*:*:*:*:*;cpe:2.3:o:netgear:cg3700emr_firmware:2.01.03:*:*:*:*:*:*:*;cpe:2.3:o:netgear:cg3700emr_firmware:2.01.05:*:*:*:*:*:*:*;cpe:2.3:o:sagemcom:f\@st_3686_firmware:3.428.0:*:*:*:*:*:*:*;cpe:2.3:o:sagemcom:f\@st_3686_firmware:4.83.0:*:*:*:*:*:*:*;cpe:2.3:o:sagemcom:f\@st_3890_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:technicolor:tc7230_steb_firmware:01.25:*:*:*:*:*:*:*,Sagemcom,F@St 3890 Firmware
CVE-2019-19509,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.71635,CWE-78,"An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php because the path parameter is passed to the exec function without filtering, which can lead to command execution.",2020-01-06,Metasploit,cpe:2.3:a:rconfig:rconfig:3.9.3:*:*:*:*:*:*:*,Rconfig,Rconfig
CVE-2019-19699,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.27485,CWE-269,"There is Authenticated remote code execution in Centreon Infrastructure Monitoring Software through 19.10 via Pollers misconfiguration, leading to system compromise via apache crontab misconfiguration, This allows the apache user to modify an executable file executed by root at 22:30 every day. To exploit the vulnerability, someone must have Admin access to the Centreon Web Interface and create a custom main.php?p=60803&type=3 command. The user must then set the Pollers Post-Restart Command to this previously created command via the main.php?p=60901&o=c&server_id=1 URI. This is triggered via an export of the Poller Configuration.",2020-04-06,Metasploit,cpe:2.3:a:centreon:centreon:*:*:*:*:*:*:*:*,Centreon,Centreon
CVE-2019-19726,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03522,CWE-269,"OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be defeated by setting a very small RLIMIT_DATA resource limit. When executing chpass or passwd (which are setuid root), _dl_setup_env in ld.so tries to strip LD_LIBRARY_PATH from the environment, but fails when it cannot allocate memory. Thus, the attacker is able to execute their own library code as root.",2019-12-12,Metasploit,cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*,Openbsd,Openbsd
CVE-2019-19781,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99999,CWE-22,"An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.",2019-12-27,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:h:citrix:application_delivery_controller:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:gateway:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:netscaler_gateway:-:*:*:*:*:*:*:*;cpe:2.3:o:citrix:application_delivery_controller_firmware:10.5:*:*:*:*:*:*:*;cpe:2.3:o:citrix:application_delivery_controller_firmware:11.1:*:*:*:*:*:*:*;cpe:2.3:o:citrix:application_delivery_controller_firmware:12.0:*:*:*:*:*:*:*;cpe:2.3:o:citrix:application_delivery_controller_firmware:12.1:*:*:*:*:*:*:*;cpe:2.3:o:citrix:application_delivery_controller_firmware:13.0:*:*:*:*:*:*:*;cpe:2.3:o:citrix:gateway_firmware:13.0:*:*:*:*:*:*:*;cpe:2.3:o:citrix:netscaler_gateway_firmware:10.5:*:*:*:*:*:*:*;cpe:2.3:o:citrix:netscaler_gateway_firmware:11.1:*:*:*:*:*:*:*;cpe:2.3:o:citrix:netscaler_gateway_firmware:12.0:*:*:*:*:*:*:*;cpe:2.3:o:citrix:netscaler_gateway_firmware:12.1:*:*:*:*:*:*:*,Citrix,Application Delivery Controller Firmware
CVE-2019-19822,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.08669,CWE-306,"A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) allows remote attackers to retrieve the configuration, including sensitive data (usernames and passwords). This affects TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0; Rutek RTK 11N AP through 2019-12-12; Sapido GR297n through 2019-12-12; CIK TELECOM MESH ROUTER through 2019-12-12; KCTVJEJU Wireless AP through 2019-12-12; Fibergate FGN-R2 through 2019-12-12; Hi-Wifi MAX-C300N through 2019-12-12; HCN MAX-C300N through 2019-12-12; T-broad GN-866ac through 2019-12-12; Coship EMTA AP through 2019-12-12; and IO-Data WN-AC1167R through 2019-12-12.",2020-01-27,Nuclei,cpe:2.3:h:ciktel:mesh_router:-:*:*:*:*:*:*:*;cpe:2.3:h:coship:emta_ap:-:*:*:*:*:*:*:*;cpe:2.3:h:fg-products:fgn-r2:-:*:*:*:*:*:*:*;cpe:2.3:h:hcn_max-c300n_project:hcn_max-c300n:-:*:*:*:*:*:*:*;cpe:2.3:h:hiwifi:max-c300n:-:*:*:*:*:*:*:*;cpe:2.3:h:iodata:wn-ac1167r:-:*:*:*:*:*:*:*;cpe:2.3:h:kctvjeju:wireless_ap:-:*:*:*:*:*:*:*;cpe:2.3:h:realtek:rtk_11n_ap:-:*:*:*:*:*:*:*;cpe:2.3:h:sapido:gr297n:-:*:*:*:*:*:*:*;cpe:2.3:h:tbroad:gn-866ac:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:a3002ru:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:a702r:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:n100re:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:n150rt:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:n200re:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:n300rt:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:n301rt:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:n302r:-:*:*:*:*:*:*:*;cpe:2.3:o:ciktel:mesh_router_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:coship:emta_ap_firmwre:*:*:*:*:*:*:*:*;cpe:2.3:o:fg-products:fgn-r2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hcn_max-c300n_project:hcn_max-c300n_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hiwifi:max-c300n_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:iodata:wn-ac1167r_firmwre:*:*:*:*:*:*:*:*;cpe:2.3:o:kctvjeju:wireless_ap_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:realtek:rtk_11n_ap_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sapido:gr297n_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tbroad:gn-866ac_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:a3002ru_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:a702r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:n100re_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:n150rt_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:n200re_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:n300rt_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:n301rt_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:n302r_firmware:*:*:*:*:*:*:*:*,Totolink,A3002Ru Firmware
CVE-2019-19823,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.06411,CWE-522,"A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext administrative passwords in flash memory and in a file. This affects TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0; Rutek RTK 11N AP through 2019-12-12; Sapido GR297n through 2019-12-12; CIK TELECOM MESH ROUTER through 2019-12-12; KCTVJEJU Wireless AP through 2019-12-12; Fibergate FGN-R2 through 2019-12-12; Hi-Wifi MAX-C300N through 2019-12-12; HCN MAX-C300N through 2019-12-12; T-broad GN-866ac through 2019-12-12; Coship EMTA AP through 2019-12-12; and IO-Data WN-AC1167R through 2019-12-12.",2020-01-27,Nuclei,cpe:2.3:h:ciktel:mesh_router:-:*:*:*:*:*:*:*;cpe:2.3:h:coship:emta_ap:-:*:*:*:*:*:*:*;cpe:2.3:h:fg-products:fgn-r2:-:*:*:*:*:*:*:*;cpe:2.3:h:hcn_max-c300n_project:hcn_max-c300n:-:*:*:*:*:*:*:*;cpe:2.3:h:hiwifi:max-c300n:-:*:*:*:*:*:*:*;cpe:2.3:h:iodata:wn-ac1167r:-:*:*:*:*:*:*:*;cpe:2.3:h:kctvjeju:wireless_ap:-:*:*:*:*:*:*:*;cpe:2.3:h:realtek:rtk_11n_ap:-:*:*:*:*:*:*:*;cpe:2.3:h:sapido:gr297n:-:*:*:*:*:*:*:*;cpe:2.3:h:tbroad:gn-866ac:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:a3002ru:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:a702r:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:n100re:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:n150rt:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:n200re:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:n300rt:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:n301rt:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:n302r:-:*:*:*:*:*:*:*;cpe:2.3:o:ciktel:mesh_router_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:coship:emta_ap_firmwre:*:*:*:*:*:*:*:*;cpe:2.3:o:fg-products:fgn-r2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hcn_max-c300n_project:hcn_max-c300n_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hiwifi:max-c300n_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:iodata:wn-ac1167r_firmwre:*:*:*:*:*:*:*:*;cpe:2.3:o:kctvjeju:wireless_ap_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:realtek:rtk_11n_ap_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sapido:gr297n_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tbroad:gn-866ac_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:a3002ru_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:a702r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:n100re_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:n150rt_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:n200re_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:n300rt_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:n301rt_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:n302r_firmware:*:*:*:*:*:*:*:*,Totolink,A3002Ru Firmware
CVE-2019-19824,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.25135,CWE-78,"On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available. This allows for full control over the device's internals. This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and N302RE 2.0.2.",2020-01-27,Nuclei,cpe:2.3:h:totolink:a3002ru:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:a702r:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:n100re:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:n150rt:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:n200re:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:n300rt:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:n301rt:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:n302r:-:*:*:*:*:*:*:*;cpe:2.3:o:totolink:a3002ru_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:a702r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:n100re_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:n150rt_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:n200re_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:n300rt_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:n301rt_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:n302r_firmware:*:*:*:*:*:*:*:*,Totolink,A3002Ru Firmware
CVE-2019-19825,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.29557,CWE-287,"On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {""topicurl"":""setting/getSanvas""} POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. (Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform router actions via HTTP requests with Basic Authentication.) This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0.",2020-01-27,Nuclei,cpe:2.3:h:totolink:a3002ru:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:a702r:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:n100re:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:n150rt:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:n200re:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:n300rt:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:n301rt:-:*:*:*:*:*:*:*;cpe:2.3:h:totolink:n302r:-:*:*:*:*:*:*:*;cpe:2.3:o:totolink:a3002ru_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:a702r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:n100re_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:n150rt_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:n200re_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:n300rt_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:n301rt_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:totolink:n302r_firmware:*:*:*:*:*:*:*:*,Totolink,A3002Ru Firmware
CVE-2019-19833,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H,0.14706,CWE-352,"In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. (Also, anonymous access can be achieved in applications that do not have a user login area).",2019-12-18,Metasploit,cpe:2.3:a:tautulli:tautulli:2.1.9:*:*:*:*:*:*:*,Tautulli,Tautulli
CVE-2019-19908,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.21232,CWE-79,"phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL. In the URL, the pmc_username parameter to pass_reset.php is vulnerable.",2019-12-20,Nuclei,cpe:2.3:a:ciprianmp:phpmychat-plus:1.98:*:*:*:*:*:*:*,Ciprianmp,Phpmychat-Plus
CVE-2019-19985,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.71399,CWE-862,"The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.",2019-12-26,Nuclei,cpe:2.3:a:icegram:email_subscribers_\&_newsletters:*:*:*:*:*:wordpress:*:*,Icegram,Email Subscribers & Newsletters
CVE-2019-20085,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.96071,CWE-22,TVT NVMS-1000 devices allow GET /.. Directory Traversal,2019-12-30,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:h:tvt:nvms-1000:-:*:*:*:*:*:*:*;cpe:2.3:o:tvt:nvms-1000_firmware:-:*:*:*:*:*:*:*,Tvt,Nvms-1000 Firmware
CVE-2019-20141,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.05008,CWE-79,An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter.,2019-12-30,Nuclei,cpe:2.3:a:laborator:neon:2.0:*:*:*:*:wordpress:*:*,Laborator,Neon
CVE-2019-20176,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.04365,CWE-400,"In Pure-FTPd 1.0.49, a stack exhaustion issue was discovered in the listdir function in ls.c.",2019-12-31,Nuclei,cpe:2.3:a:pureftpd:pure-ftpd:1.0.49:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2019-20183,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.07625,CWE-434,uploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code because file-extension validation is only on the client side. The attacker can modify global.js to allow the .php extension.,2020-01-09,Nuclei,cpe:2.3:a:employee_records_system_project:employee_records_system:1.0:*:*:*:*:*:*:*,Employee Records System Project,Employee Records System
CVE-2019-20210,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03243,CWE-79,"The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Reflected XSS via a search query.",2020-01-13,Nuclei,cpe:2.3:a:cththemes:citybook:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:cththemes:easybook:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:cththemes:townhub:*:*:*:*:*:wordpress:*:*,Cththemes,Citybook
CVE-2019-20215,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.75105,CWE-78,"D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, because HTTP_ST is mishandled. The value of the urn: service/device is checked with the strstr function, which allows an attacker to concatenate arbitrary commands separated by shell metacharacters.",2020-01-29,Metasploit,cpe:2.3:h:dlink:dir-859:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-859_firmware:1.05:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-859_firmware:1.06b01:beta01:*:*:*:*:*:*,D-Link,Dir-859 Firmware
CVE-2019-20224,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.4968,CWE-78,netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ip_src parameter in an index.php?operation/netflow/nf_live_view request. This issue has been fixed in Pandora FMS 7.0 NG 742.,2020-01-09,Nuclei,cpe:2.3:a:artica:pandora_fms:7.0_ng:*:*:*:*:*:*:*,Artica,Pandora Fms
CVE-2019-20361,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.8511,CWE-89,"There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter (a blind SQL injection vulnerability).",2020-01-08,Metasploit,cpe:2.3:a:icegram:email_subscribers_\&_newsletters:*:*:*:*:*:wordpress:*:*,Icegram,Email Subscribers & Newsletters
CVE-2019-20499,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.96635,CWE-78,"D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_restore configRestore or configServerip parameter.",2020-03-05,EPSS/Metasploit,cpe:2.3:h:dlink:dwl-2600ap:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dwl-2600ap_firmware:*:*:*:*:*:*:*:*,D-Link,Dwl-2600Ap Firmware
CVE-2019-20500,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.97109,CWE-78,"D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.",2020-03-05,CISA/EPSS,cpe:2.3:h:dlink:dwl-2600ap:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dwl-2600ap_firmware:*:*:*:*:*:*:*:*,D-Link,Dwl-2600Ap Firmware
CVE-2019-20504,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0955,CWE-78,service/krashrpt.php in Quest KACE K1000 Systems Management Appliance before 6.4 SP3 (6.4.120822) allows a remote attacker to execute code via shell metacharacters in the kuid parameter.,2020-03-09,Nuclei,cpe:2.3:a:quest:kace_systems_management:*:*:*:*:*:*:*:*,Quest,Kace Systems Management
CVE-2019-20933,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.30921,CWE-287,InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).,2020-11-19,Nuclei,cpe:2.3:a:influxdata:influxdb:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2019-2215,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.72105,CWE-416,"A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095",2019-10-11,CISA/Metasploit,cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:data_availability_services:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:service_processor:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:alp-al00b:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:alp-tl00b:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:anne-al00:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:ares-al00b:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:ares-al10d:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:ares-tl00chw:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:barca-al00:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:berkeley-l09:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:berkeley-tl10:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:bla-al00b:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:bla-l29c:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:bla-tl00b:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:columbia-al00a:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:columbia-l29d:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:cornell-tl10b:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:duke-l09i:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:dura-al00a:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:figo-al00a:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:florida-al20b:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:florida-l03:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:florida-l21:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:florida-l22:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:florida-tl10b:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:honor_9i:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:honor_view_20:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:jakarta-al00a:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:johnson-tl00d:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:leland-al10b:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:leland-l21a:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:leland-l32a:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:leland-tl10b:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:leland-tl10c:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:lelandp-al00c:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:lelandp-l22c:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:mate_rs:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:neo-al00d:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:nova_2s:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:nova_3:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:nova_3e:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:p20:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:p20_lite:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:princeton-al10b:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:rhone-al00:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:stanford-l09:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:stanford-l09s:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:sydney-al00:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:sydney-tl00:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:sydneym-al00:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:tony-al00b:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:tony-tl00b:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:y9_2019:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:yale-al00a:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:yale-l21a:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:yale-tl00b:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:a220:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:a320:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:a800:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:aff_baseboard_management_controller:a700s:*:*:*:*:*:*:*;cpe:2.3:h:netapp:c190:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:fas2720:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:fas2750:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:solidfire_baseboard_management_controller:-:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:-:*:*:*:*:*:*:*;cpe:2.3:o:huawei:alp-al00b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:alp-tl00b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:anne-al00_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:ares-al00b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:ares-al10d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:ares-tl00chw_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:barca-al00_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:berkeley-l09_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:berkeley-tl10_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:bla-al00b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:bla-l29c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:bla-tl00b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:columbia-al00a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:columbia-l29d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:cornell-tl10b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:duke-l09i_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:dura-al00a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:figo-al00a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:florida-al20b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:florida-l03_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:florida-l21_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:florida-l22_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:florida-tl10b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:honor_9i_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:honor_view_20_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:jakarta-al00a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:johnson-tl00d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:leland-al10b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:leland-l21a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:leland-l32a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:leland-tl10b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:leland-tl10c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:lelandp-al00c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:lelandp-l22c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:mate_rs_firmware:9.1.0.321\(c786e320r1p1t8\):*:*:*:*:*:*:*;cpe:2.3:o:huawei:neo-al00d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:nova_2s_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:nova_3_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:nova_3e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:p20_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:p20_lite_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:princeton-al10b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:rhone-al00_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:stanford-l09_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:stanford-l09s_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:sydney-al00_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:sydney-tl00_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:sydneym-al00_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:tony-al00b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:tony-tl00b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:y9_2019_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:yale-al00a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:yale-l21a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:yale-tl00b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netapp:a220_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:a320_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:a800_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:aff_baseboard_management_controller_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:c190_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:fas2720_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:fas2750_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:*,Netapp,Solidfire Baseboard Management Controller Firmware
CVE-2019-25065,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.06588,CWE-78,A vulnerability was found in OpenNetAdmin 18.1.1. It has been rated as critical. Affected by this issue is some unknown functionality. The manipulation leads to privilege escalation. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.,2022-06-09,Metasploit,cpe:2.3:a:opennetadmin:opennetadmin:18.1.1:*:*:*:*:*:*:*,Opennetadmin,Opennetadmin
CVE-2019-25066,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.05244,CWE-269,A vulnerability has been found in ajenti 2.1.31 and classified as critical. This vulnerability affects unknown code of the component API. The manipulation leads to privilege escalation. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.1.32 is able to address this issue. The name of the patch is 7aa146b724e0e20cfee2c71ca78fafbf53a8767c. It is recommended to upgrade the affected component.,2022-06-09,Metasploit,cpe:2.3:a:ajenti:ajenti:2.1.31:*:*:*:*:*:*:*,Ajenti,Ajenti
CVE-2019-25141,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04498,CWE-862,"The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks on the admin_init() function, in addition to insufficient input validation. This makes it possible for unauthenticated attackers to modify the plugins settings and arbitrary options on the site that can be used to inject new administrative user accounts.",2023-06-07,Nuclei,cpe:2.3:a:wp-ecommerce:easy_wp_smtp:*:*:*:*:*:wordpress:*:*,Wp-Ecommerce,Easy Wp Smtp
CVE-2019-25152,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.01364,CWE-79,"The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in user input that will execute on the admin dashboard.",2023-06-22,Nuclei,cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:tychesoftwares:abandoned_cart_pro_for_woocommerce:*:*:*:*:*:wordpress:*:*,Tychesoftwares,Abandoned Cart Lite For Woocommerce
CVE-2019-25213,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02772,CWE-22,"The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to insufficient validation on the aam-media parameter. This allows unauthenticated attackers to read any file on the server, including sensitive files such as wp-config.php",2024-10-16,Nuclei,cpe:2.3:a:vasyltech:advanced_access_manager:*:*:*:*:*:wordpress:*:*,Vasyltech,Advanced Access Manager
CVE-2019-25224,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.16682,CWE-78,The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system.,2025-07-25,Metasploit,cpe:2.3:a:wpseeds:wp_database_backup:*:*:*:*:*:wordpress:*:*,Wpseeds,Wp Database Backup
CVE-2019-25246,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.17393,CWE-22,Beward N100 H.264 VGA IP Camera M2.1.6 contains an authenticated file disclosure vulnerability that allows attackers to read arbitrary system files via the 'READ.filePath' parameter. Attackers can exploit the fileread script or SendCGICMD API to access sensitive files like /etc/passwd and /etc/issue by supplying absolute file paths.,2025-12-24,Nuclei,,,
CVE-2019-2557,0.0,,0.05503,NVD-CWE-noinfo,"Vulnerability in the Oracle Application Testing Suite component of Oracle Enterprise Manager Products Suite (subcomponent: Load Testing for Web Apps). The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Testing Suite accessible data as well as unauthorized read access to a subset of Oracle Application Testing Suite accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Application Testing Suite. CVSS 3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).",2019-04-23,Metasploit,cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*,Oracle,Application Testing Suite
CVE-2019-2578,0.0,,0.72402,NVD-CWE-noinfo,"Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. While the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).",2019-04-23,Nuclei,cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*,Oracle,Webcenter Sites
CVE-2019-2579,0.0,,0.06079,NVD-CWE-noinfo,Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).,2019-04-23,Nuclei,cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*,Oracle,Webcenter Sites
CVE-2019-2588,0.0,,0.37351,NVD-CWE-noinfo,"Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).",2019-04-23,Nuclei,cpe:2.3:a:oracle:business_intelligence_publisher:11.1.1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:business_intelligence_publisher:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:business_intelligence_publisher:12.2.1.4.0:*:*:*:*:*:*:*,Oracle,Business Intelligence Publisher
CVE-2019-2616,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.92183,NVD-CWE-noinfo,"Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). While the vulnerability is in BI Publisher (formerly XML Publisher), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of BI Publisher (formerly XML Publisher) accessible data as well as unauthorized read access to a subset of BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).",2019-04-23,CISA/Nuclei,cpe:2.3:a:oracle:business_intelligence_publisher:11.1.1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:business_intelligence_publisher:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:business_intelligence_publisher:12.2.1.4.0:*:*:*:*:*:*:*,Oracle,Business Intelligence Publisher
CVE-2019-2725,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99964,CWE-74,"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",2019-04-26,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:agile_plm:9.3.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:agile_plm:9.3.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_converged_application_server:5.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_converged_application_server:7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_converged_application_server:7.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*;cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*;cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*;cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:tape_library_acsls:8.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:tape_virtual_storage_manager_gui:6.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:vm_virtualbox:5.2.36:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*,Oracle,Agile Plm
CVE-2019-2729,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.8883,CWE-284,"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",2019-06-19,Nuclei,cpe:2.3:a:oracle:communications_diameter_signaling_router:8.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_diameter_signaling_router:8.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_network_integrity:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.2.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:identity_manager:11.1.2.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:identity_manager:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*;cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*;cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*;cpe:2.3:a:oracle:rapid_planning:12.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:rapid_planning:12.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:tape_library_acsls:8.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*,Oracle,Communications Diameter Signaling Router
CVE-2019-2767,0.0,,0.05238,NVD-CWE-noinfo,"Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). The supported version that is affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). While the vulnerability is in BI Publisher (formerly XML Publisher), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of BI Publisher (formerly XML Publisher) accessible data as well as unauthorized read access to a subset of BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).",2019-07-23,Nuclei,cpe:2.3:a:oracle:bi_publisher:11.1.1.9.0:*:*:*:*:*:*:*,Oracle,Bi Publisher
CVE-2019-3010,8.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.13399,NVD-CWE-noinfo,"Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).",2019-10-16,CISA/Metasploit,cpe:2.3:o:oracle:solaris:11:*:*:*:*:*:*:*,Oracle,Solaris
CVE-2019-3396,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99913,CWE-22,"The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.",2019-03-25,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*,Atlassian,Confluence Server
CVE-2019-3398,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.97153,CWE-22,"Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability.",2019-04-18,CISA/EPSS/Nuclei,cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*,Atlassian,Confluence Server
CVE-2019-3401,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.12719,CWE-863,The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.,2019-05-22,Nuclei,cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*,Atlassian,Jira
CVE-2019-3402,0.0,,0.08947,CWE-79,The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.,2019-05-22,Nuclei,cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*,Atlassian,Jira
CVE-2019-3403,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.52637,CWE-863,"The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.",2019-05-22,Nuclei,cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*,Atlassian,Jira
CVE-2019-3568,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.39166,CWE-122,"A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.",2019-05-14,CISA,cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:android:*:*;cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:iphone_os:*:*;cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:tizen:*:*;cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:windows_phone:*:*;cpe:2.3:a:whatsapp:whatsapp_business:*:*:*:*:*:android:*:*;cpe:2.3:a:whatsapp:whatsapp_business:*:*:*:*:*:iphone_os:*:*,Whatsapp,Whatsapp
CVE-2019-3799,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.85295,CWE-22,"Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.",2019-05-06,Metasploit/Nuclei,cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*,Vmware,Spring Cloud Config
CVE-2019-3911,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03813,CWE-79,Reflected cross-site scripting (XSS) vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 allows an unauthenticated remote attacker to inject arbitrary javascript via the onerror parameter in the /__r2/query endpoints.,2019-01-30,Nuclei,cpe:2.3:a:labkey:labkey_server:*:*:community:*:*:*:*:*,Labkey,Labkey Server
CVE-2019-3912,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.04825,CWE-601,An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /__r1/ returnURL parameter allows an unauthenticated remote attacker to redirect users to arbitrary web sites.,2019-01-30,Nuclei,cpe:2.3:a:labkey:labkey_server:*:*:*:*:community:*:*:*,Labkey,Labkey Server
CVE-2019-3929,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98952,CWE-79,"The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro firmware 1.0.0.5, Blackbox HD WPS firmware 1.0.0.5, InFocus LiteShow3 firmware 1.0.16, and InFocus LiteShow4 2.0.0.7 are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.",2019-04-30,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:h:barco:wepresent_wipg-1000p:-:*:*:*:*:*:*:*;cpe:2.3:h:barco:wepresent_wipg-1600w:-:*:*:*:*:*:*:*;cpe:2.3:h:blackbox:hd_wireless_presentation_system:-:*:*:*:*:*:*:*;cpe:2.3:h:crestron:am-100:-:*:*:*:*:*:*:*;cpe:2.3:h:crestron:am-101:-:*:*:*:*:*:*:*;cpe:2.3:h:extron:sharelink_200:-:*:*:*:*:*:*:*;cpe:2.3:h:extron:sharelink_250:-:*:*:*:*:*:*:*;cpe:2.3:h:infocus:liteshow3:-:*:*:*:*:*:*:*;cpe:2.3:h:infocus:liteshow4:-:*:*:*:*:*:*:*;cpe:2.3:h:optoma:wps-pro:-:*:*:*:*:*:*:*;cpe:2.3:h:sharp:pn-l703wa:-:*:*:*:*:*:*:*;cpe:2.3:h:teqavit:wips710:-:*:*:*:*:*:*:*;cpe:2.3:o:barco:wepresent_wipg-1000p_firmware:2.3.0.10:*:*:*:*:*:*:*;cpe:2.3:o:barco:wepresent_wipg-1600w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:blackbox:hd_wireless_presentation_system_firmware:1.0.0.5:*:*:*:*:*:*:*;cpe:2.3:o:crestron:am-100_firmware:1.6.0.2:*:*:*:*:*:*:*;cpe:2.3:o:crestron:am-101_firmware:2.7.0.2:*:*:*:*:*:*:*;cpe:2.3:o:extron:sharelink_200_firmware:2.0.3.4:*:*:*:*:*:*:*;cpe:2.3:o:extron:sharelink_250_firmware:2.0.3.4:*:*:*:*:*:*:*;cpe:2.3:o:infocus:liteshow3_firmware:1.0.16:*:*:*:*:*:*:*;cpe:2.3:o:infocus:liteshow4_firmware:2.0.0.7:*:*:*:*:*:*:*;cpe:2.3:o:optoma:wps-pro_firmware:1.0.0.5:*:*:*:*:*:*:*;cpe:2.3:o:sharp:pn-l703wa_firmware:1.4.2.3:*:*:*:*:*:*:*;cpe:2.3:o:teqavit:wips710_firmware:1.1.0.7:*:*:*:*:*:*:*,Crestron,Am-100 Firmware
CVE-2019-3999,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.08566,CWE-78,"Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, unauthenticated attacker to execute arbitrary operating system commands with SYSTEM privileges.",2020-02-25,Metasploit,cpe:2.3:a:druva:insync_client:6.5.0:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2019-4061,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.22547,CWE-200,IBM BigFix Platform 9.2 and 9.5 could allow an attacker to query the relay remotely and gather information about the updates and fixlets deployed to the associated sites due to not enabling authenticated access. IBM X-Force ID: 156869.,2019-02-27,Metasploit/Nuclei,cpe:2.3:a:ibm:bigfix_platform:*:*:*:*:*:*:*:*,Ibm,Bigfix Platform
CVE-2019-4279,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.79926,CWE-502,IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 160445.,2019-05-17,Metasploit,cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*;cpe:2.3:a:ibm:websphere_application_server:7.0.0.0:*:*:*:*:*:*:*,Ibm,Websphere Application Server
CVE-2019-4716,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.86441,CWE-94,"IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as ""admin"", and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094.",2019-12-18,CISA/Metasploit/Nuclei,cpe:2.3:a:ibm:planning_analytics:*:*:*:*:*:*:*:*,Ibm,Planning Analytics
CVE-2019-5127,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.45302,CWE-78,A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube. The parameter base64Url in /objects/getImage.php is vulnerable to a command injection attack.,2019-10-25,Nuclei,cpe:2.3:a:youphptube:youphptube_encoder:2.3:*:*:*:*:*:*:*,Youphptube,Youphptube Encoder
CVE-2019-5128,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.30174,CWE-78,A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube. The parameter base64Url in /objects/getImageMP4.php is vulnerable to a command injection attack.,2019-10-25,Nuclei,cpe:2.3:a:youphptube:youphptube_encoder:2.3:*:*:*:*:*:*:*,Youphptube,Youphptube Encoder
CVE-2019-5129,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.38531,CWE-78,A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube. The parameter base64Url in /objects/getSpiritsFromVideo.php is vulnerable to a command injection attack.,2019-10-25,Nuclei,cpe:2.3:a:youphptube:youphptube_encoder:2.3:*:*:*:*:*:*:*,Youphptube,Youphptube Encoder
CVE-2019-5418,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.98507,CWE-22,"There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.",2019-03-27,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:redhat:cloudforms:4.6:*:*:*:*:*:*:*;cpe:2.3:a:redhat:cloudforms:4.7:*:*:*:*:*:*:*;cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2019-5420,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.92144,CWE-77,"A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.",2019-03-27,Metasploit,cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:6.0.0:beta1:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:6.0.0:beta2:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2019-5434,0.0,,0.57022,CWE-502,"An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the ""what"" parameter in the ""openads.spc"" RPC method. Such vulnerability could be used to perform various types of attacks, e.g. exploit serialize-related PHP vulnerabilities or PHP object injection. It is possible, although unconfirmed, that the vulnerability has been used by some attackers in order to gain access to some Revive Adserver instances and deliver malware through them to third party websites. This vulnerability was addressed in version 4.2.0.",2019-05-06,Nuclei,cpe:2.3:a:revive-sas:revive_adserver:*:*:*:*:*:*:*:*,Revive-Sas,Revive Adserver
CVE-2019-5544,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96823,CWE-787,OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.,2019-12-06,CISA/EPSS/Nuclei,cpe:2.3:a:openslp:openslp:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:horizon_daas:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.0_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.7_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.7_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.7_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:-:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:1:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:1a:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:1b:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:2:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:3:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:3a:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201504401:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201505401:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201507101:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201507102:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201507401:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201507402:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201507403:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201507404:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201507405:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201507406:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201507407:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201509101:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201509102:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201509201:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201509202:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201509203:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201509204:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201509205:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201509206:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201509207:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201509208:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201509209:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201509210:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201510401:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201511401:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201601101:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201601102:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201601401:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201601402:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201601403:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201601404:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201601405:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201602401:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201603101:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201603102:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201603201:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201603202:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201603203:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201603204:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201603205:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201603206:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201603207:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201603208:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201605401:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201608101:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201608401:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201608402:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201608403:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201608404:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201608405:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201610410:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201611401:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201611402:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201611403:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201702101:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201702102:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201702201:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201702202:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201702203:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201702204:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201702205:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201702206:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201702207:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201702208:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201702209:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201702210:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201702211:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201702212:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201703401:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201706101:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201706102:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201706103:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201706401:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201706402:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201706403:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201710301:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201811001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.0:600-201811401:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:-:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201701001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201703001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201703002:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201704001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707101:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707102:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707103:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707201:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707202:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707203:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707204:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707205:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707206:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707207:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707208:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707209:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707210:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707211:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707212:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707213:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707214:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707215:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707216:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707217:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707218:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707219:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707220:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707221:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201710001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201712001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201803001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201806001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201808001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201810001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201810002:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201811001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201811002:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201811301:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201901001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201903001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201905001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201908001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201910001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-20191004001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201911001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201911401:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201911402:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:-:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201806001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201807001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201808001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810101:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810102:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810103:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810201:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810202:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810203:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810204:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810205:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810206:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810207:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810208:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810209:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810210:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810211:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810212:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810213:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810214:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810215:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810216:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810217:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810218:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810219:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810220:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810221:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810222:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810223:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810224:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810225:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810226:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810227:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810228:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810229:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810230:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810231:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810232:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810233:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810234:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201811001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201901001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201901401:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201901402:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201901403:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201903001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904201:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904202:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904203:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904204:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904205:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904206:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904207:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904208:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904209:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904210:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904211:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904212:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904213:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904214:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904215:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904216:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904217:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904218:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904219:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904220:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904221:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904222:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904223:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904224:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904225:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904226:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904227:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904228:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904229:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201905001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201906002:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908101:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908102:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908103:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908104:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908201:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908202:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908203:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908204:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908205:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908206:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908207:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908208:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908209:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908210:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908211:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908212:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908213:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908214:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908215:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908216:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908217:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908218:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908219:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908220:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908221:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201911001:*:*:*:*:*:*,Vmware,Esxi
CVE-2019-5591,6.5,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.18566,CWE-306,A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.,2020-08-14,CISA/Nuclei,cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*,Fortinet,Fortios
CVE-2019-5618,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.02176,CWE-121,A-PDF WAV to MP3 version 1.0.0 suffers from an instance of CWE-121: Stack-based Buffer Overflow.,2020-04-29,Metasploit,cpe:2.3:a:a-pdf:wav_to_mp3:1.0.0:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2019-5619,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0472,CWE-121,AASync.com AASync version 2.2.1.0 suffers from an instance of CWE-121: Stack-based Buffer Overflow.,2020-04-29,Metasploit,cpe:2.3:a:aasync:aasync:2.2.1.0:*:*:*:*:*:*:*,Aasync,Aasync
CVE-2019-5620,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.70081,CWE-306,ABB MicroSCADA Pro SYS600 version 9.3 suffers from an instance of CWE-306: Missing Authentication for Critical Function.,2020-04-29,Metasploit,cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.3:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*,Microsoft,Windows 7
CVE-2019-5645,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.41688,CWE-400,"By sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an attacker can register an arbitrary regular expression. When evaluated, this malicious handler can either prevent new HTTP handler sessions from being established, or cause a resource exhaustion on the Metasploit server.",2020-09-01,Metasploit,cpe:2.3:a:rapid7:metasploit:*:*:*:*:*:*:*:*,Rapid7,Metasploit
CVE-2019-5736,8.6,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.9857,CWE-78,"runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.",2019-02-11,EPSS/Metasploit,cpe:2.3:a:apache:mesos:*:*:*:*:*:*:*:*;cpe:2.3:a:d2iq:kubernetes_engine:*:*:*:*:*:*:*:*;cpe:2.3:a:docker:docker:*:*:*:*:*:*:*:*;cpe:2.3:a:google:kubernetes_engine:-:*:*:*:*:*:*:*;cpe:2.3:a:hp:onesphere:-:*:*:*:*:*:*:*;cpe:2.3:a:linuxcontainers:lxc:*:*:*:*:*:*:*:*;cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*;cpe:2.3:a:linuxfoundation:runc:1.0.0:rc1:*:*:*:*:*:*;cpe:2.3:a:linuxfoundation:runc:1.0.0:rc2:*:*:*:*:*:*;cpe:2.3:a:linuxfoundation:runc:1.0.0:rc3:*:*:*:*:*:*;cpe:2.3:a:linuxfoundation:runc:1.0.0:rc4:*:*:*:*:*:*;cpe:2.3:a:linuxfoundation:runc:1.0.0:rc5:*:*:*:*:*:*;cpe:2.3:a:linuxfoundation:runc:1.0.0:rc6:*:*:*:*:*:*;cpe:2.3:a:microfocus:service_management_automation:2018.02:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:service_management_automation:2018.05:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:service_management_automation:2018.08:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:service_management_automation:2018.11:*:*:*:*:*:*:*;cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*;cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*;cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*;cpe:2.3:a:redhat:container_development_kit:3.7:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift:3.4:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift:3.5:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift:3.6:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift:3.7:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*;cpe:2.3:o:d2iq:dc\/os:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*,Redhat,Enterprise Linux
CVE-2019-5786,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H,0.61537,CWE-416,Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.,2019-06-27,CISA/Metasploit,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*,Google,Chrome
CVE-2019-5825,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H,0.55925,CWE-787,Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2019-11-25,CISA/Metasploit,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*,Google,Chrome
CVE-2019-6112,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.09221,CWE-79,A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter (aka $search_term or the Search field).,2020-08-14,Nuclei,cpe:2.3:a:graphpaperpress:sell_media:*:*:*:*:*:wordpress:*:*,Graphpaperpress,Sell Media
CVE-2019-6223,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02629,NVD-CWE-noinfo,"A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. The initiator of a Group FaceTime call may be able to cause the recipient to answer.",2019-03-05,CISA,cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*,Apple,Iphone Os
CVE-2019-6340,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.92017,CWE-502,"Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)",2019-02-21,CISA/Metasploit/Nuclei,cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*,Drupal,Drupal
CVE-2019-6443,0.0,,0.66881,CWE-125,"An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_control.c in ntpd.",2019-01-16,Nuclei,cpe:2.3:a:ntpsec:ntpsec:*:*:*:*:*:*:*:*,Ntpsec,Ntpsec
CVE-2019-6447,8.1,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.6202,CWE-306,"The ES File Explorer File Manager application through 4.1.9.7.4 for Android allows remote attackers to read arbitrary files or execute applications via TCP port 59777 requests on the local Wi-Fi network. This TCP port remains open after the ES application has been launched once, and responds to unauthenticated application/json data over HTTP.",2019-01-16,Metasploit,cpe:2.3:a:estrongs:es_file_explorer_file_manager:*:*:*:*:*:android:*:*,Estrongs,Es File Explorer File Manager
CVE-2019-6693,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.05663,CWE-798,"Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).",2019-11-21,CISA,cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:6.2.0:*:*:*:*:*:*:*,Fortinet,Fortios
CVE-2019-6703,0.0,,0.26076,NVD-CWE-noinfo,"Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option values, leading to site takeover. These attackers can send requests to wp-admin/admin-ajax.php to call the miglaA_update_me action to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.",2019-01-27,Nuclei,cpe:2.3:a:calmar-webmedia:total_donations:*:*:*:*:*:wordpress:*:*,Calmar-Webmedia,Total Donations
CVE-2019-6715,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.19396,NVD-CWE-noinfo,pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionConfirmation JSON data.,2019-04-01,Nuclei,cpe:2.3:a:boldgrid:w3_total_cache:*:*:*:*:*:wordpress:*:*,Boldgrid,W3 Total Cache
CVE-2019-6793,7.0,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L,0.03506,CWE-918,"An issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The Jira integration feature is vulnerable to an unauthenticated blind SSRF issue.",2019-09-09,Nuclei,cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*,Gitlab,Gitlab
CVE-2019-6799,0.0,,0.15407,NVD-CWE-noinfo,"An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of ""options(MYSQLI_OPT_LOCAL_INFILE"" calls.",2019-01-26,Nuclei,cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2019-6802,0.0,,0.03922,CWE-74,CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI.,2019-01-25,Nuclei,cpe:2.3:a:python:pypiserver:*:*:*:*:*:*:*:*,Python,Pypiserver
CVE-2019-6814,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.3665,CWE-287,"A CWE-287: Improper Authentication vulnerability exists in the NET55XX Encoder with firmware prior to version 2.1.9.7 which could cause impact to confidentiality, integrity, and availability when a remote attacker crafts a malicious request to the encoder webUI.",2019-05-22,Metasploit,cpe:2.3:h:schneider-electric:net5500:-:*:*:*:*:*:*:*;cpe:2.3:h:schneider-electric:net5501-i:-:*:*:*:*:*:*:*;cpe:2.3:h:schneider-electric:net5501-xt:-:*:*:*:*:*:*:*;cpe:2.3:h:schneider-electric:net5501:-:*:*:*:*:*:*:*;cpe:2.3:h:schneider-electric:net5504:-:*:*:*:*:*:*:*;cpe:2.3:h:schneider-electric:net5508:-:*:*:*:*:*:*:*;cpe:2.3:h:schneider-electric:net5516:-:*:*:*:*:*:*:*;cpe:2.3:o:schneider-electric:net5500_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:schneider-electric:net5501-i_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:schneider-electric:net5501-xt_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:schneider-electric:net5501_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:schneider-electric:net5504_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:schneider-electric:net5508_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:schneider-electric:net5516_firmware:*:*:*:*:*:*:*:*,Schneider-Electric,Net5501 Firmware
CVE-2019-7139,0.0,,0.1545,CWE-89,"An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.",2019-04-10,Nuclei,cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*;cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*,Magento,Magento
CVE-2019-7192,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.88213,CWE-863,"This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.",2019-12-05,CISA/Metasploit/Nuclei,cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.4.1:*:*:*:*:*:*:*,Qnap,Qts
CVE-2019-7193,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.14367,NVD-CWE-noinfo,"This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.",2019-12-05,CISA,cpe:2.3:o:qnap:qts:4.3.6.0895:-:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.0907:-:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.0923:-:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.0944:-:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.0959:-:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.0979:-:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.0993:-:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.1013:-:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.1033:-:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.4.1.0948:beta:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.4.1.0949:beta:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.4.1.0978:beta_2:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.4.1.0998:beta_3:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.4.1.0999:beta_3:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.4.1.1031:beta_4:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.4.1.1033:beta_4:*:*:*:*:*:*,Qnap,Qts
CVE-2019-7194,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.82966,CWE-22,"This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.",2019-12-05,CISA/Metasploit/Nuclei,cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.4.1:*:*:*:*:*:*:*,Qnap,Qts
CVE-2019-7195,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.89681,CWE-22,"This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.",2019-12-05,CISA/Metasploit/Nuclei,cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.4.1:*:*:*:*:*:*:*,Qnap,Qts
CVE-2019-7214,0.0,,0.84824,CWE-502,SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not accessible remotely by default after applying the Build 6985 patch.,2019-04-24,Metasploit,cpe:2.3:a:smartertools:smartermail:*:*:*:*:*:*:*:*,Smartertools,Smartermail
CVE-2019-7219,0.0,,0.05173,CWE-79,"Unauthenticated reflected cross-site scripting (XSS) exists in Zarafa Webapp 2.0.1.47791 and earlier. NOTE: this is a discontinued product. The issue was fixed in later Zarafa Webapp versions; however, some former Zarafa Webapp customers use the related Kopano product instead.",2019-04-11,Nuclei,cpe:2.3:a:zarafa:webaccess:7.2.0-48204:*:*:*:*:*:*:*,Zarafa,Webaccess
CVE-2019-7238,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.76526,NVD-CWE-noinfo,Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.,2019-03-21,CISA/Nuclei,cpe:2.3:a:sonatype:nexus_repository_manager:*:*:*:*:*:*:*:*,Sonatype,Nexus Repository Manager
CVE-2019-7254,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.82036,CWE-22,Linear eMerge E3-Series devices allow File Inclusion.,2019-07-02,Nuclei,cpe:2.3:h:nortekcontrol:linear_emerge_elite:-:*:*:*:*:*:*:*;cpe:2.3:h:nortekcontrol:linear_emerge_essential:-:*:*:*:*:*:*:*;cpe:2.3:o:nortekcontrol:linear_emerge_elite_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:nortekcontrol:linear_emerge_essential_firmware:*:*:*:*:*:*:*:*,Nortekcontrol,Linear Emerge Essential Firmware
CVE-2019-7255,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.55807,CWE-79,Linear eMerge E3-Series devices allow XSS.,2019-07-02,Nuclei,cpe:2.3:h:nortekcontrol:linear_emerge_elite:-:*:*:*:*:*:*:*;cpe:2.3:h:nortekcontrol:linear_emerge_essential:-:*:*:*:*:*:*:*;cpe:2.3:o:nortekcontrol:linear_emerge_elite_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:nortekcontrol:linear_emerge_essential_firmware:*:*:*:*:*:*:*:*,Nortekcontrol,Linear Emerge Essential Firmware
CVE-2019-7256,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97136,CWE-78,Linear eMerge E3-Series devices allow Command Injections.,2019-07-02,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:h:nortekcontrol:linear_emerge_elite:-:*:*:*:*:*:*:*;cpe:2.3:h:nortekcontrol:linear_emerge_essential:-:*:*:*:*:*:*:*;cpe:2.3:o:nortekcontrol:linear_emerge_elite_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:nortekcontrol:linear_emerge_essential_firmware:*:*:*:*:*:*:*:*,Nortekcontrol,Linear Emerge Essential Firmware
CVE-2019-7275,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.09087,CWE-601,Optergy Proton/Enterprise devices allow Open Redirect.,2019-07-01,Nuclei,cpe:2.3:a:optergy:enterprise:*:*:*:*:*:*:*:*;cpe:2.3:a:optergy:proton:*:*:*:*:*:*:*:*,Optergy,Enterprise
CVE-2019-7276,0.0,,0.93384,NVD-CWE-noinfo,Optergy Proton/Enterprise devices allow Remote Root Code Execution via a Backdoor Console.,2019-07-01,Metasploit/Nuclei,cpe:2.3:a:optergy:enterprise:*:*:*:*:*:*:*:*;cpe:2.3:a:optergy:proton:*:*:*:*:*:*:*:*,Optergy,Enterprise
CVE-2019-7286,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.15705,CWE-787,"A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. An application may be able to gain elevated privileges.",2019-12-18,CISA,cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*,Apple,Iphone Os
CVE-2019-7287,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.04589,CWE-787,A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An application may be able to execute arbitrary code with kernel privileges.,2019-12-18,CISA,cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*,Apple,Iphone Os
CVE-2019-7315,0.0,,0.11198,CWE-22,"Genie Access WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camera devices through 3.x are vulnerable to directory traversal via the web interface, as demonstrated by reading /etc/shadow. NOTE: this product is discontinued, and its final firmware version has this vulnerability (4.x versions exist only for other Genie Access products).",2019-06-17,Nuclei,cpe:2.3:h:genieaccess:wip3bvaf:-:*:*:*:*:*:*:*;cpe:2.3:o:genieaccess:wip3bvaf_firmware:*:*:*:*:*:*:*:*,Genieaccess,Wip3Bvaf Firmware
CVE-2019-7481,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.99906,CWE-89,Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vulnerablity impacted SMA100 version 9.0.0.3 and earlier.,2019-12-17,CISA/EPSS/Nuclei,cpe:2.3:h:sonicwall:sma_100:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_100_firmware:*:*:*:*:*:*:*:*,Sonicwall,Sma 100 Firmware
CVE-2019-7483,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03977,CWE-22,"In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.",2019-12-19,CISA,cpe:2.3:h:sonicwall:sma_100:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_100_firmware:*:*:*:*:*:*:*:*,Sonicwall,Sma 100 Firmware
CVE-2019-7543,0.0,,0.03161,CWE-79,"In KindEditor 4.1.11, the php/demo.php content1 parameter has a reflected Cross-site Scripting (XSS) vulnerability.",2019-02-06,Nuclei,cpe:2.3:a:kindsoft:kindeditor:4.1.11:*:*:*:*:*:*:*,Kindsoft,Kindeditor
CVE-2019-7609,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.95338,CWE-94,Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.,2019-03-25,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*,Elastic,Kibana
CVE-2019-8086,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.24141,CWE-611,"Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.",2019-10-25,Nuclei,cpe:2.3:a:adobe:experience_manager:6.2:*:*:*:*:*:*:*;cpe:2.3:a:adobe:experience_manager:6.3:*:*:*:*:*:*:*;cpe:2.3:a:adobe:experience_manager:6.4:*:*:*:*:*:*:*;cpe:2.3:a:adobe:experience_manager:6.5:*:*:*:*:*:*:*,Adobe,Experience Manager
CVE-2019-8390,0.0,,0.09836,CWE-79,qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter.,2019-05-14,Nuclei,cpe:2.3:a:qdpm:qdpm:9.1:*:*:*:*:*:*:*,Qdpm,Qdpm
CVE-2019-8394,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N,0.64051,CWE-434,Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.,2019-02-17,CISA/Metasploit,cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:-:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10001:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10002:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10003:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10004:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10005:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10006:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10007:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10008:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10009:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10010:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10011:*:*:*:*:*:*,Zohocorp,Manageengine Servicedesk Plus
CVE-2019-8442,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.59832,NVD-CWE-noinfo,"The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to access files in the Jira webroot under the META-INF directory via a lax path access check.",2019-05-22,Nuclei,cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*,Atlassian,Jira
CVE-2019-8446,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.1755,CWE-863,The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check.,2019-08-23,Nuclei,cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*,Atlassian,Jira Server
CVE-2019-8449,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.84771,CWE-306,The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure vulnerability.,2019-09-11,Nuclei,cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*,Atlassian,Jira
CVE-2019-8451,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.94453,CWE-918,The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class.,2019-09-11,Nuclei,cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*,Atlassian,Jira Server
CVE-2019-8506,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.18108,CWE-843,"A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.",2019-12-18,CISA,cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*;cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:*;cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*,Apple,Iphone Os
CVE-2019-8513,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02919,CWE-78,This issue was addressed with improved checks. This issue is fixed in macOS Mojave 10.14.4. A local user may be able to execute arbitrary shell commands.,2019-12-18,Metasploit,cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2019-8526,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.00701,CWE-416,A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An application may be able to gain elevated privileges.,2019-12-18,CISA,cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2019-8565,7.0,CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.13512,CWE-362,"A race condition was addressed with additional validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4. A malicious application may be able to gain root privileges.",2019-12-18,Metasploit,cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*,Apple,Iphone Os
CVE-2019-8605,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.17438,CWE-416,"A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. A malicious application may be able to execute arbitrary code with system privileges.",2019-12-18,CISA,cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Iphone Os
CVE-2019-8720,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.01543,CWE-119,A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.,2023-03-06,CISA,cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_eus:8.4:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_eus:8.6:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:8.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:8.4:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:8.6:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:8.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:8.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:8.4:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:8.6:*:*:*:*:*:*:*;cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:*;cpe:2.3:a:wpewebkit:wpe_webkit:*:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:arm64:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:arm64:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:arm64:*;cpe:2.3:o:redhat:enterprise_linux_for_arm64_eus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*,Redhat,Enterprise Linux
CVE-2019-8903,0.0,,0.72058,CWE-22,index.js in Total.js Platform before 3.2.3 allows path traversal.,2019-02-18,Metasploit/Nuclei,cpe:2.3:a:totaljs:total.js:*:*:*:*:*:node.js:*:*,Totaljs,Total.Js
CVE-2019-8937,0.0,,0.1068,CWE-79,"HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizza.php, and visualizza_tabelle.php.",2019-05-17,Nuclei,cpe:2.3:a:digitaldruid:hoteldruid:2.3.0:*:*:*:*:*:*:*,Digitaldruid,Hoteldruid
CVE-2019-8942,0.0,,0.82736,CWE-434,"WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943.",2019-02-20,Metasploit,cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:5.0:-:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:5.0:beta1:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:5.0:beta2:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:5.0:beta3:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:5.0:beta4:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:5.0:beta5:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:5.0:rc1:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:5.0:rc2:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:5.0:rc3:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2019-8943,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N,0.91985,CWE-22,"WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring.",2019-02-20,Metasploit/Nuclei,cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*,Wordpress,Wordpress
CVE-2019-8982,0.0,,0.25563,CWE-918,"com/wavemaker/studio/StudioService.java in WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value, leading to disclosure of local files and SSRF.",2019-02-21,Nuclei,cpe:2.3:a:wavemaker:wavemarker_studio:6.6:*:*:*:*:*:*:*,Wavemaker,Wavemarker Studio
CVE-2019-9041,0.0,,0.31421,CWE-917,"An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzz_template.php file, the parserIfLabel() function's filtering is not strict, resulting in PHP code execution, as demonstrated by the if:assert substring.",2019-02-23,Nuclei,cpe:2.3:a:zzzcms:zzzphp:1.6.1:*:*:*:*:*:*:*,Zzzcms,Zzzphp
CVE-2019-9055,0.0,,0.12281,CWE-502,"An issue was discovered in CMS Made Simple 2.2.8. In the module DesignManager (in the files action.admin_bulk_css.php and action.admin_bulk_template.php), with an unprivileged user with Designer permission, it is possible reach an unserialize call with a crafted value in the m1_allparms parameter, and achieve object injection.",2019-03-26,Metasploit,cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*,Cmsmadesimple,Cms Made Simple
CVE-2019-9082,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.97419,CWE-94,"ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.",2019-02-24,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:opensourcebms:open_source_background_management_system:1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:thinkphp:thinkphp:*:*:*:*:*:*:*:*;cpe:2.3:a:zzzcms:zzzphp:1.6.1:*:*:*:*:*:*:*,Thinkphp,Thinkphp
CVE-2019-9193,0.0,,0.91655,CWE-78,"In PostgreSQL 9.3 through 11.2, the ""COPY TO/FROM PROGRAM"" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.",2019-04-01,Metasploit/Nuclei,cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*,Postgresql,Postgresql
CVE-2019-9194,0.0,,0.96572,CWE-78,elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.,2019-02-26,EPSS/Metasploit/Nuclei,cpe:2.3:a:std42:elfinder:*:*:*:*:*:*:*:*,Std42,Elfinder
CVE-2019-9213,5.5,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H,0.05667,CWE-476,"In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task.",2019-03-05,Metasploit,cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2019-9618,0.0,,0.40771,CWE-22,"The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the ""cfg"" parameter.",2019-05-13,Nuclei,cpe:2.3:a:gracemedia_media_player_project:gracemedia_media_player:1.0:*:*:*:*:wordpress:*:*,Gracemedia Media Player Project,Gracemedia Media Player
CVE-2019-9621,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.80906,CWE-918,"Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.",2019-04-30,CISA/Metasploit/Nuclei,cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:patch10:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:patch11:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:patch12:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:patch1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:patch2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:patch3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:patch4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:patch5:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:patch6:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:patch7:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:patch8:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:patch9:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:patch10:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:patch1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:patch2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:patch3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:patch4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:patch5:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:patch6:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:patch7:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:patch8:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:patch9:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.10:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.10:patch1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.10:patch2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.10:patch3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.10:patch4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.10:patch6:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.10:patch7:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.11:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.11:patch1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.11:patch2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.11:patch3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p5:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:patch1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:patch2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:patch3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:patch4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:patch6:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:patch7:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:patch8:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:patch9:*:*:*:*:*:*,Synacor,Zimbra Collaboration Suite
CVE-2019-9624,0.0,,0.23689,CWE-269,"Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the ""Java file manager"" and ""Upload and Download"" privileges to upload a crafted .cgi file via the /updown/upload.cgi URI.",2019-03-07,Metasploit,cpe:2.3:a:webmin:webmin:1.900:*:*:*:*:*:*:*,Webmin,Webmin
CVE-2019-9632,0.0,,0.39885,NVD-CWE-noinfo,ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack parameter is mishandled in a /CDGServer3/ClientAjax request.,2019-03-08,Nuclei,cpe:2.3:a:esafenet:electronic_document_security_management_system:v3:*:*:*:*:*:*:*;cpe:2.3:a:esafenet:electronic_document_security_management_system:v5:*:*:*:*:*:*:*,Esafenet,Electronic Document Security Management System
CVE-2019-9670,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99986,CWE-611,"mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.",2019-05-29,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p5:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p6:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p7:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p8:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p9:*:*:*:*:*:*,Synacor,Zimbra Collaboration Suite
CVE-2019-9692,0.0,,0.45896,CWE-434,"class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, or PNG).",2019-03-11,Metasploit,cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*,Cmsmadesimple,Cms Made Simple
CVE-2019-9726,0.0,,0.16342,CWE-22,Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.,2019-05-13,Nuclei,cpe:2.3:h:eq-3:ccu3:-:*:*:*:*:*:*:*;cpe:2.3:o:eq-3:ccu3_firmware:*:*:*:*:*:*:*:*,Eq-3,Ccu3 Firmware
CVE-2019-9733,0.0,,0.53879,NVD-CWE-noinfo,"An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password of the admin account in case an administrator gets locked out from the Artifactory console. This is only allowable from a connection directly from localhost, but providing a X-Forwarded-For HTTP header to the request allows an unauthenticated user to login with the default credentials of the access-admin account while bypassing the whitelist of allowed IP addresses. The access-admin account can use Artifactory's API to request authentication tokens for all users including the admin account and, in turn, assume full control of all artifacts and repositories managed by Artifactory.",2019-04-11,Nuclei,cpe:2.3:a:jfrog:artifactory:6.7.3:*:*:*:*:*:*:*,Jfrog,Artifactory
CVE-2019-9757,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.37336,CWE-611,An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-exportImage.view or visualization-exportPDF.view allows local files to be read.,2019-10-29,Nuclei,cpe:2.3:a:labkey:labkey_server:19.1.0:*:*:*:*:*:*:*,Labkey,Labkey Server
CVE-2019-9760,0.0,,0.53093,CWE-787,FTPGetter Standard v.5.97.0.177 allows remote code execution when a user initiates an FTP connection to an attacker-controlled machine that sends crafted responses. Long responses can also crash the FTP client with memory corruption.,2019-03-14,Metasploit,cpe:2.3:a:ftpgetter:ftpgetter:5.97.0.177:*:*:*:standard:*:*:*,Ftpgetter,Ftpgetter
CVE-2019-9762,0.0,,0.05806,CWE-89,A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnerability does not need any authentication.,2019-03-14,Nuclei,cpe:2.3:a:phpshe:phpshe:1.7:*:*:*:*:*:*:*,Phpshe,Phpshe
CVE-2019-9851,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.78347,CWE-20,"LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from document event script handers, e.g. mouse over. However LibreOffice also has a separate feature where documents can specify that pre-installed scripts can be executed on various global script events such as document-open, etc. In the fixed versions, global script event handlers are validated equivalently to document script event handlers. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.",2019-08-15,Metasploit,cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2019-9858,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.19165,CWE-22,"Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17. Horde/Form/Type.php contains a vulnerable class that handles image upload in forms. When the Horde_Form_Type_image method onSubmit() is called on uploads, it invokes the functions getImage() and _getUpload(), which uses unsanitized user input as a path to save the image. The unsanitized POST parameter object[photo][img][file] is saved in the $upload[img][file] PHP variable, allowing an attacker to manipulate the $tmp_file passed to move_uploaded_file() to save the uploaded file. By setting the parameter to (for example) ../usr/share/horde/static/bd.php, one can write a PHP backdoor inside the web root. The static/ destination folder is a good candidate to drop the backdoor because it is always writable in Horde installations. (The unsanitized POST parameter went probably unnoticed because it's never submitted by the forms, which default to securely using a random path.)",2019-05-29,Metasploit,cpe:2.3:a:horde:groupware:5.2.17:*:*:*:webmail:*:*:*;cpe:2.3:a:horde:groupware:5.2.22:*:*:*:webmail:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2019-9874,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.83857,CWE-502,Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.,2019-05-31,CISA/Nuclei,cpe:2.3:a:sitecore:cms:*:*:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:*,Sitecore,Cms
CVE-2019-9875,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.14154,CWE-502,Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.,2019-05-31,CISA,cpe:2.3:a:sitecore:cms:*:*:*:*:*:*:*:*,Sitecore,Cms
CVE-2019-9879,0.0,,0.46614,CWE-306,"The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation.",2019-06-10,Nuclei,cpe:2.3:a:wpengine:wpgraphql:0.2.3:*:*:*:*:wordpress:*:*,Wpengine,Wpgraphql
CVE-2019-9880,0.0,,0.34761,CWE-306,"An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.",2019-06-10,Nuclei,cpe:2.3:a:wpengine:wpgraphql:0.2.3:*:*:*:*:wordpress:*:*,Wpengine,Wpgraphql
CVE-2019-9881,0.0,,0.18832,CWE-306,"The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.",2019-06-10,Nuclei,cpe:2.3:a:wpengine:wpgraphql:0.2.3:*:*:*:*:wordpress:*:*,Wpengine,Wpgraphql
CVE-2019-9912,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03151,CWE-79,The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO.,2019-03-22,Nuclei,cpe:2.3:a:codecabin:wp_go_maps:*:*:*:*:*:wordpress:*:*,Codecabin,Wp Go Maps
CVE-2019-9915,0.0,,0.03626,CWE-601,GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter.,2019-03-22,Nuclei,cpe:2.3:a:get-simple.:getsimplecms:3.3.13:*:*:*:*:*:*:*,Get-Simple.,Getsimplecms
CVE-2019-9922,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.1059,CWE-22,An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. Directory Traversal allows read access to arbitrary files.,2019-03-29,Nuclei,cpe:2.3:a:harmistechnology:je_messenger:1.2.2:*:*:*:*:joomla\!:*:*,Harmistechnology,Je Messenger
CVE-2019-9955,0.0,,0.20861,CWE-79,"On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, ZyWALL 1100 devices, the security firewall login page is vulnerable to Reflected XSS via the unsanitized 'mp_idx' parameter.",2019-04-22,Nuclei,cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg1100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg110:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg1900:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg210:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg2200-vpn:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg310:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg40:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg40w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg60:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg60w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_1100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_110:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_310:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp200_firmware:4.31:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp500_firmware:4.31:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp800_firmware:4.31:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg1100_firmware:4.31:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg110_firmware:4.31:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg1900_firmware:4.31:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg20-vpn_firmware:4.31:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg20w-vpn_firmware:4.31:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg210_firmware:4.31:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg2200-vpn_firmware:4.31:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg310_firmware:4.31:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg40_firmware:4.31:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg40w_firmware:4.31:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg60_firmware:4.31:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg60w_firmware:4.31:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn300_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn50_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_1100_firmware:4.31:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_110_firmware:4.31:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_310_firmware:4.31:*:*:*:*:*:*:*,Zyxel,Atp200 Firmware
CVE-2019-9960,0.0,,0.13373,CWE-22,The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path.,2019-03-24,Metasploit,cpe:2.3:a:limesurvey:limesurvey:*:*:*:*:*:*:*:*,Limesurvey,Limesurvey
CVE-2019-9978,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.73543,CWE-79,"The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.",2019-03-24,CISA/Nuclei,cpe:2.3:a:warfareplugins:social_warfare:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:warfareplugins:social_warfare_pro:*:*:*:*:*:wordpress:*:*,Warfareplugins,Social Warfare
CVE-2020-0041,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03246,CWE-20,"In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-145988638References: Upstream kernel",2020-03-10,CISA,cpe:2.3:o:google:android:-:*:*:*:*:*:*:*,Google,Android
CVE-2020-0069,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01299,CWE-787,"In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754",2020-03-10,CISA,cpe:2.3:h:huawei:berkeley-l09:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:columbia-al10b:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:columbia-l29d:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:columbia-tl00b:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:columbia-tl00d:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:cornell-al00a:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:cornell-tl10b:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:dura-al00a:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:honor_20_pro:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:honor_8a:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:honor_view_20:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:jakarta-al00a:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:katyusha-al00a:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:katyusha-al10a:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:madrid-al00a:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:nova_3:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:nova_4:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:paris-l29b:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:princeton-al10b:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:sydney-al00:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:sydney-tl00:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:sydneym-al00:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:tony-al00b:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:tony-tl00b:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:y6_2019:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:yale-al00a:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:yale-l21a:-:*:*:*:*:*:*:*;cpe:2.3:h:huawei:yalep-al10b:-:*:*:*:*:*:*:*;cpe:2.3:o:google:android:-:*:*:*:*:*:*:*;cpe:2.3:o:huawei:berkeley-l09_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:columbia-al10b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:columbia-l29d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:columbia-tl00b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:columbia-tl00d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:cornell-al00a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:cornell-tl10b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:dura-al00a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:honor_20_pro_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:honor_8a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:honor_view_20_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:jakarta-al00a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:katyusha-al00a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:katyusha-al10a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:madrid-al00a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:nova_3_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:nova_4_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:paris-l29b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:princeton-al10b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:sydney-al00_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:sydney-tl00_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:sydneym-al00_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:tony-al00b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:tony-tl00b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:y6_2019_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:yale-al00a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:yale-l21a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:huawei:yalep-al10b_firmware:*:*:*:*:*:*:*:*,Huawei,Berkeley-L09 Firmware
CVE-2020-0601,8.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N,0.89436,CWE-295,"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.",2020-01-14,CISA,cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1909:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2020-0618,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.99022,CWE-502,"A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.",2020-02-11,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:microsoft:sql_server:2012:sp4:*:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:sql_server:2016:sp2:*:*:*:*:x64:*,Microsoft,Sql Server
CVE-2020-0638,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03042,NVD-CWE-noinfo,"An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.",2020-01-14,CISA,cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1909:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1709
CVE-2020-0646,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99222,CWE-91,"A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.",2020-01-14,CISA/EPSS/Metasploit,cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.6.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.6:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:1803:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*,Microsoft,Windows Server 2008
CVE-2020-0668,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.2605,CWE-732,"An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0669, CVE-2020-0670, CVE-2020-0671, CVE-2020-0672.",2020-02-11,Metasploit,cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:1803:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10
CVE-2020-0674,7.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.86863,CWE-416,"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0673, CVE-2020-0710, CVE-2020-0711, CVE-2020-0712, CVE-2020-0713, CVE-2020-0767.",2020-02-11,CISA,cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows Server 2008
CVE-2020-0683,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.07667,NVD-CWE-noinfo,"An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0686.",2020-02-11,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1909:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:-:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2020-0688,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.99965,CWE-287,"A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.",2020-02-11,CISA/EPSS/Metasploit,cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup_30:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2020-0787,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.42524,CWE-59,"An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability'.",2020-03-12,CISA/Metasploit,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1909:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2020-0796,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.9981,CWE-119,"A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.",2020-03-12,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_1909:-:*:*:*:*:*:x64:*,Microsoft,Windows 10 1903
CVE-2020-0878,4.2,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N,0.02696,CWE-787,"<p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, the attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>An attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers, and then convince a user to view the website. The attacker could also take advantage of compromised websites, or websites that accept or host user-provided content or advertisements, by adding specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically via an enticement in email or instant message, or by getting them to open an email attachment.</p>
<p>The security update addresses the vulnerability by modifying how Microsoft browsers handle objects in memory.</p>",2020-09-11,CISA,cpe:2.3:a:microsoft:chakracore:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2020-0938,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.69166,CWE-787,"A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format.For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely, aka 'Adobe Font Manager Library Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1020.",2020-04-15,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_1909:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2020-0968,7.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.30018,CWE-787,"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0970.",2020-04-15,CISA,cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2020-0986,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.15932,CWE-787,"An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1237, CVE-2020-1246, CVE-2020-1262, CVE-2020-1264, CVE-2020-1266, CVE-2020-1269, CVE-2020-1273, CVE-2020-1274, CVE-2020-1275, CVE-2020-1276, CVE-2020-1307, CVE-2020-1316.",2020-06-09,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_2004:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_2004:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_2004:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_1909:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2004:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2020-10148,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9198,CWE-288,"The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 are affected.",2020-12-29,CISA/Nuclei,cpe:2.3:a:solarwinds:orion_platform:2019.4:hotfix5:*:*:*:*:*:*;cpe:2.3:a:solarwinds:orion_platform:2020.2.1:hotfix1:*:*:*:*:*:*;cpe:2.3:a:solarwinds:orion_platform:2020.2:-:*:*:*:*:*:*,Solarwinds,Orion Platform
CVE-2020-10181,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.14322,CWE-352,"goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by a setString=new_user<*1*>administrator<*1*>123456 request.",2020-03-11,CISA,cpe:2.3:h:sumavision:enhanced_multimedia_router:-:*:*:*:*:*:*:*;cpe:2.3:o:sumavision:enhanced_multimedia_router_firmware:3.0.4.27:*:*:*:*:*:*:*,Sumavision,Enhanced Multimedia Router Firmware
CVE-2020-10189,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99941,CWE-502,Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.,2020-03-06,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:zohocorp:manageengine_desktop_central:*:*:*:*:*:*:*:*,Zohocorp,Manageengine Desktop Central
CVE-2020-10199,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.99064,CWE-917,Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).,2020-04-01,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:sonatype:nexus:*:*:*:*:*:*:*:*,Sonatype,Nexus
CVE-2020-1020,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.65037,CWE-787,"A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format.For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely, aka 'Adobe Font Manager Library Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0938.",2020-04-15,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1909:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2020-10220,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99683,CWE-89,An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter.,2020-03-07,EPSS/Metasploit/Nuclei,cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:*,Rconfig,Rconfig
CVE-2020-10221,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.36754,CWE-78,lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter.,2020-03-08,CISA,cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:*,Rconfig,Rconfig
CVE-2020-10257,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.08877,CWE-94,"The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.",2020-03-10,Nuclei,"cpe:2.3:a:themerex:addons:1.0.49.10:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.49.5:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.49.6.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.49.6:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.49.8:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.50.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.50:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.51.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.51.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.52.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.52.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.53.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.53.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.53.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.53:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.54:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.55.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.55.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.55.4:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.55.7:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.56:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.57.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.57.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.57.4:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.57:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.58.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.59.1.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.59.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.59.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.59:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.60:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.61.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.61.2:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.61.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.61:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.62.1:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.62.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.65:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.66:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.6.67:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:addons:1.70.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:aldo-gutenberg_wordpress_blog_theme:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:amuli:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:blabber:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:bonkozoo_zoo:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:briny-diving_wordpress_theme:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:bugster-pests_control:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:buzz_stone-magazine_\&_blog:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:chainpress:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:chit_club-board_games:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:coinpress-cryptocurrency_magazine_\&_blog_wordpress_theme:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:corredo_sport_event:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:dronex-aerial_photography_services:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:especio-food_gutenberg_theme:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:fc_united-football:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:gloss_blog:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:gridiron:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:hallelujah-church:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:heaven_11-multiskin_property_theme:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:helion-agency_\&portfolio:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:hobo_digital_nomad_blog:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:impacto_patronus_multi-landing:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:justitia-multiskin_lawyer_theme:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:kargo-freight_transport:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:katelyn-gutenberg_wordpress_blog_theme:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:kids_care:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:kratz-digital_agency:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:lingvico-language_learning_school:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:maxify-startup_blog:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:meals_and_wheels-food_truck:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:modern_housewife-housewife_and_family_blog:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:mystik-esoterics:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:nazareth-church:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:nelson-barbershop_\+_tattoo_salon:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:netmix-broadband_\&_telecom:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:ozeum-museum:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:partiso_electioncampaign:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:piqes-creative_startup_\&_agency_wordpress_theme:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:pixefy:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:plumbing-repair\,_building_\&_construction_wordpress_theme:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:prider-pride_fest:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:rare_radio:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:renewal-plastic_surgeon_clinic:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:rhodos-creative_corporate_wordpress_theme:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:right_way:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:rosalinda-vegetarian_\&_health_coach:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:rumble-single_fighter_boxer\,_news\,_gym\,_store:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:samadhi-buddhist:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:savejulia_personal_fundraising_campaign:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:scientia-public_library:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:skydiving_and_flying_company:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:tacticool-shooting_range_wordpress_theme:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:tantum-rent_a_car\,_rent_a_bike\,_rent_a_scooter_multiskin_theme:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:tediss-soft_play_area\,_cafe_\&_child_care_center:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:topper_theme_and_skins:-:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:tornados:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:vapester:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:vihara-ashram\,_buddhist:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:vixus-startup_\/_mobile_application:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:wellspring_water_filter_systems:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:yolox-startup_magazine_\&_blog_wordpress_theme:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:yottis-simple_portfolio:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themerex:yungen-digital\/marketing_agency:*:*:*:*:*:wordpress:*:*",Themerex,Addons
CVE-2020-1027,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.04447,CWE-787,"An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0913, CVE-2020-1000, CVE-2020-1003.",2020-04-15,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1909:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2020-1040,9.0,CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.06903,CWE-20,"A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1032, CVE-2020-1036, CVE-2020-1041, CVE-2020-1042, CVE-2020-1043.",2020-07-14,CISA,cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*,Microsoft,Windows Server 2008
CVE-2020-1048,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.16502,CWE-669,"An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system, aka 'Windows Print Spooler Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1070.",2020-05-21,Metasploit,cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:1803:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10
CVE-2020-10532,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02785,CWE-312,The AD Helper component in WatchGuard Fireware before 5.8.5.10317 allows remote attackers to discover cleartext passwords via the /domains/list URI.,2020-03-12,Nuclei,cpe:2.3:o:watchguard:ad_helper_firmware:*:*:*:*:*:*:*:*,Watchguard,Ad Helper Firmware
CVE-2020-1054,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.52778,CWE-787,"An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1143.",2020-05-21,CISA/Metasploit,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_1909:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2020-10546,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.8733,CWE-89,"rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.",2020-06-04,Nuclei,cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:*,Rconfig,Rconfig
CVE-2020-10547,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.36114,CWE-89,"rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.",2020-06-04,Nuclei,cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:*,Rconfig,Rconfig
CVE-2020-10548,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.37325,CWE-89,"rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.",2020-06-04,Nuclei,cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:*,Rconfig,Rconfig
CVE-2020-10549,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.36164,CWE-89,"rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.",2020-06-04,Nuclei,cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:*,Rconfig,Rconfig
CVE-2020-10644,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.20208,CWE-502,"The affected product lacks proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8 Gateway (versions prior to 8.0.10) and Ignition 7 Gateway (versions prior to 7.9.14), allowing an attacker to obtain sensitive information.",2020-06-09,Metasploit,cpe:2.3:a:inductiveautomation:ignition_gateway:*:*:*:*:*:*:*:*,Inductiveautomation,Ignition Gateway
CVE-2020-10770,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.69724,CWE-918,"A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack.",2020-12-15,Nuclei,cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*,Redhat,Keycloak
CVE-2020-10808,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.77261,CWE-78,"Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. The attacker must be able to create a crafted filename on the server, as demonstrated by an FTP session that renames .bash_logout to a .bash_logout' substring followed by shell metacharacters.",2020-03-22,Metasploit,cpe:2.3:a:vestacp:vesta_control_panel:*:*:*:*:*:*:*:*,Vestacp,Vesta Control Panel
CVE-2020-10882,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.44711,CWE-78,"This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service, which listens on UDP port 20002 by default. When parsing the slave_mac parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the root user. Was ZDI-CAN-9650.",2020-03-25,Metasploit,cpe:2.3:h:tp-link:ac1750:-:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:ac1750_firmware:190726:*:*:*:*:*:*:*,TP-Link,Ac1750 Firmware
CVE-2020-10883,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.05898,CWE-732,This vulnerability allows local attackers to escalate privileges on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the file system. The issue lies in the lack of proper permissions set on the file system. An attacker can leverage this vulnerability to escalate privileges. Was ZDI-CAN-9651.,2020-03-25,Metasploit,cpe:2.3:h:tp-link:ac1750:-:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:ac1750_firmware:190726:*:*:*:*:*:*:*,TP-Link,Ac1750 Firmware
CVE-2020-10884,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.2468,CWE-321,"This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service, which listens on UDP port 20002 by default. This issue results from the use of hard-coded encryption key. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-9652.",2020-03-25,Metasploit,cpe:2.3:h:tp-link:ac1750:-:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:ac1750_firmware:190726:*:*:*:*:*:*:*,TP-Link,Ac1750 Firmware
CVE-2020-10914,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.4703,CWE-502,"This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to exploit this vulnerability. The specific flaw exists within the PerformHandshake method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-10400.",2020-04-22,Metasploit,cpe:2.3:a:veeam:one:9.5.4.4587:*:*:*:*:*:*:*,Veeam,One
CVE-2020-10915,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.86619,CWE-502,"This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HandshakeResult method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-10401.",2020-04-22,Metasploit,cpe:2.3:a:veeam:one:9.5.4.4587:*:*:*:*:*:*:*,Veeam,One
CVE-2020-10923,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.84676,CWE-305,"This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPnP service, which listens on TCP port 5000. A crafted UPnP message can be used to bypass authentication. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-9642.",2020-07-28,Metasploit,cpe:2.3:h:netgear:r6700:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6700_firmware:1.0.4.84_10.0.58:*:*:*:*:*:*:*,Netgear,R6700 Firmware
CVE-2020-10924,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.87343,CWE-121,"This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the UPnP service, which listens on TCP port 5000 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9643.",2020-07-28,Metasploit,cpe:2.3:h:netgear:r6700:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6700_firmware:1.0.4.84_10.0.58:*:*:*:*:*:*:*,Netgear,R6700 Firmware
CVE-2020-10973,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.07759,CWE-306,"An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacker must perform a decryption step, but all decryption information is readily available.",2020-05-07,Nuclei,cpe:2.3:h:wavlink:wn530hg4:-:*:*:*:*:*:*:*;cpe:2.3:h:wavlink:wn531g3:-:*:*:*:*:*:*:*;cpe:2.3:h:wavlink:wn533a8:-:*:*:*:*:*:*:*;cpe:2.3:h:wavlink:wn551k1:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wn530hg4_firmware:m30hg4.v5030.191116:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wn531g3_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wn533a8_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wn551k1_firmware:-:*:*:*:*:*:*:*,Wavlink,Wn530Hg4 Firmware
CVE-2020-10977,5.5,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.42741,CWE-22,GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects.,2020-04-08,Metasploit,cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*;cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*,Gitlab,Gitlab
CVE-2020-10987,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.7981,CWE-78,The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.,2020-07-13,CISA/Nuclei,cpe:2.3:h:tenda:ac15:-:*:*:*:*:*:*:*;cpe:2.3:o:tenda:ac15_firmware:15.03.05.19:*:*:*:*:*:*:*,Tenda,Ac15 Firmware
CVE-2020-11022,6.9,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N,0.99019,CWE-79,"In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",2020-04-29,EPSS,cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*;cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:max_data:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*;cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:agile_product_supplier_collaboration_for_process:6.2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_digital_experience:18.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_application_session_controller:3.8m0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_diameter_signaling_router_idih\::*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:8.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_asset_liability_management:8.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_balance_sheet_planning:8.0.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_data_foundation:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_data_governance_for_us_regulatory_reporting:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_data_integration_hub:8.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:8.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_profitability_management:8.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_profitability_management:8.0.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_profitability_management:8.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_european_banking_authority:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_us_federal_reserve:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:healthcare_foundation:7.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:healthcare_foundation:7.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:healthcare_foundation:7.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hospitality_simphony:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hospitality_simphony:18.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hospitality_simphony:18.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hospitality_simphony:19.1.0-19.1.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_accounting_analyzer:8.0.9:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.0.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_data_foundation:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_data_foundation:8.0.6-8.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.6.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*;cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*;cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation_connector_for_siebel:10.4.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation_for_mobile_devices:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:siebel_ui_framework:20.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*,Netapp,H300S Firmware
CVE-2020-11023,6.9,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N,0.8383,CWE-79,"In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",2020-04-29,CISA,cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*;cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*;cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:cloud_insights_storage_workload_security_agent:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:hci_baseboard_management_controller:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:max_data:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:snapcenter_server:-:*:*:*:*:*:*:*;cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_enterprise_collections:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:blockchain_platform:21.1.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:*;cpe:2.3:a:oracle:communications_analytics:12.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_interactive_session_recorder:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_operations_monitor:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_report_manager:8.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_route_manager:8.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_de_nederlandsche_bank:8.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:health_sciences_inform:6.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:healthcare_translational_research:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:healthcare_translational_research:3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:healthcare_translational_research:3.3.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:healthcare_translational_research:3.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hyperion_financial_reporting:11.1.2.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:oss_support_tools:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:peoplesoft_enterprise_human_capital_management_resources:9.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:*;cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:*;cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:*;cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:*;cpe:2.3:a:oracle:rest_data_services:19c:*:*:*:-:*:*:*;cpe:2.3:a:oracle:siebel_mobile:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*,Netapp,H300S Firmware
CVE-2020-11034,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.07608,CWE-185,"In GLPI before version 9.4.6, there is a vulnerability that allows bypassing the open redirect protection based which is based on a regexp. This is fixed in version 9.4.6.",2020-05-05,Nuclei,cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*,Glpi-Project,Glpi
CVE-2020-11108,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.78262,CWE-434,"The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abused for Remote Code Execution by writing to a PHP file in the web directory. (Also, it can be used in conjunction with the sudo rule for the www-data user to escalate privileges to root.) The code error is in gravity_DownloadBlocklistFromUrl in gravity.sh.",2020-05-11,Metasploit,cpe:2.3:a:pi-hole:pi-hole:*:*:*:*:*:*:*:*,Pi-Hole,Pi-Hole
CVE-2020-11110,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.09619,CWE-79,"Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.",2020-07-27,Nuclei,cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*,Grafana,Grafana
CVE-2020-11261,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01772,CWE-787,"Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables",2021-06-09,CISA,cpe:2.3:h:qualcomm:apq8009:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:apq8009w:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:apq8017:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:apq8037:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:apq8053:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:apq8064au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:apq8096au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:aqt1000:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ar8031:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ar8035:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ar8151:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:csra6620:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:csra6640:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:csrb31024:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fsm10055:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fsm10056:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:mdm9650:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:msm8909w:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:msm8917:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:msm8920:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:msm8937:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:msm8940:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:msm8953:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:msm8996au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm215:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm3003a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm4125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm439:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm456:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm6125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm6150:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm6150a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm6150l:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm6250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm6350:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm640a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm640l:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm640p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm660:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm660a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm660l:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm670:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm670a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm670l:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm7150a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm7150l:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm7250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm7250b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm7350c:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8004:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8005:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8008:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8009:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8150:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8150a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8150b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8150c:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8150l:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8350:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8350b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8350bh:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8350bhs:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8350c:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm855:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm855a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm855b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm855l:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm855p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8909:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8916:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8937:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8940:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8953:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8996:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8998:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmc1000h:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmd9655:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pme605:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmi632:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmi8937:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmi8952:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmi8994:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmi8996:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmi8998:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmk7350:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmk8001:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmk8002:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmk8003:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmk8350:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmm6155au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmm8155au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmm855au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmm8996au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmr525:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmr735a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmr735b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmw3100:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmx20:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmx24:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmx50:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmx55:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat3514:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat3516:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat3518:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat3519:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat3522:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat3550:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat3555:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat5515:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat5516:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat5522:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat5533:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat5568:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qbt1000:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qbt1500:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qbt2000:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca4020:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6174a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6310:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6320:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6335:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6390:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6420:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6421:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6426:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6430:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6431:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6436:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6564:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6564a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6564au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6584au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6595au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6696:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca8337:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca9377:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca9379:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcc1110:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm2290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm4290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm6125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs2290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs405:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs410:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs4290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs603:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs605:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs610:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs6125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm2301:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm2302:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm2305:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm2307:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm2308:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm2310:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm3301:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm3302:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm4643:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm4650:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5579:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5620:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5621:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5650:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5652:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5670:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5671:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5677:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5679:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qet4100:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qet4101:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qet5100:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qet5100m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qet6100:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qet6110:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe2101:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe2520:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe2550:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe3340:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe4301:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe4302:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe4303:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe4305:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe4308:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe4309:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe4320:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe4373fc:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfs2530:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfs2580:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfs2608:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfs2630:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln1020:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln1021aq:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln1030:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln1031:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln1036aq:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln4640:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln4642:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln4650:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln5020:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln5030:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln5040:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa2625:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa4340:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa4360:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa4361:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa5373:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa5460:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa5461:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa5580:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa5581:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa6560:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa8673:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa8675:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa8686:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa8801:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa8802:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa8803:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa8821:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa8842:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm2630:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm4621:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm4630:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm4640:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm4641:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm4650:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5541:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5577:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5579:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5620:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5621:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5641:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5657:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5658:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5670:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5677:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5679:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5870:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5875:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm6325:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm6375:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm6582:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm6585:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm6621:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm6670:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm8820:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm8830:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm8870:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm8895:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qsm7250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qsm8250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qsw6310:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qsw8573:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qsw8574:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qtc410s:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qtc800h:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qtc800s:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qtc800t:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qtc801s:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qtm525:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qtm527:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qualcomm215:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:rgr7640au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:rsw8577:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa415m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa515m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6145p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6155:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6155p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8155:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8155p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd205:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd210:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd429:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd439:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd450:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd460:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd632:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd660:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd662:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd665:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd670:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd675:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd690_5g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd710:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd720g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd730:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd750g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd765:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd765g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd768g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd820:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd821:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd835:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd845:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd855:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd865_5g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd888_5g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd_455:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd_636:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd_675:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd_8c:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd_8cx:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sda429w:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdm429w:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdm630:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdm830:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr051:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr052:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr425:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr660:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr660g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr675:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr735:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr735g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr8150:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr8250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr845:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr865:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdw2500:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdw3100:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx20:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx20m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx24:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx50m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx55:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx55m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdxr1:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdxr2_5g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm4125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm4350:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6250p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7250p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7350:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1350:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1351:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1354:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1355:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1357:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1358:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1360:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1380:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1381:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1390:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1394:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1395:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1396:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1398:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb231:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb2351:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smr525:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smr526:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9326:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9335:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9340:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9341:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9371:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3610:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3615:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3620:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3660:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3660b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3680:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3680b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3910:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3980:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3988:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3990:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3991:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3998:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3999:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6740:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6750:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6850:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6851:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6856:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wgr7640:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wtr2955:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wtr2965:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wtr3905:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wtr3925:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wtr3950:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wtr4905:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wtr5975:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wtr6955:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8009_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8009w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8017_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8037_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8053_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8064au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8096au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:aqt1000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ar8031_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ar8035_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ar8151_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:csra6620_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:csra6640_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:csrb31024_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fsm10055_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fsm10056_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:mdm9650_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:msm8909w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:msm8917_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:msm8920_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:msm8937_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:msm8940_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:msm8953_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:msm8996au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm215_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm3003a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm4125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm439_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm456_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm6125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm6150_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm6150a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm6150l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm6250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm6350_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm640a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm640l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm640p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm660_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm660a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm660l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm670_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm670a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm670l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm7150a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm7150l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm7250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm7250b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm7350c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8004_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8005_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8008_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8009_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8150_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8150a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8150b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8150c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8150l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8350_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8350b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8350bh_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8350bhs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8350c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm855_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm855a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm855b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm855l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm855p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8909_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8916_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8937_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8940_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8953_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8996_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8998_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmc1000h_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmd9655_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pme605_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmi632_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmi8937_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmi8952_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmi8994_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmi8996_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmi8998_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmk7350_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmk8001_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmk8002_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmk8003_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmk8350_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmm6155au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmm8155au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmm855au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmm8996au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmr525_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmr735a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmr735b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmw3100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmx20_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmx24_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmx50_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmx55_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat3514_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat3516_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat3518_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat3519_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat3522_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat3550_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat3555_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat5515_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat5516_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat5522_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat5533_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat5568_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qbt1000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qbt1500_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qbt2000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca4020_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6174a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6310_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6320_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6335_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6390_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6420_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6421_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6426_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6430_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6431_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6436_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6564_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6564a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6564au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6584au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6595au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6696_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca8337_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca9377_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca9379_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcc1110_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm2290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm4290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm6125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs2290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs405_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs410_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs4290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs603_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs605_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs610_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs6125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm2301_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm2302_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm2305_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm2307_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm2308_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm2310_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm3301_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm3302_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm4643_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm4650_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5579_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5620_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5621_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5650_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5652_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5670_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5671_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5677_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5679_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qet4100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qet4101_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qet5100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qet5100m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qet6100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qet6110_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe2101_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe2520_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe2550_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe3340_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe4301_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe4302_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe4303_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe4305_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe4308_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe4309_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe4320_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe4373fc_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfs2530_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfs2580_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfs2608_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfs2630_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln1020_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln1021aq_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln1030_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln1031_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln1036aq_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln4640_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln4642_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln4650_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln5020_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln5030_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln5040_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa2625_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa4340_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa4360_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa4361_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa5373_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa5460_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa5461_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa5580_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa5581_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa6560_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa8673_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa8675_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa8686_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa8801_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa8802_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa8803_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa8821_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa8842_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm2630_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm4621_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm4630_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm4640_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm4641_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm4650_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5541_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5577_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5579_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5620_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5621_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5641_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5657_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5658_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5670_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5677_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5679_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5870_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5875_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm6325_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm6375_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm6582_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm6585_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm6621_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm6670_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm8820_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm8830_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm8870_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm8895_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qsm7250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qsm8250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qsw6310_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qsw8573_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qsw8574_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qtc410s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qtc800h_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qtc800s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qtc800t_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qtc801s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qtm525_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qtm527_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qualcomm215_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:rgr7640au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:rsw8577_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa415m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa515m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6145p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6155_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6155p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8155_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8155p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd205_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd210_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd429_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd439_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd450_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd460_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd632_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd660_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd662_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd665_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd670_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd675_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd690_5g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd710_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd720g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd730_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd750g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd765_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd765g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd768g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd820_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd821_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd835_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd845_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd855_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd865_5g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd888_5g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd_455_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd_636_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd_675_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd_8c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd_8cx_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sda429w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdm429w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdm630_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdm830_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr051_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr052_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr425_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr660_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr660g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr675_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr735_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr735g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr8150_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr8250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr845_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr865_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdw2500_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdw3100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx20_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx20m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx24_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx50m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx55_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx55m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdxr1_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdxr2_5g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm4125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm4350_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6250p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7250p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7350_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1350_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1351_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1354_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1355_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1357_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1358_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1360_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1380_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1381_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1390_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1394_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1395_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1396_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1398_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb231_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb2351_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smr525_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smr526_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9326_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9335_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9340_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9341_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9371_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3610_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3615_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3620_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3660_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3660b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3680_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3680b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3910_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3980_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3990_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3991_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3998_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3999_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6740_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6750_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6850_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6851_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6856_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wgr7640_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wtr2955_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wtr2965_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wtr3905_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wtr3925_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wtr3950_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wtr4905_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wtr5975_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wtr6955_firmware:-:*:*:*:*:*:*:*,Qualcomm,Apq8009 Firmware
CVE-2020-11441,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02312,CWE-74,"phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. NOTE: the vendor states ""I don't see anything specifically exploitable.",2020-03-31,Nuclei,cpe:2.3:a:phpmyadmin:phpmyadmin:5.0.2:*:*:*:*:*:*:*,Phpmyadmin,Phpmyadmin
CVE-2020-11450,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.17841,NVD-CWE-noinfo,"Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other information through the URL /MicroStrategyWS/happyaxis.jsp. An attacker could use this vulnerability to learn more about the environment the application is running in. This issue has been mitigated in all versions of the product 11.0 and higher.",2020-04-02,Nuclei,cpe:2.3:a:microstrategy:microstrategy_web:*:*:*:*:*:*:*:*,Microstrategy,Microstrategy Web
CVE-2020-11455,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96986,CWE-22,LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php.,2020-04-01,EPSS/Metasploit/Nuclei,cpe:2.3:a:limesurvey:limesurvey:*:*:*:*:*:*:*:*;cpe:2.3:a:limesurvey:limesurvey:4.1.12:-:*:*:*:*:*:*;cpe:2.3:a:limesurvey:limesurvey:4.1.12:200324:*:*:*:*:*:*,Limesurvey,Limesurvey
CVE-2020-1147,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.94243,NVD-CWE-Other,"A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.",2020-07-14,CISA/Metasploit,cpe:2.3:a:microsoft:.net_core:2.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_core:3.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.6.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.6:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_enterprise_server:2013:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:visual_studio_2017:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:1803:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows Server 2008
CVE-2020-11491,4.9,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N,0.0787,CWE-22,"Monitoring::Logs in Zen Load Balancer 3.10.1 allows remote authenticated admins to conduct absolute path traversal attacks, as demonstrated by a filelog=/etc/shadow request to index.cgi.",2020-04-02,Metasploit,cpe:2.3:a:zevenet:zen_load_balancer:3.10.1:*:*:*:*:*:*:*,Zevenet,Zen Load Balancer
CVE-2020-11514,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09106,CWE-862,"The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escalate or revoke administrative privileges for existing users via the unsecured rankmath/v1/updateMeta REST API endpoint.",2020-04-07,Nuclei,cpe:2.3:a:rankmath:seo:*:*:*:*:free:wordpress:*:*,Rankmath,Seo
CVE-2020-11515,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02072,CWE-601,"The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external web site) via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an ""Open Redirect"" issue; instead, it allows the attacker to create a new URI with an arbitrary name (e.g., the /exampleredirect URI).",2020-04-07,Nuclei,cpe:2.3:a:rankmath:seo:*:*:*:*:free:wordpress:*:*,Rankmath,Seo
CVE-2020-11529,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.10879,CWE-601,Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x.,2020-04-04,Nuclei,cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*,Getgrav,Grav
CVE-2020-11530,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.95657,CWE-89,"A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. The vulnerability is introduced in the id GET parameter supplied to get_script/index.php, and allows an attacker to execute arbitrary SQL queries in the context of the WP database user.",2020-05-08,EPSS/Metasploit/Nuclei,cpe:2.3:a:idangero:chop_slider:3.0:*:*:*:*:wordpress:*:*,Idangero,Chop Slider
CVE-2020-11532,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.77477,CWE-1188,Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. This allows an attacker to bypass authentication for this server and execute all operations in the context of admin user.,2020-05-08,Metasploit,cpe:2.3:a:zohocorp:manageengine_adaudit_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:*:*:*:*:*:*:*:*,Zohocorp,Manageengine Adaudit Plus
CVE-2020-11546,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.32841,CWE-94,SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php. An unauthenticated remote attacker can exploit this behavior to execute arbitrary PHP code via Code Injection.,2020-07-14,Nuclei,cpe:2.3:a:superwebmailer:superwebmailer:*:*:*:*:*:*:*:*,Superwebmailer,Superwebmailer
CVE-2020-11547,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.52059,CWE-306,"PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself (CPU usage, memory, Windows version, and internal statistics) via an HTTP request, as demonstrated by type=probes to login.htm or index.htm.",2020-04-05,Nuclei,cpe:2.3:a:paessler:prtg_network_monitor:*:*:*:*:*:*:*:*,Paessler,Prtg Network Monitor
CVE-2020-11651,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96405,NVD-CWE-Other,An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.,2020-04-30,CISA/EPSS/Metasploit,cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:application_remote_collector:7.5.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:application_remote_collector:8.0.0:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*,Opensuse,Leap
CVE-2020-11652,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.86063,CWE-22,An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.,2020-04-30,CISA/Metasploit,cpe:2.3:a:blackberry:workspaces_server:*:*:*:*:*:*:*:*;cpe:2.3:a:blackberry:workspaces_server:9.1.0:*:*:*:*:*:*:*;cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:application_remote_collector:7.5.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:application_remote_collector:8.0.0:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*,Opensuse,Leap
CVE-2020-11698,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.73668,CWE-77,An issue was discovered in Titan SpamTitan 7.07. Improper input sanitization of the parameter community on the page snmp-x.php would allow a remote attacker to inject commands into the file snmpd.conf that would allow executing commands on the target server.,2020-09-17,Metasploit,cpe:2.3:a:titanhq:spamtitan:7.07:*:*:*:*:*:*:*,Titanhq,Spamtitan
CVE-2020-11710,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.33825,NVD-CWE-Other,"An issue was discovered in docker-kong (for Kong) through 2.0.3. The admin API port may be accessible on interfaces other than 127.0.0.1. NOTE: The vendor argue that this CVE is not a vulnerability because it has an inaccurate bug scope and patch links. “1) Inaccurate Bug Scope - The issue scope was on Kong's docker-compose template, and not Kong's docker image itself. In reality, this issue is not associated with any version of the Kong gateway. As such, the description stating ‘An issue was discovered in docker-kong (for Kong) through 2.0.3.’ is incorrect. This issue only occurs if a user decided to spin up Kong via docker-compose without following the security documentation. The docker-compose template is meant for users to quickly get started with Kong, and is meant for development purposes only. 2) Incorrect Patch Links - The CVE currently points to a documentation improvement as a “Patch” link: https://github.com/Kong/docs.konghq.com/commit/d693827c32144943a2f45abc017c1321b33ff611.This link actually points to an improvement Kong Inc made for fool-proofing. However, instructions for how to protect the admin API were already well-documented here: https://docs.konghq.com/2.0.x/secure-admin-api/#network-layer-access-restrictions , which was first published back in 2017 (as shown in this commit: https://github.com/Kong/docs.konghq.com/commit/e99cf875d875dd84fdb751079ac37882c9972949) Lastly, the hyperlink to https://github.com/Kong/kong (an unrelated Github Repo to this issue) on the Hyperlink list does not include any meaningful information on this topic.",2020-04-12,Nuclei,cpe:2.3:a:konghq:docker-kong:*:*:*:*:*:kong:*:*,Konghq,Docker-Kong
CVE-2020-11732,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04917,NVD-CWE-noinfo,The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_gallery link=download.,2020-04-13,Nuclei,cpe:2.3:a:davidlingren:media_library_assistant:*:*:*:*:*:wordpress:*:*,Davidlingren,Media Library Assistant
CVE-2020-11738,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.97822,CWE-22,The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.,2020-04-13,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:awesomemotive:duplicator:*:*:*:*:lite:wordpress:*:*;cpe:2.3:a:awesomemotive:duplicator:*:*:*:*:pro:wordpress:*:*,Awesomemotive,Duplicator
CVE-2020-11798,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.45241,CWE-22,"A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful exploit could allow an attacker to access sensitive information from the restricted directories.",2020-06-10,Nuclei,"cpe:2.3:a:mitel:micollab_audio\,_web_\&_video_conferencing:*:*:*:*:*:*:*:*",Mitel,"Micollab Audio, Web & Video Conferencing"
CVE-2020-11853,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.7699,NVD-CWE-noinfo,"Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) Universal CMDB affecting version: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30 6.) Hybrid Cloud Management affecting version 2020.05 7.) Service Management Automation affecting version 2020.5 and 2020.02. The vulnerability could allow to execute arbitrary code.",2020-10-22,Metasploit/Nuclei,cpe:2.3:a:hp:universal_cmbd_foundation:10.20:*:*:*:*:*:*:*;cpe:2.3:a:hp:universal_cmbd_foundation:10.30:*:*:*:*:*:*:*;cpe:2.3:a:hp:universal_cmbd_foundation:10.31:*:*:*:*:*:*:*;cpe:2.3:a:hp:universal_cmbd_foundation:10.32:*:*:*:*:*:*:*;cpe:2.3:a:hp:universal_cmbd_foundation:10.33:*:*:*:*:*:*:*;cpe:2.3:a:hp:universal_cmbd_foundation:11.0:*:*:*:*:*:*:*;cpe:2.3:a:hp:universal_cmbd_foundation:2018.05:*:*:*:*:*:*:*;cpe:2.3:a:hp:universal_cmbd_foundation:2018.08:*:*:*:*:*:*:*;cpe:2.3:a:hp:universal_cmbd_foundation:2018.11:*:*:*:*:*:*:*;cpe:2.3:a:hp:universal_cmbd_foundation:2019.02:*:*:*:*:*:*:*;cpe:2.3:a:hp:universal_cmbd_foundation:2019.05:*:*:*:*:*:*:*;cpe:2.3:a:hp:universal_cmbd_foundation:2019.11:*:*:*:*:*:*:*;cpe:2.3:a:hp:universal_cmbd_foundation:2020.05.:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:application_performance_management:9.40:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:application_performance_management:9.50:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:application_performance_management:9.51:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:data_center_automation:*:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:hybrid_cloud_management:*:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operation_bridge_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operation_bridge_manager:10.11:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operation_bridge_manager:10.12:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operation_bridge_manager:10.60:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operation_bridge_manager:10.61:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operation_bridge_manager:10.62:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operation_bridge_manager:10.63:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:2017.11:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:2018.02:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:2018.05:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:2018.08:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:2018.11:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:2019.05:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:2019.08:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:2019.11:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:2020.05:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:service_manager_automation:2020.02:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:service_manager_automation:2020.05:*:*:*:*:*:*:*,Microfocus,Operation Bridge Manager
CVE-2020-11854,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.74232,CWE-798,"Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products products Operation Bridge Manager, Operation Bridge (containerized) and Application Performance Management. The vulneravility affects: 1.) Operation Bridge Manager versions 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. 3.) Application Performance Management versions 9,51, 9.50 and 9.40 with uCMDB 10.33 CUP 3. The vulnerability could allow Arbitrary code execution.",2020-10-27,Metasploit/Nuclei,cpe:2.3:a:microfocus:application_performance_management:9.40:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:application_performance_management:9.50:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:application_performance_management:9.51:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge:2017.11:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge:2018.02:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge:2018.05:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge:2018.08:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge:2018.11:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge:2019.05:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge:2019.08:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge:2020.05:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:10.11:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:10.12:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:10.60:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:10.61:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:10.62:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:10.63:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:2018.05:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:2018.11:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:2019.05:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:2019.11:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:2020.05:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:universal_cmdb:10.33:cumulative_update_package_3:*:*:*:*:*:*,Microfocus,Application Performance Management
CVE-2020-11855,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01348,CWE-732,"An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier. The vulnerability could allow local attackers on the OBR host to execute code with escalated privileges.",2020-09-22,Metasploit,cpe:2.3:a:microfocus:operation_bridge_reporter:*:*:*:*:*:*:*:*,Microfocus,Operation Bridge Reporter
CVE-2020-11857,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.15776,CWE-798,"An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier. The vulnerability could allow remote attackers to access the OBR host as a non-admin user",2020-09-22,Metasploit,cpe:2.3:a:microfocus:operation_bridge_reporter:*:*:*:*:*:*:*:*,Microfocus,Operation Bridge Reporter
CVE-2020-11858,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02687,NVD-CWE-noinfo,"Code execution with escalated privileges vulnerability in Micro Focus products Operation Bridge Manager and Operation Bridge (containerized). The vulneravility affects: 1.) Operation Bridge Manager versions: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) versions: 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. The vulnerability could allow local attackers to execute code with escalated privileges.",2020-10-27,Metasploit,cpe:2.3:a:microfocus:operations_bridge:2017.11:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge:2018.02:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge:2018.05:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge:2018.08:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge:2018.11:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge:2019.05:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge:2019.08:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge:2020.05:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:10.11:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:10.12:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:10.60:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:10.61:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:10.62:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:10.63:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:2018.05:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:2018.11:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:2019.05:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:2019.11:*:*:*:*:*:*:*;cpe:2.3:a:microfocus:operations_bridge_manager:2020.05:*:*:*:*:*:*:*,Microfocus,Operations Bridge
CVE-2020-11899,5.4,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L,0.18564,CWE-125,The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.,2020-06-17,CISA,cpe:2.3:a:treck:tcp\/ip:*:*:*:*:*:*:*:*;cpe:2.3:h:dell:wyse_5030:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:wyse_5050_all-in-one:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:wyse_7030:-:*:*:*:*:*:*:*;cpe:2.3:o:dell:wyse_5030_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dell:wyse_5050_all-in-one_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dell:wyse_7030_firmware:-:*:*:*:*:*:*:*,Dell,Wyse 5050 All-In-One Firmware
CVE-2020-11930,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.04457,CWE-79,The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link. This requires use of the hreflang tags feature within a sub-domain or sub-directory paid option.,2020-04-20,Nuclei,cpe:2.3:a:gtranslate:translate_wordpress_with_gtranslate:*:*:*:*:*:wordpress:*:*,Gtranslate,Translate Wordpress With Gtranslate
CVE-2020-11975,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.29885,NVD-CWE-noinfo,Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.,2020-06-05,Nuclei,cpe:2.3:a:apache:unomi:*:*:*:*:*:*:*:*,Apache,Unomi
CVE-2020-11978,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.99118,CWE-78,An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.,2020-07-17,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*,Apache,Airflow
CVE-2020-11981,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.33742,CWE-78,"An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.",2020-07-17,Nuclei,cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*,Apache,Airflow
CVE-2020-11984,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.90039,CWE-120,Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE,2020-08-07,Nuclei,cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2020-11991,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.72456,CWE-611,"When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be used to access any file on the server system.",2020-09-11,Nuclei,cpe:2.3:a:apache:cocoon:*:*:*:*:*:*:*:*,Apache,Cocoon
CVE-2020-12004,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.13639,CWE-306,"The affected product lacks proper authentication required to query the server on the Ignition 8 Gateway (versions prior to 8.0.10) and Ignition 7 Gateway (versions prior to 7.9.14), allowing an attacker to obtain sensitive information.",2020-06-09,Metasploit,cpe:2.3:a:inductiveautomation:ignition_gateway:*:*:*:*:*:*:*:*,Inductiveautomation,Ignition Gateway
CVE-2020-12027,4.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N,0.53024,CWE-200,"All versions of FactoryTalk View SE disclose the hostnames and file paths for certain files within the system. A remote, authenticated attacker may be able to leverage this information for reconnaissance efforts. Rockwell Automation recommends enabling built in security features found within FactoryTalk View SE. Users should follow guidance found in knowledge base articles 109056 and 1126943 to set up IPSec and/or HTTPs.",2020-07-20,Metasploit,cpe:2.3:a:rockwellautomation:factorytalk_view:*:*:*:*:se:*:*:*,Rockwellautomation,Factorytalk View
CVE-2020-12028,7.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N,0.53033,CWE-264,"In all versions of FactoryTalk View SEA remote, an authenticated attacker may be able to utilize certain handlers to interact with the data on the remote endpoint since those handlers do not enforce appropriate permissions. Rockwell Automation recommends enabling built in security features found within FactoryTalk View SE. Users should follow guidance found in knowledge base articles 109056 and 1126943 to set up IPSec and/or HTTPs.",2020-07-20,Metasploit,cpe:2.3:a:rockwellautomation:factorytalk_view:*:*:*:*:se:*:*:*,Rockwellautomation,Factorytalk View
CVE-2020-12029,9.0,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N,0.46968,CWE-20,"All versions of FactoryTalk View SE do not properly validate input of filenames within a project directory. A remote, unauthenticated attacker may be able to execute a crafted file on a remote endpoint that may result in remote code execution (RCE). Rockwell Automation recommends applying patch 1126289. Before installing this patch, the patch rollup dated 06 Apr 2020 or later MUST be applied. 1066644 – Patch Roll-up for CPR9 SRx.",2020-07-20,Metasploit,cpe:2.3:a:rockwellautomation:factorytalk_view:-:*:*:*:se:*:*:*,Rockwellautomation,Factorytalk View
CVE-2020-12054,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03611,CWE-79,"The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query). Also affected are 16 themes (if the plugin is enabled) by the same author: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean Enterprise PRO, Bold Photography PRO, Intuitive PRO, Devotepress PRO, Clean Blocks PRO, Foodoholic PRO, Catch Mag PRO, Catch Wedding PRO, and Higher Education PRO.",2020-04-23,Nuclei,cpe:2.3:a:catchplugins:catch_breadcrumb:*:*:*:*:*:wordpress:*:*,Catchplugins,Catch Breadcrumb
CVE-2020-12109,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.74338,CWE-78,"Certain TP-Link devices allow Command Injection. This affects NC200 2.1.9 build 200225, NC210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0 build 200304, NC250 1.3.0 build 200304, NC260 1.5.2 build 200304, and NC450 1.5.3 build 200304.",2020-05-04,Metasploit,cpe:2.3:h:tp-link:nc200:-:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:nc210:-:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:nc220:-:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:nc230:-:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:nc250:-:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:nc260:-:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:nc450:-:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:nc200_firmware:2.1.6:160108_b:*:*:*:*:*:*;cpe:2.3:o:tp-link:nc200_firmware:2.1.9:200225:*:*:*:*:*:*;cpe:2.3:o:tp-link:nc210_firmware:1.0.3:160229:*:*:*:*:*:*;cpe:2.3:o:tp-link:nc210_firmware:1.0.4:160412:*:*:*:*:*:*;cpe:2.3:o:tp-link:nc210_firmware:1.0.9:200304:*:*:*:*:*:*;cpe:2.3:o:tp-link:nc220_firmware:1.2.0:170516:*:*:*:*:*:*;cpe:2.3:o:tp-link:nc220_firmware:1.3.0:180105:*:*:*:*:*:*;cpe:2.3:o:tp-link:nc220_firmware:1.3.0:200304:*:*:*:*:*:*;cpe:2.3:o:tp-link:nc230_firmware:1.0.3:160108:*:*:*:*:*:*;cpe:2.3:o:tp-link:nc230_firmware:1.2.1:170515:*:*:*:*:*:*;cpe:2.3:o:tp-link:nc230_firmware:1.3.0:200304:*:*:*:*:*:*;cpe:2.3:o:tp-link:nc250_firmware:1.0.10:160321:*:*:*:*:*:*;cpe:2.3:o:tp-link:nc250_firmware:1.0.8:160108:*:*:*:*:*:*;cpe:2.3:o:tp-link:nc250_firmware:1.2.1:170515:*:*:*:*:*:*;cpe:2.3:o:tp-link:nc250_firmware:1.3.0:200304:*:*:*:*:*:*;cpe:2.3:o:tp-link:nc260_firmware:1.0.5:160804:*:*:*:*:*:*;cpe:2.3:o:tp-link:nc260_firmware:1.0.6:161114:*:*:*:*:*:*;cpe:2.3:o:tp-link:nc260_firmware:1.4.1:180720:*:*:*:*:*:*;cpe:2.3:o:tp-link:nc260_firmware:1.5.0:181123:*:*:*:*:*:*;cpe:2.3:o:tp-link:nc260_firmware:1.5.2:200304:*:*:*:*:*:*;cpe:2.3:o:tp-link:nc450_firmware:1.0.15:160920:*:*:*:*:*:*;cpe:2.3:o:tp-link:nc450_firmware:1.1.2:161013:*:*:*:*:*:*;cpe:2.3:o:tp-link:nc450_firmware:1.3.4:171130:*:*:*:*:*:*;cpe:2.3:o:tp-link:nc450_firmware:1.5.3:200304:*:*:*:*:*:*,TP-Link,Nc200 Firmware
CVE-2020-12116,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.97418,CWE-22,Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request.,2020-05-07,EPSS/Nuclei,cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:-:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124011:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124012:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124013:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124014:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124015:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124016:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124022:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124023:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124024:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124025:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124026:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124027:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124030:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124033:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124037:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124039:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124040:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124041:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124042:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124043:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124051:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124053:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124054:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124056:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124058:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124065:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124066:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124067:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124069:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124070:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124071:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124072:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124074:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124075:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124081:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124082:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124085:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124086:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124087:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124089:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124095:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124096:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124097:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124098:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124099:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124102:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124168:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124169:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124175:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124176:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124178:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124181:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124182:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124183:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124189:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124190:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124191:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125002:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125102:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125108:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125110:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125111:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125112:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125113:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125114:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125116:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125117:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125118:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125120:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125121:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125123:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125124:*:*:*:*:*:*,Zohocorp,Manageengine Opmanager
CVE-2020-12124,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.7465,CWE-78,A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary Linux commands as root without authentication.,2020-10-02,Nuclei,cpe:2.3:h:wavlink:wn530h4:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wn530h4_firmware:m30h4.v5030.190403:*:*:*:*:*:*:*,Wavlink,Wn530H4 Firmware
CVE-2020-12127,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.07401,CWE-306,"An information disclosure vulnerability in the /cgi-bin/ExportAllSettings.sh endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to leak router settings, including cleartext login details, DNS settings, and other sensitive information without authentication.",2020-10-02,Nuclei,cpe:2.3:h:wavlink:wn530h4:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wn530h4_firmware:m30h4.v5030.190403:*:*:*:*:*:*:*,Wavlink,Wn530H4 Firmware
CVE-2020-12256,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.95752,CWE-79,rConfig 3.9.4 is vulnerable to reflected XSS. The devicemgmnt.php file improperly validates user input. An attacker can exploit this by crafting arbitrary JavaScript in the deviceId GET parameter to devicemgmnt.php.,2020-05-18,EPSS/Nuclei,cpe:2.3:a:rconfig:rconfig:3.9.4:*:*:*:*:*:*:*,Rconfig,Rconfig
CVE-2020-12259,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.96179,CWE-79,rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php.,2020-05-18,EPSS/Nuclei,cpe:2.3:a:rconfig:rconfig:3.9.4:*:*:*:*:*:*:*,Rconfig,Rconfig
CVE-2020-12262,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01819,CWE-79,"Intelbras TIP200 60.61.75.15, TIP200LITE 60.61.75.15, and TIP300 65.61.75.15 devices allow /cgi-bin/cgiServer.exx?page= XSS.",2020-11-27,Nuclei,cpe:2.3:h:intelbras:tip200:-:*:*:*:*:*:*:*;cpe:2.3:h:intelbras:tip200lite:-:*:*:*:*:*:*:*;cpe:2.3:h:intelbras:tip300:-:*:*:*:*:*:*:*;cpe:2.3:o:intelbras:tip200_firmware:65.61.75.15:*:*:*:*:*:*:*;cpe:2.3:o:intelbras:tip200lite_firmware:60.61.75.15:*:*:*:*:*:*:*;cpe:2.3:o:intelbras:tip300_firmware:60.61.75.15:*:*:*:*:*:*:*,Intelbras,Tip200 Firmware
CVE-2020-12271,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.42164,CWE-89,"A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. This affected devices configured with either the administration (HTTPS) service or the User Portal exposed on the WAN zone. A successful attack may have caused remote code execution that exfiltrated usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords)",2020-04-27,CISA,cpe:2.3:h:sophos:xg_firewall:-:*:*:*:*:*:*:*;cpe:2.3:o:sophos:sfos:17.0:*:*:*:*:*:*:*;cpe:2.3:o:sophos:sfos:17.1:*:*:*:*:*:*:*;cpe:2.3:o:sophos:sfos:17.5:*:*:*:*:*:*:*;cpe:2.3:o:sophos:sfos:18.0:*:*:*:*:*:*:*,Sophos,Sfos
CVE-2020-12447,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.13704,CWE-22,"A Local File Inclusion (LFI) issue on Onkyo TX-NR585 1000-0000-000-0008-0000 devices allows remote unauthenticated users on the network to read sensitive files via %2e%2e%2f directory traversal, as demonstrated by reading /etc/shadow.",2020-04-29,Nuclei,cpe:2.3:h:onkyo:tx-nr585:-:*:*:*:*:*:*:*;cpe:2.3:o:onkyo:tx-nr585_firmware:1000-0000-000-0008-0000:*:*:*:*:*:*:*,Onkyo,Tx-Nr585 Firmware
CVE-2020-12478,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.08392,CWE-306,TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files.,2020-04-29,Nuclei,cpe:2.3:a:teampass:teampass:2.1.27.36:*:*:*:*:*:*:*,Teampass,Teampass
CVE-2020-12641,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.84456,CWE-78,rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.,2020-05-04,CISA/Nuclei,cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*;cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*;cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*,Opensuse,Leap
CVE-2020-12720,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.88948,CWE-89,"vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.",2020-05-08,Metasploit/Nuclei,cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.5.6:-:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.6.0:-:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.6.1.-:*:*:*:*:*:*:*,Vbulletin,Vbulletin
CVE-2020-12800,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.78751,CWE-434,The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting supported_type to php% and uploading a .php% file.,2020-06-08,Metasploit/Nuclei,cpe:2.3:a:codedropz:drag_and_drop_multiple_file_upload_-_contact_form_7:*:*:*:*:*:wordpress:*:*,Codedropz,Drag And Drop Multiple File Upload - Contact Form 7
CVE-2020-12812,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.49344,CWE-178,"An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.",2020-07-24,CISA,cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*,Fortinet,Fortios
CVE-2020-12832,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07131,CWE-22,WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input.,2020-05-13,Nuclei,cpe:2.3:a:simplefilelist:simple-file-list:*:*:*:*:*:wordpress:*:*,Simplefilelist,Simple-File-List
CVE-2020-13117,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.68794,CWE-77,"Wavlink WN575A4, WN579X3, and WN530G3A devices through 2020-05-15 allow unauthenticated remote users to inject commands via the key parameter in a login request.",2021-02-09,Nuclei,cpe:2.3:h:wavlink:wn575a4:-:*:*:*:*:*:*:*;cpe:2.3:h:wavlink:wn579x3:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wn575a4_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wn579x3_firmware:*:*:*:*:*:*:*:*,Wavlink,Wn575A4 Firmware
CVE-2020-13121,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02956,CWE-601,Submitty through 20.04.01 has an open redirect via authentication/login?old= during an invalid login attempt.,2020-05-16,Nuclei,cpe:2.3:a:rcos:submitty:*:*:*:*:*:*:*:*,Rcos,Submitty
CVE-2020-13125,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.02307,NVD-CWE-noinfo,"An issue was discovered in the ""Ultimate Addons for Elementor"" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers can create users with the Subscriber role even if registration is disabled.",2020-05-17,Nuclei,cpe:2.3:a:brainstormforce:ultimate_addons_for_elementor:*:*:*:*:*:wordpress:*:*,Brainstormforce,Ultimate Addons For Elementor
CVE-2020-1313,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.39967,NVD-CWE-noinfo,"An elevation of privilege vulnerability exists when the Windows Update Orchestrator Service improperly handles file operations, aka 'Windows Update Orchestrator Service Elevation of Privilege Vulnerability'.",2020-06-09,Metasploit,cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:*,Microsoft,Windows 10
CVE-2020-13151,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.86749,CWE-78,"Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions (UDFs), written in Lua, as part of a database query. It attempts to restrict code execution by disabling os.execute() calls, but this is insufficient. Anyone with network access can use a crafted UDF to execute arbitrary OS commands on all nodes of the cluster at the permission level of the user running the Aerospike service.",2020-08-05,Metasploit,cpe:2.3:a:aerospike:aerospike_server:*:*:*:*:community:*:*:*,Aerospike,Aerospike Server
CVE-2020-13158,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.53973,CWE-22,Artica Proxy before 4.30.000000 Community Edition allows Directory Traversal via the fw.progrss.details.php popup parameter.,2020-06-22,Nuclei,cpe:2.3:a:articatech:artica_proxy:*:*:*:*:community:*:*:*,Articatech,Artica Proxy
CVE-2020-13160,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.80551,CWE-134,AnyDesk before 5.5.3 on Linux and FreeBSD has a format string vulnerability that can be exploited for remote code execution.,2020-06-09,Metasploit,cpe:2.3:a:anydesk:anydesk:*:*:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*,Freebsd,Freebsd
CVE-2020-13166,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.77635,CWE-798,"The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config, and can be used to send serialized ASP code.",2020-05-19,Metasploit,cpe:2.3:a:mylittletools:mylittleadmin:3.8:*:*:*:*:*:*:*,Mylittletools,Mylittleadmin
CVE-2020-13167,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.95415,CWE-78,"Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command line with client-supplied parameters, and allows injection of shell metacharacters.",2020-05-19,EPSS/Metasploit/Nuclei,cpe:2.3:a:netsweeper:netsweeper:*:*:*:*:*:*:*:*,Netsweeper,Netsweeper
CVE-2020-13258,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02063,CWE-79,"Contentful through 2020-05-21 for Python allows reflected XSS, as demonstrated by the api parameter to the-example-app.py.",2020-05-21,Nuclei,cpe:2.3:a:contentful:python_example:*:*:*:*:*:*:*:*,Contentful,Python Example
CVE-2020-1337,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.14179,CWE-367,"An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application.
The update addresses the vulnerability by correcting how the Windows Print Spooler Component writes to the file system.",2020-08-17,Metasploit,cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:sp1:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10
CVE-2020-13379,8.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H,0.99856,CWE-918,"The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.",2020-06-03,EPSS/Nuclei,cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*;cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*;cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2020-13381,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.59028,CWE-89,openSIS through 7.4 allows SQL Injection.,2020-07-01,Metasploit,cpe:2.3:a:os4ed:opensis:*:*:*:*:*:*:*:*,Os4Ed,Opensis
CVE-2020-13382,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.52814,CWE-306,openSIS through 7.4 has Incorrect Access Control.,2020-07-01,Metasploit,cpe:2.3:a:os4ed:opensis:*:*:*:*:*:*:*:*,Os4Ed,Opensis
CVE-2020-13383,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.67792,CWE-22,openSIS through 7.4 allows Directory Traversal.,2020-07-01,Metasploit,cpe:2.3:a:os4ed:opensis:*:*:*:*:*:*:*:*,Os4Ed,Opensis
CVE-2020-13405,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.13204,CWE-306,userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request.,2020-07-16,Nuclei,cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*,Microweber,Microweber
CVE-2020-13483,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.04511,CWE-79,The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the items[ITEMS][ID] parameter to the components/bitrix/mobileapp.list/ajax.php/ URI.,2020-06-24,Nuclei,cpe:2.3:a:bitrix24:bitrix24:*:*:*:*:*:*:*:*,Bitrix24,Bitrix24
CVE-2020-1350,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.92178,NVD-CWE-noinfo,"A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.",2020-07-14,CISA,cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows Server 2008
CVE-2020-13638,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.76758,CWE-269,"lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation. This issue has been fixed in 3.9.7.",2020-11-13,Nuclei,cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:*,Rconfig,Rconfig
CVE-2020-13640,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.12706,CWE-89,A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. (No 7.x versions are affected.),2020-06-18,Nuclei,cpe:2.3:a:gvectors:wpdiscuz:*:*:*:*:*:wordpress:*:*,Gvectors,Wpdiscuz
CVE-2020-13671,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.04304,CWE-434,"Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.",2020-11-20,CISA,cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2020-13699,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.25895,CWE-88,"TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers. A malicious website could launch TeamViewer with arbitrary parameters, as demonstrated by a teamviewer10: --play URL. An attacker could force a victim to send an NTLM authentication request and either relay the request or capture the hash for offline password cracking. This affects teamviewer10, teamviewer8, teamviewerapi, tvchat1, tvcontrol1, tvfiletransfer1, tvjoinv8, tvpresent1, tvsendfile1, tvsqcustomer1, tvsqsupport1, tvvideocall1, and tvvpn1. The issue is fixed in 8.0.258861, 9.0.258860, 10.0.258873, 11.0.258870, 12.0.258869, 13.2.36220, 14.2.56676, 14.7.48350, and 15.8.3.",2020-07-29,Metasploit,cpe:2.3:a:teamviewer:teamviewer:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2020-13700,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.13463,CWE-639,"An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress. It allows an insecure direct object reference via permalinks manipulation, as demonstrated by a wp-json/acf/v3/options/ request that reads sensitive information in the wp_options table, such as the login and pass values.",2020-06-24,Nuclei,cpe:2.3:a:acf_to_rest_api_project:acf_to_rest_api:*:*:*:*:*:wordpress:*:*,Acf To Rest Api Project,Acf To Rest Api
CVE-2020-1380,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.24188,CWE-787,"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website. An attacker could also embed an ActiveX control marked &quot;safe for initialization&quot; in an application or Microsoft Office document that hosts the IE rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.
The security update addresses the vulnerability by modifying how the scripting engine handles objects in memory.",2020-08-17,CISA,cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2020-13820,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.04015,CWE-79,Extreme Management Center 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request.,2020-08-03,Nuclei,cpe:2.3:a:extremenetworks:extreme_management_center:8.4.1.24:*:*:*:*:*:*:*,Extremenetworks,Extreme Management Center
CVE-2020-13851,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.91095,CWE-78,Artica Pandora FMS 7.44 allows remote command execution via the events feature.,2020-06-11,Metasploit/Nuclei,cpe:2.3:a:pandorafms:pandora_fms:7.44:*:*:*:*:*:*:*,Pandorafms,Pandora Fms
CVE-2020-13886,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.05198,CWE-22,"Intelbras TIP 200 60.61.75.15, TIP 200 LITE 60.61.75.15, and TIP 300 65.61.75.22 devices allow cgi-bin/cgiServer.exx?page=../ Directory Traversal.",2020-11-26,Nuclei,cpe:2.3:h:intelbras:tip200:-:*:*:*:*:*:*:*;cpe:2.3:h:intelbras:tip200lite:-:*:*:*:*:*:*:*;cpe:2.3:h:intelbras:tip300:-:*:*:*:*:*:*:*;cpe:2.3:o:intelbras:tip200_firmware:60.61.75.15:*:*:*:*:*:*:*;cpe:2.3:o:intelbras:tip200lite_firmware:60.61.75.15:*:*:*:*:*:*:*;cpe:2.3:o:intelbras:tip300_firmware:65.61.75.22:*:*:*:*:*:*:*,Intelbras,Tip200 Firmware
CVE-2020-13927,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9967,CWE-306,"The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default",2020-11-10,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*,Apache,Airflow
CVE-2020-13937,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.78331,CWE-922,"Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information without any authentication, so it is dangerous because some confidential information entries will be disclosed to everyone.",2020-10-19,Nuclei,cpe:2.3:a:apache:kylin:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:2.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:2.3.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:2.3.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:2.4.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:2.4.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:2.5.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:2.5.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:2.6.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:2.6.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:2.6.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:2.6.3:*:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:2.6.4:*:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:2.6.5:*:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:2.6.6:*:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:3.0.0:-:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:3.0.0:alpha2:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:3.0.0:alpha:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:3.0.0:beta:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:3.0.2:*:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:4.0.0:alpha:*:*:*:*:*:*,Apache,Kylin
CVE-2020-13942,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.68398,CWE-20,It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.,2020-11-24,Nuclei,cpe:2.3:a:apache:unomi:*:*:*:*:*:*:*:*,Apache,Unomi
CVE-2020-13945,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.72976,NVD-CWE-Other,"In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.",2020-12-07,Metasploit/Nuclei,cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:*,Apache,Apisix
CVE-2020-13965,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.76596,CWE-79,An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.,2020-06-09,CISA,cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2020-14092,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9453,CWE-89,The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.,2020-07-02,Nuclei,cpe:2.3:a:ithemes:paypal_pro:*:*:*:*:*:wordpress:*:*,Ithemes,Paypal Pro
CVE-2020-14144,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.95432,CWE-78,"The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLE_GIT_HOOKS line in the config file). NOTE: The vendor has indicated this is not a vulnerability and states ""This is a functionality of the software that is limited to a very limited subset of accounts. If you give someone the privilege to execute arbitrary code on your server, they can execute arbitrary code on your server. We provide very clear warnings to users around this functionality and what it provides.",2020-10-16,EPSS/Metasploit/Nuclei,cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*,Gitea,Gitea
CVE-2020-14179,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.76042,NVD-CWE-noinfo,"Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. The affected versions are before version 8.5.8, and from version 8.6.0 before 8.11.1.",2020-09-21,Nuclei,cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*,Atlassian,Jira Data Center
CVE-2020-14181,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.99603,CWE-200,"Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0 before 8.12.0.",2020-09-17,EPSS/Metasploit/Nuclei,cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*,Atlassian,Data Center
CVE-2020-14295,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.8633,CWE-89,A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.,2020-06-17,Metasploit,cpe:2.3:a:cacti:cacti:1.2.12:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2020-14321,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.16734,CWE-863,"In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course.",2022-08-16,Metasploit,cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:3.9.0:-:*:*:*:*:*:*,Moodle,Moodle
CVE-2020-14408,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03003,CWE-79,"An issue was discovered in Agentejo Cockpit 0.10.2. Insufficient sanitization of the to parameter in the /auth/login route allows for injection of arbitrary JavaScript code into a web page's content, creating a Reflected XSS attack vector.",2020-06-17,Nuclei,cpe:2.3:a:agentejo:cockpit:0.10.2:*:*:*:*:*:*:*,Agentejo,Cockpit
CVE-2020-14413,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03442,CWE-79,"NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize() in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a Devices-Config.php?sta= value.",2020-06-29,Nuclei,cpe:2.3:a:nedi:nedi:1.9c:*:*:*:*:*:*:*,Nedi,Nedi
CVE-2020-1464,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.41131,CWE-347,"A spoofing vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploited this vulnerability could bypass security features and load improperly signed files.
In an attack scenario, an attacker could bypass security features intended to prevent improperly signed files from being loaded.
The update addresses the vulnerability by correcting how Windows validates file signatures.",2020-08-17,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1909:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2004:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2020-14644,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.94465,NVD-CWE-noinfo,"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",2020-07-15,CISA/Nuclei,cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*,Oracle,Weblogic Server
CVE-2020-1472,5.5,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.99512,NVD-CWE-noinfo,"An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network.
To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access.
Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels.
For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see  How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020).
When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.",2020-08-17,CISA/EPSS/Metasploit,cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*;cpe:2.3:a:synology:directory_server:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1903:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2004:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:-:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*,Microsoft,Windows Server 1903
CVE-2020-14750,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9927,NVD-CWE-noinfo,"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",2020-11-02,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*,Oracle,Weblogic Server
CVE-2020-14864,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.97233,CWE-22,"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).",2020-10-21,CISA/EPSS/Nuclei,cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*;cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*;cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:*,Oracle,Business Intelligence
CVE-2020-14871,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.79842,CWE-787,"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. Note: This CVE is not exploitable for Solaris 11.1 and later releases, and ZFSSA 8.7 and later releases, thus the CVSS Base Score is 0.0. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).",2020-10-21,CISA/Metasploit,cpe:2.3:o:oracle:solaris:*:*:*:*:*:*:*:*;cpe:2.3:o:oracle:solaris:9:*:*:*:*:*:*:*,Oracle,Solaris
CVE-2020-14882,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99997,NVD-CWE-Other,"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",2020-10-21,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*,Oracle,Weblogic Server
CVE-2020-14883,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.97929,NVD-CWE-Other,"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).",2020-10-21,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*,Oracle,Weblogic Server
CVE-2020-15050,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.50734,CWE-22,An issue was discovered in the Video Extension in Suprema BioStar 2 before 2.8.2. Remote attackers can read arbitrary files from the server via Directory Traversal.,2020-07-13,Nuclei,cpe:2.3:a:supremainc:biostar_2:*:*:*:*:*:*:*:*,Supremainc,Biostar 2
CVE-2020-15069,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.10674,CWE-120,Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x.,2020-06-29,CISA,cpe:2.3:h:sophos:xg_firewall:-:*:*:*:*:*:*:*;cpe:2.3:o:sophos:xg_firewall_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sophos:xg_firewall_firmware:17.5:-:*:*:*:*:*:*;cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release10:*:*:*:*:*:*;cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release11:*:*:*:*:*:*;cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release12:*:*:*:*:*:*;cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release1:*:*:*:*:*:*;cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release3:*:*:*:*:*:*;cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release4:*:*:*:*:*:*;cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release5:*:*:*:*:*:*;cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release6:*:*:*:*:*:*;cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release7:*:*:*:*:*:*;cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release8:*:*:*:*:*:*;cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release9:*:*:*:*:*:*,Sophos,Xg Firewall Firmware
CVE-2020-15081,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01648,CWE-548,"In PrestaShop from version 1.5.0.0 and before 1.7.6.6, there is information exposure in the upload directory. The problem is fixed in version 1.7.6.6. A possible workaround is to add an empty index.php file in the upload directory.",2020-07-02,Nuclei,cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:*,Prestashop,Prestashop
CVE-2020-15129,6.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N,0.08011,CWE-601,"In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the ""X-Forwarded-Prefix"" header. The Traefik API dashboard component doesn't validate that the value of the header ""X-Forwarded-Prefix"" is a site relative path and will redirect to any header provided URI. Successful exploitation of an open redirect can be used to entice victims to disclose sensitive information. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team addressed this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios.",2020-07-30,Nuclei,cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*;cpe:2.3:a:traefik:traefik:2.3.0:-:*:*:*:*:*:*;cpe:2.3:a:traefik:traefik:2.3.0:rc1:*:*:*:*:*:*;cpe:2.3:a:traefik:traefik:2.3.0:rc2:*:*:*:*:*:*,Traefik,Traefik
CVE-2020-15148,8.9,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H,0.78759,CWE-502,Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.,2020-09-15,Nuclei,cpe:2.3:a:yiiframework:yii:*:*:*:*:*:*:*:*,Yiiframework,Yii
CVE-2020-15227,8.7,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N,0.35228,CWE-74,"Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.",2020-10-01,Nuclei,cpe:2.3:a:nette:application:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2020-15415,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.84599,CWE-78,"On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.",2020-06-30,CISA/Nuclei,cpe:2.3:h:draytek:vigor2960:-:*:*:*:*:*:*:*;cpe:2.3:h:draytek:vigor300b:-:*:*:*:*:*:*:*;cpe:2.3:h:draytek:vigor3900:-:*:*:*:*:*:*:*;cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:draytek:vigor300b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:draytek:vigor3900_firmware:*:*:*:*:*:*:*:*,Draytek,Vigor3900 Firmware
CVE-2020-15500,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.12224,CWE-79,"An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page, causing reflected XSS.",2020-07-01,Nuclei,cpe:2.3:a:tileserver:tileservergl:*:*:*:*:*:*:*:*,Tileserver,Tileservergl
CVE-2020-15505,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99737,CWE-706,"A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8.0; and Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier that allows remote attackers to execute arbitrary code via unspecified vectors.",2020-07-07,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:mobileiron:core:*:*:*:*:*:*:*:*;cpe:2.3:a:mobileiron:enterprise_connector:*:*:*:*:*:*:*:*;cpe:2.3:a:mobileiron:monitor_and_reporting_database:*:*:*:*:*:*:*:*;cpe:2.3:a:mobileiron:sentry:*:*:*:*:*:*:*:*,Mobileiron,Core
CVE-2020-15568,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.28495,CWE-913,"TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with (for example) OS commands in the opt parameter.",2021-01-30,Nuclei,cpe:2.3:o:terra-master:tos:*:*:*:*:*:*:*:*,Terra-Master,Tos
CVE-2020-15718,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.06325,CWE-79,"RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php script. A remote attacker could exploit this vulnerability using the include_inactive parameter in a crafted URL.",2020-07-15,Nuclei,cpe:2.3:a:rosariosis:rosariosis:6.7.2:*:*:*:*:*:*:*,Rosariosis,Rosariosis
CVE-2020-15867,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.87153,NVD-CWE-noinfo,"The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook feature is granted to a user who does not have administrative privileges. NOTE: because this is mentioned in the documentation but not in the UI, it could be considered a ""Product UI does not Warn User of Unsafe Actions"" issue.",2020-10-16,Metasploit/Nuclei,cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*,Gogs,Gogs
CVE-2020-15893,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.20856,CWE-78,An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. Universal Plug and Play (UPnP) is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target (ST) field of the SSDP M-SEARCH discover packet.,2020-07-22,Metasploit,cpe:2.3:h:dlink:dir-816l:b1:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-816l_firmware:2.06.b09:beta:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-816l_firmware:2.06:*:*:*:*:*:*:*,D-Link,Dir-816L Firmware
CVE-2020-15895,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02835,CWE-79,"An XSS issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. In the file webinc/js/info.php, no output filtration is applied to the RESULT parameter, before it's printed on the webpage.",2020-07-22,Nuclei,cpe:2.3:h:dlink:dir-816l:b1:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-816l_firmware:2.06.b09:beta:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-816l_firmware:2.06:*:*:*:*:*:*:*,D-Link,Dir-816L Firmware
CVE-2020-15906,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.27362,CWE-307,tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts.,2020-10-22,Nuclei,cpe:2.3:a:tiki:tiki:*:*:*:*:*:*:*:*,Tiki,Tiki
CVE-2020-15920,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98239,CWE-78,There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. No authentication is required.,2020-07-24,EPSS/Metasploit/Nuclei,cpe:2.3:a:midasolutions:eframework:*:*:*:*:*:*:*:*,Midasolutions,Eframework
CVE-2020-15999,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.5063,CWE-787,Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2020-11-03,CISA,cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:*;cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*;cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2020-16009,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.48574,CWE-787,Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2020-11-03,CISA,cpe:2.3:a:cefsharp:cefsharp:*:*:*:*:*:*:*:*;cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*;cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*;cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*,Opensuse,Leap
CVE-2020-16010,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.06414,CWE-787,Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.,2020-11-03,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:google:android:-:*:*:*:*:*:*:*,Google,Android
CVE-2020-16013,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.02826,CWE-787,Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2021-01-08,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*,Google,Chrome
CVE-2020-16017,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.02747,CWE-416,Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.,2021-01-08,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*,Google,Chrome
CVE-2020-16040,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H,0.99595,CWE-20,Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2021-01-08,EPSS/Metasploit,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*,Google,Chrome
CVE-2020-16137,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.19379,NVD-CWE-noinfo,"A privilege escalation issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to reset the credentials for the SSH administrative console to arbitrary values. Note: We cannot prove this vulnerability exists. Out of an abundance of caution, this CVE is being assigned to better serve our customers and ensure all who are still running this product understand that the product is end of life and should be removed or upgraded. For more information on this, and how to upgrade, refer to the CVE’s reference information",2020-08-12,Metasploit,cpe:2.3:h:cisco:unified_ip_conference_station_7937g:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:unified_ip_conference_station_7937g_firmware:*:*:*:*:*:*:*:*,Cisco,Unified Ip Conference Station 7937G Firmware
CVE-2020-16138,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.2136,NVD-CWE-noinfo,"A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the device until it is power cycled. Note: We cannot prove this vulnerability exists. Out of an abundance of caution, this CVE is being assigned to better serve our customers and ensure all who are still running this product understand that the product is end of life and should be removed or upgraded. For more information on this, and how to upgrade, refer to the CVE’s reference information",2020-08-12,Metasploit,cpe:2.3:h:cisco:unified_ip_conference_station_7937g:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:unified_ip_conference_station_7937g_firmware:*:*:*:*:*:*:*:*,Cisco,Unified Ip Conference Station 7937G Firmware
CVE-2020-16139,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.7977,NVD-CWE-noinfo,"A denial-of-service in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers restart the device remotely through sending specially crafted packets. Note: We cannot prove this vulnerability exists. Out of an abundance of caution, this CVE is being assigned to better serve our customers and ensure all who are still running this product understand that the product is end of life and should be removed or upgraded. For more information on this, and how to upgrade, refer to the CVE’s reference information",2020-08-12,Metasploit/Nuclei,cpe:2.3:h:cisco:unified_ip_conference_station_7937g:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:unified_ip_conference_station_7937g_firmware:*:*:*:*:*:*:*:*,Cisco,Unified Ip Conference Station 7937G Firmware
CVE-2020-16152,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.35047,CWE-829,The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP code as the root user via remote HTTP requests that insert this code into a log file and then traverse to that file.,2021-11-14,Metasploit,cpe:2.3:h:extremenetworks:aerohive_netconfig:*:*:*:*:*:*:*:*;cpe:2.3:h:extremenetworks:aerohive_netconfig:10.0r8a:-:*:*:*:*:*:*;cpe:2.3:h:extremenetworks:aerohive_netconfig:10.0r8a:build242466:*:*:*:*:*:*,Extremenetworks,Aerohive Netconfig
CVE-2020-16205,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.592,CWE-78,"Using a specially crafted URL command, a remote authenticated user can execute commands as root on the G-Cam and G-Code (Firmware Versions 1.12.0.25 and prior as well as the limited Versions 1.12.13.2 and 1.12.14.5).",2020-08-14,Metasploit,cpe:2.3:h:geutebrueck:g-cam_ebc-2110:-:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ebc-2111:-:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2240:-:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2241:-:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2250:-:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2230:-:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2239:-:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2240:-:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2249:-:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2270:-:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_eec-2400:-:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.0.25:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.0.25:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2240_firmware:1.12.0.25:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2240_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2240_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.0.25:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.0.25:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.0.25:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.0.25:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.0.25:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.0.25:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.0.25:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.0.25:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.14.5:*:*:*:*:*:*:*,Geutebrueck,G-Cam Ebc-2110 Firmware
CVE-2020-16248,5.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N,0.02698,CWE-918,Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this might plausibly be interpreted as both intended functionality and also a vulnerability,2020-08-09,Nuclei,cpe:2.3:a:prometheus:blackbox_exporter:*:*:*:*:*:*:*:*,Prometheus,Blackbox Exporter
CVE-2020-1631,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.04725,CWE-22,"A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform local file inclusion (LFI) or path traversal. Using this vulnerability, an attacker may be able to inject commands into the httpd.log, read files with 'world' readable permission file or obtain J-Web session tokens. In the case of command injection, as the HTTP service runs as user 'nobody', the impact of this command injection is limited. (CVSS score 5.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) In the case of reading files with 'world' readable permission, in Junos OS 19.3R1 and above, the unauthenticated attacker would be able to read the configuration file. (CVSS score 5.9, vector CVSS:3.1/ AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) If J-Web is enabled, the attacker could gain the same level of access of anyone actively logged into J-Web. If an administrator is logged in, the attacker could gain administrator access to J-Web. (CVSS score 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) This issue only affects Juniper Networks Junos OS devices with HTTP/HTTPS services enabled. Junos OS devices with HTTP/HTTPS services disabled are not affected. If HTTP/HTTPS services are enabled, the following command will show the httpd processes: user@device> show system processes | match http 5260 - S 0:00.13 /usr/sbin/httpd-gk -N 5797 - I 0:00.10 /usr/sbin/httpd --config /jail/var/etc/httpd.conf To summarize: If HTTP/HTTPS services are disabled, there is no impact from this vulnerability. If HTTP/HTTPS services are enabled and J-Web is not in use, this vulnerability has a CVSS score of 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). If J-Web is enabled, this vulnerability has a CVSS score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Juniper SIRT has received a single report of this vulnerability being exploited in the wild. Out of an abundance of caution, we are notifying customers so they can take appropriate actions. Indicators of Compromise: The /var/log/httpd.log may have indicators that commands have injected or files being accessed. The device administrator can look for these indicators by searching for the string patterns ""=*;*&"" or ""*%3b*&"" in /var/log/httpd.log, using the following command: user@device> show log httpd.log | match ""=*;*&|=*%3b*&"" If this command returns any output, it might be an indication of malicious attempts or simply scanning activities. Rotated logs should also be reviewed, using the following command: user@device> show log httpd.log.0.gz | match ""=*;*&|=*%3b*&"" user@device> show log httpd.log.1.gz | match ""=*;*&|=*%3b*&"" Note that a skilled attacker would likely remove these entries from the local log file, thus effectively eliminating any reliable signature that the device had been attacked. This issue affects Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S16; 12.3X48 versions prior to 12.3X48-D101, 12.3X48-D105; 14.1X53 versions prior to 14.1X53-D54; 15.1 versions prior to 15.1R7-S7; 15.1X49 versions prior to 15.1X49-D211, 15.1X49-D220; 16.1 versions prior to 16.1R7-S8; 17.2 versions prior to 17.2R3-S4; 17.3 versions prior to 17.3R3-S8; 17.4 versions prior to 17.4R2-S11, 17.4R3-S2; 18.1 versions prior to 18.1R3-S10; 18.2 versions prior to 18.2R2-S7, 18.2R3-S4; 18.3 versions prior to 18.3R2-S4, 18.3R3-S2; 18.4 versions prior to 18.4R1-S7, 18.4R3-S2 ; 18.4 version 18.4R2 and later versions; 19.1 versions prior to 19.1R1-S5, 19.1R3-S1; 19.1 version 19.1R2 and later versions; 19.2 versions prior to 19.2R2; 19.3 versions prior to 19.3R2-S3, 19.3R3; 19.4 versions prior to 19.4R1-S2, 19.4R2; 20.1 versions prior to 20.1R1-S1, 20.1R2.",2020-05-04,CISA,cpe:2.3:o:juniper:junos:12.3:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3:r10-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3:r10-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3:r10:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3:r11:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3:r12-s11:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3:r12-s12:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3:r12-s13:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3:r12-s14:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3:r12-s15:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3:r12-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3:r12-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3:r12-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3:r12-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3:r12-s8:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3:r12:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3x48:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3x48:d100:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3x48:d10:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3x48:d15:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3x48:d20:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3x48:d25:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3x48:d30:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3x48:d35:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3x48:d40:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3x48:d45:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3x48:d50:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3x48:d51:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3x48:d55:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3x48:d60:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3x48:d65:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3x48:d70:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3x48:d75:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3x48:d80:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3x48:d85:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3x48:d90:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:12.3x48:d95:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:14.1x53:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:14.1x53:d10:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:14.1x53:d15:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:14.1x53:d16:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:14.1x53:d25:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:14.1x53:d26:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:14.1x53:d27:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:14.1x53:d30:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:14.1x53:d35:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:14.1x53:d40:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:14.1x53:d42:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:14.1x53:d43:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:14.1x53:d44:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:14.1x53:d45:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:14.1x53:d46:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:14.1x53:d47:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:14.1x53:d48:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:14.1x53:d49:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:14.1x53:d50:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:14.1x53:d51:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:14.1x53:d52:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:14.1x53:d53:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:a1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:f1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:f2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:f2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:f2-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:f2-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:f2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:f3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:f4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:f5-s7:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:f5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:f6-s12:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:f6-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:f6-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:f6-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:f6-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:f6-s7:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:f6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:f7:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:f:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:r4-s7:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:r4-s8:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:r4-s9:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:r4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:r5-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:r5-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:r5-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:r5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:r6-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:r6-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:r6-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:r6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:r7-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:r7-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:r7-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:r7-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:r7-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1:r7:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d100:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d10:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d110:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d120:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d130:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d140:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d150:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d15:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d160:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d170:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d180:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d190:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d200:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d20:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d210:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d25:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d30:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d35:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d40:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d45:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d50:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d55:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d60:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d65:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d70:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d75:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d80:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:15.1x49:d90:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:16.1:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:16.1:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:16.1:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:16.1:r3-s10:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:16.1:r3-s11:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:16.1:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:16.1:r4-s12:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:16.1:r4-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:16.1:r4-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:16.1:r4-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:16.1:r4-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:16.1:r4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:16.1:r5-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:16.1:r5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:16.1:r6-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:16.1:r6-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:16.1:r7-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:16.1:r7-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:16.1:r7-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:16.1:r7-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:16.1:r7-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:16.1:r7-s7:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:16.1:r7:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.2:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.2:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.2:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.2:r1-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.2:r1-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.2:r1-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.2:r1-s7:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.2:r1-s8:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.2:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.2:r2-s11:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.2:r2-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.2:r2-s7:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.2:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.2:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.2:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.2:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.3:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.3:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.3:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.3:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.3:r2-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.3:r2-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.3:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.3:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.3:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.3:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.3:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.3:r3-s7:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.3:r3:-:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.4:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.4:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.4:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.4:r1-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.4:r1-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.4:r1-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.4:r1-s7:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.4:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.4:r2-s10:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.4:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.4:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.4:r2-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.4:r2-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.4:r2-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.4:r2-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.4:r2-s7:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.4:r2-s8:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.4:r2-s9:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.4:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.4:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:17.4:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.1:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.1:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.1:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.1:r2-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.1:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.1:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.1:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.1:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.1:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.1:r3-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.1:r3-s7:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.1:r3-s8:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.1:r3-s9:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.1:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.2:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.2:r1-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.2:r1-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.2:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.2:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.2:r2-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.2:r2-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.2:r2-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.2:r2-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.2:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.2:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.2:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.2:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.3:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.3:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.3:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.3:r1-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.3:r1-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.3:r1-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.3:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.3:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.3:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.3:r2-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.3:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.3:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.3:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.4:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.4:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.4:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.4:r1-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.4:r1-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.4:r1-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.4:r1-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.4:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.4:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.4:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.4:r2-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.4:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:18.4:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r1-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r1-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.2:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.2:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.2:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.2:r1-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.2:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.3:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.3:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.3:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.3:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.3:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.3:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.4:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.4:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.1:r1:*:*:*:*:*:*,Juniper,Junos
CVE-2020-16846,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99585,CWE-78,"An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.",2020-11-06,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*;cpe:2.3:a:saltstack:salt:3001:*:*:*:*:*:*:*;cpe:2.3:a:saltstack:salt:3002:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2020-16875,8.4,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H,0.47145,CWE-74,"<p>A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments.</p>
<p>An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. Exploitation of the vulnerability requires an authenticated user in a certain Exchange role to be compromised.</p>
<p>The security update addresses the vulnerability by correcting how Microsoft Exchange handles cmdlet arguments.</p>",2020-09-11,Metasploit,cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2020-16952,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L,0.70894,CWE-346,"<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.</p>
<p>Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint.</p>
<p>The security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages.</p>",2020-10-16,Metasploit/Nuclei,cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*,Microsoft,Sharepoint Enterprise Server
CVE-2020-17087,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.05387,CWE-131,Windows Kernel Local Elevation of Privilege Vulnerability,2020-11-11,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_2004:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_2004:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_2004:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_20h2:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_20h2:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:20h2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2020-17132,9.1,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H,0.8979,NVD-CWE-noinfo,Microsoft Exchange Remote Code Execution Vulnerability,2020-12-10,Metasploit,cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2020-17136,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.13958,NVD-CWE-noinfo,Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability,2020-12-10,Metasploit,cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:20h2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10
CVE-2020-17144,8.4,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H,0.36514,CWE-502,Microsoft Exchange Remote Code Execution Vulnerability,2020-12-10,CISA,cpe:2.3:a:microsoft:exchange_server:2010:sp3_rollup_31:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2020-17362,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02873,CWE-79,search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS.,2020-08-12,Nuclei,cpe:2.3:a:themeinprogress:nova_lite:*:*:*:*:*:wordpress:*:*,Themeinprogress,Nova Lite
CVE-2020-17453,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.26118,CWE-79,WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.,2021-04-05,Nuclei,cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager_analytics:2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager_analytics:2.5.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager_analytics:2.6.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_microgateway:2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:enterprise_integrator:*:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_analytics:5.4.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_analytics:5.4.1:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_analytics:5.5.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_analytics:5.6.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_as_key_manager:5.5.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_as_key_manager:5.6.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_as_key_manager:5.7.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_as_key_manager:5.9.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:micro_integrator:1.0.0:*:*:*:*:*:*:*,Wso2,Api Manager
CVE-2020-17456,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.71691,CWE-78,SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the system_log.cgi page.,2020-08-20,Nuclei,cpe:2.3:h:seowonintech:slc-130:-:*:*:*:*:*:*:*;cpe:2.3:h:seowonintech:slr-120d42g:-:*:*:*:*:*:*:*;cpe:2.3:h:seowonintech:slr-120s42g:-:*:*:*:*:*:*:*;cpe:2.3:h:seowonintech:slr-120s:-:*:*:*:*:*:*:*;cpe:2.3:h:seowonintech:slr-120t42g:-:*:*:*:*:*:*:*;cpe:2.3:o:seowonintech:slc-130_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:seowonintech:slr-120d42g_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:seowonintech:slr-120s42g_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:seowonintech:slr-120s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:seowonintech:slr-120t42g_firmware:*:*:*:*:*:*:*:*,Seowonintech,Slc-130 Firmware
CVE-2020-17463,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.90044,CWE-89,"FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.",2020-08-13,CISA/Nuclei,cpe:2.3:a:thedaylightstudio:fuel_cms:1.4.7:*:*:*:*:*:*:*,Thedaylightstudio,Fuel Cms
CVE-2020-17496,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.8774,CWE-74,vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.,2020-08-12,CISA/Metasploit/Nuclei,cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:*,Vbulletin,Vbulletin
CVE-2020-17505,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.82165,CWE-78,Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. These commands are executed with root privileges via service_cmds_peform.,2020-08-12,Metasploit/Nuclei,cpe:2.3:a:articatech:web_proxy:4.30.000000:*:*:*:*:*:*:*,Articatech,Web Proxy
CVE-2020-17506,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.93967,CWE-89,Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php.,2020-08-12,Metasploit/Nuclei,cpe:2.3:a:articatech:web_proxy:4.30.000000:*:*:*:*:*:*:*,Articatech,Web Proxy
CVE-2020-17518,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N,0.50038,CWE-23,"Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit a5264a6f41524afe8ceadf1d8ddc8c80f323ebc4 from apache/flink:master.",2021-01-05,Nuclei,cpe:2.3:a:apache:flink:*:*:*:*:*:*:*:*,Apache,Flink
CVE-2020-17519,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.97856,CWE-552,A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.,2021-01-05,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:flink:*:*:*:*:*:*:*:*,Apache,Flink
CVE-2020-17526,7.7,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N,0.23336,NVD-CWE-noinfo,"Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config.",2020-12-21,Nuclei,cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*,Apache,Airflow
CVE-2020-17530,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.95922,CWE-917,"Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.",2020-12-11,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*;cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*;cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.2.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hospitality_opera_5:5.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql_enterprise_monitor:8.0.23:*:*:*:*:*:*:*,Apache,Struts
CVE-2020-18268,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02687,CWE-601,"Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the ""redirect"" parameter in the component ""zb_system/cmd.php.""",2021-06-07,Nuclei,cpe:2.3:a:zblogcn:z-blogphp:*:*:*:*:*:*:*:*,Zblogcn,Z-Blogphp
CVE-2020-19282,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03162,CWE-79,A reflected cross-site scripting (XSS) vulnerability in Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the system error message's text field.,2021-09-09,Nuclei,cpe:2.3:a:jeesns:jeesns:1.4.2:*:*:*:*:*:*:*,Jeesns,Jeesns
CVE-2020-19283,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02633,CWE-79,A reflected cross-site scripting (XSS) vulnerability in the /newVersion component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML.,2021-09-09,Nuclei,cpe:2.3:a:jeesns:jeesns:1.4.2:*:*:*:*:*:*:*,Jeesns,Jeesns
CVE-2020-19295,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03509,CWE-79,A reflected cross-site scripting (XSS) vulnerability in the /weibo/topic component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML.,2021-09-09,Nuclei,cpe:2.3:a:jeesns:jeesns:1.4.2:*:*:*:*:*:*:*,Jeesns,Jeesns
CVE-2020-19360,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.19722,CWE-22,"Local file inclusion in FHEM 6.0 allows in fhem/FileLog_logWrapper file parameter can allow an attacker to include a file, which can lead to sensitive information disclosure.",2021-01-20,Nuclei,cpe:2.3:a:fhem:fhem:6.0:*:*:*:*:*:*:*,Fhem,Fhem
CVE-2020-19363,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.03613,CWE-200,"Vtiger CRM v7.2.0 allows an attacker to display hidden files, list directories by using /libraries and /layout directories.",2021-01-20,Nuclei,cpe:2.3:a:vtiger:vtiger_crm:7.2.0:*:*:*:*:*:*:*,Vtiger,Vtiger Crm
CVE-2020-1938,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9927,NVD-CWE-Other,"When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.",2020-02-24,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:geode:1.12.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*;cpe:2.3:a:blackberry:good_control:*:*:*:*:*:*:*:*;cpe:2.3:a:blackberry:workspaces_server:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:blackberry:workspaces_server:7.1.2:*:*:*:*:*:*:*;cpe:2.3:a:blackberry:workspaces_server:8.1.0:*:*:*:*:*:*:*;cpe:2.3:a:blackberry:workspaces_server:9.0:*:*:*:*:*:*:*;cpe:2.3:a:netapp:data_availability_services:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:agile_plm:9.3.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:health_sciences_empirica_inspections:1.0.1.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:health_sciences_empirica_signal:7.3.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:transportation_management:6.3.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:workload_manager:12.2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:*;cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2020-1943,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.97309,CWE-79,"Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.",2020-04-01,EPSS/Nuclei,cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*,Apache,Ofbiz
CVE-2020-19515,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01789,CWE-79,qdPM V9.1 is vulnerable to Cross Site Scripting (XSS) via qdPM\install\modules\database_config.php.,2021-09-09,Nuclei,cpe:2.3:a:qdpm:qdpm:9.1:*:*:*:*:*:*:*,Qdpm,Qdpm
CVE-2020-1956,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.97337,CWE-78,"Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.",2020-05-22,CISA/EPSS/Nuclei,cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:2.4.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:2.4.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:3.0.0:-:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:3.0.0:alpha2:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:3.0.0:alpha:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:3.0.0:beta:*:*:*:*:*:*;cpe:2.3:a:apache:kylin:3.0.1:*:*:*:*:*:*:*,Apache,Kylin
CVE-2020-19625,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.13143,NVD-CWE-noinfo,"Remote Code Execution Vulnerability in tests/support/stores/test_grid_filter.php in oria gridx 1.3, allows remote attackers to execute arbitrary code, via crafted value to the $query parameter.",2021-03-26,Nuclei,cpe:2.3:a:gridx_project:gridx:1.3:*:*:*:*:*:*:*,Gridx Project,Gridx
CVE-2020-2021,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.04362,CWE-347,"When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources. The attacker must have network access to the vulnerable server to exploit this vulnerability. This issue affects PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15, and all versions of PAN-OS 8.0 (EOL). This issue does not affect PAN-OS 7.1. This issue cannot be exploited if SAML is not used for authentication. This issue cannot be exploited if the 'Validate Identity Provider Certificate' option is enabled (checked) in the SAML Identity Provider Server Profile. Resources that can be protected by SAML-based single sign-on (SSO) authentication are: GlobalProtect Gateway, GlobalProtect Portal, GlobalProtect Clientless VPN, Authentication and Captive Portal, PAN-OS next-generation firewalls (PA-Series, VM-Series) and Panorama web interfaces, Prisma Access In the case of GlobalProtect Gateways, GlobalProtect Portal, Clientless VPN, Captive Portal, and Prisma Access, an unauthenticated attacker with network access to the affected servers can gain access to protected resources if allowed by configured authentication and Security policies. There is no impact on the integrity and availability of the gateway, portal or VPN server. An attacker cannot inspect or tamper with sessions of regular users. In the worst case, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). In the case of PAN-OS and Panorama web interfaces, this issue allows an unauthenticated attacker with network access to the PAN-OS or Panorama web interfaces to log in as an administrator and perform administrative actions. In the worst-case scenario, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). If the web interfaces are only accessible to a restricted management network, then the issue is lowered to a CVSS Base Score of 9.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Palo Alto Networks is not aware of any malicious attempts to exploit this vulnerability.",2020-06-29,CISA,cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*,Paloaltonetworks,Pan-Os
CVE-2020-20285,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01395,CWE-79,There is a XSS in the user login page in zzcms 2019. Users can inject js code by the referer header via user/login.php,2020-12-18,Nuclei,cpe:2.3:a:zzcms:zzcms:2019:*:*:*:*:*:*:*,Zzcms,Zzcms
CVE-2020-20300,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.08752,CWE-89,SQL injection vulnerability in the wp_where function in WeiPHP 5.0.,2020-12-18,Nuclei,cpe:2.3:a:weiphp:weiphp:5.0:*:*:*:*:*:*:*,Weiphp,Weiphp
CVE-2020-2036,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.2389,CWE-79,A reflected cross-site scripting (XSS) vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could potentially execute arbitrary JavaScript code in the administrator's browser and perform administrative actions. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9.,2020-09-09,Nuclei,cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*,Paloaltonetworks,Pan-Os
CVE-2020-2038,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.85574,CWE-78,An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; PAN-OS 10.0 versions earlier than 10.0.1.,2020-09-09,Metasploit,cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*,Paloaltonetworks,Pan-Os
CVE-2020-20601,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07598,CWE-94,An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet.,2021-12-22,Nuclei,cpe:2.3:a:thinkcmf:thinkcmf:x1.6.0:*:*:*:*:*:*:*;cpe:2.3:a:thinkcmf:thinkcmf:x2.1.0:*:*:*:*:*:*:*;cpe:2.3:a:thinkcmf:thinkcmf:x2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:thinkcmf:thinkcmf:x2.2.1:*:*:*:*:*:*:*;cpe:2.3:a:thinkcmf:thinkcmf:x2.2.2:*:*:*:*:*:*:*,Thinkcmf,Thinkcmf
CVE-2020-20627,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.01881,CWE-306,The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change.,2020-08-31,Nuclei,cpe:2.3:a:givewp:givewp:*:*:*:*:*:wordpress:*:*,Givewp,Givewp
CVE-2020-2096,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.89434,CWE-79,"Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.",2020-01-15,Nuclei,cpe:2.3:a:jenkins:gitlab_hook:*:*:*:*:*:jenkins:*:*,Jenkins,Gitlab Hook
CVE-2020-20982,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.06095,CWE-79,"Cross Site Scripting (XSS) vulnerability in shadoweb wdja v1.5.1, allows attackers to execute arbitrary code and gain escalated privileges, via the backurl parameter to /php/passport/index.php.",2021-11-03,Nuclei,cpe:2.3:a:wdja:wdja_cms:1.5.1:*:*:*:*:*:*:*,Wdja,Wdja Cms
CVE-2020-20988,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01331,CWE-79,"A cross site scripting (XSS) vulnerability in the /domains/cost-by-owner.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the ""or Expiring Between"" parameter.",2021-08-12,Nuclei,cpe:2.3:a:domainmod:domainmod:4.13.0:*:*:*:*:*:*:*,Domainmod,Domainmod
CVE-2020-2103,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.07044,CWE-200,"Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page.",2020-01-29,Nuclei,cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*;cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*,Jenkins,Jenkins
CVE-2020-21224,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.38745,CWE-88,A Remote Code Execution vulnerability has been found in Inspur ClusterEngine V4.0. A remote attacker can send a malicious login packet to the control server,2021-02-22,Nuclei,cpe:2.3:a:inspur:clusterengine:4.0:*:*:*:*:*:*:*,Inspur,Clusterengine
CVE-2020-2140,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.75975,CWE-79,"Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability.",2020-03-09,Nuclei,cpe:2.3:a:jenkins:audit_trail:*:*:*:*:*:jenkins:*:*,Jenkins,Audit Trail
CVE-2020-21998,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01319,CWE-601,In HomeAutomation 3.3.2 input passed via the 'redirect' GET parameter in 'api.php' script is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain.,2021-04-27,Nuclei,cpe:2.3:a:homeautomation_project:homeautomation:3.3.2:*:*:*:*:*:*:*,Homeautomation Project,Homeautomation
CVE-2020-22165,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.06348,CWE-89,PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.,2021-06-22,Nuclei,cpe:2.3:a:phpgurukul:hospital_management_system:4.0:*:*:*:*:*:*:*,Phpgurukul,Hospital Management System
CVE-2020-22208,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09743,CWE-89,SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajax_street.php.,2021-06-16,Nuclei,cpe:2.3:a:74cms:74cms:3.2.0:*:*:*:*:*:*:*,74Cms,74Cms
CVE-2020-22209,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.08579,CWE-89,SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php.,2021-06-16,Nuclei,cpe:2.3:a:74cms:74cms:3.2.0:*:*:*:*:*:*:*,74Cms,74Cms
CVE-2020-22210,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.08579,CWE-89,SQL Injection in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php.,2021-06-16,Nuclei,cpe:2.3:a:74cms:74cms:3.2.0:*:*:*:*:*:*:*,74Cms,74Cms
CVE-2020-22211,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0794,CWE-89,SQL Injection in 74cms 3.2.0 via the key parameter to plus/ajax_street.php.,2021-06-16,Nuclei,cpe:2.3:a:74cms:74cms:3.2.0:*:*:*:*:*:*:*,74Cms,74Cms
CVE-2020-22840,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.13817,CWE-601,Open redirect vulnerability in b2evolution CMS version prior to 6.11.6 allows an attacker to perform malicious open redirects to an attacker controlled resource via redirect_to parameter in email_passthrough.php.,2021-02-09,Nuclei,cpe:2.3:a:b2evolution:b2evolution:*:*:*:*:*:*:*:*,B2Evolution,B2Evolution
CVE-2020-23015,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02689,CWE-601,"An open redirect issue was discovered in OPNsense through 20.1.5. The redirect parameter ""url"" in login page was not filtered and can redirect user to any website.",2021-05-03,Nuclei,cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*,Opnsense,Opnsense
CVE-2020-23517,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.07051,CWE-79,"Cross Site Scripting (XSS) vulnerability in Aryanic HighMail (High CMS) versions 2020 and before allows remote attackers to inject arbitrary web script or HTML, via 'user' to LoginForm.",2021-03-26,Nuclei,cpe:2.3:a:aryanic:high_cms:*:*:*:*:*:*:*:*,Aryanic,High Cms
CVE-2020-23575,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.36765,CWE-22,A directory traversal vulnerability exists in Kyocera Printer d-COPIA253MF plus. Successful exploitation of this vulnerability could allow an attacker to retrieve or view arbitrary files from the affected server.,2021-05-10,Nuclei,cpe:2.3:h:kyocera:d-copia253mf_plus:-:*:*:*:*:*:*:*;cpe:2.3:o:kyocera:d-copia253mf_plus_firmware:-:*:*:*:*:*:*:*,Kyocera,D-Copia253Mf Plus Firmware
CVE-2020-23697,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01885,CWE-79,Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php.,2021-07-06,Nuclei,cpe:2.3:a:monstra:monstra_cms:3.0.4:*:*:*:*:*:*:*,Monstra,Monstra Cms
CVE-2020-23814,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01188,CWE-79,Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) AppName and (2)AddressList parameter in JobGroupController.java file.,2020-09-03,Nuclei,cpe:2.3:a:xuxueli:xxl-job:2.2.0:*:*:*:*:*:*:*,Xuxueli,Xxl-Job
CVE-2020-23972,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N,0.31444,CWE-434,"In Joomla Component GMapFP Version J3.5 and J3.5free, an attacker can access the upload function without authenticating to the application and can also upload files which due to issues of unrestricted file uploads which can be bypassed by changing the content-type and name file too double extensions.",2020-08-27,Nuclei,cpe:2.3:a:gmapfp:gmapfp:j3.5:*:*:*:-:joomla\!:*:*;cpe:2.3:a:gmapfp:gmapfp:j3.5:*:*:*:free:joomla\!:*:*,Gmapfp,Gmapfp
CVE-2020-24148,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H,0.14745,CWE-918,Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a moove_read_xml action.,2021-07-07,Nuclei,cpe:2.3:a:mooveagency:import_xml_and_rss_feeds:2.0.1:*:*:*:*:wordpress:*:*,Mooveagency,Import Xml And Rss Feeds
CVE-2020-24186,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.94535,CWE-434,"A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action.",2020-08-24,Metasploit/Nuclei,cpe:2.3:a:gvectors:wpdiscuz:*:*:*:*:*:wordpress:*:*,Gvectors,Wpdiscuz
CVE-2020-24223,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.14552,CWE-79,Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters.,2020-08-30,Nuclei,cpe:2.3:a:mara_cms_project:mara_cms:7.5:*:*:*:*:*:*:*,Mara Cms Project,Mara Cms
CVE-2020-24285,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04497,NVD-CWE-noinfo,INTELBRAS TELEFONE IP TIP200 version 60.61.75.22 allows an attacker to obtain sensitive information through /cgi-bin/cgiServer.exx.,2021-04-12,Nuclei,cpe:2.3:h:intelbras:tip200:-:*:*:*:*:*:*:*;cpe:2.3:h:intelbras:tip200lite:-:*:*:*:*:*:*:*;cpe:2.3:o:intelbras:tip200_firmware:60.61.75.22:*:*:*:*:*:*:*;cpe:2.3:o:intelbras:tip200lite_firmware:60.61.75.22:*:*:*:*:*:*:*,Intelbras,Tip200 Firmware
CVE-2020-24312,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.15906,CWE-552,"mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file. This results in the ability for unauthenticated users to browse and download any site backups, which sometimes include full database backups, that the plugin has taken.",2020-08-26,Nuclei,cpe:2.3:a:filemanagerpro:file_manager:*:*:*:*:*:wordpress:*:*,Filemanagerpro,File Manager
CVE-2020-24363,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.20689,CWE-306,TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password.,2020-08-31,CISA,cpe:2.3:h:tp-link:tl-wa855re:v5:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:tl-wa855re_firmware:*:*:*:*:*:*:*:*,TP-Link,Tl-Wa855Re Firmware
CVE-2020-24391,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.74519,NVD-CWE-noinfo,mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769.,2021-03-30,Nuclei,cpe:2.3:a:mongo-express_project:mongo-express:*:*:*:*:*:node.js:*:*,Mongo-Express Project,Mongo-Express
CVE-2020-24550,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.04719,CWE-601,"An Open Redirect vulnerability in EpiServer Find before 13.2.7 allows an attacker to redirect users to untrusted websites via the _t_redirect parameter in a crafted URL, such as a /find_v2/_click URL.",2021-03-31,Nuclei,cpe:2.3:a:episerver:find:*:*:*:*:*:*:*:*,Episerver,Find
CVE-2020-24557,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02639,NVD-CWE-Other,"A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function and attain privilege escalation. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Please note that version 1909 (OS Build 18363.719) of Microsoft Windows 10 mitigates hard links, but previous versions are affected.",2020-09-01,CISA,cpe:2.3:a:trendmicro:apex_one:-:*:*:*:saas:*:*:*;cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:*:*:*:*;cpe:2.3:a:trendmicro:worry-free_business_security:10.0:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2020-24571,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.17959,CWE-22,NexusQA NexusDB before 4.50.23 allows the reading of files via ../ directory traversal.,2020-08-21,Nuclei,cpe:2.3:a:nexusdb:nexusdb:*:*:*:*:*:*:*:*,Nexusdb,Nexusdb
CVE-2020-24579,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09997,CWE-287,An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. An unauthenticated attacker could bypass authentication to access authenticated pages and functionality.,2020-12-22,Nuclei,cpe:2.3:h:dlink:dsl2888a:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dsl2888a_firmware:*:*:*:*:*:*:*:*,D-Link,Dsl2888A Firmware
CVE-2020-24589,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H,0.26939,CWE-611,The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks.,2020-08-21,Nuclei,cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_microgateway:2.2.0:*:*:*:*:*:*:*,Wso2,Api Manager
CVE-2020-24701,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.06788,CWE-79,OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH_INFO to the /appsuite URI).,2021-01-12,Nuclei,cpe:2.3:a:open-xchange:open-xchange_appsuite:*:*:*:*:*:*:*:*,Open-Xchange,Open-Xchange Appsuite
CVE-2020-24719,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.23304,CWE-78,"Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack. Communication between Erlang nodes is done by exchanging a shared secret (aka ""magic cookie""). There are cases where the magic cookie is included in the content of the logs. An attacker can use the cookie to attach to an Erlang node and run OS level commands on the system running the Erlang node. Affects version: 6.5.1. Fix version: 6.6.0.",2020-11-12,Metasploit,cpe:2.3:a:couchbase:couchbase_server:*:*:*:*:*:*:*:*,Couchbase,Couchbase Server
CVE-2020-24881,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.73267,CWE-918,"SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.",2020-11-02,Nuclei,cpe:2.3:a:enhancesoft:osticket:*:*:*:*:*:*:*:*,Enhancesoft,Osticket
CVE-2020-24902,4.7,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N,0.02852,CWE-79,"Quixplorer <=2.4.1 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.",2021-01-07,Nuclei,cpe:2.3:a:quixplorer_project:quixplorer:*:*:*:*:*:*:*:*;cpe:2.3:a:quixplorer_project:quixplorer:2.4.1:beta:*:*:*:*:*:*,Quixplorer Project,Quixplorer
CVE-2020-24903,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02932,CWE-79,"Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.",2021-01-07,Nuclei,cpe:2.3:a:cutesoft:cute_editor:6.4:*:*:*:*:asp.net:*:*,Cutesoft,Cute Editor
CVE-2020-24912,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.06289,CWE-79,A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.,2021-03-04,Nuclei,cpe:2.3:a:qcubed:qcubed:*:*:*:*:*:*:*:*,Qcubed,Qcubed
CVE-2020-24949,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.67289,NVD-CWE-noinfo,Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution (RCE).,2020-09-03,Nuclei,cpe:2.3:a:php-fusion:php-fusion:9.03.50:*:*:*:*:*:*:*,Php-Fusion,Php-Fusion
CVE-2020-25042,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.18248,CWE-434,"An arbitrary file upload issue exists in Mara CMS 7.5. In order to exploit this, an attacker must have a valid authenticated (admin/manager) session and make a codebase/dir.php?type=filenew request to upload PHP code to codebase/handler.php.",2020-09-03,Metasploit,cpe:2.3:a:maracms:maracms:7.5:*:*:*:*:*:*:*,Maracms,Maracms
CVE-2020-2506,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.01982,CWE-284,"The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.",2021-02-03,CISA,cpe:2.3:a:qnap:helpdesk:*:*:*:*:*:*:*:*,Qnap,Helpdesk
CVE-2020-25078,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.97901,NVD-CWE-noinfo,An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure.,2020-09-02,CISA/EPSS/Nuclei,cpe:2.3:h:dlink:dcs-2530l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dcs-2670l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dcs-4603:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dcs-4622:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dcs-4701e:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dcs-4703e:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dcs-4705e:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dcs-4802e:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dcs-p703:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dcs-2530l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dcs-2670l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dcs-4603_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dcs-4622_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dcs-4701e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dcs-4703e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dcs-4705e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dcs-4802e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dcs-p703_firmware:*:*:*:*:*:*:*:*,D-Link,Dcs-4603 Firmware
CVE-2020-25079,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.52717,CWE-77,An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated command injection.,2020-09-02,CISA,cpe:2.3:h:dlink:dcs-2530l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dcs-2670l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dcs-4603:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dcs-4622:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dcs-4701e:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dcs-4703e:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dcs-4705e:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dcs-4802e:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dcs-p703:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dcs-2530l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dcs-2670l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dcs-4603_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dcs-4622_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dcs-4701e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dcs-4703e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dcs-4705e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dcs-4802e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dcs-p703_firmware:*:*:*:*:*:*:*:*,D-Link,Dcs-4703E Firmware
CVE-2020-2509,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.328,CWE-77,"A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build 20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6 Build 20210327 and later QuTS hero h4.5.1.1491 build 20201119 and later",2021-04-17,CISA,cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:-:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.3.0174:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.3.0868:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.3.0998:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.3.1051:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.3.1098:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.3.1161:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.3.1252:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.3.1315:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.3.1386:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.3.1432:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0358:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0358:beta1:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0370:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0370:beta1:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0372:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0372:beta1:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0374:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0374:beta1:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0387:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0387:beta2:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0411:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0416:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0427:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0434:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0435:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0451:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0483:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0486:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0506:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0516:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0526:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0551:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0557:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0561:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0569:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0593:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0597:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0604:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.0899:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.1029:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.1082:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.1190:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.1282:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.1368:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.1417:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4.1463:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.0895:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.0907:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.0923:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.0944:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.0959:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.0979:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.0993:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.1013:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.1033:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.1070:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.1154:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.1218:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.1263:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.1286:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.1333:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.1411:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6.1446:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6:-:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.5.1.1456:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.5.1.1461:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.5.1.1465:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.5.1.1480:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.5.1:-:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.5.2:-:*:*:*:*:*:*;cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*;cpe:2.3:o:qnap:quts_hero:h4.5.1.1472:*:*:*:*:*:*:*;cpe:2.3:o:qnap:quts_hero:h4.5.1:-:*:*:*:*:*:*,Qnap,Qts
CVE-2020-25200,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.0747,CWE-203,"Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts. Initially, the server will return error 401. However, if the username is valid, then after 20 login attempts, the server will start responding with error 400. Invalid usernames will receive error 401 indefinitely. Note: This has been disputed by the vendor as not a vulnerability. They argue that this is an intended design",2020-10-01,Nuclei,cpe:2.3:a:pritunl:pritunl:1.29.2145.25:*:*:*:*:*:*:*,Pritunl,Pritunl
CVE-2020-25213,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.97328,CWE-434,"The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.",2020-09-09,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:filemanagerpro:file_manager:*:*:*:*:free:wordpress:*:*,Filemanagerpro,File Manager
CVE-2020-25223,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96693,CWE-78,"A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11",2020-09-25,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:sophos:unified_threat_management:*:*:*:*:*:*:*:*;cpe:2.3:a:sophos:unified_threat_management:9.511:-:*:*:*:*:*:*;cpe:2.3:a:sophos:unified_threat_management:9.607:-:*:*:*:*:*:*;cpe:2.3:a:sophos:unified_threat_management:9.705:-:*:*:*:*:*:*,Sophos,Unified Threat Management
CVE-2020-25495,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.08142,CWE-79,A reflected Cross-site scripting (XSS) vulnerability in Xinuo (formerly SCO) Openserver version 5 and 6 allows remote attackers to inject arbitrary web script or HTML tag via the parameter 'section'.,2020-12-18,Nuclei,cpe:2.3:a:xinuos:openserver:5.0.7:*:*:*:*:*:*:*;cpe:2.3:a:xinuos:openserver:6.0:*:*:*:*:*:*:*,Xinuos,Openserver
CVE-2020-25506,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99968,CWE-78,"D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.",2021-02-02,CISA/EPSS/Nuclei,cpe:2.3:h:dlink:dns-320:ax:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-320_firmware:2.06b01:*:*:*:*:*:*:*,D-Link,Dns-320 Firmware
CVE-2020-2551,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.93168,NVD-CWE-noinfo,"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",2020-01-15,CISA/Nuclei,cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*,Oracle,Weblogic Server
CVE-2020-25540,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.75881,CWE-22,ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode parameter.,2020-09-14,Nuclei,cpe:2.3:a:thinkadmin:thinkadmin:6.0:*:*:*:*:*:*:*,Thinkadmin,Thinkadmin
CVE-2020-2555,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97116,CWE-502,"Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",2020-01-15,CISA/EPSS/Metasploit,cpe:2.3:a:oracle:access_manager:11.1.2.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:coherence:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:coherence:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:coherence:3.7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:commerce_platform:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:commerce_platform:11.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:commerce_platform:11.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:commerce_platform:11.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:healthcare_data_repository:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:rapid_planning:12.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:rapid_planning:12.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_assortment_planning:15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_assortment_planning:16.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*,Oracle,Access Manager
CVE-2020-25592,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.57453,CWE-287,"In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.",2020-11-06,Metasploit,cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*;cpe:2.3:a:saltstack:salt:3001:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2020-25736,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02152,NVD-CWE-noinfo,Acronis True Image 2019 update 1 through 2021 update 1 on macOS allows local privilege escalation due to an insecure XPC service configuration.,2021-07-15,Metasploit,cpe:2.3:a:acronis:true_image:2019:1:*:*:*:macos:*:*;cpe:2.3:a:acronis:true_image:2019:2:*:*:*:macos:*:*;cpe:2.3:a:acronis:true_image:2019:3:*:*:*:macos:*:*;cpe:2.3:a:acronis:true_image:2020:*:*:*:*:macos:*:*;cpe:2.3:a:acronis:true_image:2021:1:*:*:*:macos:*:*,Acronis,True Image
CVE-2020-25780,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.09884,CWE-22,"In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, Directory Traversal can occur such that an attempt to view a log file can instead view a file outside of the log-files folder.",2020-10-29,Nuclei,cpe:2.3:a:commvault:commcell:*:*:*:*:*:*:*:*,Commvault,Commcell
CVE-2020-25864,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.06095,CWE-79,"HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14.",2021-04-20,Nuclei,cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*;cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*,Hashicorp,Consul
CVE-2020-26073,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.12062,CWE-35,"A vulnerability in the application data endpoints of Cisco&nbsp;SD-WAN vManage Software could allow an unauthenticated, remote attacker to gain access to sensitive information.
The vulnerability is due to improper validation of directory traversal character sequences within requests to application programmatic interfaces (APIs). An attacker could exploit this vulnerability by sending malicious requests to an API within the affected application. A successful exploit could allow the attacker to conduct directory traversal attacks and gain access to sensitive information including credentials or user tokens.Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.",2024-11-18,Nuclei,cpe:2.3:a:cisco:catalyst_sd-wan_manager:17.2.10:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:17.2.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:17.2.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:17.2.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:17.2.7:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:17.2.8:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:17.2.9:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.2.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.3.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.3.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.3.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.3.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.3.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.3.6.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.3.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.3.7:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.3.8:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.4.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.4.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.4.302:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.4.303:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.4.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.4.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.4.501_es:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.4.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:19.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:19.0.1a:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:19.1.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:19.2.097:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:19.2.098:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:19.2.099:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:19.2.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:19.2.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:19.2.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:19.2.31:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:19.2.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:19.2.929:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:19.3.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.1.12:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.1.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.1.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.3.1:*:*:*:*:*:*:*,Cisco,Catalyst Sd-Wan Manager
CVE-2020-26124,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.67168,CWE-94,"openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code injection attacks, via the sortfield POST parameter of rpc.php, because json_encode_safe is not used in config/databasebackend.inc. Successful exploitation allows arbitrary command execution on the underlying operating system as root.",2020-10-02,Metasploit,cpe:2.3:a:openmediavault:openmediavault:*:*:*:*:*:*:*:*,Openmediavault,Openmediavault
CVE-2020-26153,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03796,CWE-79,A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in the Event Espresso Core plugin before 4.10.7.p for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.,2021-07-13,Nuclei,cpe:2.3:a:eventespresso:event_espresso:*:*:*:*:*:wordpress:*:*,Eventespresso,Event Espresso
CVE-2020-26214,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.65933,CWE-287,"In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deployments where LDAP servers are configured to allow unauthenticated authentication mechanism for anonymous authorization are affected. A fix has been implemented in version 8.1.0 that returns HTTP 401 Unauthorized response for any authentication attempts where the password field is empty. As a workaround LDAP administrators can disallow unauthenticated bind requests by clients.",2020-11-06,Nuclei,cpe:2.3:a:alerta_project:alerta:*:*:*:*:*:*:*:*,Alerta Project,Alerta
CVE-2020-26217,8.0,CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H,0.85001,CWE-78,XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.,2020-11-16,Nuclei,cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.16.0:*:*:*:*:*:*:*;cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:sap:*:*;cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:*;cpe:2.3:a:oracle:banking_cash_management:14.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_cash_management:14.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_cash_management:14.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_supply_chain_finance:14.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_supply_chain_finance:14.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_supply_chain_finance:14.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*;cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2020-26248,6.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H,0.12388,CWE-89,"In the PrestaShop module ""productcomments"" before version 4.2.1, an attacker can use a Blind SQL injection to retrieve data or stop the MySQL service. The problem is fixed in 4.2.1 of the module.",2020-12-03,Nuclei,cpe:2.3:a:prestashop:productcomments:*:*:*:*:*:prestashop:*:*,Prestashop,Productcomments
CVE-2020-26258,6.3,CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N,0.81817,CWE-918,"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.",2020-12-16,Nuclei,cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*;cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2020-26413,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.34931,CWE-200,An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2. Information disclosure via GraphQL results in user email being unexpectedly visible.,2020-12-11,Nuclei,cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*;cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*,Gitlab,Gitlab
CVE-2020-26836,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02338,CWE-601,"SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attacker can enter a link to malicious site which could trick the user to enter credentials or download malicious software, as a parameter in the application URL and share it with the end user who could potentially become a victim of the attack.",2020-12-09,Nuclei,cpe:2.3:a:sap:solution_manager:7.20:*:*:*:*:*:*:*,Sap,Solution Manager
CVE-2020-26876,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.10551,CWE-306,"The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materials) by using the /wp-json REST API, as exploited in the wild in September 2020. This occurs because show_in_rest is enabled for custom post types (e.g., /wp-json/wp/v2/course and /wp-json/wp/v2/lesson exist).",2020-10-07,Nuclei,cpe:2.3:a:wpcoursesplugin:wp-courses:*:*:*:*:*:wordpress:*:*,Wpcoursesplugin,Wp-Courses
CVE-2020-26879,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.45083,CWE-798,Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attacker can interact with the service API by using a backdoor value as the Authorization header.,2020-10-26,Nuclei,cpe:2.3:a:commscope:ruckus_vriot:*:*:*:*:*:*:*:*;cpe:2.3:h:commscope:ruckus_iot_module:-:*:*:*:*:*:*:*,Commscope,Ruckus Iot Module
CVE-2020-26919,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.57544,NVD-CWE-Other,NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level.,2020-10-09,CISA/Nuclei,cpe:2.3:h:netgear:jgs516pe:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:jgs516pe_firmware:*:*:*:*:*:*:*:*,Netgear,Jgs516Pe Firmware
CVE-2020-26935,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.67081,CWE-89,An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.,2020-10-10,Nuclei,cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*;cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*;cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*;cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*,Opensuse,Leap
CVE-2020-26948,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.87154,CWE-918,Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.,2020-10-10,Metasploit/Nuclei,cpe:2.3:a:emby:emby:*:*:*:*:*:*:*:*,Emby,Emby
CVE-2020-26950,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.42327,CWE-416,"In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition. This vulnerability affects Firefox < 82.0.3, Firefox ESR < 78.4.1, and Thunderbird < 78.4.2.",2020-12-09,Metasploit,cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*,Mozilla,Firefox
CVE-2020-27191,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.09595,NVD-CWE-noinfo,"LionWiki before 3.2.12 allows an unauthenticated user to read files as the web server user via crafted string in the index.php f1 variable, aka Local File Inclusion. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.",2020-11-16,Nuclei,cpe:2.3:a:lionwiki:lionwiki:*:*:*:*:*:*:*:*,Lionwiki,Lionwiki
CVE-2020-2733,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.18645,NVD-CWE-noinfo,"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",2020-04-15,Nuclei,cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*,Oracle,Jd Edwards Enterpriseone Tools
CVE-2020-27361,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.06714,CWE-668,An issue exists within Akkadian Provisioning Manager 4.50.02 which allows attackers to view sensitive information within the /pme subdirectories.,2021-07-01,Nuclei,cpe:2.3:a:akkadianlabs:akkadian_provisioning_manager:4.50.02:*:*:*:*:*:*:*,Akkadianlabs,Akkadian Provisioning Manager
CVE-2020-27386,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.72872,CWE-434,"An unrestricted file upload issue in FlexDotnetCMS before v1.5.9 allows an authenticated remote attacker to upload and execute arbitrary files by using the FileManager to upload malicious code (e.g., ASP code) in the form of a safe file type (e.g., a TXT file), and then using the FileEditor (in v1.5.8 and prior) or the FileManager's rename function (in v1.5.7 and prior) to rename the file to an executable extension (e.g., ASP), and finally executing the file via an HTTP GET request to /<path_to_file>.",2020-11-12,Metasploit,cpe:2.3:a:flexdotnetcms_project:flexdotnetcms:*:*:*:*:*:*:*:*,Flexdotnetcms Project,Flexdotnetcms
CVE-2020-27387,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.18461,CWE-434,"An unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker (with access to the FileManager) to upload and execute arbitrary PHP code by uploading a PHP payload, and then using the FileManager's rename function to provide the payload (which will receive a random name on the server) with the PHP extension, and finally executing the PHP file via an HTTP GET request to /storage/<php_file_name>. NOTE: the vendor has patched this while leaving the version number at 1.0.0-beta.",2020-11-05,Metasploit,cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:alpha2:*:*:*:*:*:*;cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:alpha3:*:*:*:*:*:*;cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:alpha4:*:*:*:*:*:*;cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:alpha5:*:*:*:*:*:*;cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:alpha6:*:*:*:*:*:*;cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:alpha7:*:*:*:*:*:*;cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:alpha8:*:*:*:*:*:*;cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:alpha:*:*:*:*:*:*;cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:beta:*:*:*:*:*:*,Horizontcms Project,Horizontcms
CVE-2020-27467,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.15737,CWE-22,A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php.,2022-02-24,Nuclei,cpe:2.3:a:processwire:processwire:*:*:*:*:*:*:*:*,Processwire,Processwire
CVE-2020-27481,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.1064,CWE-89,"An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage of ""wp_ajax_nopriv"" call in WordPress, which allows any unauthenticated user to get access to the function ""gdlr_lms_cancel_booking"" where POST Parameter ""id"" was sent straight into SQL query without sanitization.",2020-11-12,Nuclei,cpe:2.3:a:goodlayers:good_learning_management_system:*:*:*:*:*:wordpress:*:*,Goodlayers,Good Learning Management System
CVE-2020-27615,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.53619,CWE-89,"The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip.",2020-10-21,Metasploit/Nuclei,cpe:2.3:a:loginizer:loginizer:*:*:*:*:*:wordpress:*:*,Loginizer,Loginizer
CVE-2020-27735,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.05626,CWE-79,"An XSS issue was discovered in Wing FTP 6.4.4. An arbitrary IFRAME element can be included in the help pages via a crafted link, leading to the execution of (sandboxed) arbitrary HTML and JavaScript in the user's browser.",2021-01-26,Nuclei,cpe:2.3:a:wftpserver:wing_ftp_server:6.4.4:*:*:*:*:*:*:*,Wftpserver,Wing Ftp Server
CVE-2020-27838,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.17943,CWE-287,A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality.,2021-03-08,Nuclei,cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*,Redhat,Keycloak
CVE-2020-27866,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.08656,CWE-288,"This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-11355.",2021-02-12,Nuclei,cpe:2.3:h:netgear:ac2100:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:ac2400:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:ac2600:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6020:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6080:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6120:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6220:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6230:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6260:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6330:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6350:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6700:v2:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6800:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6850:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6900:v2:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r7200:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r7350:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r7400:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r7450:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:ac2100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:ac2400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:ac2600_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6020_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6080_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6120_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6220_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6230_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6260_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6330_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6350_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6700_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6800_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6850_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6900_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r7200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r7350_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r7400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r7450_firmware:*:*:*:*:*:*:*:*,Netgear,Ac2100 Firmware
CVE-2020-27930,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.22178,CWE-787,"A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. Processing a maliciously crafted font may lead to arbitrary code execution.",2020-12-08,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2020-27932,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.10337,CWE-843,"A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. A malicious application may be able to execute arbitrary code with kernel privileges.",2020-12-08,CISA,cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*;cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2020-27950,5.5,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.1652,CWE-665,"A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. A malicious application may be able to disclose kernel memory.",2020-12-08,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2020-27955,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.82715,CWE-427,Git LFS 2.12.0 allows Remote Code Execution.,2020-11-05,Metasploit,cpe:2.3:a:git_large_file_storage_project:git_large_file_storage:2.12.0:*:*:*:*:*:*:*,Git Large File Storage Project,Git Large File Storage
CVE-2020-27982,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.05272,CWE-79,IceWarp 11.4.5.0 allows XSS via the language parameter.,2020-11-02,Nuclei,cpe:2.3:a:icewarp:mail_server:11.4.5:*:*:*:*:*:*:*,Icewarp,Mail Server
CVE-2020-27986,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.16183,CWE-306,"SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is ""it is the administrator's responsibility to configure it.",2020-10-28,Nuclei,cpe:2.3:a:sonarsource:sonarqube:8.4.2.36762:*:*:*:*:*:*:*,Sonarsource,Sonarqube
CVE-2020-28185,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.18066,NVD-CWE-noinfo,User Enumeration vulnerability in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to identify valid users within the system via the username parameter to wizard/initialise.php.,2020-12-24,Nuclei,cpe:2.3:o:terra-master:tos:*:*:*:*:*:*:*:*,Terra-Master,Tos
CVE-2020-28188,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96598,CWE-78,Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter.,2020-12-24,EPSS/Metasploit/Nuclei,cpe:2.3:o:terra-master:tos:*:*:*:*:*:*:*:*,Terra-Master,Tos
CVE-2020-28208,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.10412,CWE-203,An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.,2021-01-08,Nuclei,cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*,Rocket.Chat,Rocket.Chat
CVE-2020-28328,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.63267,CWE-434,"SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled .php file under the web root.",2020-11-06,Metasploit,cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*,Salesagility,Suitecrm
CVE-2020-28347,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.73848,CWE-78,tdpServer on TP-Link Archer A7 AC1750 devices before 201029 allows remote attackers to execute arbitrary code via the slave_mac parameter. NOTE: this issue exists because of an incomplete fix for CVE-2020-10882 in which shell quotes are mishandled.,2020-11-08,Metasploit,cpe:2.3:h:tp-link:ac1750:a7:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:ac1750_firmware:*:*:*:*:*:*:*:*,TP-Link,Ac1750 Firmware
CVE-2020-28351,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.15987,CWE-79,The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack (via the PATH_INFO to index.php) due to insufficient validation for the time_zone object in the HOME_MEETING& page.,2020-11-09,Nuclei,cpe:2.3:h:mitel:shoretel:-:*:*:*:*:*:*:*;cpe:2.3:o:mitel:shoretel_firmware:19.46.1802.0:*:*:*:*:*:*:*,Mitel,Shoretel Firmware
CVE-2020-28429,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.63305,CWE-78,"All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require(""geojson2kml""); a(""./"",""& touch JHU"",function(){})",2021-02-23,Nuclei,cpe:2.3:a:geojson2kml_project:geojson2kml:*:*:*:*:*:node.js:*:*,Geojson2Kml Project,Geojson2Kml
CVE-2020-28653,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.787,NVD-CWE-noinfo,Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet.,2021-02-03,Metasploit/Nuclei,cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125002:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125102:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125108:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125110:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125111:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125112:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125113:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125114:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125116:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125117:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125118:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125120:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125121:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125123:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125124:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125125:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125136:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125137:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125139:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125140:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125143:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125144:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125145:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125156:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125157:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125158:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125159:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125161:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125163:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125174:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125175:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125176:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125177:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125178:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125180:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125181:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125192:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125193:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125194:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125195:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125196:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125197:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125198:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125201:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125204:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125212:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125213:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125214:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125215:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125216:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125228:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125229:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125230:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125231:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125232:*:*:*:*:*:*,Zohocorp,Manageengine Opmanager
CVE-2020-2883,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.94928,NVD-CWE-noinfo,"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",2020-04-15,CISA/Metasploit/Nuclei,cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*,Oracle,Weblogic Server
CVE-2020-28871,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.85785,CWE-434,Remote code execution in Monitorr v1.7.6m in upload.php allows an unauthorized person to execute arbitrary code on the server-side via an insecure file upload.,2021-02-10,Metasploit/Nuclei,cpe:2.3:a:monitorr:monitorr:1.7.6m:*:*:*:*:*:*:*,Monitorr,Monitorr
CVE-2020-28949,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.84554,NVD-CWE-noinfo,"Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.",2020-11-19,CISA/Metasploit,cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*;cpe:2.3:a:php:archive_tar:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2020-28976,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.27771,CWE-918,The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/detail.php?subdomain=SSRF.,2020-11-30,Nuclei,cpe:2.3:a:canto:canto:1.3.0:*:*:*:*:wordpress:*:*,Canto,Canto
CVE-2020-29047,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.16017,CWE-502,The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpress_hotel_booking_1 cookie in load in includes/class-wphb-sessions.php.,2021-03-03,Nuclei,cpe:2.3:a:thimpress:wp_hotel_booking:*:*:*:*:*:wordpress:*:*,Thimpress,Wp Hotel Booking
CVE-2020-29164,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.05355,CWE-79,PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by cross-site scripting (XSS).,2021-02-03,Nuclei,cpe:2.3:a:rainbowfishsoftware:pacsone_server:*:*:*:*:*:*:*:*,Rainbowfishsoftware,Pacsone Server
CVE-2020-29214,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04499,CWE-89,SQL injection vulnerability in SourceCodester Alumni Management System 1.0 allows the user to inject SQL payload to bypass the authentication via admin/login.php.,2021-06-15,Nuclei,cpe:2.3:a:alumni_management_system_project:alumni_management_system:1.0:*:*:*:*:*:*:*,Alumni Management System Project,Alumni Management System
CVE-2020-29227,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.16822,NVD-CWE-noinfo,"An issue was discovered in Car Rental Management System 1.0. An unauthenticated user can perform a file inclusion attack against the /index.php file with a partial filename in the ""page"" parameter, to cause local file inclusion resulting in code execution.",2020-12-14,Nuclei,cpe:2.3:a:car_rental_management_system_project:car_rental_management_system:1.0:*:*:*:*:*:*:*,Car Rental Management System Project,Car Rental Management System
CVE-2020-29279,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.52881,NVD-CWE-noinfo,PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 allows remote code execution.,2020-12-02,Nuclei,cpe:2.3:a:74cms:74cms:*:*:*:*:*:*:*:*,74Cms,74Cms
CVE-2020-29390,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.40228,CWE-78,Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartSessionSubmit parameter that could allow an unauthenticated attacker to execute a system command by using shell metacharacters and the %0a character.,2020-11-30,Nuclei,cpe:2.3:o:zeroshell:zeroshell:3.9.3:*:*:*:*:*:*:*,Zeroshell,Zeroshell
CVE-2020-29395,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.11696,CWE-79,The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field.,2020-11-30,Nuclei,cpe:2.3:a:myeventon:eventon:*:*:*:*:*:wordpress:*:*,Myeventon,Eventon
CVE-2020-29453,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.23086,CWE-22,"The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.",2021-02-22,Nuclei,cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*,Atlassian,Data Center
CVE-2020-29557,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.5432,CWE-119,An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-authentication remote code execution.,2021-01-29,CISA,cpe:2.3:h:dlink:dir-825:r1:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-825\/a:d1a:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-825\/ac:e1a:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-825\/ac:e:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-825\/acf:f1:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-825\/gf:gf:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-825_r1_firmware:*:*:*:*:*:*:*:*,D-Link,Dir-825 R1 Firmware
CVE-2020-29574,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04729,CWE-89,An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.,2020-12-11,CISA,cpe:2.3:o:sophos:cyberoamos:*:*:*:*:*:*:*:*,Sophos,Cyberoamos
CVE-2020-29583,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.90049,CWE-522,Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.,2020-12-22,CISA/Nuclei,cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg1100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg110:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg1900:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg210:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg2200:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg310:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg40:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg40w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg60:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg60w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall1100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall110:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall310:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp100_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp100w_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp200_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp500_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp700_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp800_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg1100_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg110_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg1900_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg20-vpn_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg20w-vpn_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg210_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg2200_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg310_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg40_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg40w_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg60_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg60w_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_100_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_100w_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_200_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_500_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_700_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn1000_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn100_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn300_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn50_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall1100_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall110_firmware:4.60:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall310_firmware:4.60:*:*:*:*:*:*:*,Zyxel,Usg20-Vpn Firmware
CVE-2020-29597,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.71006,CWE-434,IncomCMS 2.0 has a modules/uploader/showcase/script.php insecure file upload vulnerability. This vulnerability allows unauthenticated attackers to upload files into the server.,2020-12-07,Nuclei,cpe:2.3:a:incomcms_project:incomcms:2.0:*:*:*:*:*:*:*,Incomcms Project,Incomcms
CVE-2020-3118,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.11685,CWE-134,"A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of string input from certain fields in Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause a stack overflow, which could allow the attacker to execute arbitrary code with administrative privileges on an affected device. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).",2020-02-05,CISA,cpe:2.3:h:cisco:asr_9000:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9000v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9001:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9006:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9010:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9901:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9903:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9904:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9906:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9910:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9912:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9920:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9922:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:crs-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_540-12z20g-sys-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_540-12z20g-sys-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_540-24z8q2c-sys:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_540-28z4c-sys-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_540-28z4c-sys-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_540-acc-sys:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_540l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_540x-12z16g-sys-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_540x-12z16g-sys-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_540x-16z4g8q2c-a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_540x-16z4g8q2c-d:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_540x-acc-sys:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_5501-se:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_5501:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_5502-se:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_5502:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_5508:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_5516:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_560:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_6000:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_6008:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:xrv_9000:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:5.2.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:6.4.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:6.5.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:6.6.25:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:7.0.1:*:*:*:*:*:*:*,Cisco,Ios Xr
CVE-2020-3153,6.5,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N,0.28307,CWE-427,"A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.",2020-02-19,CISA/Metasploit,cpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:windows:*:*,Cisco,Anyconnect Secure Mobility Client
CVE-2020-3161,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.83734,CWE-20,"A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web server of a targeted device. A successful exploit could allow the attacker to remotely execute code with root privileges or cause a reload of an affected IP phone, resulting in a DoS condition.",2020-04-15,CISA,cpe:2.3:h:cisco:8831:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ip_phone_7811:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ip_phone_7821:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ip_phone_7841:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ip_phone_7861:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ip_phone_8811:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ip_phone_8821-ex:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ip_phone_8821:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ip_phone_8841:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ip_phone_8845:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ip_phone_8851:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ip_phone_8861:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ip_phone_8865:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:8831_firmware:10.3\(1\)es14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:8831_firmware:11.0\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:8831_firmware:11.0\(5\)sr1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_7811_firmware:11.0\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_7821_firmware:11.0\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_7841_firmware:11.0\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_7861_firmware:11.0\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_8811_firmware:10.3\(1\)es14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_8811_firmware:11.0\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_8811_firmware:11.0\(5\)sr1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_8821-ex_firmware:10.3\(1\)es14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_8821-ex_firmware:11.0\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_8821-ex_firmware:11.0\(5\)sr1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_8821_firmware:10.3\(1\)es14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_8821_firmware:11.0\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_8821_firmware:11.0\(5\)sr1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_8841_firmware:10.3\(1\)es14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_8841_firmware:11.0\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_8841_firmware:11.0\(5\)sr1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_8845_firmware:10.3\(1\)es14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_8845_firmware:11.0\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_8845_firmware:11.0\(5\)sr1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_8851_firmware:10.3\(1\)es14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_8851_firmware:11.0\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_8851_firmware:11.0\(5\)sr1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_8861_firmware:10.3\(1\)es14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_8861_firmware:11.0\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_8861_firmware:11.0\(5\)sr1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_8865_firmware:10.3\(1\)es14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_8865_firmware:11.0\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:ip_phone_8865_firmware:11.0\(5\)sr1:*:*:*:*:*:*:*,Cisco,Ip Phone 8865 Firmware
CVE-2020-3187,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.96595,CWE-22,"A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a targeted system. The vulnerability is due to a lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences. An exploit could allow the attacker to view or delete arbitrary files on the targeted system. When the device is reloaded after exploitation of this vulnerability, any files that were deleted are restored. The attacker can only view and delete files within the web services file system. This file system is enabled when the affected device is configured with either WebVPN or AnyConnect features. This vulnerability can not be used to obtain access to ASA or FTD system files or underlying operating system (OS) files. Reloading the affected device will restore all files within the web services file system.",2020-05-06,EPSS/Nuclei,cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5505:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5510:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5512-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5515-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5520:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5525-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5540:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5545-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5550:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5555-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5580:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5585-x:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:asa_5505_firmware:9.6\(4\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:asa_5510_firmware:9.6\(4\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:asa_5512-x_firmware:9.6\(4\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:asa_5515-x_firmware:9.6\(4\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:asa_5520_firmware:9.6\(4\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:asa_5525-x_firmware:9.6\(4\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:asa_5540_firmware:9.6\(4\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:asa_5545-x_firmware:9.6\(4\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:asa_5550_firmware:9.6\(4\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:asa_5555-x_firmware:9.6\(4\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:asa_5580_firmware:9.6\(4\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:asa_5585-x_firmware:9.6\(4\):*:*:*:*:*:*:*,Cisco,Asa 5505 Firmware
CVE-2020-3243,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.88374,CWE-20,"Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.",2020-04-15,Metasploit,cpe:2.3:a:cisco:ucs_director:6.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.0.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.0.1.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.0.1.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.0.1.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.5.0.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.6.1.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.6.2.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.7.2.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.7.3.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director_express_for_big_data:*:*:*:*:*:*:*:*,Cisco,Ucs Director
CVE-2020-3250,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.60158,CWE-20,"Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.",2020-04-15,Metasploit,cpe:2.3:a:cisco:ucs_director:6.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.0.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.0.1.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.0.1.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.0.1.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.5.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.5.0.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.5.0.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.6.1.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.6.2.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.7.2.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:6.7.3.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director_express_for_big_data:*:*:*:*:*:*:*:*,Cisco,Ucs Director
CVE-2020-3259,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.71789,CWE-200,"A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. An attacker could exploit this vulnerability by sending a crafted GET request to the web services interface. A successful exploit could allow the attacker to retrieve memory contents, which could lead to the disclosure of confidential information. Note: This vulnerability affects only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.",2020-05-06,CISA,cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*,Cisco,Adaptive Security Appliance Software
CVE-2020-3433,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.10049,CWE-427,"A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system.",2020-08-17,CISA/Metasploit,cpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:windows:*:*,Cisco,Anyconnect Secure Mobility Client
CVE-2020-3452,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.99992,CWE-20,"A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system. The vulnerability is due to a lack of proper input validation of URLs in HTTP requests processed by an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device. The web services file system is enabled when the affected device is configured with either WebVPN or AnyConnect features. This vulnerability cannot be used to obtain access to ASA or FTD system files or underlying operating system (OS) files.",2020-07-22,CISA/EPSS/Nuclei,cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5505:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5510:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5512-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5515-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5520:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5525-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5540:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5545-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5550:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5555-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5580:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asa_5585-x:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*,Cisco,Adaptive Security Appliance Software
CVE-2020-35131,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.51299,CWE-94,"Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestreset URI.",2021-01-08,Nuclei,cpe:2.3:a:agentejo:cockpit:*:*:*:*:*:*:*:*,Agentejo,Cockpit
CVE-2020-35234,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.64603,CWE-532,"The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/easy-wp-smtp/ directory, then they can discover a log file (such as #############_debug_log.txt) that contains all password-reset links. The attacker can request a reset of the Administrator password and then use a link found there.",2020-12-14,Metasploit/Nuclei,cpe:2.3:a:wp-ecommerce:easy_wp_smtp:*:*:*:*:*:wordpress:*:*,Wp-Ecommerce,Easy Wp Smtp
CVE-2020-35338,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.12111,CWE-798,"The Web Administrative Interface in Mobile Viewpoint Wireless Multiplex Terminal (WMT) Playout Server 20.2.8 and earlier has a default account with a password of ""pokon.""",2020-12-14,Nuclei,cpe:2.3:a:mobileviewpoint:wireless_multiplex_terminal_playout_server:*:*:*:*:*:*:*:*,Mobileviewpoint,Wireless Multiplex Terminal Playout Server
CVE-2020-35359,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.04744,CWE-770,Pure-FTPd 1.0.48 allows remote attackers to prevent legitimate server use by making enough connections to exceed the connection limit.,2020-12-26,Nuclei,cpe:2.3:a:pureftpd:pure-ftpd:1.0.48:*:*:*:*:*:*:*,Pureftpd,Pure-Ftpd
CVE-2020-35476,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.8533,CWE-78,A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. The yrange value is written to a gnuplot file in the /tmp directory. This file is then executed via the mygnuplot.sh shell script. (tsd/GraphHandler.java attempted to prevent command injections by blocking backticks but this is insufficient.),2020-12-16,Metasploit/Nuclei,cpe:2.3:a:opentsdb:opentsdb:*:*:*:*:*:*:*:*,Opentsdb,Opentsdb
CVE-2020-35578,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.81915,CWE-78,"An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands.",2021-01-13,Metasploit,cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*,Nagios,Nagios Xi
CVE-2020-35580,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.13975,CWE-22,"A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated users to read arbitrary files from the operating system via a /searchblox/servlet/FileServlet?col=url= request. Additionally, this may be used to read the contents of the SearchBlox configuration file (e.g., searchblox/WEB-INF/config.xml), which contains both the Super Admin's API key and the base64 encoded SHA1 password hashes of other SearchBlox users.",2021-05-20,Nuclei,cpe:2.3:a:searchblox:searchblox:*:*:*:*:*:*:*:*,Searchblox,Searchblox
CVE-2020-35598,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.21,CWE-22,ACS Advanced Comment System 1.0 is affected by Directory Traversal via an advanced_component_system/index.php?ACS_path=..%2f URI. NOTE: this might be the same as CVE-2009-4623,2020-12-23,Nuclei,cpe:2.3:a:advanced_comment_system_project:advanced_comment_system:1.0:*:*:*:*:*:*:*,Advanced Comment System Project,Advanced Comment System
CVE-2020-3566,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H,0.03631,CWE-400,"A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected device. The vulnerability is due to insufficient queue management for Internet Group Management Protocol (IGMP) packets. An attacker could exploit this vulnerability by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to cause memory exhaustion, resulting in instability of other processes. These processes may include, but are not limited to, interior and exterior routing protocols. Cisco will release software updates that address this vulnerability.",2020-08-29,CISA,cpe:2.3:h:cisco:asr_9001:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9006:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9010:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9901:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9904:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9906:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9910:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9912:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9922:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:6.4.2:*:*:*:*:*:*:*,Cisco,Ios Xr
CVE-2020-35665,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.78141,CWE-78,An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV creation.,2020-12-23,Metasploit,cpe:2.3:o:terra-master:terramaster_operating_system:*:*:*:*:*:*:*:*,Terra-Master,Terramaster Operating System
CVE-2020-3569,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H,0.03293,CWE-400,"Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to either immediately crash the Internet Group Management Protocol (IGMP) process or make it consume available memory and eventually crash. The memory consumption may negatively impact other processes that are running on the device. These vulnerabilities are due to the incorrect handling of IGMP packets. An attacker could exploit these vulnerabilities by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to immediately crash the IGMP process or cause memory exhaustion, resulting in other processes becoming unstable. These processes may include, but are not limited to, interior and exterior routing protocols. Cisco will release software updates that address these vulnerabilities.",2020-09-23,CISA,cpe:2.3:h:cisco:asr_9000v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9001:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9006:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9010:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9901:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9903:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9904:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9906:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9910:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9912:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_9922:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:crs-1_16-slot_line_card_chassis:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:crs-1_16-slot_single-shelf_system:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:crs-1_4-slot_single-shelf_system:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:crs-1_8-slot_line_card_chassis:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:crs-1_8-slot_single-shelf_system:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:crs-1_fabric_card_chassis:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:crs-1_line_card_chassis_\(dual\):-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:crs-1_line_card_chassis_\(multi\):-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:crs-1_multishelf_system:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:crs-3_16-slot_single-shelf_system:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:crs-3_4-slot_single-shelf_system:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:crs-3_8-slot_single-shelf_system:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:crs-3_multishelf_system:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:crs-8\/s-b_crs:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:crs-8\/scrs:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:crs-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:crs-x_16-slot_single-shelf_system:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:crs-x_multishelf_system:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:crs:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:crs_performance_route_processor:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_5001:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_5002:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_5011:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_520:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_540:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_5501:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_5501:se:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_5502:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_5502:se:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_5508:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_5516:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_560:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_6008:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:6.1.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:6.2.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:6.3.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:6.4.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:6.4.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:6.5.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:6.6.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:6.6.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:7.0.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:7.1.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:7.1.2:*:*:*:*:*:*:*,Cisco,Ios Xr
CVE-2020-35713,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.32704,CWE-78,Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page.,2020-12-26,Nuclei,cpe:2.3:h:linksys:re6500:-:*:*:*:*:*:*:*;cpe:2.3:o:linksys:re6500_firmware:*:*:*:*:*:*:*:*,Linksys,Re6500 Firmware
CVE-2020-35729,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.87987,CWE-78,KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter.,2020-12-27,Metasploit/Nuclei,cpe:2.3:a:klogserver:klog_server:2.4.1:*:*:*:*:*:*:*,Klogserver,Klog Server
CVE-2020-35730,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.32823,CWE-79,"An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.",2020-12-28,CISA,cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2020-35736,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.15402,CWE-22,GateOne 1.1 allows arbitrary file download without authentication via /downloads/.. directory traversal because os.path.join is misused.,2020-12-27,Nuclei,cpe:2.3:a:liftoffsoftware:gateone:1.1:*:*:*:*:*:*:*,Liftoffsoftware,Gateone
CVE-2020-35749,7.7,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N,0.30479,CWE-22,Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin 2.9.3 and earlier for WordPress allows remote attackers to read arbitrary files via the sjb_file parameter to wp-admin/post.php.,2021-01-15,Nuclei,cpe:2.3:a:presstigers:simple_board_job:*:*:*:*:*:wordpress:*:*,Presstigers,Simple Board Job
CVE-2020-35774,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.87622,CWE-79,"server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.",2020-12-29,Nuclei,cpe:2.3:a:twitter:twitter-server:*:*:*:*:*:*:*:*,Twitter,Twitter-Server
CVE-2020-3580,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.85439,CWE-79,"Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.",2020-10-21,CISA/Nuclei,cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*,Cisco,Firepower Threat Defense
CVE-2020-35846,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.93201,CWE-89,Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.,2020-12-30,Metasploit/Nuclei,cpe:2.3:a:agentejo:cockpit:*:*:*:*:*:*:*:*,Agentejo,Cockpit
CVE-2020-35847,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98294,CWE-89,Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.,2020-12-30,EPSS/Metasploit/Nuclei,cpe:2.3:a:agentejo:cockpit:*:*:*:*:*:*:*:*,Agentejo,Cockpit
CVE-2020-35848,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.74989,CWE-89,Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.,2020-12-30,Nuclei,cpe:2.3:a:agentejo:cockpit:*:*:*:*:*:*:*:*,Agentejo,Cockpit
CVE-2020-35951,9.9,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H,0.76328,CWE-306,"An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files).",2021-01-01,Nuclei,cpe:2.3:a:expresstech:quiz_and_survey_master:*:*:*:*:*:wordpress:*:*,Expresstech,Quiz And Survey Master
CVE-2020-35984,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01104,CWE-79,A stored cross site scripting (XSS) vulnerability in the 'Users Alerts' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Title' parameter.,2021-07-09,Nuclei,cpe:2.3:a:rukovoditel:rukovoditel:2.7.2:*:*:*:*:*:*:*,Rukovoditel,Rukovoditel
CVE-2020-35985,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01111,CWE-79,"A stored cross site scripting (XSS) vulnerability in the 'Global Lists"" feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter.",2021-07-09,Nuclei,cpe:2.3:a:rukovoditel:rukovoditel:2.7.2:*:*:*:*:*:*:*,Rukovoditel,Rukovoditel
CVE-2020-35986,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01109,CWE-79,A stored cross site scripting (XSS) vulnerability in the 'Users Access Groups' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter.,2021-07-09,Nuclei,cpe:2.3:a:rukovoditel:rukovoditel:2.7.2:*:*:*:*:*:*:*,Rukovoditel,Rukovoditel
CVE-2020-35987,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01109,CWE-79,A stored cross site scripting (XSS) vulnerability in the 'Entities List' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter.,2021-07-09,Nuclei,cpe:2.3:a:rukovoditel:rukovoditel:2.7.2:*:*:*:*:*:*:*,Rukovoditel,Rukovoditel
CVE-2020-36112,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.17383,CWE-89,"CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in bookPerPub.php and in cart.php. A successful exploitation of this vulnerability will lead to an attacker dumping the entire database on which the web application is running.",2021-01-04,Nuclei,cpe:2.3:a:cse_bookstore_project:cse_bookstore:1.0:*:*:*:*:*:*:*,Cse Bookstore Project,Cse Bookstore
CVE-2020-36155,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.08975,CWE-269,"An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could supply an array parameter for sensitive metadata, such as the wp_capabilities user meta that defines a user's role. During the registration process, submitted registration details were passed to the update_profile function, and any metadata was accepted, e.g., wp_capabilities[administrator] for Administrator access.",2021-01-04,Nuclei,cpe:2.3:a:ultimatemember:ultimate_member:*:*:*:*:*:wordpress:*:*,Ultimatemember,Ultimate Member
CVE-2020-36193,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N,0.70595,CWE-22,"Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.",2021-01-18,CISA,cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*;cpe:2.3:a:php:archive_tar:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2020-36289,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.99209,CWE-863,"Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.",2021-05-12,EPSS/Nuclei,cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*,Atlassian,Data Center
CVE-2020-36333,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H,0.03429,CWE-306,"themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a reset_wizard_actions hook.",2021-05-05,Nuclei,cpe:2.3:a:themegrill:themegrill_demo_importer:*:*:*:*:*:wordpress:*:*,Themegrill,Themegrill Demo Importer
CVE-2020-36365,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02575,CWE-601,"Smartstore (aka SmartStoreNET) before 4.1.0 allows CommonController.ClearCache, ClearDatabaseCache, RestartApplication, and ScheduleTaskController.Edit open redirect.",2021-05-19,Nuclei,cpe:2.3:a:smartstore:smartstorenet:*:*:*:*:*:*:*:*,Smartstore,Smartstorenet
CVE-2020-36510,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02602,CWE-79,"The 15Zine WordPress theme before 3.3.0 does not sanitise and escape the cbi parameter before outputing it back in the response via the cb_s_a AJAX action, leading to a Reflected Cross-Site Scripting",2022-02-28,Nuclei,cpe:2.3:a:codetipi:15zine:*:*:*:*:*:wordpress:*:*,Codetipi,15Zine
CVE-2020-36705,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06944,CWE-434,"The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the _ning_upload_image function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.",2023-06-07,Nuclei,cpe:2.3:a:tunasite:adning_advertising:*:*:*:*:*:wordpress:*:*,Tunasite,Adning Advertising
CVE-2020-36708,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.65342,CWE-94,"The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, Pixova Lite <= 2.0.5, Brilliance <= 1.2.7, MedZone Lite <= 1.2.4, Regina Lite <= 2.0.4, Transcend <= 1.1.8, Affluent <= 1.1.0, Bonkers <= 1.0.4, Antreas <= 1.0.2, Sparkling <= 2.4.8, and NatureMag Lite <= 1.0.4. This is due to epsilon_framework_ajax_action. This makes it possible for unauthenticated attackers to call functions and achieve remote code execution.",2023-06-07,Nuclei,cpe:2.3:a:colorlib:activello:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:colorlib:bonkers:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:colorlib:illdy:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:colorlib:newspaper_x:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:colorlib:pixova_lite:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:colorlib:shapely:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:colorlib:sparklinkg:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:cpothemes:affluent:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:cpothemes:allegiant:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:cpothemes:brilliance:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:cpothemes:transcend:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:machothemes:antreas:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:machothemes:medzone_lite:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:machothemes:naturemag_lite:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:machothemes:newsmag:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:machothemes:regina_lite:*:*:*:*:*:wordpress:*:*,Colorlib,Activello
CVE-2020-36719,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04304,CWE-862,"The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lp_cc_addons_actions function. This makes it possible for unauthenticated attackers to arbitrarily install, activate and deactivate any plugin.",2023-06-07,Nuclei,cpe:2.3:a:cridio:listingpro:*:*:*:*:*:wordpress:*:*,Cridio,Listingpro
CVE-2020-36723,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01608,CWE-200,"The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the ~/listingpro-plugin/functions.php file. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, full names, email addresses, phone numbers, physical addresses and user post counts.",2023-06-07,Nuclei,cpe:2.3:a:cridio:listingpro:*:*:*:*:*:wordpress:*:*,Cridio,Listingpro
CVE-2020-36728,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.03159,CWE-22,"The Adning Advertising plugin for WordPress is vulnerable to file deletion via path traversal in versions up to, and including, 1.5.5. This allows unauthenticated attackers to delete arbitrary files which can be used to reset and gain full control of a site.",2023-06-07,Nuclei,cpe:2.3:a:tunasite:adning_advertising:*:*:*:*:*:wordpress:*:*,Tunasite,Adning Advertising
CVE-2020-36731,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.01342,CWE-79,"The Flexible Checkout Fields for WooCommerce  plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction() function which is called via an admin_init hook, along with missing sanitization and escaping on the settings that are stored.",2023-06-07,Nuclei,cpe:2.3:a:wpdesk:flexible_checkout_fields:*:*:*:*:free:wordpress:*:*,Wpdesk,Flexible Checkout Fields
CVE-2020-36836,8.0,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H,0.01407,CWE-352,"The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 due to a lack of capability checking and insufficient path validation. This makes it possible for authenticated users with minimal permissions to delete arbitrary files from the server.",2024-10-16,Nuclei,cpe:2.3:a:wpfastestcache:wp_fastest_cache:*:*:*:*:*:wordpress:*:*,Wpfastestcache,Wp Fastest Cache
CVE-2020-36847,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.12633,CWE-434,"The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server.",2025-07-12,Metasploit,cpe:2.3:a:simplefilelist:simple_file_list:*:*:*:*:*:wordpress:*:*,Simplefilelist,Simple File List
CVE-2020-36848,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01095,CWE-200,"The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.14.9 via the env-info.php and restore-info.json files. This makes it possible for unauthenticated attackers to find the location of back-up files and subsequently download them.",2025-07-12,Metasploit,cpe:2.3:a:boldgrid:total_upkeep:*:*:*:*:*:wordpress:*:*,Boldgrid,Total Upkeep
CVE-2020-36849,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04693,CWE-434,"The AIT CSV import/export plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-content/plugins/ait-csv-import-export/admin/upload-handler.php file in versions up to, and including, 3.0.3. This makes it possible for unauthorized attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.",2025-07-12,Metasploit,cpe:2.3:a:ait-themes:csv_import_\/_export:*:*:*:*:*:wordpress:*:*,Ait-Themes,Csv Import / Export
CVE-2020-36884,0.0,,0.0083,CWE-918,BrightSign Digital Signage Diagnostic Web Server 8.2.26 and less contains an unauthenticated server-side request forgery vulnerability in the 'url' GET parameter of the Download Speed Test service. Attackers can specify external domains to bypass firewalls and perform network enumeration by forcing the application to make arbitrary HTTP requests to internal network hosts.,2025-12-10,Nuclei,,,
CVE-2020-36939,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02488,CWE-22,Cassandra Web 0.5.0 contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating path traversal parameters. Attackers can exploit the disabled Rack::Protection module to read sensitive system files like /etc/passwd and retrieve Apache Cassandra database credentials.,2026-01-27,Metasploit,,,
CVE-2020-37123,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03135,CWE-78,Pinger 1.0 contains a remote code execution vulnerability that allows attackers to inject shell commands through the ping and socket parameters. Attackers can exploit the unsanitized input in ping.php to write arbitrary PHP files and execute system commands by appending shell metacharacters.,2026-02-05,Nuclei,,,
CVE-2020-3837,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.16111,CWE-787,"A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.",2020-02-27,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2020-3950,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.07254,CWE-269,"VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed.",2020-03-17,CISA/Metasploit,cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:horizon_client:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:remote_console:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*,Apple,Macos
CVE-2020-3952,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.90384,CWE-306,"Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.",2020-04-10,CISA/Metasploit/Nuclei,cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:*,Vmware,Vcenter Server
CVE-2020-3992,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.83015,CWE-416,"OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.",2020-10-20,CISA,cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:-:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:2:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201701001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201703001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201703002:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201704001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707101:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707102:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707103:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707201:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707202:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707203:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707204:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707205:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707206:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707207:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707208:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707209:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707210:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707211:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707212:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707213:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707214:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707215:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707216:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707217:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707218:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707219:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707220:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201707221:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201710001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201712001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201803001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201806001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201808001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201810001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201810002:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201811001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201811002:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201811301:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201901001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201903001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201905001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201908001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201910001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-20191004001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201911001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201911401:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201911402:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201912001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201912002:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201912101:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201912102:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201912103:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201912104:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201912301:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201912401:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201912402:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201912403:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-201912404:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-202005001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-202006001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-202007001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.5:650-202010001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:-:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201806001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201807001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201808001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810101:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810102:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810103:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810201:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810202:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810203:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810204:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810205:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810206:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810207:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810208:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810209:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810210:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810211:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810212:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810213:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810214:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810215:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810216:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810217:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810218:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810219:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810220:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810221:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810222:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810223:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810224:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810225:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810226:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810227:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810228:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810229:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810230:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810231:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810232:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810233:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201810234:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201811001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201901001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201901401:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201901402:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201901403:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201903001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904201-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904201:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904202-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904202:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904203-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904203:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904204-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904204:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904205-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904205:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904206-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904206:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904207-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904207:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904208-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904208:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904209-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904209:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904210-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904210:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904211-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904211:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904212-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904212:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904213-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904213:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904214-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904214:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904215-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904215:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904216-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904216:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904217-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904217:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904218-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904218:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904219-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904219:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904220-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904220:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904221-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904221:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904222-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904222:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904223-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904223:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904224-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904224:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904225-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904225:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904226-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904226:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904227-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904227:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904228-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904228:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904229-ug:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201904229:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201905001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201906002:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908101:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908102:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908103:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908104:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908201:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908202:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908203:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908204:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908205:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908206:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908207:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908208:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908209:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908210:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908211:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908212:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908213:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908214:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908215:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908216:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908217:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908218:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908219:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908220:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201908221:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201912001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201912101:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201912102:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201912401:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201912402:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201912403:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201912404:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-201912405:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-202004001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-202004002:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-202004301:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-202004401:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-202004402:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-202004403:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-202004404:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-202004405:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-202004406:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-202004407:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-202004408:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-202006001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-202008001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:6.7:670-202010001:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0.0:-:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0.0:1.20.16321839:*:*:*:*:*:*,Vmware,Esxi
CVE-2020-4006,9.1,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H,0.23771,CWE-78,"VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.",2020-11-23,CISA,cpe:2.3:a:vmware:cloud_foundation:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:4.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.3:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager_connector:3.3.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager_connector:3.3.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager_connector:3.3.3:*:*:*:*:*:*:*;cpe:2.3:a:vmware:one_access:20.01:*:*:*:*:*:*:*;cpe:2.3:a:vmware:one_access:20.10:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2020-4427,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.70031,NVD-CWE-noinfo,"IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system. IBM X-Force ID: 180532.",2020-05-07,CISA/Metasploit/Nuclei,cpe:2.3:a:ibm:data_risk_manager:*:*:*:*:*:*:*:*,Ibm,Data Risk Manager
CVE-2020-4428,9.1,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H,0.61692,CWE-78,"IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533.",2020-05-07,CISA/Metasploit,cpe:2.3:a:ibm:data_risk_manager:*:*:*:*:*:*:*:*,Ibm,Data Risk Manager
CVE-2020-4429,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.71363,CWE-798,"IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. A remote attacker could exploit this vulnerability to login and execute arbitrary code on the system with root privileges. IBM X-Force ID: 180534.",2020-05-07,Metasploit/Nuclei,cpe:2.3:a:ibm:data_risk_manager:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:data_risk_manager:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:ibm:data_risk_manager:2.0.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:data_risk_manager:2.0.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:data_risk_manager:2.0.5:*:*:*:*:*:*:*;cpe:2.3:a:ibm:data_risk_manager:2.0.6:*:*:*:*:*:*:*,Ibm,Data Risk Manager
CVE-2020-4430,4.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N,0.68544,CWE-22,"IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to download arbitrary files from the system. IBM X-Force ID: 180535.",2020-05-07,CISA,cpe:2.3:a:ibm:data_risk_manager:*:*:*:*:*:*:*:*,Ibm,Data Risk Manager
CVE-2020-4463,8.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L,0.3159,CWE-611,IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181484.,2020-07-29,Nuclei,cpe:2.3:a:ibm:maximo_asset_management:7.6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:maximo_asset_management:7.6.0.2:*:*:*:*:*:*:*,Ibm,Maximo Asset Management
CVE-2020-5135,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.26869,CWE-120,"A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. This vulnerability affected SonicOS Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.",2020-10-12,CISA,cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sonicos:7.0.0.0:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sonicosv:*:*:*:*:*:*:*:*,Sonicwall,Sonicos
CVE-2020-5191,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0552,CWE-79,PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple Persistent XSS vulnerabilities.,2020-01-06,Nuclei,cpe:2.3:a:phpgurukul:hospital_management_system:4.0:*:*:*:*:*:*:*,Phpgurukul,Hospital Management System
CVE-2020-5192,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.1681,CWE-89,"PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple SQL injection vulnerabilities: multiple pages and parameters are not validating user input, and allow for the application's database and information to be fully compromised.",2020-01-06,Nuclei,cpe:2.3:a:phpgurukul:hospital_management_system:4.0:*:*:*:*:*:*:*,Phpgurukul,Hospital Management System
CVE-2020-5284,4.4,CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N,0.43426,CWE-23,"Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.",2020-03-30,Nuclei,cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*,Zeit,Next.Js
CVE-2020-5307,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.15652,CWE-89,"PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to SQL injection, as demonstrated by the username parameter in index.php, the category and CategoryCode parameters in add-category.php, the CompanyName parameter in add-company.php, and the ProductName and ProductPrice parameters in add-product.php.",2020-01-07,Nuclei,cpe:2.3:a:phpgurukul:dairy_farm_shop_management_system:1.0:*:*:*:*:*:*:*,Phpgurukul,Dairy Farm Shop Management System
CVE-2020-5405,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N,0.6876,CWE-23,"Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.",2020-03-05,Nuclei,cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*,Vmware,Spring Cloud Config
CVE-2020-5410,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.95586,CWE-23,"Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.",2020-06-02,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*,Vmware,Spring Cloud Config
CVE-2020-5412,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.10214,CWE-441,"Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.",2020-08-07,Nuclei,cpe:2.3:a:vmware:spring_cloud_netflix:*:*:*:*:*:*:*:*,Vmware,Spring Cloud Netflix
CVE-2020-5722,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.83926,CWE-89,The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.,2020-03-23,CISA/Metasploit/Nuclei,cpe:2.3:h:grandstream:ucm6200:-:*:*:*:*:*:*:*;cpe:2.3:o:grandstream:ucm6200_firmware:*:*:*:*:*:*:*:*,Grandstream,Ucm6200 Firmware
CVE-2020-5723,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05704,CWE-312,The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database. This could allow an attacker to retrieve all passwords and possibly gain elevated privileges.,2020-03-30,Metasploit,cpe:2.3:h:grandstream:ucm6202:-:*:*:*:*:*:*:*;cpe:2.3:h:grandstream:ucm6204:-:*:*:*:*:*:*:*;cpe:2.3:h:grandstream:ucm6208:-:*:*:*:*:*:*:*;cpe:2.3:o:grandstream:ucm6202_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:grandstream:ucm6204_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:grandstream:ucm6208_firmware:*:*:*:*:*:*:*:*,Grandstream,Ucm6202 Firmware
CVE-2020-5724,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.11875,CWE-89,The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint. A remote unauthenticated attacker can invoke the challenge action with a crafted username and discover user passwords.,2020-03-30,Metasploit,cpe:2.3:h:grandstream:ucm6202:-:*:*:*:*:*:*:*;cpe:2.3:h:grandstream:ucm6204:-:*:*:*:*:*:*:*;cpe:2.3:h:grandstream:ucm6208:-:*:*:*:*:*:*:*;cpe:2.3:o:grandstream:ucm6202_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:grandstream:ucm6204_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:grandstream:ucm6208_firmware:*:*:*:*:*:*:*:*,Grandstream,Ucm6202 Firmware
CVE-2020-5735,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.35643,CWE-121,Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to crash the device and possibly execute arbitrary code.,2020-04-08,CISA,cpe:2.3:h:amcrest:1080-lite_8ch:-:*:*:*:*:*:*:*;cpe:2.3:h:amcrest:amdv10814-h5:-:*:*:*:*:*:*:*;cpe:2.3:h:amcrest:ip2m-841-v3:-:*:*:*:*:*:*:*;cpe:2.3:h:amcrest:ip2m-841:-:*:*:*:*:*:*:*;cpe:2.3:h:amcrest:ip2m-853ew:-:*:*:*:*:*:*:*;cpe:2.3:h:amcrest:ip2m-858w:-:*:*:*:*:*:*:*;cpe:2.3:h:amcrest:ip2m-866ew:-:*:*:*:*:*:*:*;cpe:2.3:h:amcrest:ip2m-866w:-:*:*:*:*:*:*:*;cpe:2.3:h:amcrest:ip4m-1053ew:-:*:*:*:*:*:*:*;cpe:2.3:h:amcrest:ip8m-2454ew:-:*:*:*:*:*:*:*;cpe:2.3:h:amcrest:ip8m-2493eb:-:*:*:*:*:*:*:*;cpe:2.3:h:amcrest:ip8m-2496eb:-:*:*:*:*:*:*:*;cpe:2.3:h:amcrest:ip8m-2597e:-:*:*:*:*:*:*:*;cpe:2.3:h:amcrest:ip8m-mb2546ew:-:*:*:*:*:*:*:*;cpe:2.3:h:amcrest:ip8m-mt2544ew:-:*:*:*:*:*:*:*;cpe:2.3:h:amcrest:ip8m-t2499ew:-:*:*:*:*:*:*:*;cpe:2.3:h:amcrest:ipm-721:-:*:*:*:*:*:*:*;cpe:2.3:h:amcrest:ipm-hx1:-:*:*:*:*:*:*:*;cpe:2.3:o:amcrest:1080-lite_8ch_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:amcrest:amdv10814-h5_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:amcrest:ip2m-841-v3_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:amcrest:ip2m-841_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:amcrest:ip2m-853ew_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:amcrest:ip2m-858w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:amcrest:ip2m-866ew_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:amcrest:ip2m-866w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:amcrest:ip4m-1053ew_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:amcrest:ip8m-2454ew_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:amcrest:ip8m-2493eb_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:amcrest:ip8m-2496eb_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:amcrest:ip8m-2597e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:amcrest:ip8m-mb2546ew_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:amcrest:ip8m-mt2544ew_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:amcrest:ip8m-t2499ew_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:amcrest:ipm-721_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:amcrest:ipm-hx1_firmware:*:*:*:*:*:*:*:*,Amcrest,1080-Lite 8Ch Firmware
CVE-2020-5741,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.72936,CWE-502,"Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.",2020-05-08,CISA/Metasploit,cpe:2.3:a:plex:media_server:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2020-5752,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.08607,CWE-22,"Relative path traversal in Druva inSync Windows Client 6.6.3 allows a local, unauthenticated attacker to execute arbitrary operating system commands with SYSTEM privileges.",2020-05-21,Metasploit,cpe:2.3:a:druva:insync_client:6.6.3:*:*:*:*:windows:*:*,Druva,Insync Client
CVE-2020-5766,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.07233,CWE-89,"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SRS Simple Hits Counter Plugin for WordPress 1.0.3 and 1.0.4 allows a remote, unauthenticated attacker to determine the value of database fields.",2020-07-13,Nuclei,cpe:2.3:a:srs_simple_hits_counter_project:srs_simple_hits_counter:1.0.3:*:*:*:*:wordpress:*:*;cpe:2.3:a:srs_simple_hits_counter_project:srs_simple_hits_counter:1.0.4:*:*:*:*:wordpress:*:*,Srs Simple Hits Counter Project,Srs Simple Hits Counter
CVE-2020-5775,5.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N,0.06531,CWE-918,"Server-Side Request Forgery in Canvas LMS 2020-07-29 allows a remote, unauthenticated attacker to cause the Canvas application to perform HTTP GET requests to arbitrary domains.",2020-08-21,Nuclei,cpe:2.3:a:instructure:canvas_learning_management_service:2020-07-29:*:*:*:*:*:*:*,Instructure,Canvas Learning Management Service
CVE-2020-5776,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.14725,CWE-352,"Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI.",2020-09-01,Nuclei,cpe:2.3:a:magmi_project:magmi:*:*:*:*:*:*:*:*,Magmi Project,Magmi
CVE-2020-5777,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.23303,CWE-287,"MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. A remote attacker can trigger this connection failure if the Mysql setting max_connections (default 151) is lower than Apache (or another web server) setting MaxRequestWorkers (formerly MaxClients) (default 256). This can be done by sending at least 151 simultaneous requests to the Magento website to trigger a ""Too many connections"" error, then use default magmi:magmi basic authentication to remotely bypass authentication.",2020-09-01,Nuclei,cpe:2.3:a:magmi_project:magmi:*:*:*:*:*:*:*:*,Magmi Project,Magmi
CVE-2020-5791,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.78632,CWE-78,"Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache user.",2020-10-20,Metasploit,cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*,Nagios,Nagios Xi
CVE-2020-5792,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.60966,CWE-88,"Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code with the privileges of the apache user.",2020-10-20,Metasploit,cpe:2.3:a:nagios:nagios_xi:5.7.3:*:*:*:*:*:*:*,Nagios,Nagios Xi
CVE-2020-5847,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.95844,NVD-CWE-Other,Unraid through 6.8.0 allows Remote Code Execution.,2020-03-16,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:o:unraid:unraid:*:*:*:*:*:*:*:*,Unraid,Unraid
CVE-2020-5849,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.93243,CWE-697,Unraid 6.8.0 allows authentication bypass.,2020-03-16,CISA/Metasploit,cpe:2.3:o:unraid:unraid:6.8.0:*:*:*:*:*:*:*,Unraid,Unraid
CVE-2020-5902,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99999,CWE-22,"In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.",2020-07-01,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:ssl_orchestrator:*:*:*:*:*:*:*:*,F5,Big-Ip Access Policy Manager
CVE-2020-6010,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.49231,CWE-89,LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection,2020-04-30,Metasploit,cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:*,Thimpress,Learnpress
CVE-2020-6171,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.04798,CWE-79,A cross-site scripting (XSS) vulnerability in the index page of the CLink Office 2.0 management console allows remote attackers to inject arbitrary web script or HTML via the lang parameter.,2020-04-07,Nuclei,cpe:2.3:a:communilink:clink_office:2.0:*:*:*:*:*:*:*,Communilink,Clink Office
CVE-2020-6207,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98266,CWE-306,"SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.",2020-03-10,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:sap:solution_manager:7.20:*:*:*:*:*:*:*,Sap,Solution Manager
CVE-2020-6287,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.94719,CWE-306,"SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.",2020-07-14,CISA/Metasploit/Nuclei,cpe:2.3:a:sap:netweaver_application_server_java:7.30:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_application_server_java:7.31:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_application_server_java:7.40:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:*,Sap,Netweaver Application Server Java
CVE-2020-6308,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.61736,CWE-918,"SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure and gather information for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to perform malicious requests, resulting in a Server-Side Request Forgery vulnerability.",2020-10-20,Nuclei,cpe:2.3:a:sap:businessobjects_business_intelligence_platform:4.1:-:*:*:*:*:*:*;cpe:2.3:a:sap:businessobjects_business_intelligence_platform:4.2:-:*:*:*:*:*:*;cpe:2.3:a:sap:businessobjects_business_intelligence_platform:4.3:*:*:*:*:*:*:*,Sap,Businessobjects Business Intelligence Platform
CVE-2020-6418,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.78808,CWE-843,Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2020-02-27,CISA/Metasploit,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2020-6572,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.10586,CWE-416,Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.,2021-01-14,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*,Google,Chrome
CVE-2020-6637,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.20058,CWE-89,openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php.,2020-08-24,Nuclei,cpe:2.3:a:os4ed:opensis:7.3:*:*:*:community:*:*:*,Os4Ed,Opensis
CVE-2020-6819,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02978,CWE-362,"Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.",2020-04-24,CISA,cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*;cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*,Mozilla,Firefox
CVE-2020-6820,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06305,CWE-362,"Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.",2020-04-24,CISA,cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*;cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*,Mozilla,Firefox
CVE-2020-6950,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.10124,CWE-22,Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.,2021-06-02,Nuclei,cpe:2.3:a:eclipse:mojarra:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_platform:2.12.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_network_integrity:7.3.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hyperion_calculation_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_merchandising_system:19.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:solaris_cluster:4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:time_and_labor:*:*:*:*:*:*:*:*,Eclipse,Mojarra
CVE-2020-7012,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.18211,CWE-94,Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker with privileges to write to the Kibana index could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system.,2020-06-03,Metasploit,cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*,Elastic,Kibana
CVE-2020-7107,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02195,CWE-79,The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php.,2020-01-16,Nuclei,cpe:2.3:a:etoilewebdesign:ultimate_faq:*:*:*:*:*:wordpress:*:*,Etoilewebdesign,Ultimate Faq
CVE-2020-7136,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.79522,NVD-CWE-noinfo,A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access. Hewlett Packard Enterprise has provided a software update to resolve this vulnerability in HPE Smart Update Manager (SUM) prior to 8.5.6. Please visit the HPE Support Center at https://support.hpe.com/hpesc/public/home to download the latest version of HPE Smart Update Manager (SUM). Download the latest version of HPE Smart Update Manager (SUM) or download the latest Service Pack For ProLiant (SPP).,2020-04-30,Nuclei,cpe:2.3:a:hpe:smart_update_manager:*:*:*:*:*:*:*:*,Hpe,Smart Update Manager
CVE-2020-7200,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.8189,NVD-CWE-noinfo,A potential security vulnerability has been identified in HPE Systems Insight Manager (SIM) version 7.6. The vulnerability could be exploited to allow remote code execution.,2020-12-18,Metasploit,cpe:2.3:a:hp:systems_insight_manager:7.6:*:*:*:*:*:*:*,Hp,Systems Insight Manager
CVE-2020-7209,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98751,NVD-CWE-noinfo,LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.,2020-02-13,EPSS/Metasploit/Nuclei,cpe:2.3:a:hp:linuxki:*:*:*:*:*:*:*:*,Hp,Linuxki
CVE-2020-7246,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.83235,CWE-22,"A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users['photop_preview'] delete photo feature, allowing bypass of .htaccess protection. NOTE: this issue exists because of an incomplete fix for CVE-2015-3884.",2020-01-21,Metasploit,cpe:2.3:a:qdpm:qdpm:*:*:*:*:*:*:*:*,Qdpm,Qdpm
CVE-2020-7247,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98946,CWE-78,"smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the ""uncommented"" default configuration. The issue exists because of an incorrect return value upon failure of input validation.",2020-01-29,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:openbsd:opensmtpd:6.6:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2020-7318,4.6,CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N,0.01024,CWE-79,Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10.9 Update 9 allows administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized.,2020-10-14,Nuclei,cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:*,Mcafee,Epolicy Orchestrator
CVE-2020-7350,6.1,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N,0.04879,CWE-78,"Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer's hostname or service name. An attacker can create a specially-crafted hostname or service name to be imported by Metasploit from a variety of sources and trigger a command injection on the operator's terminal. Note, only the Metasploit Framework and products that expose the plugin system is susceptible to this issue -- notably, this does not include Rapid7 Metasploit Pro. Also note, this vulnerability cannot be triggered through a normal scan operation -- the attacker would have to supply a file that is processed with the db_import command.",2020-04-22,Metasploit,cpe:2.3:a:rapid7:metasploit:*:*:*:*:*:*:*:*,Rapid7,Metasploit
CVE-2020-7351,7.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N,0.65208,CWE-78,"An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the ""asterisk"" user. Note that Trixbox Community Edition has been unsupported by the vendor since 2012. This issue affects: Fonality Trixbox Community Edition, versions 1.2.0 through 2.8.0.4. Versions 1.0 and 1.1 are unaffected.",2020-05-01,Metasploit,cpe:2.3:a:netfortris:trixbox:*:*:*:*:community:*:*:*,Netfortris,Trixbox
CVE-2020-7352,8.4,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N,0.03778,CWE-264,"The GalaxyClientService component of GOG Galaxy runs with elevated SYSTEM privileges in a Windows environment. Due to the software shipping with embedded, static RSA private key, an attacker with this key material and local user permissions can effectively send any operating system command to the service for execution in this elevated context. The service listens for such commands on a locally-bound network port, localhost:9978. A Metasploit module has been published which exploits this vulnerability. This issue affects the 2.0.x branch of the software (2.0.12 and earlier) as well as the 1.2.x branch (1.2.64 and earlier). A fix was issued for the 2.0.x branch of the affected software.",2020-08-06,Metasploit,cpe:2.3:a:gog:galaxy:*:*:*:*:*:windows:*:*,Gog,Galaxy
CVE-2020-7356,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N,0.14014,CWE-89,CAYIN xPost suffers from an unauthenticated SQL Injection vulnerability. Input passed via the GET parameter 'wayfinder_seqid' in wayfinder_meeting_input.jsp is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and execute SYSTEM commands.,2020-08-06,Metasploit,cpe:2.3:a:cayintech:xpost:1.0:*:*:*:*:*:*:*;cpe:2.3:a:cayintech:xpost:2.0:*:*:*:*:*:*:*;cpe:2.3:a:cayintech:xpost:2.5.18103:*:*:*:*:*:*:*,Cayintech,Xpost
CVE-2020-7357,9.6,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N,0.33874,CWE-78,"Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'NTP_Server_IP' HTTP POST parameter in system.cgi page. This issue affects several branches and versions of the CMS application, including CME-SE, CMS-60, CMS-40, CMS-20, and CMS version 8.2, 8.0, and 7.5.",2020-08-06,Metasploit,cpe:2.3:a:cayintech:cms-se:-:*:*:*:*:*:*:*;cpe:2.3:h:cayintech:cms-20:-:*:*:*:*:*:*:*;cpe:2.3:h:cayintech:cms-40:-:*:*:*:*:*:*:*;cpe:2.3:h:cayintech:cms-60:-:*:*:*:*:*:*:*;cpe:2.3:h:cayintech:cms-se-lxc:-:*:*:*:*:*:*:*;cpe:2.3:o:cayintech:cms-20_firmware:9.0:14092:*:*:*:*:*:*;cpe:2.3:o:cayintech:cms-20_firmware:9.0:14197:*:*:*:*:*:*;cpe:2.3:o:cayintech:cms-40_firmware:9.0:14093:*:*:*:*:*:*;cpe:2.3:o:cayintech:cms-40_firmware:9.0:14197:*:*:*:*:*:*;cpe:2.3:o:cayintech:cms-40_firmware:9.0:14199:*:*:*:*:*:*;cpe:2.3:o:cayintech:cms-60_firmware:11.0:19025:*:*:*:*:*:*;cpe:2.3:o:cayintech:cms-se-lxc_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cayintech:cms-se_firmware:11.0:18325:*:*:*:*:*:*;cpe:2.3:o:cayintech:cms-se_firmware:11.0:19025:*:*:*:*:*:*;cpe:2.3:o:cayintech:cms-se_firmware:11.0:19179:*:*:*:*:*:*;cpe:2.3:o:cayintech:cms:7.5:11175:*:*:*:*:*:*;cpe:2.3:o:cayintech:cms:8.0:11175:*:*:*:*:*:*;cpe:2.3:o:cayintech:cms:8.2:12199:*:*:*:*:*:*,Cayintech,Cms-Se Firmware
CVE-2020-7361,9.6,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N,0.17225,CWE-78,"The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its '/pro/repo-create.html' component. After authenticating to the ZenTao dashboard, attackers may construct and send arbitrary OS commands via the POST parameter 'path', and those commands will run in an elevated SYSTEM context on the underlying Windows operating system.",2020-08-06,Metasploit,cpe:2.3:a:easycorp:zentao_pro:*:*:*:*:*:*:*:*,Easycorp,Zentao Pro
CVE-2020-7374,5.3,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L,0.03094,CWE-120,Documalis Free PDF Editor version 5.7.2.26 and Documalis Free PDF Scanner version 5.7.2.122 do not appropriately validate the contents of JPEG images contained within a PDF. Attackers can exploit this vulnerability to trigger a buffer overflow on the stack and gain remote code execution as the user running the Documalis Free PDF Editor or Documalis Free PDF Scanner software.,2020-08-12,Metasploit,cpe:2.3:a:documalis:free_pdf_editor:5.7.2.26:*:*:*:*:*:*:*;cpe:2.3:a:documalis:free_pdf_scanner:5.7.2.122:*:*:*:*:*:*:*,Documalis,Free Pdf Editor
CVE-2020-7384,7.0,CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.30463,CWE-77,Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary commands on a victim's machine.,2020-10-29,Metasploit,cpe:2.3:a:rapid7:metasploit:*:*:*:*:*:*:*:*,Rapid7,Metasploit
CVE-2020-7387,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.36366,CWE-200,"Sage X3 Installation Pathname Disclosure. A specially crafted packet can elicit a response from the AdxDSrv.exe component that reveals the installation directory of the product. Note that this vulnerability can be combined with CVE-2020-7388 to achieve full RCE. This issue was fixed in AdxAdmin 93.2.53, which ships with updates for on-premises versions of Sage X3 Version 9 (components shipped with Syracuse 9.22.7.2 and later), Sage X3 HR & Payroll Version 9 (those components that ship with Syracuse 9.24.1.3), Version 11 (components shipped with Syracuse 11.25.2.6 and later), and Version 12 (components shipped with Syracuse 12.10.2.8 and later) of Sage X3. Other on-premises versions of Sage X3 are unsupported by the vendor.",2021-07-22,Metasploit,cpe:2.3:a:sage:adxadmin:*:*:*:*:*:*:*:*;cpe:2.3:a:sage:x3:11.0:*:*:*:*:*:*:*;cpe:2.3:a:sage:x3:12.0:*:*:*:*:*:*:*;cpe:2.3:a:sage:x3:9.0:*:*:*:*:*:*:*;cpe:2.3:a:sage:x3_hr_\&_payroll:9.0:*:*:*:*:*:*:*,Sage,Adxadmin
CVE-2020-7388,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N,0.70268,CWE-290,"Sage X3 Unauthenticated Remote Command Execution (RCE) as SYSTEM in AdxDSrv.exe component. By editing the client side authentication request, an attacker can bypass credential validation. While exploiting this does require knowledge of the installation path, that information can be learned by exploiting CVE-2020-7387. This issue was fixed in AdxAdmin 93.2.53, which ships with updates for on-premises versions of Sage X3 including Version 9 (components shipped with Syracuse 9.22.7.2 and later), Sage X3 HR & Payroll Version 9 (those components that ship with Syracuse 9.24.1.3), Version 11 (components shipped with Syracuse 11.25.2.6 and later), and Version 12 (components shipped with Syracuse 12.10.2.8 and later) of Sage X3. Other on-premises versions of Sage X3 are unsupported by the vendor.",2021-07-22,Metasploit,cpe:2.3:a:sage:adxadmin:*:*:*:*:*:*:*:*;cpe:2.3:a:sage:x3:11.0:*:*:*:*:*:*:*;cpe:2.3:a:sage:x3:12.0:*:*:*:*:*:*:*;cpe:2.3:a:sage:x3:9.0:*:*:*:*:*:*:*;cpe:2.3:a:sage:x3_hr_\&_payroll:9.0:*:*:*:*:*:*:*,Sage,Adxadmin
CVE-2020-7457,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.33106,CWE-362,"In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 11.3-RELEASE before p11, missing synchronization in the IPV6_2292PKTOPTIONS socket option set handler contained a race condition allowing a malicious application to modify memory after being freed, possibly resulting in code execution.",2020-07-09,Metasploit,cpe:2.3:o:freebsd:freebsd:11.3:-:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:11.3:p10:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:11.3:p1:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:11.3:p2:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:11.3:p3:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:11.3:p4:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:11.3:p5:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:11.3:p6:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:11.3:p7:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:11.3:p8:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:11.3:p9:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:11.4:-:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:11.4:beta1:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:11.4:rc2:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:12.1:-:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:12.1:p1:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:12.1:p2:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:12.1:p3:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:12.1:p4:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:12.1:p5:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:12.1:p6:*:*:*:*:*:*,Freebsd,Freebsd
CVE-2020-7796,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.84593,CWE-918,Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.,2020-02-18,CISA/Nuclei,cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p6:*:*:*:*:*:*,Synacor,Zimbra Collaboration Suite
CVE-2020-7943,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.07884,CWE-276,"Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network. PE 2018.1.13 & 2019.5.0, Puppet Server 6.9.2 & 5.3.12, and PuppetDB 6.9.1 & 5.2.13 disable trapperkeeper-metrics /v1 metrics API and only allows /v2 access on localhost by default. This affects software versions: Puppet Enterprise 2018.1.x stream prior to 2018.1.13 Puppet Enterprise prior to 2019.5.0 Puppet Server prior to 6.9.2 Puppet Server prior to 5.3.12 PuppetDB prior to 6.9.1 PuppetDB prior to 5.2.13 Resolved in: Puppet Enterprise 2018.1.13 Puppet Enterprise 2019.5.0 Puppet Server 6.9.2 Puppet Server 5.3.12 PuppetDB 6.9.1 PuppetDB 5.2.13",2020-03-11,Nuclei,cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*;cpe:2.3:a:puppet:puppet_server:*:*:*:*:*:*:*:*;cpe:2.3:a:puppet:puppetdb:*:*:*:*:*:*:*:*,Puppet,Puppet Enterprise
CVE-2020-7961,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99766,CWE-502,Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).,2020-03-20,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:liferay:liferay_portal:*:*:*:*:community:*:*:*,Liferay,Liferay Portal
CVE-2020-7980,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.82956,CWE-78,Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a valid sid cookie for a login to the intellian default account might be needed.,2020-01-25,Nuclei,cpe:2.3:a:intelliantech:aptus_web:1.24:*:*:*:*:*:*:*,Intelliantech,Aptus Web
CVE-2020-8010,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.48665,NVD-CWE-Other,"CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains an improper ACL handling vulnerability in the robot (controller) component. A remote attacker can execute commands, read from, or write to the target system.",2020-02-18,Metasploit,cpe:2.3:a:broadcom:unified_infrastructure_management:*:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unified_infrastructure_management:20.1:*:*:*:*:*:*:*,Broadcom,Unified Infrastructure Management
CVE-2020-8012,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.77566,CWE-120,"CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a buffer overflow vulnerability in the robot (controller) component. A remote attacker can execute arbitrary code.",2020-02-18,Metasploit,cpe:2.3:a:broadcom:unified_infrastructure_management:*:*:*:*:*:*:*:*;cpe:2.3:a:broadcom:unified_infrastructure_management:20.1:*:*:*:*:*:*:*,Broadcom,Unified Infrastructure Management
CVE-2020-8115,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.07055,CWE-79,"A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver <= 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is stored in an http-only cookie as of v3.2.2. On older versions, however, under specific circumstances, it could be possible to steal the session identifier and gain access to the admin interface. The query string sent to the www/delivery/afr.php script was printed back without proper escaping in a JavaScript context, allowing an attacker to execute arbitrary JS code on the browser of the victim.",2020-02-04,Nuclei,cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*,Revive-Adserver,Revive Adserver
CVE-2020-8163,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.82047,CWE-94,The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.,2020-07-02,Nuclei,cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2020-8191,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.26136,CWE-79,"Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows reflected Cross Site Scripting (XSS).",2020-07-10,Nuclei,cpe:2.3:h:citrix:4000-wo:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:4100-wo:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:5000-wo:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:5100-wo:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:application_delivery_controller:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:gateway:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:netscaler_gateway:-:*:*:*:*:*:*:*;cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:citrix:gateway_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:citrix:netscaler_gateway_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:citrix:sd-wan_wanop:*:*:*:*:*:*:*:*,Citrix,Application Delivery Controller Firmware
CVE-2020-8193,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.88411,CWE-284,"Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints.",2020-07-10,CISA/Nuclei,cpe:2.3:h:citrix:4000-wo:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:4100-wo:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:5000-wo:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:5100-wo:-:*:*:*:*:*:*:*;cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:citrix:gateway_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:citrix:netscaler_gateway_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:citrix:sd-wan_wanop:*:*:*:*:*:*:*:*,Citrix,Application Delivery Controller Firmware
CVE-2020-8194,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N,0.10695,CWE-94,"Reflected code injection in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows the modification of a file download.",2020-07-10,Nuclei,cpe:2.3:h:citrix:4000-wo:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:4100-wo:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:5000-wo:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:5100-wo:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:application_delivery_controller:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:gateway:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:netscaler_gateway:-:*:*:*:*:*:*:*;cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:citrix:gateway_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:citrix:netscaler_gateway_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:citrix:sd-wan_wanop:*:*:*:*:*:*:*:*,Citrix,Application Delivery Controller Firmware
CVE-2020-8195,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.33263,CWE-20,"Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.",2020-07-10,CISA,cpe:2.3:a:citrix:gateway_plug-in_for_linux:*:*:*:*:*:*:*:*;cpe:2.3:h:citrix:4000-wo:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:4100-wo:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:5000-wo:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:5100-wo:-:*:*:*:*:*:*:*;cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:citrix:gateway_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:citrix:netscaler_gateway_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:citrix:sd-wan_wanop:*:*:*:*:*:*:*:*,Citrix,Application Delivery Controller Firmware
CVE-2020-8196,4.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N,0.26333,CWE-284,"Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.",2020-07-10,CISA,cpe:2.3:h:citrix:4000-wo:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:4100-wo:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:5000-wo:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:5100-wo:-:*:*:*:*:*:*:*;cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:citrix:gateway_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:citrix:netscaler_gateway_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:citrix:sd-wan_wanop:*:*:*:*:*:*:*:*,Citrix,Application Delivery Controller Firmware
CVE-2020-8209,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.48656,CWE-22,"Improper access control in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10 before RP6 and Citrix XenMobile Server before 10.9 RP5 and leads to the ability to read arbitrary files.",2020-08-17,Nuclei,cpe:2.3:a:citrix:xenmobile_server:*:*:*:*:*:*:*:*;cpe:2.3:a:citrix:xenmobile_server:10.10.0:-:*:*:*:*:*:*;cpe:2.3:a:citrix:xenmobile_server:10.10.0:rolling_patch1:*:*:*:*:*:*;cpe:2.3:a:citrix:xenmobile_server:10.10.0:rolling_patch2:*:*:*:*:*:*;cpe:2.3:a:citrix:xenmobile_server:10.10.0:rolling_patch3:*:*:*:*:*:*;cpe:2.3:a:citrix:xenmobile_server:10.10.0:rolling_patch4:*:*:*:*:*:*;cpe:2.3:a:citrix:xenmobile_server:10.10.0:rolling_patch5:*:*:*:*:*:*;cpe:2.3:a:citrix:xenmobile_server:10.11.0:-:*:*:*:*:*:*;cpe:2.3:a:citrix:xenmobile_server:10.11.0:rolling_patch1:*:*:*:*:*:*;cpe:2.3:a:citrix:xenmobile_server:10.11.0:rolling_patch2:*:*:*:*:*:*;cpe:2.3:a:citrix:xenmobile_server:10.11.0:rolling_patch3:*:*:*:*:*:*;cpe:2.3:a:citrix:xenmobile_server:10.12.0:-:*:*:*:*:*:*;cpe:2.3:a:citrix:xenmobile_server:10.12.0:rolling_patch1:*:*:*:*:*:*;cpe:2.3:a:citrix:xenmobile_server:10.9.0:-:*:*:*:*:*:*;cpe:2.3:a:citrix:xenmobile_server:10.9.0:rolling_patch1:*:*:*:*:*:*;cpe:2.3:a:citrix:xenmobile_server:10.9.0:rolling_patch2:*:*:*:*:*:*;cpe:2.3:a:citrix:xenmobile_server:10.9.0:rolling_patch3:*:*:*:*:*:*;cpe:2.3:a:citrix:xenmobile_server:10.9.0:rolling_patch4:*:*:*:*:*:*,Citrix,Xenmobile Server
CVE-2020-8218,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.32739,CWE-94,A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.,2020-07-30,CISA,cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r3.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r4.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r4.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r5:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r6:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r7:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_policy_secure:*:*:*:*:*:*:*:*,Ivanti,Connect Secure
CVE-2020-8243,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.90759,CWE-94,A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution.,2020-09-30,CISA,cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:*:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r4.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r4.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r4.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r5:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r6:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r7:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r8.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r8:*:*:*:*:*:*,Ivanti,Connect Secure
CVE-2020-8260,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.9648,CWE-434,A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction.,2020-10-28,CISA/EPSS/Metasploit,cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r1.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r2.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r3.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r5.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r6.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r7.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.4:*:*:*:*:*:*,Ivanti,Connect Secure
CVE-2020-8467,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.10793,NVD-CWE-noinfo,A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute arbitrary code on affected installations (RCE). An attempted attack requires user authentication.,2020-03-18,CISA,cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:*:*:*:*;cpe:2.3:a:trendmicro:officescan:xg:-:*:*:*:*:*:*;cpe:2.3:a:trendmicro:officescan:xg:sp1:*:*:*:*:*:*,Trendmicro,Apex One
CVE-2020-8468,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.05754,CWE-74,"Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability which could allow an attacker to manipulate certain agent client components. An attempted attack requires user authentication.",2020-03-18,CISA,cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:*:*:*:*;cpe:2.3:a:trendmicro:officescan:xg:-:*:*:*:*:*:*;cpe:2.3:a:trendmicro:officescan:xg:sp1:*:*:*:*:*:*;cpe:2.3:a:trendmicro:worry-free_business_security:10.0:-:*:*:*:*:*:*;cpe:2.3:a:trendmicro:worry-free_business_security:10.0:sp1:*:*:*:*:*:*;cpe:2.3:a:trendmicro:worry-free_business_security:9.0:sp3:*:*:*:*:*:*;cpe:2.3:a:trendmicro:worry-free_business_security:9.5:*:*:*:*:*:*:*,Trendmicro,Apex One
CVE-2020-8497,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.05275,CWE-306,"In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps.",2020-03-23,Nuclei,cpe:2.3:a:artica:pandora_fms:*:*:*:*:*:*:*:*,Artica,Pandora Fms
CVE-2020-8512,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.14834,CWE-79,"In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.",2020-02-01,Nuclei,cpe:2.3:a:icewarp:icewarp_server:*:*:*:*:*:*:*:*,Icewarp,Icewarp Server
CVE-2020-8515,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99993,CWE-78,"DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.",2020-02-01,CISA/EPSS/Nuclei,cpe:2.3:h:draytek:vigor2960:-:*:*:*:*:*:*:*;cpe:2.3:h:draytek:vigor300b:-:*:*:*:*:*:*:*;cpe:2.3:h:draytek:vigor3900:-:*:*:*:*:*:*:*;cpe:2.3:o:draytek:vigor2960_firmware:1.3.1:beta:*:*:*:*:*:*;cpe:2.3:o:draytek:vigor300b_firmware:1.3.3:beta:*:*:*:*:*:*;cpe:2.3:o:draytek:vigor300b_firmware:1.4.2.1:beta:*:*:*:*:*:*;cpe:2.3:o:draytek:vigor300b_firmware:1.4.4:beta:*:*:*:*:*:*;cpe:2.3:o:draytek:vigor3900_firmware:1.4.4:beta:*:*:*:*:*:*,Draytek,Vigor2960 Firmware
CVE-2020-8518,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.71728,CWE-94,"Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution.",2020-02-17,Metasploit,cpe:2.3:a:horde:groupware:5.2.22:*:*:*:webmail:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2020-8539,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02257,CWE-276,"Kia Motors Head Unit with Software version: SOP.003.30.18.0703, SOP.005.7.181019, and SOP.007.1.191209 may allow an attacker to inject unauthorized commands, by executing the micomd executable deamon, to trigger unintended functionalities. In addition, this executable may be used by an attacker to inject commands to generate CAN frames that are sent into the M-CAN bus (Multimedia CAN bus) of the vehicle.",2020-12-01,Metasploit,cpe:2.3:h:kia:head_unit:-:*:*:*:*:*:*:*;cpe:2.3:o:kia:head_unit_firmware:sop.003.30.18.0703:*:*:*:*:*:*:*;cpe:2.3:o:kia:head_unit_firmware:sop.005.7.181019:*:*:*:*:*:*:*;cpe:2.3:o:kia:head_unit_firmware:sop.007.1.191209:*:*:*:*:*:*:*,Kia,Head Unit Firmware
CVE-2020-8599,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.11576,NVD-CWE-noinfo,Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login. Authentication is not required to exploit this vulnerability.,2020-03-18,CISA,cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:*:*:*:*;cpe:2.3:a:trendmicro:officescan:xg:-:*:*:*:*:*:*;cpe:2.3:a:trendmicro:officescan:xg:sp1:*:*:*:*:*:*,Trendmicro,Apex One
CVE-2020-8604,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.89661,CWE-22,A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to disclose sensitive informatoin on affected installations.,2020-05-27,Metasploit,cpe:2.3:a:trendmicro:interscan_web_security_virtual_appliance:6.5:*:*:*:*:*:*:*,Trendmicro,Interscan Web Security Virtual Appliance
CVE-2020-8605,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.8758,CWE-78,A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to execute arbitrary code on affected installations. Authentication is required to exploit this vulnerability.,2020-05-27,Metasploit,cpe:2.3:a:trendmicro:interscan_web_security_virtual_appliance:6.5:*:*:*:*:*:*:*,Trendmicro,Interscan Web Security Virtual Appliance
CVE-2020-8606,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.7274,CWE-287,A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authentication on affected installations of Trend Micro InterScan Web Security Virtual Appliance.,2020-05-27,Metasploit,cpe:2.3:a:trendmicro:interscan_web_security_virtual_appliance:6.5:*:*:*:*:*:*:*,Trendmicro,Interscan Web Security Virtual Appliance
CVE-2020-8615,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N,0.0883,CWE-352,A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).,2020-02-04,Nuclei,cpe:2.3:a:themeum:tutor_lms:*:*:*:*:*:wordpress:*:*,Themeum,Tutor Lms
CVE-2020-8617,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.93422,CWE-617,"Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results.",2020-05-19,Metasploit,cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.10.5:s1:*:*:supported_preview:*:*:*;cpe:2.3:a:isc:bind:9.10.7:s1:*:*:supported_preview:*:*:*;cpe:2.3:a:isc:bind:9.11.3:s1:*:*:supported_preview:*:*:*;cpe:2.3:a:isc:bind:9.11.5:s3:*:*:supported_preview:*:*:*;cpe:2.3:a:isc:bind:9.11.5:s5:*:*:supported_preview:*:*:*;cpe:2.3:a:isc:bind:9.11.6:s1:*:*:supported_preview:*:*:*;cpe:2.3:a:isc:bind:9.11.7:s1:*:*:supported_preview:*:*:*;cpe:2.3:a:isc:bind:9.11.8:s1:*:*:supported_preview:*:*:*;cpe:2.3:a:isc:bind:9.12.4:p1:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.12.4:p2:*:*:*:*:*:*;cpe:2.3:a:isc:bind:9.9.3:s1:*:*:supported_preview:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2020-8641,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.10808,CWE-22,Lotus Core CMS 1.0.1 allows authenticated Local File Inclusion of .php files via directory traversal in the index.php page_slug parameter.,2020-02-05,Nuclei,cpe:2.3:a:lotus_core_cms_project:lotus_core_cms:1.0.1:*:*:*:*:*:*:*,Lotus Core Cms Project,Lotus Core Cms
CVE-2020-8644,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.86689,CWE-94,PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.,2020-02-05,CISA/Metasploit/Nuclei,cpe:2.3:a:playsms:playsms:*:*:*:*:*:*:*:*,Playsms,Playsms
CVE-2020-8654,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.85646,CWE-78,An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/module_frame/index.php autodiscovery.php target field.,2020-02-07,Metasploit/Nuclei,cpe:2.3:a:eyesofnetwork:eyesofnetwork:5.3-0:*:*:*:*:*:*:*,Eyesofnetwork,Eyesofnetwork
CVE-2020-8655,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.60075,CWE-269,"An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to run arbitrary commands as root via a crafted NSE script for nmap 7.",2020-02-07,CISA/Metasploit,cpe:2.3:a:eyesofnetwork:eyesofnetwork:5.3-0:*:*:*:*:*:*:*,Eyesofnetwork,Eyesofnetwork
CVE-2020-8656,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.846,CWE-89,"An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the username field to getApiKey in include/api_functions.php.",2020-02-07,Metasploit/Nuclei,cpe:2.3:a:eyesofnetwork:eyesofnetwork:5.3-0:*:*:*:*:*:*:*,Eyesofnetwork,Eyesofnetwork
CVE-2020-8657,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.91874,CWE-798,"An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4.2) by default for all installations, hence allowing an attacker to calculate/guess the admin access token.",2020-02-06,CISA/Metasploit/Nuclei,cpe:2.3:a:eyesofnetwork:eyesofnetwork:5.3-0:*:*:*:*:*:*:*,Eyesofnetwork,Eyesofnetwork
CVE-2020-8771,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.46454,CWE-287,The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.,2020-02-06,Nuclei,cpe:2.3:a:wptimecapsule:wp_time_capsule:*:*:*:*:*:wordpress:*:*,Wptimecapsule,Wp Time Capsule
CVE-2020-8772,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.8787,CWE-862,The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker who knows the username of an administrator can log in.,2020-02-06,Metasploit/Nuclei,cpe:2.3:a:revmakx:infinitewp_client:*:*:*:*:*:wordpress:*:*,Revmakx,Infinitewp Client
CVE-2020-8794,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.889,CWE-125,"OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.",2020-02-25,Metasploit,cpe:2.3:a:opensmtpd:opensmtpd:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2020-8813,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.73779,CWE-78,"graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.",2020-02-22,Nuclei,cpe:2.3:a:cacti:cacti:1.2.8:*:*:*:*:*:*:*;cpe:2.3:a:opmantek:open-audit:3.3.1:*:*:*:-:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:suse_linux_enterprise_server:12.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:suse_package_hub:*:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2020-8816,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.7819,CWE-78,Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.,2020-05-29,CISA/Metasploit,cpe:2.3:a:pi-hole:pi-hole:*:*:*:*:*:*:*:*,Pi-Hole,Pi-Hole
CVE-2020-8956,3.3,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N,0.01177,CWE-521,Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled.,2020-10-27,Metasploit,cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r1.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r2.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r2.1:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r3.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r3.1:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r4.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r4.1:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.1r1.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.1r2.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.1r3.0:*:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.1r3.1:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2020-8982,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.27149,CWE-22,"An unauthenticated arbitrary file read issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases as of May 2020. RCE and file access is granted to everything hosted by ShareFile, be it on-premise or inside Citrix Cloud itself (both are internet facing). NOTE: unlike most CVEs, exploitability depends on the product version that was in use when a particular setup step was performed, NOT the product version that is in use during a current assessment of a CVE consumer's product inventory. Specifically, the vulnerability can be exploited if a storage zone was created by one of these product versions: 5.9.0, 5.8.0, 5.7.0, 5.6.0, 5.5.0, or earlier. This CVE differs from CVE-2020-7473 and CVE-2020-8983.",2020-05-07,Nuclei,cpe:2.3:a:citrix:sharefile_storagezones_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:citrix:sharefile_storagezones_controller:5.6.0:*:*:*:*:*:*:*;cpe:2.3:a:citrix:sharefile_storagezones_controller:5.7.0:*:*:*:*:*:*:*;cpe:2.3:a:citrix:sharefile_storagezones_controller:5.8.0:*:*:*:*:*:*:*;cpe:2.3:a:citrix:sharefile_storagezones_controller:5.9.0:*:*:*:*:*:*:*,Citrix,Sharefile Storagezones Controller
CVE-2020-9015,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.16464,NVD-CWE-noinfo,"Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly other products) allow attackers to bypass intended TACACS+ shell restrictions via a | character. NOTE: the vendor reports that this is a configuration issue relating to an overly permissive regular expression in the TACACS+ server permitted commands",2020-02-20,Metasploit,cpe:2.3:h:arista:dcs-7050cx3-32s-r:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:dcs-7050qx-32s-r:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:dcs-7280sram-48c6-r:-:*:*:*:*:*:*:*;cpe:2.3:o:arista:dcs-7050cx3-32s-r_firmware:4.20.11m:*:*:*:*:*:*:*;cpe:2.3:o:arista:dcs-7050qx-32s-r_firmware:4.20.9m:*:*:*:*:*:*:*;cpe:2.3:o:arista:dcs-7280sram-48c6-r_firmware:4.22.0.1f:*:*:*:*:*:*:*,Arista,Dcs-7050Qx-32S-R Firmware
CVE-2020-9036,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03587,CWE-79,Jeedom through 4.0.38 allows XSS.,2020-08-05,Nuclei,cpe:2.3:a:jeedom:jeedom:*:*:*:*:*:*:*:*,Jeedom,Jeedom
CVE-2020-9039,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03939,CWE-276,"Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Permissions for the projector and indexer REST endpoints (they allow unauthenticated access).The /settings REST endpoint exposed by the projector process is an endpoint that administrators can use for various tasks such as updating configuration and collecting performance profiles. The endpoint was unauthenticated and has been updated to only allow authenticated users to access these administrative APIs.",2020-02-22,Nuclei,cpe:2.3:a:couchbase:couchbase_server:*:*:*:*:*:*:*:*;cpe:2.3:a:couchbase:couchbase_server:4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:couchbase:couchbase_server:4.1.0:*:*:*:*:*:*:*;cpe:2.3:a:couchbase:couchbase_server:4.1.1:*:*:*:*:*:*:*;cpe:2.3:a:couchbase:couchbase_server:4.5.0:*:*:*:*:*:*:*;cpe:2.3:a:couchbase:couchbase_server:4.5.1:*:*:*:*:*:*:*;cpe:2.3:a:couchbase:couchbase_server:5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:couchbase:couchbase_server:5.1.1:*:*:*:*:*:*:*;cpe:2.3:a:couchbase:couchbase_server:5.5.0:*:*:*:*:*:*:*;cpe:2.3:a:couchbase:couchbase_server:5.5.1:*:*:*:*:*:*:*,Couchbase,Couchbase Server
CVE-2020-9043,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.08173,CWE-200,The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key.,2020-02-17,Nuclei,cpe:2.3:a:wpcentral:wpcentral:*:*:*:*:*:wordpress:*:*,Wpcentral,Wpcentral
CVE-2020-9047,6.8,CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L,0.0777,CWE-347,A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web Service versions 20.06.3.0 and prior and exacqVision Enterprise Manager versions 20.06.4.0 and prior. An attacker with administrative privileges could potentially download and run a malicious executable that could allow OS command injection on the system.,2020-06-26,Nuclei,cpe:2.3:a:johnsoncontrols:exacqvision_enterprise_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:johnsoncontrols:exacqvision_web_service:*:*:*:*:*:*:*:*,Johnsoncontrols,Exacqvision Enterprise Manager
CVE-2020-9054,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99988,CWE-78,"Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device. Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device. This may happen by directly connecting to a device if it is directly exposed to an attacker. However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices. For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system. Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2",2020-03-04,CISA/EPSS/Nuclei,cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:nas326:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:nas520:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:nas540:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:nas542:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg1100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg110:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg1900:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg210:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg2200:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg310:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg40:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg40w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg60:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg60w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall1100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall110:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall310:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:nas326_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:nas520_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:nas540_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:nas542_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg1100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg110_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg1900_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg210_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg2200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg310_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg40_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg40w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg60_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg60w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall1100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall110_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall310_firmware:*:*:*:*:*:*:*:*,Zyxel,Nas326 Firmware
CVE-2020-9274,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.05957,CWE-824,"An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the *lookup_alias(const char alias) or print_aliases(void) function is called, they fail to correctly detect the end of the linked list and try to access a non-existent list member. This is related to init_aliases in diraliases.c.",2020-02-26,Nuclei,cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:a:pureftpd:pure-ftpd:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2020-9294,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.77778,CWE-287,"An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthenticated attacker to access the system as a legitimate user by requesting a password change via the user interface.",2020-04-27,Metasploit,cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortivoice:*:*:*:*:*:*:*:*,Fortinet,Fortimail
CVE-2020-9314,4.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N,0.01282,CWE-79,** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter to an admingui URI. This issue exists because of an incomplete fix for CVE-2012-0516. NOTE: a related support policy can be found in the www.oracle.com references attached to this CVE.,2020-05-10,Nuclei,cpe:2.3:a:oracle:iplanet_web_server:*:*:*:*:*:*:*:*,Oracle,Iplanet Web Server
CVE-2020-9315,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.81814,CWE-306,"** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/version URIs in the Administration console, as demonstrated by unauthenticated read access to encryption keys. NOTE: a related support policy can be found in the www.oracle.com references attached to this CVE.",2020-05-10,Nuclei,cpe:2.3:a:oracle:iplanet_web_server:*:*:*:*:*:*:*:*,Oracle,Iplanet Web Server
CVE-2020-9344,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.05198,CWE-79,Subversion ALM for the enterprise before 8.8.2 allows reflected XSS at multiple locations.,2020-03-20,Nuclei,cpe:2.3:a:atlassian:subversion_application_lifecycle_management:*:*:*:*:*:*:*:*,Atlassian,Subversion Application Lifecycle Management
CVE-2020-9365,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.07112,CWE-125,An issue was discovered in Pure-FTPd 1.0.49. An out-of-bounds (OOB) read has been detected in the pure_strcmp function in utils.c.,2020-02-24,Nuclei,cpe:2.3:a:pureftpd:pure-ftpd:1.0.49:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2020-9376,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.16586,CWE-74,D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer,2020-07-09,Nuclei,cpe:2.3:h:dlink:dir-610:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-610_firmware:-:*:*:*:*:*:*:*,D-Link,Dir-610 Firmware
CVE-2020-9377,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.21338,CWE-78,D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer,2020-07-09,CISA,cpe:2.3:h:dlink:dir-610:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-610_firmware:-:*:*:*:*:*:*:*,D-Link,Dir-610 Firmware
CVE-2020-9425,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.16671,CWE-670,"An issue was discovered in includes/head.inc.php in rConfig before 3.9.4. An unauthenticated attacker can retrieve saved cleartext credentials via a GET request to settings.php. Because the application was not exiting after a redirect is applied, the rest of the page still executed, resulting in the disclosure of cleartext credentials in the response.",2020-03-20,Nuclei,cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:*,Rconfig,Rconfig
CVE-2020-9465,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.82244,CWE-89,"An issue was discovered in EyesOfNetwork eonweb 5.1 through 5.3 before 5.3-3. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the user_id field in a cookie.",2020-02-28,Metasploit,cpe:2.3:a:eyesofnetwork:eyesofnetwork:*:*:*:*:*:*:*:*,Eyesofnetwork,Eyesofnetwork
CVE-2020-9480,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.26793,CWE-306,"In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).",2020-06-23,Nuclei,cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:*,Apache,Spark
CVE-2020-9483,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.34613,CWE-89,"**Resolved** When use H2/MySQL/TiDB as Apache SkyWalking storage, the metadata query through GraphQL protocol, there is a SQL injection vulnerability, which allows to access unpexcted data. Apache SkyWalking 6.0.0 to 6.6.0, 7.0.0 H2/MySQL/TiDB storage implementations don't use the appropriate way to set SQL parameters.",2020-06-30,Nuclei,cpe:2.3:a:apache:skywalking:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:skywalking:7.0.0:*:*:*:*:*:*:*,Apache,Skywalking
CVE-2020-9484,7.0,CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.56636,CWE-502,"When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=""null"" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.",2020-05-20,Nuclei,cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*;cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*;cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*;cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*;cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*;cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.0:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:agile_plm:9.3.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.10.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:database:12.2.0.1:*:*:*:enterprise:*:*:*;cpe:2.3:a:oracle:database:19c:*:*:*:enterprise:*:*:*;cpe:2.3:a:oracle:database:21c:*:*:*:enterprise:*:*:*;cpe:2.3:a:oracle:fmw_platform:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:fmw_platform:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:siebel_apps_-_marketing:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:transportation_management:6.3.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:workload_manager:12.2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:*;cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2020-9496,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.98926,CWE-79,XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03,2020-07-15,EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:ofbiz:17.12.03:*:*:*:*:*:*:*,Apache,Ofbiz
CVE-2020-9547,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.18671,CWE-502,"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).",2020-03-02,Nuclei,cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:linux:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*;cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_contacts_server:8.0.0.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_network_charging_and_control:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2020-9548,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.18345,CWE-502,"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).",2020-03-02,Nuclei,cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:linux:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*;cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_digital_experience:18.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_calendar_server:8.0.0.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_contacts_server:8.0.0.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_contacts_server:8.0.0.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_network_charging_and_control:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_merchandising_system:15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_sales_audit:14.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2020-9715,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.48441,CWE-416,"Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .",2020-08-19,CISA,cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:*;cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*;cpe:2.3:a:adobe:acrobat_dc:20.001.30002:*:*:*:classic:*:*:*;cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:*;cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*;cpe:2.3:a:adobe:acrobat_reader_dc:20.001.30002:*:*:*:classic:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Apple,Macos
CVE-2020-9757,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.73434,CWE-74,The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.,2020-03-04,Nuclei,cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*,Craftcms,Craft Cms
CVE-2020-9801,5.3,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.01382,NVD-CWE-noinfo,A logic issue was addressed with improved restrictions. This issue is fixed in Safari 13.1.1. A malicious process may cause Safari to launch an application.,2020-06-09,Metasploit,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*,Apple,Safari
CVE-2020-9818,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.02286,CWE-787,"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5. Processing a maliciously crafted mail message may lead to unexpected memory modification or application termination.",2020-06-09,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2020-9819,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L,0.02178,CWE-787,"A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5, watchOS 5.3.7. Processing a maliciously crafted mail message may lead to heap corruption.",2020-06-09,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2020-9839,7.0,CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.03667,CWE-362,"A race condition was addressed with improved state handling. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. An application may be able to gain elevated privileges.",2020-06-09,Metasploit,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2020-9850,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.77246,NVD-CWE-Other,"A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. A remote attacker may be able to cause arbitrary code execution.",2020-06-09,Metasploit,cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*;cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:*;cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2020-9856,5.3,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.0139,NVD-CWE-noinfo,This issue was addressed with improved checks. This issue is fixed in macOS Catalina 10.15.5. An application may be able to gain elevated privileges.,2020-06-09,Metasploit,cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.13.6:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.13.6:-:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-002:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-003:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-002:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-003:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-004:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-005:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-006:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-007:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-002:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:-:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-002:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-006:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-007:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-002:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-003:*:*:*:*:*:*,Apple,Mac Os X
CVE-2020-9859,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.00829,CWE-415,"A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, tvOS 13.4.6, watchOS 6.2.6. An application may be able to execute arbitrary code with kernel privileges.",2020-06-05,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2020-9907,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.03899,CWE-787,"A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8. An application may be able to execute arbitrary code with kernel privileges.",2020-10-16,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2020-9934,5.5,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.03208,NVD-CWE-noinfo,"An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information.",2020-10-16,CISA/Metasploit,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2021-0920,6.4,CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H,0.00811,CWE-362,"In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel",2021-12-15,CISA,cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:5.14:rc1:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:5.14:rc2:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:5.14:rc3:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2021-1048,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01047,CWE-416,"In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-204573007References: Upstream kernel",2021-12-15,CISA,cpe:2.3:o:google:android:-:*:*:*:*:*:*:*,Google,Android
CVE-2021-1472,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.72472,CWE-119,"Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary commands or bypass authentication and upload files on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.",2021-04-08,Metasploit/Nuclei,cpe:2.3:h:cisco:rv160:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv160w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv260:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv260p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv260w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv340:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv340w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv345:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv345p:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv160_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv160w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv260_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv260p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv260w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv340_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv340w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv345_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv345p_firmware:*:*:*:*:*:*:*:*,Cisco,Rv160 Firmware
CVE-2021-1473,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.64161,CWE-119,"Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary commands or bypass authentication and upload files on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.",2021-04-08,Metasploit,cpe:2.3:h:cisco:rv340:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv340w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv345:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv345p:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv340_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv340w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv345_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv345p_firmware:*:*:*:*:*:*:*:*,Cisco,Rv340 Firmware
CVE-2021-1497,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99928,CWE-78,"Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.",2021-05-06,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:h:cisco:hyperflex_hx220c_af_m5:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:hyperflex_hx220c_all_nvme_m5:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:hyperflex_hx220c_edge_m5:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:hyperflex_hx220c_m5:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:hyperflex_hx240c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:hyperflex_hx240c_af_m5:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:hyperflex_hx240c_m5:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:hyperflex_hx_data_platform:*:*:*:*:*:*:*:*,Cisco,Hyperflex Hx Data Platform
CVE-2021-1498,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99999,CWE-78,"Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.",2021-05-06,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:h:cisco:hyperflex_hx220c_af_m5:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:hyperflex_hx220c_all_nvme_m5:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:hyperflex_hx220c_edge_m5:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:hyperflex_hx220c_m5:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:hyperflex_hx240c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:hyperflex_hx240c_af_m5:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:hyperflex_hx240c_m5:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:hyperflex_hx_data_platform:*:*:*:*:*:*:*:*,Cisco,Hyperflex Hx Data Platform
CVE-2021-1499,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.80426,CWE-306,"A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to upload files to an affected device. This vulnerability is due to missing authentication for the upload function. An attacker could exploit this vulnerability by sending a specific HTTP request to an affected device. A successful exploit could allow the attacker to upload files to the affected device with the permissions of the tomcat8 user.",2021-05-06,Metasploit/Nuclei,cpe:2.3:h:cisco:hyperflex_hx220c_af_m5:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:hyperflex_hx220c_all_nvme_m5:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:hyperflex_hx220c_edge_m5:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:hyperflex_hx220c_m5:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:hyperflex_hx240c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:hyperflex_hx240c_af_m5:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:hyperflex_hx240c_m5:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:hyperflex_hx_data_platform:*:*:*:*:*:*:*:*,Cisco,Hyperflex Hx Data Platform
CVE-2021-1647,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.39653,NVD-CWE-noinfo,Microsoft Defender Remote Code Execution Vulnerability,2021-01-12,CISA,cpe:2.3:a:microsoft:security_essentials:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:system_center_endpoint_protection:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:system_center_endpoint_protection:2012:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:system_center_endpoint_protection:2012:r2:*:*:*:*:*:*;cpe:2.3:a:microsoft:windows_defender:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1909:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2004:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2021-1675,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.86132,NVD-CWE-Other,Windows Print Spooler Remote Code Execution Vulnerability,2021-06-08,CISA/Metasploit,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2021-1732,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.78376,CWE-787,Windows Win32k Elevation of Privilege Vulnerability,2021-02-25,CISA/Metasploit,cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1909:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2004:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1803
CVE-2021-1782,7.0,CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02222,CWE-667,"A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited..",2021-04-02,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:-:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-006:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-007:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-002:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-003:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-004:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-005:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-006:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-007:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update_2:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:supplemental_update:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2021-1789,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.14542,CWE-843,"A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4, Safari 14.0.3. Processing maliciously crafted web content may lead to arbitrary code execution.",2021-04-02,CISA,cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:-:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-006:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-007:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-002:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-003:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-004:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-005:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-006:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-007:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update_2:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:supplemental_update:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*,Apple,Ipados
CVE-2021-1870,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07921,NVD-CWE-noinfo,"A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..",2021-04-02,CISA,cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:supplemental_update:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*,Apple,Ipados
CVE-2021-1871,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0712,NVD-CWE-noinfo,"A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..",2021-04-02,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:supplemental_update:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*,Apple,Ipados
CVE-2021-1879,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.07082,CWE-79,"This issue was addressed by improved management of object lifetimes. This issue is fixed in iOS 12.5.2, iOS 14.4.2 and iPadOS 14.4.2, watchOS 7.3.3. Processing maliciously crafted web content may lead to universal cross site scripting. Apple is aware of a report that this issue may have been actively exploited..",2021-04-02,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2021-1905,8.4,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0115,CWE-416,"Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables",2021-05-07,CISA,cpe:2.3:h:qualcomm:apq8009:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:apq8009w:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:apq8017:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:apq8053:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:apq8064au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:apq8096au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:aqt1000:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ar8031:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ar8035:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ar8151:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:csra6620:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:csra6640:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fsm10055:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fsm10056:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:mdm9206:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:mdm9607:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:mdm9626:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:mdm9628:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:mdm9650:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:msm8909w:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:msm8917:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:msm8953:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:msm8996au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm215:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm3003a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm4125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm4250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm439:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm456:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm6125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm6150:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm6150a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm6150l:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm6250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm6350:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm640a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm640l:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm640p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm660:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm660a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm660l:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm670:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm670a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm670l:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm7150a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm7150l:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm7250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm7250b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8004:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8005:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8008:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8009:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8150:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8150a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8150b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8150c:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8150l:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8350:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8350b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8350bh:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8350c:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm855:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm855a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm855b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm855l:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm855p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8909:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8916:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8937:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8953:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8998:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmc1000h:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmd9607:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmd9655:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pme605:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmi632:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmi8937:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmi8952:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmi8998:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmk8002:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmk8003:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmk8350:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmm6155au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmm8155au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmm8195au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmm855au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmm8920au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmm8996au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmr525:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmr735a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmr735b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmw3100:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmx20:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmx24:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmx50:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmx55:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat3514:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat3516:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat3518:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat3519:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat3522:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat3550:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat3555:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat5515:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat5516:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat5522:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat5533:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat5568:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qbt1000:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qbt1500:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qbt2000:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca4020:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6174:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6174a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6310:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6320:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6335:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6390:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6420:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6421:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6426:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6430:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6431:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6436:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6564:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6564a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6564au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6584au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6595au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6696:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca8337:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca9367:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca9377:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca9379:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcc1110:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm2290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm4290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm6125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs2290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs405:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs410:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs4290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs603:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs605:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs610:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs6125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm2301:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm2302:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm2305:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm2307:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm2308:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm2310:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm3301:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm4643:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm4650:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5620:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5621:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5650:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5652:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5670:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5671:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5677:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5679:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qet4100:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qet4101:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qet5100:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qet5100m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qet6100:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qet6105:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qet6110:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe2101:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe2520:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe2550:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe3100:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe3340:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe4301:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe4302:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe4303:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe4305:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe4308:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe4309:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe4320:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe4373fc:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfs2530:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfs2580:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfs2608:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfs2630:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln1020:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln1030:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln4640:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln4642:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln4650:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln5020:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln5030:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln5040:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa2625:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa4340:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa4360:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa4361:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa5373:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa5460:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa5461:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa5580:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa5581:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa6560:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa8673:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa8675:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa8686:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa8801:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa8802:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa8803:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa8821:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa8842:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm2630:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm4621:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm4630:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm4640:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm4641:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm4650:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5541:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5577:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5579:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5620:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5621:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5641:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5657:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5658:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5670:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5677:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5679:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5870:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5875:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm6325:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm6375:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm6582:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm6585:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm6621:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm6670:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm8820:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm8830:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm8870:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm8895:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qsm7250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qsm8250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qsw6310:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qsw8573:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qsw8574:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qtc410s:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qtc800h:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qtc800s:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qtc800t:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qtc801s:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qtm525:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qtm527:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qualcomm215:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:rgr7640au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:rsw8577:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa2150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa515m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6145p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6155:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6155p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8155:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8155p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8195p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd205:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd210:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd429:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd439:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd450:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd455:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd460:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd480:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd632:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd636:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd660:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd662:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd665:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd670:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd675:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd678:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd6905g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd710:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd720g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd730:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd750g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd765:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd765g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd768g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd835:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd845:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd855:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd8655g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd870:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd8885g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd888:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd8c:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd8cx:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sda429w:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdm429w:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdm630:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdm830:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr051:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr052:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr425:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr660:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr660g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr675:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr735:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr735g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr8150:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr8250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr845:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr865:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdw2500:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdw3100:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx20:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx20m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx24:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx50m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx55:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx55m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdxr1:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdxr2_5g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm4125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6250p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7250p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1350:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1351:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1354:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1355:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1357:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1358:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1360:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1380:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1381:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1390:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1395:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1396:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1398:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb231:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb2351:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb358s:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smr525:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smr526:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smr545:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smr546:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9326:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9330:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9335:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9340:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9341:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9360:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9371:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3610:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3615:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3620:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3660:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3660b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3680:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3680b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3910:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3980:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3988:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3990:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3991:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3998:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3999:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6850:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6851:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6855:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6856:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wgr7640:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wtr2955:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wtr2965:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wtr3925:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wtr4905:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wtr5975:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wtr6955:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8009_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8009w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8017_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8053_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8064au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8096au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:aqt1000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ar8031_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ar8035_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ar8151_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:csra6620_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:csra6640_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fsm10055_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fsm10056_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:mdm9206_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:mdm9607_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:mdm9626_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:mdm9628_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:mdm9650_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:msm8909w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:msm8917_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:msm8953_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:msm8996au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm215_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm3003a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm4125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm4250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm439_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm456_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm6125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm6150_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm6150a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm6150l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm6250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm6350_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm640a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm640l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm640p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm660_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm660a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm660l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm670_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm670a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm670l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm7150a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm7150l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm7250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm7250b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8004_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8005_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8008_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8009_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8150_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8150a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8150b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8150c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8150l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8350_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8350b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8350bh_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8350c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm855_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm855a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm855b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm855l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm855p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8909_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8916_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8937_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8953_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8998_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmc1000h_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmd9607_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmd9655_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pme605_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmi632_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmi8937_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmi8952_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmi8998_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmk8002_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmk8003_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmk8350_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmm6155au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmm8155au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmm8195au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmm855au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmm8920au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmm8996au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmr525_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmr735a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmr735b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmw3100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmx20_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmx24_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmx50_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmx55_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat3514_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat3516_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat3518_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat3519_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat3522_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat3550_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat3555_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat5515_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat5516_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat5522_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat5533_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat5568_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qbt1000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qbt1500_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qbt2000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca4020_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6174_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6174a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6310_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6320_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6335_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6390_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6420_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6421_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6426_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6430_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6431_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6436_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6564_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6564a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6564au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6584au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6595au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6696_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca8337_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca9367_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca9377_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca9379_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcc1110_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm2290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm4290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm6125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs2290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs405_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs410_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs4290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs603_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs605_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs610_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs6125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm2301_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm2302_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm2305_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm2307_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm2308_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm2310_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm3301_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm4643_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm4650_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5620_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5621_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5650_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5652_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5670_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5671_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5677_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5679_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qet4100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qet4101_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qet5100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qet5100m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qet6100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qet6105_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qet6110_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe2101_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe2520_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe2550_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe3100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe3340_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe4301_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe4302_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe4303_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe4305_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe4308_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe4309_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe4320_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe4373fc_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfs2530_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfs2580_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfs2608_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfs2630_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln1020_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln1030_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln4640_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln4642_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln4650_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln5020_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln5030_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln5040_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa2625_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa4340_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa4360_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa4361_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa5373_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa5460_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa5461_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa5580_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa5581_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa6560_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa8673_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa8675_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa8686_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa8801_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa8802_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa8803_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa8821_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa8842_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm2630_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm4621_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm4630_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm4640_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm4641_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm4650_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5541_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5577_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5579_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5620_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5621_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5641_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5657_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5658_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5670_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5677_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5679_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5870_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5875_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm6325_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm6375_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm6582_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm6585_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm6621_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm6670_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm8820_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm8830_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm8870_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm8895_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qsm7250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qsm8250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qsw6310_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qsw8573_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qsw8574_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qtc410s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qtc800h_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qtc800s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qtc800t_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qtc801s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qtm525_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qtm527_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qualcomm215_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:rgr7640au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:rsw8577_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa2150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa515m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6145p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6155_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6155p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8155_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8155p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8195p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd205_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd210_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd429_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd439_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd450_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd455_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd460_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd480_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd632_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd636_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd660_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd662_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd665_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd670_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd675_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd678_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd6905g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd710_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd720g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd730_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd750g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd765_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd765g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd768g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd835_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd845_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd855_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd8655g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd870_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd8885g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd888_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd8c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd8cx_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sda429w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdm429w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdm630_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdm830_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr051_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr052_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr425_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr660_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr660g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr675_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr735_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr735g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr8150_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr8250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr845_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr865_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdw2500_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdw3100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx20_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx20m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx24_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx50m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx55_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx55m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdxr1_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdxr2_5g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm4125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6250p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7250p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1350_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1351_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1354_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1355_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1357_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1358_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1360_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1380_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1381_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1390_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1395_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1396_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1398_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb231_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb2351_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb358s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smr525_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smr526_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smr545_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smr546_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9326_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9330_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9335_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9340_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9341_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9360_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9371_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3610_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3615_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3620_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3660_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3660b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3680_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3680b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3910_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3980_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3990_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3991_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3998_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3999_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6850_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6851_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6855_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6856_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wgr7640_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wtr2955_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wtr2965_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wtr3925_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wtr4905_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wtr5975_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wtr6955_firmware:-:*:*:*:*:*:*:*,Qualcomm,Apq8009 Firmware
CVE-2021-1906,6.2,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.0052,NVD-CWE-Other,"Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables",2021-05-07,CISA,cpe:2.3:h:qualcomm:apq8009:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:apq8009w:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:apq8017:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:apq8053:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:apq8064au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:apq8096au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:aqt1000:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ar8031:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ar8035:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ar8151:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:csra6620:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:csra6640:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:csrb31024:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fsm10055:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fsm10056:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:mdm9150:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:mdm9206:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:mdm9250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:mdm9607:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:mdm9626:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:mdm9628:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:mdm9650:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:msm8909w:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:msm8917:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:msm8953:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:msm8996au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm215:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm3003a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm4125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm4250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm439:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm456:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm6125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm6150:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm6150a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm6150l:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm6250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm6350:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm640a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm640l:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm640p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm660:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm660a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm660l:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm670:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm670a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm670l:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm7150a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm7150l:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm7250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm7250b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm7350c:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8004:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8005:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8008:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8009:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8150:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8150a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8150b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8150c:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8150l:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8350:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8350b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8350bh:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8350bhs:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8350c:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm855:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm855a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm855b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm855l:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm855p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8909:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8916:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8937:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8953:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pm8998:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmc1000h:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmd9607:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmd9655:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmd9655au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pme605:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmi632:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmi8937:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmi8952:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmi8998:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmk7350:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmk8002:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmk8003:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmk8350:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmm6155au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmm8155au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmm8195au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmm855au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmm8996au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmr525:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmr735a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmr735b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmx20:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmx24:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmx50:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pmx55:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat3514:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat3516:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat3518:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat3519:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat3522:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat3550:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat3555:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat5515:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat5516:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat5522:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat5533:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qat5568:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qbt1000:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qbt1500:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qbt2000:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6174a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6310:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6320:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6335:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6390:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6420:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6426:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6430:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6436:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6564:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6564a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6564au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6584au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6595au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6696:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca8337:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca9367:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca9377:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm2290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm4290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm6125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs2290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs405:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs410:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs4290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs603:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs605:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs610:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs6125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm2301:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm2302:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm2305:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm2307:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm2308:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm2310:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm3301:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm3302:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm4643:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm4650:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5579:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5620:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5621:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5650:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5652:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5670:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5671:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5677:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qdm5679:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qet4100:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qet4101:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qet5100:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qet5100m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qet6100:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qet6105:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qet6110:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe2101:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe2520:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe2550:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe3340:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe4301:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe4302:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe4303:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe4305:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe4308:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe4309:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe4320:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfe4373fc:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfs2530:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfs2580:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfs2608:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qfs2630:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln1020:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln1021aq:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln1030:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln1031:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln1036aq:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln4640:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln4642:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln4650:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln5020:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln5030:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln5040:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa2625:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa4340:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa4360:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa4361:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa5373:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa5460:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa5461:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa5580:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa5581:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa6560:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa8673:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa8675:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa8686:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa8801:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa8802:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa8803:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa8821:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa8842:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm2630:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm4621:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm4630:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm4640:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm4641:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm4650:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5541:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5577:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5579:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5620:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5621:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5641:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5657:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5658:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5670:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5677:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5679:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5870:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm5875:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm6325:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm6375:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm6582:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm6585:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm6621:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm6670:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm8820:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm8830:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm8870:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpm8895:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qsm7250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qsw6310:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qsw8573:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qsw8574:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qtc410s:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qtc800h:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qtc800s:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qtc800t:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qtc801s:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qtm525:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qtm527:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qualcomm215:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:rgr7640au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:rsw8577:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa2150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa415m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa515m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6145p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6155:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6155p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8155:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8155p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8195p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd205:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd210:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd429:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd439:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd450:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd455:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd460:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd480:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd632:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd636:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd660:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd662:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd665:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd670:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd675:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd678:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd6905g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd710:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd720g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd730:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd750g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd765:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd765g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd768g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd835:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd845:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd855:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd8655g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd870:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd8885g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd888:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd8c:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd8cx:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sda429w:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdm429w:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdm630:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdm830:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr051:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr052:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr425:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr660:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr660g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr675:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr735:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr735g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr8150:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr8250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdr865:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdw3100:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx20:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx20m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx24:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx50m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx55:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx55m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdxr1:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdxr25g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm4125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6250p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7250p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7350:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1350:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1351:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1354:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1355:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1357:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1358:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1360:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1380:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1381:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1390:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1394:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1395:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1396:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb1398:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb231:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb2351:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smb358s:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smr525:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smr526:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smr545:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smr546:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9326:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9330:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9335:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9340:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9341:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9360:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9371:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3610:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3615:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3620:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3660:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3660b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3680:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3680b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3910:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3980:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3988:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3990:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3991:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3998:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3999:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6740:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6850:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6851:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6855:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6856:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wgr7640:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wtr2955:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wtr2965:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wtr3925:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wtr4905:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wtr5975:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wtr6955:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8009_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8009w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8017_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8053_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8064au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8096au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:aqt1000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ar8031_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ar8035_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ar8151_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:csra6620_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:csra6640_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:csrb31024_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fsm10055_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fsm10056_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:mdm9150_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:mdm9206_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:mdm9250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:mdm9607_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:mdm9626_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:mdm9628_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:mdm9650_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:msm8909w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:msm8917_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:msm8953_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:msm8996au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm215_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm3003a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm4125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm4250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm439_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm456_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm6125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm6150_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm6150a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm6150l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm6250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm6350_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm640a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm640l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm640p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm660_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm660a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm660l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm670_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm670a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm670l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm7150a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm7150l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm7250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm7250b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm7350c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8004_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8005_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8008_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8009_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8150_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8150a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8150b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8150c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8150l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8350_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8350b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8350bh_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8350bhs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8350c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm855_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm855a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm855b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm855l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm855p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8909_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8916_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8937_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8953_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pm8998_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmc1000h_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmd9607_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmd9655_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmd9655au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pme605_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmi632_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmi8937_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmi8952_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmi8998_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmk7350_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmk8002_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmk8003_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmk8350_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmm6155au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmm8155au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmm8195au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmm855au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmm8996au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmr525_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmr735a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmr735b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmx20_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmx24_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmx50_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pmx55_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat3514_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat3516_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat3518_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat3519_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat3522_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat3550_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat3555_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat5515_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat5516_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat5522_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat5533_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qat5568_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qbt1000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qbt1500_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qbt2000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6174a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6310_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6320_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6335_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6390_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6420_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6426_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6430_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6436_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6564_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6564a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6564au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6584au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6595au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6696_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca8337_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca9367_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca9377_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm2290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm4290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm6125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs2290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs405_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs410_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs4290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs603_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs605_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs610_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs6125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm2301_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm2302_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm2305_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm2307_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm2308_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm2310_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm3301_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm3302_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm4643_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm4650_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5579_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5620_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5621_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5650_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5652_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5670_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5671_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5677_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qdm5679_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qet4100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qet4101_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qet5100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qet5100m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qet6100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qet6105_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qet6110_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe2101_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe2520_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe2550_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe3340_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe4301_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe4302_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe4303_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe4305_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe4308_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe4309_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe4320_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfe4373fc_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfs2530_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfs2580_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfs2608_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qfs2630_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln1020_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln1021aq_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln1030_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln1031_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln1036aq_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln4640_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln4642_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln4650_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln5020_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln5030_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln5040_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa2625_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa4340_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa4360_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa4361_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa5373_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa5460_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa5461_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa5580_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa5581_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa6560_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa8673_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa8675_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa8686_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa8801_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa8802_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa8803_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa8821_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa8842_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm2630_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm4621_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm4630_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm4640_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm4641_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm4650_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5541_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5577_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5579_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5620_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5621_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5641_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5657_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5658_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5670_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5677_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5679_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5870_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm5875_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm6325_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm6375_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm6582_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm6585_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm6621_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm6670_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm8820_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm8830_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm8870_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpm8895_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qsm7250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qsw6310_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qsw8573_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qsw8574_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qtc410s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qtc800h_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qtc800s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qtc800t_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qtc801s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qtm525_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qtm527_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qualcomm215_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:rgr7640au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:rsw8577_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa2150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa415m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa515m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6145p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6155_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6155p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8155_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8155p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8195p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd205_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd210_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd429_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd439_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd450_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd455_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd460_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd480_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd632_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd636_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd660_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd662_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd665_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd670_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd675_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd678_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd6905g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd710_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd720g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd730_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd750g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd765_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd765g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd768g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd835_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd845_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd855_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd8655g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd870_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd8885g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd888_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd8c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd8cx_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sda429w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdm429w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdm630_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdm830_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr051_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr052_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr425_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr660_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr660g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr675_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr735_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr735g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr8150_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr8250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdr865_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdw3100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx20_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx20m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx24_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx50m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx55_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx55m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdxr1_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdxr25g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm4125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6250p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7250p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7350_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1350_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1351_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1354_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1355_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1357_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1358_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1360_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1380_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1381_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1390_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1394_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1395_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1396_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb1398_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb231_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb2351_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smb358s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smr525_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smr526_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smr545_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smr546_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9326_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9330_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9335_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9340_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9341_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9360_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9371_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3610_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3615_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3620_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3660_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3660b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3680_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3680b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3910_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3980_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3990_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3991_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3998_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3999_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6740_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6850_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6851_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6855_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6856_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wgr7640_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wtr2955_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wtr2965_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wtr3925_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wtr4905_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wtr5975_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wtr6955_firmware:-:*:*:*:*:*:*:*,Qualcomm,Apq8009 Firmware
CVE-2021-20016,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.40038,CWE-89,A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.,2021-02-04,CISA,cpe:2.3:a:sonicwall:sma_500v:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_100:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_200:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_210:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_400:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_410:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_200_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_210_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_400_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_410_firmware:-:*:*:*:*:*:*:*,Sonicwall,Sma 100 Firmware
CVE-2021-20021,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.83425,CWE-269,A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.,2021-04-09,CISA/Nuclei,cpe:2.3:a:sonicwall:email_security:*:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:email_security_virtual_appliance:*:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:hosted_email_security:*:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:email_security_appliance_3300:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:email_security_appliance_4300:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:email_security_appliance_5000:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:email_security_appliance_5050:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:email_security_appliance_7000:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:email_security_appliance_7050:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:email_security_appliance_8300:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:email_security_appliance_9000:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:email_security_appliance_3300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:email_security_appliance_4300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:email_security_appliance_5000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:email_security_appliance_5050_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:email_security_appliance_7000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:email_security_appliance_7050_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:email_security_appliance_8300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:email_security_appliance_9000_firmware:*:*:*:*:*:*:*:*,Sonicwall,Email Security Appliance 9000 Firmware
CVE-2021-20022,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.16509,CWE-434,SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.,2021-04-09,CISA,cpe:2.3:a:sonicwall:email_security:*:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:email_security_virtual_appliance:*:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:hosted_email_security:*:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:email_security_appliance_3300:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:email_security_appliance_4300:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:email_security_appliance_5000:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:email_security_appliance_5050:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:email_security_appliance_7000:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:email_security_appliance_7050:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:email_security_appliance_8300:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:email_security_appliance_9000:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:email_security_appliance_3300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:email_security_appliance_4300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:email_security_appliance_5000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:email_security_appliance_5050_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:email_security_appliance_7000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:email_security_appliance_7050_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:email_security_appliance_8300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:email_security_appliance_9000_firmware:*:*:*:*:*:*:*:*,Sonicwall,Email Security Appliance 9000 Firmware
CVE-2021-20023,4.9,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N,0.51407,CWE-22,SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.,2021-04-20,CISA,cpe:2.3:a:sonicwall:email_security:*:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:email_security_virtual_appliance:*:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:hosted_email_security:*:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:email_security_appliance_3300:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:email_security_appliance_4300:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:email_security_appliance_5000:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:email_security_appliance_5050:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:email_security_appliance_7000:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:email_security_appliance_7050:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:email_security_appliance_8300:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:email_security_appliance_9000:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:email_security_appliance_3300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:email_security_appliance_4300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:email_security_appliance_5000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:email_security_appliance_5050_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:email_security_appliance_7000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:email_security_appliance_7050_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:email_security_appliance_8300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:email_security_appliance_9000_firmware:*:*:*:*:*:*:*:*,Sonicwall,Email Security Appliance 9000 Firmware
CVE-2021-20028,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.30084,CWE-89,"Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier",2021-08-04,CISA,cpe:2.3:h:sonicwall:sma_210:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_410:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_500v:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sra_1600:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sra_4600:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sra_va:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_210_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_410_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_500v_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sra_1600_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sra_4600_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sra_va_firmware:*:*:*:*:*:*:*:*,Sonicwall,Sma 210 Firmware
CVE-2021-20031,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.13041,CWE-601,A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management users to arbitrary web domains.,2021-10-12,Nuclei,cpe:2.3:h:sonicwall:nsa_2650:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_2700:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_3650:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_3700:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_4650:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_4700:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_5650:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_6650:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_6700:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_9250:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_9450:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_9650:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nssp_12400:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nssp_12800:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nssp_13700:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nssp_15700:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsv_100:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsv_10:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsv_1600:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsv_200:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsv_25:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsv_270:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsv_300:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsv_400:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsv_470:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsv_50:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsv_800:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsv_870:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:soho_250:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:soho_250w:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:supermassive_9200:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:supermassive_9400:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:supermassive_9600:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:supermassive_9800:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:supermassive_e10200:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:supermassive_e10400:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:supermassive_e10800:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz270:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz270w:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz300:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz300p:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz300w:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz350:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz350w:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz370:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz370w:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz400:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz400w:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz470:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz470w:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz500:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz500w:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz570:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz570p:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz570w:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz600:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz600p:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz670:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:*,Sonicwall,Sonicos
CVE-2021-20035,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H,0.04181,CWE-78,Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.,2021-09-27,CISA,cpe:2.3:a:sonicwall:sma_500v:*:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_200:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_210:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_400:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_410:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_210_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_410_firmware:*:*:*:*:*:*:*:*,Sonicwall,Sma 200 Firmware
CVE-2021-20038,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99912,CWE-121,"A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.",2021-12-08,CISA/EPSS/Nuclei,cpe:2.3:h:sonicwall:sma_200:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_210:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_400:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_410:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_500v:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_200_firmware:10.2.0.8-37sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_200_firmware:10.2.1.1-19sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_200_firmware:10.2.1.2-24sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_210_firmware:10.2.0.8-37sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_210_firmware:10.2.1.1-19sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_210_firmware:10.2.1.2-24sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_400_firmware:10.2.0.8-37sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_400_firmware:10.2.1.1-19sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_400_firmware:10.2.1.2-24sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_410_firmware:10.2.0.8-37sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_410_firmware:10.2.1.1-19sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_410_firmware:10.2.1.2-24sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_500v_firmware:10.2.0.8-37sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_500v_firmware:10.2.1.1-19sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_500v_firmware:10.2.1.2-24sv:*:*:*:*:*:*:*,Sonicwall,Sma 200 Firmware
CVE-2021-20039,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.7811,CWE-78,"Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.",2021-12-08,Metasploit,cpe:2.3:h:sonicwall:sma_200:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_210:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_400:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_410:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_500v:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_200_firmware:10.2.0.8-37sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_200_firmware:10.2.1.1-19sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_200_firmware:9.0.0.11-31sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_210_firmware:10.2.0.8-37sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_210_firmware:10.2.1.1-19sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_210_firmware:9.0.0.11-31sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_400_firmware:10.2.0.8-37sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_400_firmware:10.2.1.1-19sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_400_firmware:9.0.0.11-31sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_410_firmware:10.2.0.8-37sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_410_firmware:10.2.1.1-19sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_410_firmware:9.0.0.11-31sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_500v_firmware:10.2.0.8-37sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_500v_firmware:10.2.1.1-19sv:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_500v_firmware:9.0.0.11-31sv:*:*:*:*:*:*:*,Sonicwall,Sma 200 Firmware
CVE-2021-20086,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.06104,CWE-1321,Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-bbq 1.2.1 allows a malicious user to inject properties into Object.prototype.,2021-04-23,Nuclei,cpe:2.3:a:jquery-bbq_project:jquery-bbq:1.2.1:*:*:*:*:*:*:*,Jquery-Bbq Project,Jquery-Bbq
CVE-2021-20090,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99983,CWE-22,A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication.,2021-04-29,CISA/EPSS/Nuclei,cpe:2.3:h:buffalo:wsr-2533dhp3-bk:-:*:*:*:*:*:*:*;cpe:2.3:h:buffalo:wsr-2533dhpl2-bk:-:*:*:*:*:*:*:*;cpe:2.3:o:buffalo:wsr-2533dhp3-bk_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:buffalo:wsr-2533dhpl2-bk_firmware:*:*:*:*:*:*:*:*,Buffalo,Wsr-2533Dhpl2-Bk Firmware
CVE-2021-20091,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.08796,NVD-CWE-noinfo,"The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not properly sanitize user input. An authenticated remote attacker could leverage this vulnerability to alter device configuration, potentially gaining remote code execution.",2021-04-29,Nuclei,cpe:2.3:h:buffalo:wsr-2533dhp3-bk:-:*:*:*:*:*:*:*;cpe:2.3:h:buffalo:wsr-2533dhpl2-bk:-:*:*:*:*:*:*:*;cpe:2.3:o:buffalo:wsr-2533dhp3-bk_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:buffalo:wsr-2533dhpl2-bk_firmware:*:*:*:*:*:*:*:*,Buffalo,Wsr-2533Dhpl2-Bk Firmware
CVE-2021-20092,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.0817,CWE-287,The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not properly restrict access to sensitive information from an unauthorized actor.,2021-04-29,Nuclei,cpe:2.3:h:buffalo:wsr-2533dhp3-bk:-:*:*:*:*:*:*:*;cpe:2.3:h:buffalo:wsr-2533dhpl2-bk:-:*:*:*:*:*:*:*;cpe:2.3:o:buffalo:wsr-2533dhp3-bk_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:buffalo:wsr-2533dhpl2-bk_firmware:*:*:*:*:*:*:*:*,Buffalo,Wsr-2533Dhpl2-Bk Firmware
CVE-2021-20114,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.05973,CWE-425,"When installed following the default/recommended settings, TCExam <= 14.8.1 allowed unauthenticated users to access the /cache/backup/ directory, which included sensitive database backup files.",2021-07-30,Nuclei,cpe:2.3:a:tecnick:tcexam:*:*:*:*:*:*:*:*,Tecnick,Tcexam
CVE-2021-20123,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.74279,CWE-22,A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.,2021-10-13,CISA/Nuclei,cpe:2.3:a:draytek:vigorconnect:1.6.0:beta3:*:*:*:*:*:*,Draytek,Vigorconnect
CVE-2021-20124,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.69248,CWE-22,A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.,2021-10-13,CISA/Nuclei,cpe:2.3:a:draytek:vigorconnect:1.6.0:beta3:*:*:*:*:*:*,Draytek,Vigorconnect
CVE-2021-20137,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02557,CWE-79,"A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/site_access/ page on the Gryphon Tower router's web interface. An attacker could exploit this issue by tricking a user into following a specially crafted link, granting the attacker javascript execution in the context of the victim's browser.",2021-12-09,Nuclei,cpe:2.3:h:gryphonconnect:gryphon_tower:-:*:*:*:*:*:*:*;cpe:2.3:o:gryphonconnect:gryphon_tower_firmware:*:*:*:*:*:*:*:*,Gryphonconnect,Gryphon Tower Firmware
CVE-2021-20150,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.4006,CWE-306,Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard. Authentication can be bypassed and a user may view information as Admin by manually browsing to the setup wizard and forcing it to redirect to the desired page.,2021-12-30,Nuclei,cpe:2.3:h:trendnet:tew-827dru:2.0:*:*:*:*:*:*:*;cpe:2.3:o:trendnet:tew-827dru_firmware:2.08b01:*:*:*:*:*:*:*,Trendnet,Tew-827Dru Firmware
CVE-2021-20158,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.10774,CWE-306,"Trendnet AC2600 TEW-827DRU version 2.08B01 contains an authentication bypass vulnerability. It is possible for an unauthenticated, malicous actor to force the change of the admin password due to a hidden administrative command.",2021-12-30,Nuclei,cpe:2.3:h:trendnet:tew-827dru:2.0:*:*:*:*:*:*:*;cpe:2.3:o:trendnet:tew-827dru_firmware:2.08b01:*:*:*:*:*:*:*,Trendnet,Tew-827Dru Firmware
CVE-2021-20167,8.0,CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.0853,CWE-77,Netgear RAX43 version 1.0.3.96 contains a command injection vulnerability. The readycloud cgi application is vulnerable to command injection in the name parameter.,2021-12-30,Nuclei,cpe:2.3:h:netgear:rax43:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:rax43_firmware:1.0.3.96:*:*:*:*:*:*:*,Netgear,Rax43 Firmware
CVE-2021-20323,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.37246,CWE-79,A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.,2022-03-25,Nuclei,cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*,Redhat,Keycloak
CVE-2021-20617,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07871,NVD-CWE-Other,"Improper access control vulnerability in acmailer ver. 4.0.1 and earlier, and acmailer DB ver. 1.1.3 and earlier allows remote attackers to execute an arbitrary OS command, or gain an administrative privilege which may result in obtaining the sensitive information on the server via unspecified vectors.",2021-01-14,Nuclei,cpe:2.3:a:acmailer:acmailer:*:*:*:*:*:*:*:*;cpe:2.3:a:acmailer:acmailer_db:*:*:*:*:*:*:*:*,Acmailer,Acmailer
CVE-2021-20792,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03378,CWE-79,Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject arbitrary script via unspecified vectors.,2021-08-18,Nuclei,cpe:2.3:a:expresstech:quiz_and_survey_master:*:*:*:*:*:wordpress:*:*,Expresstech,Quiz And Survey Master
CVE-2021-20837,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.88144,CWE-78,"Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8.2 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors. Note that all versions of Movable Type 4.0 or later including unsupported (End-of-Life, EOL) versions are also affected by this vulnerability.",2021-10-26,Nuclei,cpe:2.3:a:sixapart:movable_type:*:*:*:*:*:*:*:*;cpe:2.3:a:sixapart:movable_type:*:*:*:*:-:*:*:*;cpe:2.3:a:sixapart:movable_type:*:*:*:*:advanced:*:*:*;cpe:2.3:a:sixapart:movable_type:*:*:*:*:premium:*:*:*;cpe:2.3:a:sixapart:movable_type:*:*:*:*:premium_advanced:*:*:*,Sixapart,Movable Type
CVE-2021-21017,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.8621,CWE-122,"Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",2021-02-11,CISA,cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:*;cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*;cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:*;cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Apple,Macos
CVE-2021-21087,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.37095,CWE-79,"Adobe Coldfusion versions 2016 (update 16 and earlier), 2018 (update 10 and earlier) and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An attacker could abuse this vulnerability to execute arbitrary JavaScript code in context of the current user. Exploitation of this issue requires user interaction.",2021-04-15,Nuclei,cpe:2.3:a:adobe:coldfusion:2016:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update10:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update11:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update12:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update13:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update14:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update15:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update16:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update7:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update8:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2016:update9:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update10:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update7:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update8:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update9:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021.0.0.323925:*:*:*:*:*:*:*,Adobe,Coldfusion
CVE-2021-21148,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.19815,CWE-787,Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2021-02-09,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-21166,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.26525,CWE-362,Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2021-03-09,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-21193,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.0987,CWE-416,Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2021-03-16,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-21206,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.09401,CWE-416,Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2021-04-26,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-21220,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.70435,CWE-787,Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2021-04-26,CISA/Metasploit,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-21224,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.57736,CWE-843,Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.,2021-04-26,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2021-21234,7.7,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N,0.21173,CWE-22,"spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package ""eu.hinsch:spring-boot-actuator-logview"". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this library is to expose a log file directory via admin (spring boot actuator) HTTP endpoints. Both the filename to view and a base folder (relative to the logging folder root) can be specified via request parameters. While the filename parameter was checked to prevent directory traversal exploits (so that `filename=../somefile` would not work), the base folder parameter was not sufficiently checked, so that `filename=somefile&base=../` could access a file outside the logging base directory). The vulnerability has been patched in release 0.2.13. Any users of 0.2.12 should be able to update without any issues as there are no other changes in that release. There is no workaround to fix the vulnerability other than updating or removing the dependency. However, removing read access of the user the application is run with to any directory not required for running the application can limit the impact. Additionally, access to the logview endpoint can be limited by deploying the application behind a reverse proxy.",2021-01-05,Nuclei,cpe:2.3:a:spring-boot-actuator-logview_project:spring-boot-actuator-logview:*:*:*:*:*:*:*:*,Spring-Boot-Actuator-Logview Project,Spring-Boot-Actuator-Logview
CVE-2021-21246,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.49051,CWE-862,"OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only administrators can list user details. However for the `/users/{id}` endpoint there are no security checks enforced so it is possible to retrieve arbitrary user details including their Access Tokens! These access tokens can be used to access the API or clone code in the build spec via the HTTP(S) protocol. It has permissions to all projects accessible by the user account. This issue may lead to `Sensitive data leak` and leak the Access Token which can be used to impersonate the administrator or any other users. This issue was addressed in 4.0.3 by removing user info from restful api.",2021-01-15,Nuclei,cpe:2.3:a:onedev_project:onedev:*:*:*:*:*:*:*:*,Onedev Project,Onedev
CVE-2021-21287,7.7,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N,0.24784,CWE-918,"MinIO is a High Performance Object Storage released under Apache License v2.0. In MinIO before version RELEASE.2021-01-30T00-20-58Z there is a server-side request forgery vulnerability. The target application may have functionality for importing data from a URL, publishing data to a URL, or otherwise reading data from a URL that can be tampered with. The attacker modifies the calls to this functionality by supplying a completely different URL or by manipulating how URLs are built (path traversal etc.). In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or modify a URL which the code running on the server will read or submit data, and by carefully selecting the URLs, the attacker may be able to read server configuration such as AWS metadata, connect to internal services like HTTP enabled databases, or perform post requests towards internal services which are not intended to be exposed. This is fixed in version RELEASE.2021-01-30T00-20-58Z, all users are advised to upgrade. As a workaround you can disable the browser front-end with ""MINIO_BROWSER=off"" environment variable.",2021-02-01,Nuclei,cpe:2.3:a:minio:minio:*:*:*:*:*:*:*:*,Minio,Minio
CVE-2021-21300,8.0,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N,0.88644,CWE-59,"Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out script to be executed while cloning onto a case-insensitive file system such as NTFS, HFS+ or APFS (i.e. the default file systems on Windows and macOS). Note that clean/smudge filters have to be configured for that. Git for Windows configures Git LFS by default, and is therefore vulnerable. The problem has been patched in the versions published on Tuesday, March 9th, 2021. As a workaound, if symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. Likewise, if no clean/smudge filters such as Git LFS are configured globally (i.e. _before_ cloning), the attack is foiled. As always, it is best to avoid cloning repositories from untrusted sources. The earliest impacted version is 2.14.2. The fix versions are: 2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5, 2.17.62.17.6.",2021-03-09,Metasploit,cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.27.0:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:2.28.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-21307,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N,0.89189,CWE-862,"Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 there is an unauthenticated remote code exploit. This is fixed in versions 5.3.7.47, 5.3.6.68 or 5.3.5.96. As a workaround, one can block access to the Lucee Administrator.",2021-02-11,Metasploit/Nuclei,cpe:2.3:a:lucee:lucee_server:*:*:*:*:*:*:*:*,Lucee,Lucee Server
CVE-2021-21311,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.90072,CWE-918,Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.,2021-02-11,CISA/Nuclei,cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2021-21315,7.1,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N,0.9024,CWE-78,"The System Information Library for Node.JS (npm package ""systeminformation"") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.",2021-02-16,CISA/Nuclei,cpe:2.3:a:apache:cordova:10.0.0:*:*:*:*:-:*:*;cpe:2.3:a:systeminformation:systeminformation:*:*:*:*:*:node.js:*:*,Systeminformation,Systeminformation
CVE-2021-21345,5.8,CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N,0.72324,CWE-94,"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",2021-03-23,Nuclei,cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.16.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.16.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:jmeter:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_platform:2.12.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0.0.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*;cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2021-2135,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0837,NVD-CWE-noinfo,"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",2021-04-22,Nuclei,cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*,Oracle,Weblogic Server
CVE-2021-21351,5.4,CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:N,0.82136,CWE-434,"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",2021-03-23,Nuclei,cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.16.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq:5.16.1:*:*:*:*:*:*:*;cpe:2.3:a:apache:jmeter:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_platform:2.12.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0.0.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2021-21389,8.1,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N,0.13882,CWE-863,"BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the REST API members endpoint. The vulnerability has been fixed in BuddyPress 7.2.1. Existing installations of the plugin should be updated to this version to mitigate the issue.",2021-03-26,Nuclei,cpe:2.3:a:buddypress:buddypress:*:*:*:*:*:wordpress:*:*,Buddypress,Buddypress
CVE-2021-21402,7.7,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N,0.79855,CWE-22,"Jellyfin is a Free Software Media System. In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from a Jellyfin server's file system. This issue is more prevalent when Windows is used as the host OS. Servers that are exposed to the public Internet are potentially at risk. This is fixed in version 10.7.1. As a workaround, users may be able to restrict some access by enforcing strict security permissions on their filesystem, however, it is recommended to update as soon as possible.",2021-03-23,Nuclei,cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:*,Jellyfin,Jellyfin
CVE-2021-21425,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N,0.806,CWE-284,"Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without needing any credentials. Particular method execution will result in arbitrary YAML file creation or content change of existing YAML files on the system. Successfully exploitation of that vulnerability results in configuration changes, such as general site information change, custom scheduler job definition, etc. Due to the nature of the vulnerability, an adversary can change some part of the webpage, or hijack an administrator account, or execute operating system command under the context of the web-server user. This vulnerability is fixed in version 1.10.8. Blocking access to the `/admin` path from untrusted sources can be applied as a workaround.",2021-04-07,Metasploit,cpe:2.3:a:getgrav:grav-plugin-admin:*:*:*:*:*:*:*:*,Getgrav,Grav-Plugin-Admin
CVE-2021-21479,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H,0.10116,CWE-74,"In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity of the system.",2021-02-09,Nuclei,cpe:2.3:a:sap:scimono:*:*:*:*:*:*:*:*,Sap,Scimono
CVE-2021-21551,8.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.58132,CWE-782,"Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required.",2021-05-04,CISA/Metasploit,cpe:2.3:a:dell:dbutil:*:*:*:*:*:*:*:*;cpe:2.3:h:dell:alienware_14:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:alienware_17_51m_r2:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:alienware_area_51:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:alienware_asm100:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:alienware_asm100r2:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:alienware_m14xr2:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:alienware_m15_r4:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:alienware_m17xr4:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:alienware_m18xr2:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:canvas_27:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:cheng_ming_3967:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:chengming_3967:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:chengming_3977:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:chengming_3980:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:chengming_3988:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:chengming_3990:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:chengming_3991:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:dock_wd15:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:dock_wd19:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:embedded_box_pc_5000:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:g15_5510:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:g3_3500:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:g3_3579:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:g3_3779:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:g5_5000:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:g5_5090:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:g5_5500:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:g5_5587:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:g5_5590:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:g7_7500:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:g7_7588:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:g7_7590:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:g7_7700:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:g7_7790:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:gaming_g3_3590:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_11-3162:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_1122:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_1210:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_13_5370:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_14-3452:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_14-5459:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_14_5468:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_14_7460:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_14_gaming_7466:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_14_gaming_7467:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_15-3552:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_15-5559:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_15-5565:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_1545:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_1564:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_15_5566:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_15_5567:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_15_5582_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_15_7560:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_15_7572:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_15_gaming_7566:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_15_gaming_7567:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_15_gaming_7577:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_15z:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_17-5759:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_17_5767:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_20-3052:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_2330:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_24-3452:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_24-3455:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_24-5475:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3043:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3048:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3147:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3157:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3168:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3252:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3268:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3421:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3437:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3442:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3443:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3470:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3471:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3480:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3481:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3490:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3493:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3501:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3520:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3521:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3537:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3542:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3543:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3580:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3581:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3583:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3584:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3590:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3593:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3646:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3647:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3655:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3656:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3668:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3670:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3671:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3780:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3781:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3790:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3793:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3847:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3880:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3881:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_3891:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5300:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5301:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5323:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5348:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5390:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5391:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5400_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5400_aio:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5401:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5402:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5406_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5408:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5409:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5423:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5443:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5448:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5480:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5481_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5482:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5485_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5490:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5490_aio:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5491_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5491_aio:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5493:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5494:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5498:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5501:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5502:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5508:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5509:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5520:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5521:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5537:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5543:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5548:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5570:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5576:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5577:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5580:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5583:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5584:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5590:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5591_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5593:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5594:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5598:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5676:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5737:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5749:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_5770:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_580s:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_620:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_660:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_660s:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7300:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7300_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7306_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7359:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7368:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7380:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7386:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7390:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7391:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7391_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7400:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7437:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7472:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7490:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7500:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7500_2-in-1_black:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7500_2-in-1_silver:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7501:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7506_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7520:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7537:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7548:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7558:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7559:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7580:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7586:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7590:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7590_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7591:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7591_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7700:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7706_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7720:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7737:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7746:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7786:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7790:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_7791:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_one_19:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:inspiron_one_2020:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_12_7285:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_12_rugged_extreme_7214:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_12_rugged_tablet_7212:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_14_rugged_5414:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_14_rugged_extreme_7404:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_14_rugged_extreme_7414:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3120:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3150:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3160:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3180:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3189:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3190:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3190_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3300:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3301:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3310:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3310_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3330:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3340:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3350:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3380:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3390:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3400:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3410:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3440:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3450:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3460:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3460_wyse_tc:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3470:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3480:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3480_mobile_thin_client:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3490:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3500:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3510:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3550:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3560:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3570:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3580:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_3590:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5175:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5179:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5200:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5250:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5280:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5280_mobile_thin_client:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5285:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5285_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5288:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5289:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5290:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5290_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5300:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5300_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5310:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5310_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5320:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5400:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5401:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5410:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5411:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5420:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5450:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5480:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5488:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5490:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5491:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5495:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5500:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5501:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5510:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5511:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5520:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5550:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5580:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5590:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_5591:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_7200_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_7210_2_in_1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_7275:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_7280:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_7285:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_7290:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_7300:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_7310:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_7320:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_7350:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_7370:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_7380:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_7389:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_7390:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_7390_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_7400:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_7400_2in1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_7410:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_7420:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_7480:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_7490:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_7520:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_9410:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_9510:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e5270:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e5420:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e5430:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e5440:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e5470:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e5530:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e5540:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e5570:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e6220:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e6230:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e6320:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e6330:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e6430:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e6430_atg:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e6440:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e6530:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e6540:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e7240:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e7250:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e7270:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e7270_mobile_thin_client:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e7270_wyse_tc:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e7440:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e7450:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_e7470:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_rugged_5420:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_rugged_5424:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_rugged_7424:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_rugged_extreme_7424:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_rugged_extreme_tablet_7220:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_rugged_extreme_tablet_7220ex:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:latitude_xt3:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_3010:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_3011_aio:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_3020:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_3030_aio:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_3040:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_3046:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_3050:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_3050_aio:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_3060:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_3070:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_3080:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_3090_ultra:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_3240_all-in-one:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_3280_aio:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_390:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_5040:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_5050:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_5055:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_5055_a-serial:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_5055_ryzen_apu:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_5055_ryzen_cpu:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_5060:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_5070:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_5080:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_5250_all-in-one:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_5260_all-in-one:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_5270_aio:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_5480_aio:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_7010:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_7020:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_7040:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_7050:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_7060:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_7070:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_7070_ultra:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_7071:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_7080:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_7090_ultra:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_7440_aio:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_7450_all-in-one:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_7460_all-in-one:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_7480_aio:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_7760_aio:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_7770_aio:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_7780_aio:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_780:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_790:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_9010:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_9020:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_9030_aio:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_990:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_fx130:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_fx170:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_xe2:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:optiplex_xe3:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_17_m5750:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_3240_cff:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_3420_tower:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_3430_tower:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_3430_xl:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_3431_tower:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_3440:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_3510:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_3520:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_3530:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_3540:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_3541:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_3550:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_3551:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_3560:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_3620_tower:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_3630_tower:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_3640:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_3930_rack:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_3930_xl_rack:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_5510:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_5520:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_5530:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_5530_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_5540:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_5550:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_5720_aio:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_5820_tower:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_5820_xl_tower:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_7510:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_7520:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_7530:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_7540:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_7550:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_7710:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_7720:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_7730:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_7740:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_7750:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_7820_tower:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_7820_xl_tower:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_7920_tower:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_7920_xl_tower:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_m4600:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_m4700:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_m6600:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_m6700:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_r5500:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_t1700:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_t3500:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_t3600:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_t3610:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_t5500:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_t5600:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_t5610:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_t5810:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_t7500:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_t7600:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_t7610:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_t7810:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:precision_t7910:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:thunderbolt_dock_tb16:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:thunderbolt_dock_tb18dc:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_13_5370:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_14-3446:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_14-5459:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_1450:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_14_3458:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_14_5468:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_14_5471:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_1550:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_15_3561:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_15_5568:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_15_7570:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_15_7580:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_20_3052:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_20_3055:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_220s:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_230:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_2521:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_260:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_270:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_270s:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3010:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3070:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3252:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3267:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3268:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3400:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3401:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3470:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3471:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3480:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3481:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3490:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3491:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3500:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3501:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3560:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3580:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3581:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3583:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3584:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3590:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3591:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3660:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3667:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3668:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3669:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3670:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3671:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3681:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3690:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3800:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3881:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3888:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3890:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3900:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3900g:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3901:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3902:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_3905:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_470:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_5090:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_5300:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_5301:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_5390:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_5391:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_5401:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_5402:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_5410:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_5480:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_5481:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_5490:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_5491:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_5501:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_5502:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_5581:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_5590:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_5591:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_5880:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_5890:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_7500:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:vostro_7590:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:wyse_5070:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:wyse_5470:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:wyse_5470_all-in-one:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:wyse_7040_thin_client:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_12_9250:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_13_7390:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_13_7390_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_13_9300:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_13_9305:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_13_9310:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_13_9310_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_13_9343:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_13_9360:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_13_9365_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_13_9370:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_13_9380:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_15_9500:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_15_9560:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_15_9570:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_15_9575_2-in-1:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_17_9700:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_27_7760:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_7590:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_8700:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_8900:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_8940:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_9350:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_9530:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_9550:-:*:*:*:*:*:*:*;cpe:2.3:h:dell:xps_one_2710:-:*:*:*:*:*:*:*,Dell,Alienware 14
CVE-2021-21745,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N,0.55709,CWE-352,"ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould use this vulnerability to perform illegal authorization operations by sending a request to the user to click.",2021-10-20,Nuclei,cpe:2.3:h:zte:mf971r:*:*:*:*:*:*:*:*;cpe:2.3:o:zte:mf971r_firmware:1v1.0.0b06:*:*:*:*:*:*:*;cpe:2.3:o:zte:mf971r_firmware:2v1.0.0b03:*:*:*:*:*:*:*;cpe:2.3:o:zte:mf971r_firmware:s2v1.0.0b03:*:*:*:*:*:*:*;cpe:2.3:o:zte:mf971r_firmware:sv1.0.0b05:*:*:*:*:*:*:*;cpe:2.3:o:zte:mf971r_firmware:v1.0.0b05:*:*:*:*:*:*:*,Zte,Mf971R Firmware
CVE-2021-21799,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.12293,CWE-79,"Cross-site scripting vulnerabilities exist in the telnet_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a user visits a specially crafted URL, it can lead to arbitrary JavaScript code execution in the context of the targeted user’s browser. An attacker can provide a crafted URL to trigger this vulnerability.",2021-07-16,Nuclei,cpe:2.3:a:advantech:r-seenet:2.4.12:*:*:*:*:*:*:*,Advantech,R-Seenet
CVE-2021-21800,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.14115,CWE-79,"Cross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a user visits a specially crafted URL, it can lead to arbitrary JavaScript code execution in the context of the targeted user’s browser. An attacker can provide a crafted URL to trigger this vulnerability.",2021-07-16,Nuclei,cpe:2.3:a:advantech:r-seenet:2.4.12:*:*:*:*:*:*:*,Advantech,R-Seenet
CVE-2021-21801,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.63415,CWE-79,"This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution.",2021-07-16,Nuclei,cpe:2.3:a:advantech:r-seenet:2.4.12:*:*:*:*:*:*:*,Advantech,R-Seenet
CVE-2021-21802,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.099,CWE-79,"This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution.",2021-07-16,Nuclei,cpe:2.3:a:advantech:r-seenet:2.4.12:*:*:*:*:*:*:*,Advantech,R-Seenet
CVE-2021-21803,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.07902,CWE-79,"This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution.",2021-07-16,Nuclei,cpe:2.3:a:advantech:r-seenet:2.4.12:*:*:*:*:*:*:*,Advantech,R-Seenet
CVE-2021-21805,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.69631,CWE-78,An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted HTTP request can lead to arbitrary OS command execution. An attacker can send a crafted HTTP request to trigger this vulnerability.,2021-08-05,Nuclei,cpe:2.3:a:advantech:r-seenet:2.4.12:*:*:*:*:*:*:*,Advantech,R-Seenet
CVE-2021-21809,9.1,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H,0.24173,CWE-78,A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.,2021-06-23,Metasploit,cpe:2.3:a:moodle:moodle:3.10.0:-:*:*:*:*:*:*,Moodle,Moodle
CVE-2021-21816,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N,0.36486,CWE-200,An information disclosure vulnerability exists in the Syslog functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to the disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability.,2021-07-16,Nuclei,cpe:2.3:h:dlink:dir-3040:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-3040_firmware:1.13b03:*:*:*:*:*:*:*,D-Link,Dir-3040 Firmware
CVE-2021-21881,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.37064,CWE-78,An OS command injection vulnerability exists in the Web Manager Wireless Network Scanner functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.,2021-12-22,Nuclei,cpe:2.3:h:lantronix:premierwave_2050:-:*:*:*:*:*:*:*;cpe:2.3:o:lantronix:premierwave_2050_firmware:8.9.0.0:r4:*:*:*:*:*:*,Lantronix,Premierwave 2050 Firmware
CVE-2021-21972,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9957,CWE-22,"The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).",2021-02-24,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:e:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:f:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update1d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update1e:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update1g:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update2:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update2b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update2c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update2d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update2g:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update3:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update3d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update3f:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update3k:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update1b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update2:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update2a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update2c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3f:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3g:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3j:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:*,Vmware,Cloud Foundation
CVE-2021-21973,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.88012,CWE-918,"The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).",2021-02-24,CISA/Nuclei,cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:e:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:f:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update1d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update1e:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update1g:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update2:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update2b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update2c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update2d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update2g:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update3:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update3d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update3f:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update3k:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update1b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update2:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update2a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update2c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3f:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3g:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3j:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:*,Vmware,Cloud Foundation
CVE-2021-21975,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.7829,CWE-918,Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.,2021-03-31,CISA/Metasploit/Nuclei,cpe:2.3:a:vmware:cloud_foundation:3.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.10:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.7.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.7.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.7:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.8.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.8:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.9.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.9:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:4.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_operations_manager:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_operations_manager:7.5.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_operations_manager:8.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_operations_manager:8.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_operations_manager:8.1.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_operations_manager:8.1.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_operations_manager:8.2.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_operations_manager:8.3.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.2:*:*:*:*:*:*:*,Vmware,Cloud Foundation
CVE-2021-21978,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99005,CWE-20,VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. Improper input validation and lack of authorization leading to arbitrary file upload in logupload web application. An unauthorized attacker with network access to View Planner Harness could upload and execute a specially crafted file leading to remote code execution within the logupload container.,2021-03-03,EPSS/Metasploit/Nuclei,cpe:2.3:a:vmware:view_planner:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:view_planner:4.6:-:*:*:*:*:*:*,Vmware,View Planner
CVE-2021-21983,6.5,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H,0.68557,NVD-CWE-noinfo,Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system.,2021-03-31,Metasploit,cpe:2.3:a:vmware:cloud_foundation:3.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.10:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.7.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.7.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.7:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.8.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.8:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.9.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.9:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:4.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_operations_manager:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_operations_manager:7.5.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_operations_manager:8.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_operations_manager:8.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_operations_manager:8.1.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_operations_manager:8.1.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_operations_manager:8.2.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_operations_manager:8.3.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.2:*:*:*:*:*:*:*,Vmware,Cloud Foundation
CVE-2021-21985,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99999,CWE-918,The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.,2021-05-26,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:e:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:f:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update1b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update1c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update1d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update1e:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update1g:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update2:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update2b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update2c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update2d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update2g:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update3:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update3d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update3f:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update3k:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update3n:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update1b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update2:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update2a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update2c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3f:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3g:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3j:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3l:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3m:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:*,Vmware,Vcenter Server
CVE-2021-22005,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99999,CWE-22,The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.,2021-09-23,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*,Vmware,Cloud Foundation
CVE-2021-22015,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01944,CWE-552,The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance.,2021-09-23,Metasploit,cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*,Vmware,Cloud Foundation
CVE-2021-22017,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.49177,NVD-CWE-noinfo,Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.,2021-09-23,CISA/Nuclei,cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:*,Vmware,Vcenter Server
CVE-2021-22053,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.13035,CWE-94,"Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution.",2021-11-19,Nuclei,cpe:2.3:a:vmware:spring_cloud_netflix:*:*:*:*:*:*:*:*,Vmware,Spring Cloud Netflix
CVE-2021-22054,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.97713,CWE-918,"VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.",2021-12-17,CISA/EPSS/Nuclei,cpe:2.3:a:vmware:workspace_one_uem_console:*:*:*:*:*:*:*:*,Vmware,Workspace One Uem Console
CVE-2021-22122,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.1052,CWE-79,"An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to perform a reflected cross site scripting attack (XSS) by injecting malicious payload in different vulnerable API end-points.",2021-02-08,Nuclei,cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*,Fortinet,Fortiweb
CVE-2021-22145,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.76249,CWE-200,A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details.,2021-07-21,Metasploit/Nuclei,cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.8.0:*:*:*:*:*:*:*,Elastic,Elasticsearch
CVE-2021-22175,6.8,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N,0.53372,CWE-918,"When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled",2021-06-11,CISA/Nuclei,cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*;cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*,Gitlab,Gitlab
CVE-2021-22204,6.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L,0.99981,CWE-94,Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image,2021-04-23,CISA/EPSS/Metasploit,cpe:2.3:a:exiftool_project:exiftool:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2021-22205,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.99731,CWE-94,An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.,2021-04-23,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*;cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*,Gitlab,Gitlab
CVE-2021-22214,6.8,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N,0.27806,CWE-918,"When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is limited",2021-06-08,Nuclei,cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*,Gitlab,Gitlab
CVE-2021-22502,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9674,CWE-78,"Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.",2021-02-08,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:microfocus:operation_bridge_reporter:10.40:*:*:*:*:*:*:*,Microfocus,Operation Bridge Reporter
CVE-2021-22506,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.25695,NVD-CWE-noinfo,"Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0. The vulnerability could cause information leakage.",2021-03-26,CISA,cpe:2.3:a:microfocus:access_manager:*:*:*:*:*:*:*:*,Microfocus,Access Manager
CVE-2021-22555,8.3,CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H,0.78684,CWE-787,A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space,2021-07-07,CISA/Metasploit,cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:solidfire_baseboard_management_controller:*:*:*:*:*:*:*:*;cpe:2.3:h:netapp:aff_500f:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:aff_a250:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:aff_a400:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:c250:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:c400:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:fas_8300:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:fas_8700:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h610c:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h615c:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*;cpe:2.3:o:brocade:fabric_operating_system:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:netapp:aff_500f_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:aff_a250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:aff_a400_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:c250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:c400_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:fas_8300_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:fas_8700_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*,Netapp,C400 Firmware
CVE-2021-22600,6.6,CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:H,0.05918,CWE-415,A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755,2022-01-26,CISA,cpe:2.3:h:netapp:8300:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:8700:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:a400:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:c400:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:netapp:8300_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:8700_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:a400_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:c400_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*,Netapp,8300 Firmware
CVE-2021-22652,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.36845,CWE-306,"Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attacker to change the configuration and obtain code execution.",2021-02-11,Metasploit,cpe:2.3:a:advantech:iview:*:*:*:*:*:*:*:*,Advantech,Iview
CVE-2021-22681,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.25455,CWE-522,"Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.",2021-03-03,CISA,cpe:2.3:a:rockwellautomation:factorytalk_services_platform:*:*:*:*:*:*:*:*;cpe:2.3:a:rockwellautomation:rslogix_5000:*:*:*:*:*:*:*:*;cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:*:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:compact_guardlogix_5370:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:compact_guardlogix_5380:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:compactlogix_1768:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:compactlogix_1769:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:compactlogix_5370:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:compactlogix_5380:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:compactlogix_5480:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:controllogix_5550:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:controllogix_5560:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:controllogix_5570:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:controllogix_5580:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:drivelogix_1794-l34:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:drivelogix_5560:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:drivelogix_5730:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:guardlogix_5570:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:guardlogix_5580:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:softlogix_5800:-:*:*:*:*:*:*:*,Rockwellautomation,Compact Guardlogix 5370
CVE-2021-22707,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.64612,CWE-798,"A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could allow an attacker to issue unauthorized commands to the charging station web server with administrative privileges.",2021-07-21,Nuclei,cpe:2.3:h:schneider-electric:evlink_city_evc1s22p4:-:*:*:*:*:*:*:*;cpe:2.3:h:schneider-electric:evlink_city_evc1s7p4:-:*:*:*:*:*:*:*;cpe:2.3:h:schneider-electric:evlink_parking_ev.2:-:*:*:*:*:*:*:*;cpe:2.3:h:schneider-electric:evlink_parking_evf2:-:*:*:*:*:*:*:*;cpe:2.3:h:schneider-electric:evlink_parking_evw2:-:*:*:*:*:*:*:*;cpe:2.3:h:schneider-electric:evlink_smart_wallbox_evb1a:-:*:*:*:*:*:*:*;cpe:2.3:o:schneider-electric:evlink_city_evc1s22p4_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:schneider-electric:evlink_city_evc1s7p4_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:schneider-electric:evlink_parking_ev.2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:schneider-electric:evlink_parking_evf2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:schneider-electric:evlink_parking_evw2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:schneider-electric:evlink_smart_wallbox_evb1a_firmware:*:*:*:*:*:*:*:*,Schneider-Electric,Evlink City Evc1S22P4 Firmware
CVE-2021-22873,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.66141,CWE-601,"Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts. Such open redirects had previously been available by design to allow third party ad servers to track such metrics when delivering ads. However, third party click tracking via redirects is not a viable option anymore, leading to such open redirect functionality being removed and reclassified as a vulnerability.",2021-01-26,Nuclei,cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*,Revive-Adserver,Revive Adserver
CVE-2021-22881,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.87301,CWE-601,"The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain ""allowed host"" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.",2021-02-11,Nuclei,cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-22893,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.47172,CWE-287,Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.,2021-04-23,CISA,cpe:2.3:a:ivanti:connect_secure:9.0:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r4.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r5.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r6.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r10.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r10.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r9.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*,Ivanti,Connect Secure
CVE-2021-22894,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.41284,CWE-94,A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room.,2021-05-27,CISA,cpe:2.3:a:ivanti:connect_secure:9.0:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r1.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r2.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r4.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r4.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r5.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r6.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r10.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r10.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r9.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*,Ivanti,Connect Secure
CVE-2021-22899,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.22343,CWE-77,A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature,2021-05-27,CISA,cpe:2.3:a:ivanti:connect_secure:9.0:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r1.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r2.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r4.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r4.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r5.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r6.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:rx:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r10.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r10.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r9.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*,Ivanti,Connect Secure
CVE-2021-22900,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.14146,CWE-94,A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.,2021-05-27,CISA,cpe:2.3:a:ivanti:connect_secure:9.0:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r1.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r2.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r4.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r4.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r5.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r6.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r10.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r10.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r9.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*;cpe:2.3:a:pulsesecure:pulse_connect_secure:*:*:*:*:*:*:*:*,Ivanti,Connect Secure
CVE-2021-22911,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.95242,CWE-75,"A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE.",2021-05-27,EPSS/Nuclei,cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:-:*:*:*:*:*:*;cpe:2.3:a:rocket.chat:rocket.chat:3.12.0:-:*:*:*:*:*:*;cpe:2.3:a:rocket.chat:rocket.chat:3.13.0:-:*:*:*:*:*:*,Rocket.Chat,Rocket.Chat
CVE-2021-22941,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.53585,CWE-284,Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zones controller.,2021-09-23,CISA,cpe:2.3:a:citrix:sharefile_storagezones_controller:*:*:*:*:*:*:*:*,Citrix,Sharefile Storagezones Controller
CVE-2021-22986,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99898,CWE-918,"On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.",2021-03-31,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_centralized_management:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:ssl_orchestrator:*:*:*:*:*:*:*:*,F5,Big-Ip Access Policy Manager
CVE-2021-22991,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.61064,CWE-119,"On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE). Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.",2021-03-31,CISA,cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:ssl_orchestrator:*:*:*:*:*:*:*:*,F5,Big-Ip Access Policy Manager
CVE-2021-23241,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.13436,CWE-22,"MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with a loginLess or login.htm URI (for authentication bypass) to the web server, as demonstrated by the /loginLess/../../etc/passwd URI.",2021-01-07,Nuclei,cpe:2.3:h:mercusys:mercury_x18g:-:*:*:*:*:*:*:*;cpe:2.3:o:mercusys:mercury_x18g_firmware:1.0.5:*:*:*:*:*:*:*,Mercusys,Mercury X18G Firmware
CVE-2021-23337,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.2241,CWE-94,Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.,2021-02-15,Nuclei,cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*;cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:system_manager:9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_extensibility_workbench:14.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_extensibility_workbench:14.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.11.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_design_studio:7.4.2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_border_controller:8.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_border_controller:9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_communications_broker:3.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:health_sciences_data_management_workbench:2.5.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:health_sciences_data_management_workbench:3.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*;cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:*;cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:*;cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*,Lodash,Lodash
CVE-2021-23394,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.19083,CWE-434,The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.,2021-06-13,Nuclei,cpe:2.3:a:std42:elfinder:*:*:*:*:*:*:*:*,Std42,Elfinder
CVE-2021-23758,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.88768,CWE-502,"All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.",2021-12-03,Metasploit,cpe:2.3:a:ajaxpro.2_project:ajaxpro.2:*:*:*:*:*:.net:*:*,Ajaxpro.2 Project,Ajaxpro.2
CVE-2021-23874,8.2,CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H,0.01026,CWE-269,Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitrary code bypassing MTP self-defense.,2021-02-10,CISA,cpe:2.3:a:mcafee:total_protection:*:*:*:*:*:*:*:*,Mcafee,Total Protection
CVE-2021-24139,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05418,CWE-89,"Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwg_search_x parameter.",2021-03-18,Nuclei,cpe:2.3:a:10web:photo_gallery:*:*:*:*:*:wordpress:*:*,10Web,Photo Gallery
CVE-2021-24145,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.88158,CWE-434,"Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.",2021-03-18,Metasploit/Nuclei,cpe:2.3:a:webnus:modern_events_calendar_lite:*:*:*:*:*:wordpress:*:*,Webnus,Modern Events Calendar Lite
CVE-2021-24146,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N,0.31043,CWE-284,"Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example.",2021-03-18,Nuclei,cpe:2.3:a:webnus:modern_events_calendar_lite:*:*:*:*:*:wordpress:*:*,Webnus,Modern Events Calendar Lite
CVE-2021-24150,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04337,CWE-918,The LikeBtn WordPress Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.32 was vulnerable to Unauthenticated Full-Read Server-Side Request Forgery (SSRF).,2021-04-05,Nuclei,cpe:2.3:a:likebtn-like-button_project:likebtn-like-button:*:*:*:*:*:wordpress:*:*,Likebtn-Like-Button Project,Likebtn-Like-Button
CVE-2021-24155,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.84112,CWE-434,"The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users (admin+) to upload arbitrary files, including PHP ones, leading to RCE.",2021-04-05,Metasploit/Nuclei,cpe:2.3:a:backup-guard:backup_guard:*:*:*:*:*:wordpress:*:*,Backup-Guard,Backup Guard
CVE-2021-24165,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01643,CWE-601,"In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect parameter and no protection in place.",2021-04-05,Nuclei,cpe:2.3:a:ninjaforms:ninja_forms:*:*:*:*:*:wordpress:*:*,Ninjaforms,Ninja Forms
CVE-2021-24169,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.10348,CWE-79,This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order data. The tab parameter in the Admin Panel is vulnerable to reflected XSS.,2021-04-05,Nuclei,cpe:2.3:a:algolplus:advanced_order_export_for_woocommerce:*:*:*:*:*:wordpress:*:*,Algolplus,Advanced Order Export For Woocommerce
CVE-2021-24170,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04788,CWE-200,"The REST API endpoint get_users in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the upload_files capability. This included password hashes, hashed user activation keys, usernames, emails, and other less sensitive information.",2021-04-05,Nuclei,cpe:2.3:a:cozmoslabs:user_profile_picture:*:*:*:*:*:wordpress:*:*,Cozmoslabs,User Profile Picture
CVE-2021-24175,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.14462,CWE-287,"The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user (including admin) by just providing the related username, as well as create accounts with arbitrary roles, such as admin. These issues can be exploited even if registration is disabled, and the Login widget is not active.",2021-04-05,Nuclei,cpe:2.3:a:posimyth:the_plus_addons_for_elementor:*:*:*:*:*:wordpress:*:*,Posimyth,The Plus Addons For Elementor
CVE-2021-24176,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.02044,CWE-79,"The JH 404 Logger WordPress plugin through 1.1 doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, which leads to executing arbitrary JavaScript code in the WordPress dashboard.",2021-04-05,Nuclei,cpe:2.3:a:jh_404_logger_project:jh_404_logger:*:*:*:*:*:wordpress:*:*,Jh 404 Logger Project,Jh 404 Logger
CVE-2021-24210,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03066,CWE-601,There is an open redirect in the PhastPress WordPress plugin before 1.111 that allows an attacker to malform a request to a page with the plugin and then redirect the victim to a malicious page. There is also a support comment from another user one year ago (https://wordpress.org/support/topic/phast-php-used-for-remote-fetch/) that says that the php involved in the request only go to whitelisted pages but it's possible to redirect the victim to any domain.,2021-04-05,Nuclei,cpe:2.3:a:kiboit:phastpress:*:*:*:*:*:wordpress:*:*,Kiboit,Phastpress
CVE-2021-24212,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07908,CWE-434,The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allows unauthenticated users to upload any files to the site which by default will end up in wp-content/uploads/hstmp.,2021-04-05,Nuclei,cpe:2.3:a:woocommerce:help_scout:*:*:*:*:*:wordpress:*:*,Woocommerce,Help Scout
CVE-2021-24213,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0137,CWE-79,"The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panel, via the 's' GET parameter on the Donors page.",2021-04-12,Nuclei,cpe:2.3:a:givewp:givewp:*:*:*:*:*:wordpress:*:*,Givewp,Givewp
CVE-2021-24214,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0163,CWE-79,"The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected Cross-Site Scripting issue. This issue does not require authentication and can be exploited with the default configuration.",2021-05-06,Nuclei,cpe:2.3:a:daggerhartlab:openid_connect_generic_client:3.8.0:*:*:*:*:wordpress:*:*;cpe:2.3:a:daggerhartlab:openid_connect_generic_client:3.8.1:*:*:*:*:wordpress:*:*,Daggerhartlab,Openid Connect Generic Client
CVE-2021-24215,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09733,CWE-284,"An Improper Access Control vulnerability was discovered in the Controlled Admin Access WordPress plugin before 1.5.2. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromise of the target resource.",2021-04-12,Nuclei,cpe:2.3:a:wpruby:controlled_admin_access:*:*:*:*:*:wordpress:*:*,Wpruby,Controlled Admin Access
CVE-2021-24219,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.02059,CWE-284,"The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before 2.3.9.4, Thrive Quiz Builder WordPress plugin before 2.3.9.4, Thrive Apprentice WordPress plugin before 2.3.9.4, Thrive Visual Editor WordPress plugin before 2.6.7.4, Thrive Dashboard WordPress plugin before 2.3.9.3, Thrive Ovation WordPress plugin before 2.4.5, Thrive Clever Widgets WordPress plugin before 1.57.1 and Rise by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0, Thrive Themes Builder WordPress theme before 2.2.4 register a REST API endpoint associated with Zapier functionality. While this endpoint was intended to require an API key in order to access, it was possible to access it by supplying an empty api_key parameter in vulnerable versions if Zapier was not enabled. Attackers could use this endpoint to add arbitrary data to a predefined option in the wp_options table.",2021-04-12,Nuclei,cpe:2.3:a:thrivethemes:focusblog:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:ignition:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:luxe:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:minus:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:performag:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:pressive:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:rise:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:squared:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:storied:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:thrive_apprentice:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:thrive_clever_widgets:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:thrive_comments:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:thrive_dashboard:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:thrive_headline_optimizer:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:thrive_optimize:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:thrive_ovation:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:thrive_quiz_builder:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:thrive_themes_builder:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:thrive_visual_editor:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:voice:*:*:*:*:*:wordpress:*:*,Thrivethemes,Focusblog
CVE-2021-24220,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H,0.03946,CWE-434,"Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0 register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote URL and overwrite an existing file on the site with it or create a new file.This includes executable PHP files that contain malicious code.",2021-04-12,Nuclei,cpe:2.3:a:thrivethemes:focusblog:*:*:*:*:*:wordpress_:*:*;cpe:2.3:a:thrivethemes:ignition:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:luxe:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:minus:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:performag:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:pressive:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:rise:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:squared:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:storied:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thrivethemes:voice:*:*:*:*:*:wordpress:*:*,Thrivethemes,Focusblog
CVE-2021-24226,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.05404,CWE-200,"In the AccessAlly WordPress plugin before 3.5.7, the file ""resource/frontend/product/product-shortcode.php"" responsible for the [accessally_order_form] shortcode is dumping serialize($_SERVER), which contains all environment variables. The leakage occurs on all public facing pages containing the [accessally_order_form] shortcode, no login or administrator role is required.",2021-04-12,Nuclei,cpe:2.3:a:accessally:accessally:*:*:*:*:*:wordpress:*:*,Accessally,Accessally
CVE-2021-24227,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.05879,CWE-200,"The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies.",2021-04-12,Nuclei,cpe:2.3:a:patreon:patreon_wordpress:*:*:*:*:*:wordpress:*:*,Patreon,Patreon Wordpress
CVE-2021-24235,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02927,CWE-79,"The Goto WordPress theme before 2.0 does not sanitise the keywords and start_date GET parameter on its Tour List page, leading to an unauthenticated reflected Cross-Site Scripting issue.",2021-04-22,Nuclei,cpe:2.3:a:boostifythemes:goto:*:*:*:*:*:wordpress:*:*,Boostifythemes,Goto
CVE-2021-24236,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0714,CWE-434,"The Imagements WordPress plugin through 1.2.5 allows images to be uploaded in comments, however only checks for the Content-Type in the request to forbid dangerous files. This allows unauthenticated attackers to upload arbitrary files by using a valid image Content-Type along with a PHP filename and code, leading to RCE.",2021-05-06,Nuclei,cpe:2.3:a:imagements_project:imagements:*:*:*:*:*:wordpress:*:*,Imagements Project,Imagements
CVE-2021-24237,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.06298,CWE-79,"The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not properly sanitise the keyword_search, search_radius. _bedrooms and _bathrooms GET parameters before outputting them in its properties page, leading to an unauthenticated reflected Cross-Site Scripting issue.",2021-04-22,Nuclei,cpe:2.3:a:purethemes:findeo:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:purethemes:realteo:*:*:*:*:*:wordpress:*:*,Purethemes,Findeo
CVE-2021-24239,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01602,CWE-79,"The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaion_code GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting issue.",2021-04-22,Nuclei,cpe:2.3:a:genetechsolutions:pie_register:*:*:*:*:*:wordpress:*:*,Genetechsolutions,Pie Register
CVE-2021-24245,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.05721,CWE-79,"The Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests (such as matching a spam word), outputting it in an attribute after sanitising it to remove HTML tags, which is not sufficient and lead to a reflected Cross-Site Scripting issue.",2021-05-06,Nuclei,cpe:2.3:a:trumani:stop_spammers:*:*:*:*:*:wordpress:*:*,Trumani,Stop Spammers
CVE-2021-24274,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.17638,CWE-79,"The Ultimate Maps by Supsystic WordPress plugin before 1.2.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue",2021-05-05,Nuclei,cpe:2.3:a:supsystic:ultimate_maps:*:*:*:*:*:wordpress:*:*,Supsystic,Ultimate Maps
CVE-2021-24275,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.18165,CWE-79,"The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue",2021-05-05,Nuclei,cpe:2.3:a:supsystic:popup:*:*:*:*:*:wordpress:*:*,Supsystic,Popup
CVE-2021-24276,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.16044,CWE-79,"The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue",2021-05-05,Nuclei,cpe:2.3:a:supsystic:contact_form:*:*:*:*:*:wordpress:*:*,Supsystic,Contact Form
CVE-2021-24278,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.07359,CWE-863,"In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce for any WordPress action/function.",2021-05-14,Nuclei,cpe:2.3:a:querysol:redirection_for_contact_form_7:*:*:*:*:*:wordpress:*:*,Querysol,Redirection For Contact Form 7
CVE-2021-24284,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.4214,CWE-434,The Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action. The supplied zipfile being unzipped in the wp-content/uploads/kaswara/fonts_icon directory with no checks for malicious files such as PHP.,2021-05-14,Nuclei,cpe:2.3:a:kaswara_project:kaswara:*:*:*:*:*:wordpress:*:*,Kaswara Project,Kaswara
CVE-2021-24285,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.14697,CWE-89,"The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitise, validate or escape the order_id POST parameter before using it in a SQL statement, leading to a SQL Injection issue.",2021-05-14,Nuclei,cpe:2.3:a:cars-seller-auto-classifieds-script_project:cars-seller-auto-classifieds-script:*:*:*:*:*:wordpress:*:*,Cars-Seller-Auto-Classifieds-Script Project,Cars-Seller-Auto-Classifieds-Script
CVE-2021-24286,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.13942,CWE-79,"The settings page of the Redirect 404 to parent WordPress plugin before 1.3.1 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue",2021-05-14,Nuclei,cpe:2.3:a:mooveagency:redirect_404_to_parent:*:*:*:*:*:wordpress:*:*,Mooveagency,Redirect 404 To Parent
CVE-2021-24287,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.10358,CWE-79,"The settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons WordPress plugin before 1.3.2 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue",2021-05-14,Nuclei,"cpe:2.3:a:mooveagency:select_all_categories_and_taxonomies\,_change_checkbox_to_radio_buttons:*:*:*:*:*:wordpress:*:*",Mooveagency,"Select All Categories And Taxonomies, Change Checkbox To Radio Buttons"
CVE-2021-24288,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01939,CWE-601,"When subscribing using AcyMailing, the 'redirect' parameter isn't properly sanitized. Turning the request from POST to GET, an attacker can craft a link containing a potentially malicious landing page and send it to the victim.",2021-05-17,Nuclei,cpe:2.3:a:acymailing:acymailing:*:*:*:*:*:wordpress:*:*,Acymailing,Acymailing
CVE-2021-24291,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.1445,CWE-79,"The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.69 was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the gallery_id, tag, album_id and _id GET parameters passed to the bwg_frontend_data AJAX action (available to both unauthenticated and authenticated users)",2021-05-14,Nuclei,cpe:2.3:a:10web:photo_gallery:*:*:*:*:*:wordpress:*:*,10Web,Photo Gallery
CVE-2021-24295,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04691,CWE-89,"It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The update_log function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected via the User-Agent Header by manipulating the cookies set by the Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.153.4, sending an initial request to obtain a ct_sfw_pass_key cookie and then manually setting a separate ct_sfw_passed cookie and disallowing it from being reset.",2021-05-17,Nuclei,"cpe:2.3:a:cleantalk:spam_protection\,_antispam\,_firewall:*:*:*:*:*:wordpress:*:*",Cleantalk,"Spam Protection, Antispam, Firewall"
CVE-2021-24298,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03451,CWE-79,"The method and share GET parameters of the Giveaway pages were not sanitised, validated or escaped before being output back in the pages, thus leading to reflected XSS",2021-05-24,Nuclei,cpe:2.3:a:ibenic:simple_giveaways:*:*:*:*:*:wordpress:*:*,Ibenic,Simple Giveaways
CVE-2021-24300,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.10587,CWE-79,"The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issue",2021-05-24,Nuclei,cpe:2.3:a:pickplugins:product_slider_for_woocommerce:*:*:*:*:*:wordpress:*:*,Pickplugins,Product Slider For Woocommerce
CVE-2021-24316,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.06442,CWE-79,"The search feature of the Mediumish WordPress theme through 1.0.47 does not properly sanitise it's 's' GET parameter before output it back the page, leading to the Cross-SIte Scripting issue.",2021-06-01,Nuclei,cpe:2.3:a:wowthemes:mediumish:*:*:*:*:*:wordpress:*:*,Wowthemes,Mediumish
CVE-2021-24320,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.10769,CWE-79,"The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise and escape its listing_list_view, bt_bb_listing_field_my_lat, bt_bb_listing_field_my_lng, bt_bb_listing_field_distance_value, bt_bb_listing_field_my_lat_default, bt_bb_listing_field_keyword, bt_bb_listing_field_location_autocomplete, bt_bb_listing_field_price_range_from and bt_bb_listing_field_price_range_to parameter in ints listing page, leading to reflected Cross-Site Scripting issues.",2021-06-01,Nuclei,cpe:2.3:a:bold-themes:bello:*:*:*:*:*:wordpress:*:*,Bold-Themes,Bello
CVE-2021-24335,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03884,CWE-79,"The Car Repair Services & Auto Mechanic WordPress theme before 4.0 did not properly sanitise its serviceestimatekey search parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue",2021-06-01,Nuclei,cpe:2.3:a:smartdatasoft:car_repair_services_\&_auto_mechanic:*:*:*:*:*:wordpress:*:*,Smartdatasoft,Car Repair Services & Auto Mechanic
CVE-2021-24340,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.29776,CWE-89,"The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones.",2021-06-07,Nuclei,cpe:2.3:a:veronalabs:wp_statistics:*:*:*:*:*:wordpress:*:*,Veronalabs,Wp Statistics
CVE-2021-24342,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01975,CWE-79,"The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*), leading to a Reflected Cross-Site Scripting (XSS) issue.",2021-06-07,Nuclei,cpe:2.3:a:jnews:jnews:*:*:*:*:*:wordpress:*:*,Jnews,Jnews
CVE-2021-24347,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.52007,CWE-178,"The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that php files could still be uploaded by changing the file extension's case, for example, from ""php"" to ""pHP"".",2021-06-14,Metasploit/Nuclei,cpe:2.3:a:smartypantsplugins:sp_project_\&_document_manager:*:*:*:*:*:wordpress:*:*,Smartypantsplugins,Sp Project & Document Manager
CVE-2021-24351,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02483,CWE-79,"The theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting (exploitable on both unauthenticated and authenticated users)",2021-06-14,Nuclei,cpe:2.3:a:posimyth:the_plus_addons_for_elementor:*:*:*:*:*:wordpress:*:*,Posimyth,The Plus Addons For Elementor
CVE-2021-24358,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02295,CWE-601,"The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an Open Redirect issue.",2021-06-14,Nuclei,cpe:2.3:a:posimyth:the_plus_addons_for_elementor:*:*:*:*:*:wordpress:*:*,Posimyth,The Plus Addons For Elementor
CVE-2021-24364,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01975,CWE-79,"The Jannah WordPress theme before 5.4.4 did not properly sanitize the options JSON parameter in its tie_get_user_weather AJAX action before outputting it back in the page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.",2021-06-21,Nuclei,cpe:2.3:a:tielabs:jannah:*:*:*:*:*:wordpress:*:*,Tielabs,Jannah
CVE-2021-24370,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.47091,CWE-434,"The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.",2021-06-21,Nuclei,cpe:2.3:a:radykal:fancy_product_designer:*:*:*:*:*:wordpress:*:*,Radykal,Fancy Product Designer
CVE-2021-24387,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03677,CWE-79,"The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ct_community parameter in its search listing page before outputting it back in it, leading to a reflected Cross-Site Scripting which can be triggered in both unauthenticated or authenticated user context",2021-07-06,Nuclei,cpe:2.3:a:contempothemes:real_estate_7:*:*:*:*:*:wordpress:*:*,Contempothemes,Real Estate 7
CVE-2021-24389,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.04348,CWE-79,"The WP Foodbakery WordPress plugin before 2.2, used in the FoodBakery WordPress theme before 2.2 did not properly sanitize the foodbakery_radius parameter before outputting it back in the response, leading to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability.",2021-07-06,Nuclei,cpe:2.3:a:chimpgroup:foodbakery:*:*:*:*:*:wordpress:*:*,Chimpgroup,Foodbakery
CVE-2021-24406,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03379,CWE-601,"The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirect_to parameter in the login form of the forum, leading to an open redirect issue after a successful login. Such issue could allow an attacker to induce a user to use a login URL redirecting to a website under their control and being a replica of the legitimate one, asking them to re-enter their credentials (which will then in the attacker hands)",2021-07-06,Nuclei,cpe:2.3:a:gvectors:wpforo_forum:*:*:*:*:*:wordpress:*:*,Gvectors,Wpforo Forum
CVE-2021-24407,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02697,CWE-79,"The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tie_ajax_search AJAX action, leading to a Reflected Cross-site Scripting (XSS) vulnerability.",2021-07-06,Nuclei,cpe:2.3:a:tielabs:jannah:*:*:*:*:*:wordpress:*:*,Tielabs,Jannah
CVE-2021-24409,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01793,CWE-79,"The Prismatic WordPress plugin before 2.8 does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator",2021-07-12,Nuclei,cpe:2.3:a:plugin-planet:prismatic:*:*:*:*:*:wordpress:*:*,Plugin-Planet,Prismatic
CVE-2021-24435,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01785,CWE-79,"The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues",2021-09-06,Nuclei,cpe:2.3:a:gambit:titan_framework:*:*:*:*:*:wordpress:*:*,Gambit,Titan Framework
CVE-2021-24436,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01905,CWE-79,"The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the ""extension"" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.",2021-07-19,Nuclei,cpe:2.3:a:boldgrid:w3_total_cache:*:*:*:*:*:wordpress:*:*,Boldgrid,W3 Total Cache
CVE-2021-24442,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.46921,CWE-89,"The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the date_answers[] POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL Injection attacks",2021-07-12,Nuclei,"cpe:2.3:a:wpdevart:poll\,_survey\,_questionnaire_and_voting_system:*:*:*:*:*:wordpress:*:*",Wpdevart,"Poll, Survey, Questionnaire And Voting System"
CVE-2021-24452,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01996,CWE-79,"The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the ""extension"" parameter in the Extensions dashboard, when the 'Anonymously track usage to improve product quality' setting is enabled, as the parameter is output in a JavaScript context without proper escaping. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.",2021-07-19,Nuclei,cpe:2.3:a:boldgrid:w3_total_cache:*:*:*:*:*:wordpress:*:*,Boldgrid,W3 Total Cache
CVE-2021-24472,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.56614,CWE-918,"The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content from any URI, this would allow for SSRF (Server Side Request Forgery) and RFI (Remote File Inclusion) vulnerabilities on the website.",2021-08-02,Nuclei,cpe:2.3:a:qantumthemes:kentharadio:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:qantumthemes:onair2:*:*:*:*:*:wordpress:*:*,Qantumthemes,Kentharadio
CVE-2021-24488,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.11241,CWE-79,"The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages, leading to Reflected Cross-Site Scripting issues",2021-08-02,Nuclei,cpe:2.3:a:pickplugins:post_grid:*:*:*:*:*:wordpress:*:*,Pickplugins,Post Grid
CVE-2021-24495,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03343,CWE-79,"The Marmoset Viewer WordPress plugin before 1.9.3 does not property sanitize, validate or escape the 'id' parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue.",2021-08-09,Nuclei,cpe:2.3:a:marmoset:marmoset_viewer:*:*:*:*:*:wordpress:*:*,Marmoset,Marmoset Viewer
CVE-2021-24498,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03536,CWE-79,"The Calendar Event Multi View WordPress plugin before 1.4.01 does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page (via php/edit.php), leading to a reflected Cross-Site Scripting issue.",2021-08-02,Nuclei,cpe:2.3:a:dwbooster:calendar_event_multi_view:*:*:*:*:*:wordpress:*:*,Dwbooster,Calendar Event Multi View
CVE-2021-24499,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.60113,CWE-434,"The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbitrary files to the uploads/workreap-temp directory. Uploaded files were neither sanitized nor validated, allowing an unauthenticated visitor to upload executable code such as php scripts.",2021-08-09,Nuclei,cpe:2.3:a:amentotech:workreap:*:*:*:*:*:wordpress:*:*,Amentotech,Workreap
CVE-2021-24510,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02721,Missing_Data,"The MF Gig Calendar WordPress plugin before 1.2 does not sanitise and escape the id GET parameter before outputting back in the admin dashboard when editing an Event, leading to a reflected Cross-Site Scripting issue",2021-09-13,Nuclei,cpe:2.3:a:mf_gig_calendar_project:mf_gig_calendar:*:*:*:*:wordpress:*:*:*,Mf Gig Calendar Project,Mf Gig Calendar
CVE-2021-24522,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01552,CWE-79,"The User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for tabbed login/register was not properly escaped and could be used in an XSS attack which could lead to wp-admin access. Further, the plugin in several places assigned $_POST as $_GET which meant that in some cases this could be replicated with just $_GET parameters and no need for $_POST values.",2021-08-09,Nuclei,cpe:2.3:a:properfraction:profilepress:*:*:*:*:*:wordpress:*:*,Properfraction,Profilepress
CVE-2021-24527,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07696,CWE-287,"The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such change by email for example.",2021-08-16,Nuclei,cpe:2.3:a:cozmoslabs:profile_builder:*:*:*:*:*:wordpress:*:*,Cozmoslabs,Profile Builder
CVE-2021-24554,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.0654,CWE-89,"The Paytm – Donation Plugin WordPress plugin through 1.3.2 does not sanitise, validate or escape the id GET parameter before using it in a SQL statement when deleting donations, leading to an authenticated SQL injection issue",2021-08-23,Nuclei,cpe:2.3:a:freelancetoindia:paytm-pay:*:*:*:*:*:wordpress:*:*,Freelancetoindia,Paytm-Pay
CVE-2021-24627,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.06561,CWE-89,"The G Auto-Hyperlink WordPress plugin through 1.0.1 does not sanitise or escape an 'id' GET parameter before using it in a SQL statement, to select data to be displayed in the admin dashboard, leading to an authenticated SQL injection",2021-11-08,Nuclei,cpe:2.3:a:g_auto-hyperlink_project:g_auto-hyperlink:*:*:*:*:*:wordpress:*:*,G Auto-Hyperlink Project,G Auto-Hyperlink
CVE-2021-24644,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.05028,CWE-22,"The Images to WebP WordPress plugin before 1.9 does not validate or sanitise the tab parameter before passing it to the include() function, which could lead to a Local File Inclusion issue",2021-11-23,Nuclei,cpe:2.3:a:imagestowebp_project:images_to_webp:*:*:*:*:*:wordpress:*:*,Imagestowebp Project,Images To Webp
CVE-2021-24647,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0968,CWE-287,"The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username",2021-11-08,Nuclei,cpe:2.3:a:genetechsolutions:pie_register:*:*:*:*:*:wordpress:*:*,Genetechsolutions,Pie Register
CVE-2021-24657,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01582,CWE-79,"The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers such as X-Forwarded-For) of attempted logins before outputting them in the reports table, leading to an Unauthenticated Stored Cross-Site Scripting issue.",2021-09-20,Nuclei,cpe:2.3:a:limit_login_attempts_project:limit_login_attempts:*:*:*:*:*:wordpress:*:*,Limit Login Attempts Project,Limit Login Attempts
CVE-2021-24666,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.08883,CWE-89,"The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by default), which adds the rest route '/services/contributor/(?P<id>[\d]+), takes an 'id' and 'category' parameters as arguments. Both parameters can be used for the SQLi.",2021-09-27,Nuclei,cpe:2.3:a:podlove:podlove_podcast_publisher:*:*:*:*:*:wordpress:*:*,Podlove,Podlove Podcast Publisher
CVE-2021-24681,4.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N,0.0087,CWE-79,"The Duplicate Page WordPress plugin through 4.4.2 does not sanitise or escape the Duplicate Post Suffix settings before outputting it, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.",2021-10-11,Nuclei,cpe:2.3:a:duplicatepro:duplicate_page:*:*:*:*:*:wordpress:*:*,Duplicatepro,Duplicate Page
CVE-2021-24731,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06566,CWE-89,"The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpoint, leading to an SQL injection.",2021-11-08,Nuclei,cpe:2.3:a:genetechsolutions:pie_register:*:*:*:*:*:wordpress:*:*,Genetechsolutions,Pie Register
CVE-2021-24746,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02244,CWE-79,"The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the ""Enable 'More' icon"" option is enabled (which is the default setting), leading to a Reflected Cross-Site Scripting issue.",2022-03-28,Nuclei,cpe:2.3:a:heateor:sassy_social_share:*:*:*:*:*:wordpress:*:*,Heateor,Sassy Social Share
CVE-2021-24750,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.38298,CWE-89,"The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform SQL injection attacks",2021-12-21,Nuclei,cpe:2.3:a:codepress:visitor_statistics:*:*:*:*:*:wordpress:*:*,Codepress,Visitor Statistics
CVE-2021-24762,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.86896,CWE-89,"The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_question AJAX action, allowing unauthenticated users to perform SQL injection.",2022-02-01,Metasploit/Nuclei,cpe:2.3:a:getperfectsurvey:perfect_survey:*:*:*:*:*:wordpress:*:*,Getperfectsurvey,Perfect Survey
CVE-2021-24786,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.17348,CWE-89,"The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the ""orderby"" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue",2022-01-03,Nuclei,cpe:2.3:a:wpchill:download_monitor:*:*:*:*:*:wordpress:*:*,Wpchill,Download Monitor
CVE-2021-24791,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.05124,CWE-89,"The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the ""orderby"" and ""order"" request parameters before using them in a SQL statement when viewing the Snippets admin dashboard, leading to SQL injections",2021-11-08,Nuclei,cpe:2.3:a:draftpress:header_footer_code_manager:*:*:*:*:*:wordpress:*:*,Draftpress,Header Footer Code Manager
CVE-2021-24827,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.13285,CWE-89,"The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a SQL statement, leading to an unauthenticated SQL injection issue",2021-11-08,Nuclei,cpe:2.3:a:asgaros:asgaros_forum:*:*:*:*:*:wordpress:*:*,Asgaros,Asgaros Forum
CVE-2021-24838,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02208,CWE-601,"The AnyComment WordPress plugin before 0.3.5 has an API endpoint which passes user input via the redirect parameter to the wp_redirect() function without being validated first, leading to an Open Redirect issue, which according to the vendor, is a feature.",2022-01-17,Nuclei,cpe:2.3:a:bologer:anycomment:*:*:*:*:*:wordpress:*:*,Bologer,Anycomment
CVE-2021-24849,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0848,CWE-89,"The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections",2021-12-21,Nuclei,cpe:2.3:a:wclovers:frontend_manager_for_woocommerce_along_with_bookings_subscription_listings_compatible:*:*:*:*:*:wordpress:*:*,Wclovers,Frontend Manager For Woocommerce Along With Bookings Subscription Listings Compatible
CVE-2021-24862,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.73293,CWE-89,"The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches, which could lead to a SQL injection issue",2022-01-10,Metasploit/Nuclei,cpe:2.3:a:metagauss:registrationmagic:*:*:*:*:*:wordpress:*:*,Metagauss,Registrationmagic
CVE-2021-24875,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01555,CWE-79,"The eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter before outputting it back in the page in an attribute, leading to a Reflected Cross-Site Scripting issue",2021-11-23,Nuclei,cpe:2.3:a:implecode:ecommerce_product_catalog:*:*:*:*:*:wordpress:*:*,Implecode,Ecommerce Product Catalog
CVE-2021-24876,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01165,CWE-79,"The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting",2021-11-29,Nuclei,cpe:2.3:a:roundupwp:registrations_for_the_events_calendar:*:*:*:*:*:wordpress:*:*,Roundupwp,Registrations For The Events Calendar
CVE-2021-24878,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01165,CWE-79,"The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the [wpsc_create_ticket] shortcode embed, leading to a Reflected Cross-Site Scripting issue",2022-02-07,Nuclei,cpe:2.3:a:supportcandy:supportcandy:*:*:*:*:*:wordpress:*:*,Supportcandy,Supportcandy
CVE-2021-24891,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.24006,CWE-79,"The Elementor Website Builder WordPress plugin before 3.4.8 does not sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM Cross-Site Scripting issue.",2021-11-23,Nuclei,cpe:2.3:a:elementor:website_builder:*:*:*:*:*:wordpress:*:*,Elementor,Website Builder
CVE-2021-24910,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01266,CWE-79,"The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated users when the curl library is installed) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue",2022-08-22,Nuclei,cpe:2.3:a:transposh:transposh_wordpress_translation:*:*:*:*:*:wordpress:*:*,Transposh,Transposh Wordpress Translation
CVE-2021-24915,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.127,CWE-89,"The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address",2021-11-29,Nuclei,cpe:2.3:a:contest_gallery:contest_gallery:*:*:*:*:*:wordpress:*:*,Contest Gallery,Contest Gallery
CVE-2021-24916,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N,0.01548,NVD-CWE-Other,The Qubely WordPress plugin before 1.8.6 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX action.,2023-08-07,Nuclei,cpe:2.3:a:themeum:qubely:*:*:*:*:*:wordpress:*:*,Themeum,Qubely
CVE-2021-24917,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.71532,CWE-863,The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user.,2021-12-06,Metasploit/Nuclei,cpe:2.3:a:wpserveur:wps_hide_login:*:*:*:*:*:wordpress:*:*,Wpserveur,Wps Hide Login
CVE-2021-24926,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.12857,CWE-79,"The Domain Check WordPress plugin before 1.0.17 does not sanitise and escape the domain parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue",2022-02-01,Nuclei,cpe:2.3:a:domaincheckplugin:domain_check:*:*:*:*:*:wordpress:*:*,Domaincheckplugin,Domain Check
CVE-2021-24931,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.78812,CWE-89,"The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an SQL injection.",2021-12-06,Metasploit/Nuclei,cpe:2.3:a:ays-pro:secure_copy_content_protection_and_content_locking:*:*:*:*:*:wordpress:*:*,Ays-Pro,Secure Copy Content Protection And Content Locking
CVE-2021-24934,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01397,CWE-79,"The Visual CSS Style Editor WordPress plugin before 7.5.4 does not sanitise and escape the wyp_page_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue",2022-02-01,Nuclei,cpe:2.3:a:yellowpencil:visual_css_style_editor:*:*:*:*:*:wordpress:*:*,Yellowpencil,Visual Css Style Editor
CVE-2021-24940,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01477,CWE-79,"The Persian Woocommerce WordPress plugin through 5.8.0 does not escape the s parameter before outputting it back in an attribute in the admin dashboard, which could lead to a Reflected Cross-Site Scripting issue",2022-03-14,Nuclei,cpe:2.3:a:woocommerce:persian-woocommerce:*:*:*:*:*:wordpress:*:*,Woocommerce,Persian-Woocommerce
CVE-2021-24943,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07474,CWE-89,"The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL injection.",2021-12-06,Nuclei,cpe:2.3:a:roundupwp:registrations_for_the_events_calendar:*:*:*:*:*:wordpress:*:*,Roundupwp,Registrations For The Events Calendar
CVE-2021-24946,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.728,CWE-89,"The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue",2021-12-13,Metasploit/Nuclei,cpe:2.3:a:webnus:modern_events_calendar_lite:*:*:*:*:*:wordpress:*:*,Webnus,Modern Events Calendar Lite
CVE-2021-24947,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.03005,CWE-863,"The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user, such as subscriber, to read arbitrary files on the web server",2022-02-07,Nuclei,cpe:2.3:a:thinkupthemes:responsive_vector_maps:*:*:*:*:*:wordpress:*:*,Thinkupthemes,Responsive Vector Maps
CVE-2021-24956,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01669,CWE-79,"The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.8.7 does not sanitise and escape the b2sShowByDate parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue",2021-12-21,Nuclei,cpe:2.3:a:adenion:blog2social:*:*:*:*:*:wordpress:*:*,Adenion,Blog2Social
CVE-2021-24970,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.05898,CWE-22,"The All-in-One Video Gallery WordPress plugin before 2.5.0 does not sanitise and validate the tab parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue",2021-12-13,Nuclei,cpe:2.3:a:plugins360:all-in-one_video_gallery:*:*:*:*:*:wordpress:*:*,Plugins360,All-In-One Video Gallery
CVE-2021-24979,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01868,CWE-79,"The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting",2021-12-27,Nuclei,cpe:2.3:a:strangerstudios:paid_memberships_pro:*:*:*:*:*:wordpress:*:*,Strangerstudios,Paid Memberships Pro
CVE-2021-24987,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01938,CWE-79,"The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue.",2022-04-11,Nuclei,cpe:2.3:a:heateor:super_socializer:*:*:*:*:*:wordpress:*:*,Heateor,Super Socializer
CVE-2021-24991,4.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N,0.01188,CWE-79,"The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.10.5 does not escape the tab and section parameters before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in the admin dashboard",2022-01-03,Nuclei,cpe:2.3:a:wpovernight:woocommerce_pdf_invoices\&_packing_slips:*:*:*:*:*:wordpress:*:*,Wpovernight,Woocommerce Pdf Invoices& Packing Slips
CVE-2021-24997,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.02753,CWE-862,"The WP Guppy WordPress plugin before 1.3 does not have any authorisation in some of the REST API endpoints, allowing any user to call them and could lead to sensitive information disclosure, such as usernames and chats between users, as well as be able to send messages as an arbitrary user",2021-12-27,Nuclei,cpe:2.3:a:wp-guppy:wp_guppy:*:*:*:*:*:wordpress:*:*,Wp-Guppy,Wp Guppy
CVE-2021-25003,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.56148,CWE-94,"The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE",2022-03-14,Nuclei,cpe:2.3:a:wptaskforce:wpcargo_track_\&_trace:*:*:*:*:*:wordpress:*:*,Wptaskforce,Wpcargo Track & Trace
CVE-2021-25008,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02258,CWE-79,"The Code Snippets WordPress plugin before 2.14.3 does not escape the snippets-safe-mode parameter before outputting it back in attributes, leading to a Reflected Cross-Site Scripting issue",2022-01-24,Nuclei,cpe:2.3:a:codesnippets:code_snippets:*:*:*:*:*:wordpress:*:*,Codesnippets,Code Snippets
CVE-2021-25016,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01798,CWE-79,"The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting",2022-01-03,Nuclei,cpe:2.3:a:premio:chaty:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:premio:chaty_pro:*:*:*:*:*:wordpress:*:*,Premio,Chaty
CVE-2021-25028,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01932,CWE-601,"The Event Tickets WordPress plugin before 5.2.2 does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given value, leading to an arbitrary redirect issue",2022-01-24,Nuclei,cpe:2.3:a:tri:event_tickets:*:*:*:*:*:wordpress:*:*,Tri,Event Tickets
CVE-2021-25032,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06745,CWE-352,"The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to the plugin. As a result, unauthenticated attackers could update arbitrary blog options, such as the default role and make any new registered user with an administrator role.",2022-01-10,Nuclei,cpe:2.3:a:publishpress:capabilities:*:*:*:*:-:wordpress:*:*;cpe:2.3:a:publishpress:capabilities:*:*:*:*:pro:wordpress:*:*,Publishpress,Capabilities
CVE-2021-25033,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0267,CWE-601,"The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue",2022-02-14,Nuclei,cpe:2.3:a:noptin:noptin:*:*:*:*:*:wordpress:*:*,Noptin,Noptin
CVE-2021-25052,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.03435,CWE-352,"The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.",2022-01-10,Nuclei,cpe:2.3:a:wow-company:button_generator:*:*:*:*:*:wordpress:*:*,Wow-Company,Button Generator
CVE-2021-25055,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02331,CWE-79,"The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the ""visibility"" parameter.",2022-02-21,Nuclei,cpe:2.3:a:feedwordpress_project:feedwordpress:*:*:*:*:*:wordpress:*:*,Feedwordpress Project,Feedwordpress
CVE-2021-25063,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02412,CWE-79,"The Skins for Contact Form 7 WordPress plugin before 2.5.1 does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting",2022-02-01,Nuclei,cpe:2.3:a:cf7skins:contact_form_7_skins:*:*:*:*:*:wordpress:*:*,Cf7Skins,Contact Form 7 Skins
CVE-2021-25065,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01217,CWE-79,The Smash Balloon Social Post Feed WordPress plugin before 4.1.1 was affected by a reflected XSS in custom-facebook-feed in cff-top admin page.,2022-01-17,Nuclei,cpe:2.3:a:smashballoon:smash_balloon_social_post_feed:*:*:*:*:*:wordpress:*:*,Smashballoon,Smash Balloon Social Post Feed
CVE-2021-25067,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01271,CWE-79,The Landing Page Builder WordPress plugin before 1.4.9.6 was affected by a reflected XSS in page-builder-add on the ulpb_post admin page.,2022-01-17,Nuclei,cpe:2.3:a:pluginops:landing_page:*:*:*:*:*:wordpress:*:*,Pluginops,Landing Page
CVE-2021-25074,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02505,CWE-601,"The WebP Converter for Media WordPress plugin before 4.0.3 contains a file (passthru.php) which does not validate the src parameter before redirecting the user to it, leading to an Open Redirect issue",2022-01-24,Nuclei,cpe:2.3:a:webp_converter_for_media_project:webp_converter_for_media:*:*:*:*:*:wordpress:*:*,Webp Converter For Media Project,Webp Converter For Media
CVE-2021-25075,3.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N,0.01582,CWE-862,"The Duplicate Page or Post WordPress plugin before 1.5.1 does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings, or perform such attack via CSRF. Furthermore, due to the lack of escaping, this could lead to Stored Cross-Site Scripting issues",2022-02-21,Nuclei,cpe:2.3:a:wpdevart:duplicate_page_or_post:*:*:*:*:*:wordpress:*:*,Wpdevart,Duplicate Page Or Post
CVE-2021-25078,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02288,CWE-79,"The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests.",2022-01-24,Nuclei,cpe:2.3:a:wpaffiliatemanager:affiliates_manager:*:*:*:*:*:wordpress:*:*,Wpaffiliatemanager,Affiliates Manager
CVE-2021-25079,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0682,CWE-79,"The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page",2022-01-24,Nuclei,cpe:2.3:a:crmperks:contact_form_entries:*:*:*:*:*:wordpress:*:*,Crmperks,Contact Form Entries
CVE-2021-25082,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.05229,CWE-22,"The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR",2022-02-21,Nuclei,cpe:2.3:a:sygnoos:popup_builder:*:*:*:*:*:wordpress:*:*,Sygnoos,Popup Builder
CVE-2021-25085,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01651,CWE-79,"The WOOF WordPress plugin before 1.2.6.3 does not sanitise and escape the woof_redraw_elements before outputing back in an admin page, leading to a Reflected Cross-Site Scripting",2022-02-01,Nuclei,cpe:2.3:a:pluginus:woocommerce_products_filter:*:*:*:*:*:wordpress:*:*,Pluginus,Woocommerce Products Filter
CVE-2021-25094,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.83354,CWE-306,"The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot ""."", this can bypass extension control implemented in the plugin. Moreover, there is a race condition in the zip extraction process which makes the shell file live long enough on the filesystem to be callable by an attacker.",2022-04-25,Metasploit/Nuclei,cpe:2.3:a:brandexponents:tatsu:*:*:*:*:*:wordpress:*:*,Brandexponents,Tatsu
CVE-2021-25099,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02145,CWE-79,"The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action, leading to a Reflected Cross-Site Scripting",2022-02-21,Nuclei,cpe:2.3:a:givewp:givewp:*:*:*:*:*:wordpress:*:*,Givewp,Givewp
CVE-2021-25104,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01388,CWE-79,"The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue",2022-06-20,Nuclei,cpe:2.3:a:oceanwp:ocean_extra:*:*:*:*:*:wordpress:*:*,Oceanwp,Ocean Extra
CVE-2021-25111,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01908,CWE-601,"The English WordPress Admin WordPress plugin before 1.5.2 does not validate the admin_custom_language_return_url before redirecting users o it, leading to an open redirect issue",2022-04-25,Nuclei,cpe:2.3:a:english_wordpress_admin_project:english_wordpress_admin:*:*:*:*:*:wordpress:*:*,English Wordpress Admin Project,English Wordpress Admin
CVE-2021-25112,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02187,CWE-79,"The WHMCS Bridge WordPress plugin before 6.4b does not sanitise and escape the error parameter before outputting it back in admin dashboard, leading to a Reflected Cross-Site Scripting",2022-02-28,Nuclei,cpe:2.3:a:i-plugins:whmcs_bridge:*:*:*:*:*:wordpress:*:*,I-Plugins,Whmcs Bridge
CVE-2021-25114,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.81828,CWE-89,"The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection",2022-02-07,Nuclei,cpe:2.3:a:strangerstudios:paid_memberships_pro:*:*:*:*:*:wordpress:*:*,Strangerstudios,Paid Memberships Pro
CVE-2021-25118,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.05632,CWE-200,The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints which could help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities.,2022-02-28,Nuclei,cpe:2.3:a:yoast:yoast_seo:*:*:*:*:*:wordpress:*:*,Yoast,Yoast Seo
CVE-2021-25120,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02909,CWE-79,"The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX actions before outputting them back in the response, leading to Reflected Cross-Site Scripting issues",2022-04-18,Nuclei,cpe:2.3:a:easysocialfeed:easy_social_feed:*:*:*:*:free:wordpress:*:*;cpe:2.3:a:easysocialfeed:easy_social_feed:*:*:*:*:pro:wordpress:*:*,Easysocialfeed,Easy Social Feed
CVE-2021-25161,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.16372,CWE-79,A remote cross-site scripting (xss) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and below; Aruba Instant 8.7.x: 8.7.1.1 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.,2021-03-30,Nuclei,cpe:2.3:h:siemens:scalance_w1750d:-:*:*:*:*:*:*:*;cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:scalance_w1750d_firmware:*:*:*:*:*:*:*:*,Siemens,Scalance W1750D Firmware
CVE-2021-25281,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.72945,CWE-287,"An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.",2021-02-27,Metasploit/Nuclei,cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-25282,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H,0.92312,CWE-22,An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.,2021-02-27,Metasploit,cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-25296,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.71536,NVD-CWE-Other,"Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.",2021-02-15,CISA/Metasploit/Nuclei,cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*,Nagios,Nagios Xi
CVE-2021-25297,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.56384,NVD-CWE-Other,"Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.",2021-02-15,CISA/Metasploit/Nuclei,cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*,Nagios,Nagios Xi
CVE-2021-25298,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.74979,NVD-CWE-Other,"Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.",2021-02-15,CISA/Metasploit/Nuclei,cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*,Nagios,Nagios Xi
CVE-2021-25299,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.97714,CWE-79,"Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs to get one-click remote command execution (RCE) on the Nagios XI server.",2021-02-15,EPSS/Nuclei,cpe:2.3:a:nagios:nagios_xi:5.7.5:*:*:*:*:*:*:*,Nagios,Nagios Xi
CVE-2021-25337,4.4,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N,0.02831,CWE-269,Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.,2021-03-04,CISA,cpe:2.3:o:samsung:android:10.0:smr-apr-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-aug-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-dec-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-dec-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-feb-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-jan-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-jan-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-jul-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-jun-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-mar-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-may-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-nov-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-nov-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-oct-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-sep-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-dec-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-jan-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-apr-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-apr-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-aug-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-aug-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-dec-2018-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-dec-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-dec-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-feb-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-feb-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jan-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jan-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jan-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jul-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jul-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jun-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jun-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-mar-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-mar-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-may-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-may-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-nov-2018-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-nov-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-nov-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-oct-2018-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-oct-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-oct-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-sep-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-sep-2020-r1:*:*:*:*:*:*,Samsung,Android
CVE-2021-25369,6.2,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01121,CWE-200,An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace.,2021-03-26,CISA,cpe:2.3:o:samsung:android:10.0:smr-apr-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-aug-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-dec-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-dec-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-feb-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-jan-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-jan-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-jul-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-jun-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-mar-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-may-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-nov-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-nov-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-oct-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-sep-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:8.0:-:*:*:*:*:*:*;cpe:2.3:o:samsung:android:8.1:-:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-apr-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-apr-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-aug-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-aug-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-dec-2018-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-dec-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-dec-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-feb-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-feb-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jan-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jan-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jan-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jul-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jul-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jun-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jun-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-mar-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-mar-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-may-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-may-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-nov-2018-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-nov-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-nov-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-oct-2018-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-oct-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-oct-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-sep-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-sep-2020-r1:*:*:*:*:*:*,Samsung,Android
CVE-2021-25370,6.1,CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H,0.0089,CWE-416,An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic.,2021-03-26,CISA,cpe:2.3:o:samsung:android:10.0:smr-apr-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-aug-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-dec-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-dec-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-feb-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-jan-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-jan-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-jul-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-jun-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-mar-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-may-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-nov-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-nov-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-oct-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-sep-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-dec-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-jan-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:8.0:-:*:*:*:*:*:*;cpe:2.3:o:samsung:android:8.1:-:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-apr-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-apr-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-aug-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-aug-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-dec-2018-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-dec-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-dec-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-feb-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-feb-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jan-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jan-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jan-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jul-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jul-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jun-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jun-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-mar-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-mar-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-may-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-may-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-nov-2018-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-nov-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-nov-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-oct-2018-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-oct-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-oct-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-sep-2019-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-sep-2020-r1:*:*:*:*:*:*,Samsung,Android
CVE-2021-25371,6.1,CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H,0.00802,CWE-912,A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.,2021-03-26,CISA,cpe:2.3:h:samsung:exynos_2100:-:*:*:*:*:*:*:*;cpe:2.3:h:samsung:exynos_980:-:*:*:*:*:*:*:*;cpe:2.3:h:samsung:exynos_9830:-:*:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-jan-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-jan-2021-r1:*:*:*:*:*:*,Samsung,Android
CVE-2021-25372,6.1,CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H,0.00804,CWE-787,An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.,2021-03-26,CISA,cpe:2.3:h:samsung:exynos_2100:-:*:*:*:*:*:*:*;cpe:2.3:h:samsung:exynos_980:-:*:*:*:*:*:*:*;cpe:2.3:h:samsung:exynos_9830:-:*:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-jan-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-jan-2021-r1:*:*:*:*:*:*,Samsung,Android
CVE-2021-25394,6.4,CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H,0.00401,CWE-416,A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radio privilege is compromised.,2021-06-11,CISA,cpe:2.3:o:samsung:android:10.0:smr-apr-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-jan-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-apr-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-jan-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-jul-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:8.1:-:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-apr-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jan-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-mar-2021-r1:*:*:*:*:*:*,Samsung,Android
CVE-2021-25395,6.4,CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H,0.00366,CWE-362,A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised.,2021-06-11,CISA,cpe:2.3:o:samsung:android:10.0:smr-apr-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-jan-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-apr-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-jan-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-jul-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:8.1:-:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-apr-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jan-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-mar-2021-r1:*:*:*:*:*:*,Samsung,Android
CVE-2021-25487,7.3,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N,0.00597,CWE-125,Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invalid function pointer.,2021-10-06,CISA,cpe:2.3:o:samsung:android:10.0:smr-apr-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-aug-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-jan-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-jul-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-jun-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-mar-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-may-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-sep-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-apr-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-aug-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-jan-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-jul-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-jun-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-mar-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-may-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-sep-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:8.1:-:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-apr-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-aug-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jan-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jul-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jun-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-mar-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-may-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-sep-2021-r1:*:*:*:*:*:*,Samsung,Android
CVE-2021-25489,3.3,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L,0.00499,CWE-20,"Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic.",2021-10-06,CISA,cpe:2.3:o:samsung:android:10.0:smr-apr-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-aug-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-jan-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-jul-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-jun-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-mar-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-may-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:10.0:smr-sep-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-apr-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-aug-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-jan-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-jul-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-jun-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-mar-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-may-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-sep-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:8.1:-:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-apr-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-aug-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jan-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jul-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-jun-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-mar-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-may-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:9.0:smr-sep-2021-r1:*:*:*:*:*:*,Samsung,Android
CVE-2021-25646,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.99301,NVD-CWE-noinfo,"Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.",2021-01-29,EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:*,Apache,Druid
CVE-2021-25864,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.09331,CWE-22,"node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary file.",2021-01-26,Nuclei,cpe:2.3:a:dgtl:huemagic:3.0.0:*:*:*:*:node.js:*:*,Dgtl,Huemagic
CVE-2021-25899,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.12245,CWE-89,An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. An unauthenticated attacker can send a crafted HTTP request to perform a blind time-based SQL Injection. The vulnerable parameter is param1.,2021-04-23,Nuclei,cpe:2.3:a:void:aurall_rec_monitor:9.0.0.1:*:*:*:*:*:*:*,Void,Aurall Rec Monitor
CVE-2021-26072,4.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N,0.38845,CWE-918,The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the content of internal network resources via a blind Server-Side Request Forgery (SSRF) vulnerability.,2021-04-01,Nuclei,cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*,Atlassian,Confluence Data Center
CVE-2021-26084,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99999,CWE-917,"In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.",2021-08-30,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*,Atlassian,Confluence Data Center
CVE-2021-26085,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.99937,CWE-425,"Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.",2021-08-03,CISA/EPSS/Nuclei,cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*,Atlassian,Confluence Data Center
CVE-2021-26086,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.99999,CWE-22,"Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.",2021-08-16,CISA/EPSS/Nuclei,cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*,Atlassian,Jira Data Center
CVE-2021-26247,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.07124,CWE-79,"As an unauthenticated remote user, visit ""http://<CACTI_SERVER>/auth_changepassword.php?ref=<script>alert(1)</script>"" to successfully execute the JavaScript payload present in the ""ref"" URL parameter.",2022-01-19,Nuclei,cpe:2.3:a:cacti:cacti:0.8.7g:*:*:*:*:*:*:*,Cacti,Cacti
CVE-2021-26294,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.16899,CWE-22,"An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such as a data/settings/settings.xml file containing admin panel credentials), as demonstrated by dav/server.php/files/personal/%2e%2e when using the caldav_public_user account (with caldav_public_user as its password).",2021-03-07,Nuclei,cpe:2.3:a:afterlogic:aurora:*:*:*:*:*:*:*:*;cpe:2.3:a:afterlogic:webmail_pro:*:*:*:*:*:*:*:*,Afterlogic,Aurora
CVE-2021-26295,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97822,CWE-502,Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.,2021-03-22,EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*,Apache,Ofbiz
CVE-2021-26411,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L,0.80667,CWE-416,Internet Explorer Memory Corruption Vulnerability,2021-03-11,CISA,cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2021-26475,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.07326,CWE-79,EPrints 3.4.2 exposes a reflected XSS opportunity in the via a cgi/cal URI.,2021-03-01,Nuclei,cpe:2.3:a:eprints:eprints:3.4.2:*:*:*:*:*:*:*,Eprints,Eprints
CVE-2021-26598,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.10528,CWE-287,"ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have a security token).",2022-03-28,Nuclei,cpe:2.3:a:impresscms:impresscms:*:*:*:*:*:*:*:*,Impresscms,Impresscms
CVE-2021-26599,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.21509,CWE-89,ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.,2022-03-28,Nuclei,cpe:2.3:a:impresscms:impresscms:*:*:*:*:*:*:*:*,Impresscms,Impresscms
CVE-2021-26702,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03072,CWE-79,EPrints 3.4.2 exposes a reflected XSS opportunity in the dataset parameter to the cgi/dataset_dictionary URI.,2021-03-01,Nuclei,cpe:2.3:a:eprints:eprints:3.4.2:*:*:*:*:*:*:*,Eprints,Eprints
CVE-2021-26710,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.075,CWE-79,A cross-site scripting (XSS) issue in the login panel in Redwood Report2Web 4.3.4.5 and 4.5.3 allows remote attackers to inject JavaScript via the signIn.do urll parameter.,2021-02-05,Nuclei,cpe:2.3:a:redwood:report2web:4.3.4.5:*:*:*:*:*:*:*;cpe:2.3:a:redwood:report2web:4.5.3:*:*:*:*:*:*:*,Redwood,Report2Web
CVE-2021-26723,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.12578,CWE-79,Jenzabar 9.2.x through 9.2.2 allows /ics?tool=search&query= XSS.,2021-02-06,Nuclei,cpe:2.3:a:jenzabar:jenzabar:*:*:*:*:*:*:*:*,Jenzabar,Jenzabar
CVE-2021-26812,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.97461,CWE-79,"Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the ""sessionpriv.php"" module. This allows attackers to craft a malicious URL, which when clicked on by users, can inject javascript code to be run by the application.",2021-04-14,EPSS/Nuclei,cpe:2.3:a:jitsi:meet:*:*:*:*:*:moodle:*:*,Jitsi,Meet
CVE-2021-26828,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.39356,CWE-434,OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.,2021-06-11,CISA,cpe:2.3:a:scadabr:scadabr:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2021-26829,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.4805,CWE-79,OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.,2021-06-11,CISA,cpe:2.3:a:scadabr:scadabr:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2021-26855,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.99999,CWE-918,Microsoft Exchange Server Remote Code Execution Vulnerability,2021-03-03,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_21:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_22:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2021-26857,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.94008,CWE-502,Microsoft Exchange Server Remote Code Execution Vulnerability,2021-03-03,CISA,cpe:2.3:a:microsoft:exchange_server:2010:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_22:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2021-26858,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.89509,NVD-CWE-noinfo,Microsoft Exchange Server Remote Code Execution Vulnerability,2021-03-03,CISA,cpe:2.3:a:microsoft:exchange_server:2010:sp3:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_22:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2021-26914,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.77673,CWE-502,NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in MvcUtil valueStringToObject.,2021-02-08,Metasploit,cpe:2.3:a:netmotionsoftware:netmotion_mobility:*:*:*:*:*:*:*:*,Netmotionsoftware,Netmotion Mobility
CVE-2021-26947,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0141,CWE-79,"Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via a crafted link.",2023-04-25,Nuclei,cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*;cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*,Odoo,Odoo
CVE-2021-27059,7.6,CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H,0.03182,NVD-CWE-noinfo,Microsoft Office Remote Code Execution Vulnerability,2021-03-11,CISA,cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2013:sp1:*:*:rt:*:*:*;cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*,Microsoft,Office
CVE-2021-27065,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.99946,CWE-22,Microsoft Exchange Server Remote Code Execution Vulnerability,2021-03-03,CISA/EPSS/Metasploit,cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_21:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2021-27085,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L,0.03708,NVD-CWE-noinfo,Internet Explorer Remote Code Execution Vulnerability,2021-03-11,CISA,cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1803
CVE-2021-27101,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05998,NVD-CWE-Other,Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.,2021-02-16,CISA,cpe:2.3:a:accellion:fta:*:*:*:*:*:*:*:*,Accellion,Fta
CVE-2021-27102,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03624,CWE-78,Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later.,2021-02-16,CISA,cpe:2.3:a:accellion:fta:*:*:*:*:*:*:*:*,Accellion,Fta
CVE-2021-27103,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.11315,CWE-918,Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.,2021-02-16,CISA,cpe:2.3:a:accellion:fta:*:*:*:*:*:*:*:*,Accellion,Fta
CVE-2021-27104,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.56411,CWE-78,Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.,2021-02-16,CISA,cpe:2.3:a:accellion:fta:*:*:*:*:*:*:*:*,Accellion,Fta
CVE-2021-27124,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.05721,CWE-89,SQL injection in the expertise parameter in search_result.php in Doctor Appointment System v1.0 allows an authenticated patient user to dump the database credentials via a SQL injection attack.,2021-02-18,Nuclei,cpe:2.3:a:doctor_appointment_system_project:doctor_appointment_system:1.0:*:*:*:*:*:*:*,Doctor Appointment System Project,Doctor Appointment System
CVE-2021-27132,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.16062,CWE-74,SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header.,2021-02-27,Nuclei,cpe:2.3:h:sercomm:agcombo_vd625:-:*:*:*:*:*:*:*;cpe:2.3:o:sercomm:agcombo_vd625_firmware:agsot_2.1.0:*:*:*:*:*:*:*,Sercomm,Agcombo Vd625 Firmware
CVE-2021-27137,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.10809,CWE-121,"An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).",2026-07-16,CISA,cpe:2.3:o:dd-wrt:dd-wrt:*:*:*:*:*:*:*:*,Dd-Wrt,Dd-Wrt
CVE-2021-27309,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01977,CWE-79,"Clansphere CMS 2011.4 allows unauthenticated reflected XSS via ""module"" parameter.",2021-03-23,Nuclei,cpe:2.3:a:csphere:clansphere:2011.4:*:*:*:*:*:*:*,Csphere,Clansphere
CVE-2021-27310,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02816,CWE-79,"Clansphere CMS 2011.4 allows unauthenticated reflected XSS via ""language"" parameter.",2021-03-23,Nuclei,cpe:2.3:a:csphere:clansphere:2011.4:*:*:*:*:*:*:*,Csphere,Clansphere
CVE-2021-27314,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.12394,CWE-89,SQL injection in admin.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via username parameter at login page.,2021-03-05,Nuclei,cpe:2.3:a:doctor_appointment_system_project:doctor_appointment_system:1.0:*:*:*:*:*:*:*,Doctor Appointment System Project,Doctor Appointment System
CVE-2021-27315,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.07826,CWE-89,Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via the comment parameter.,2021-03-24,Nuclei,cpe:2.3:a:doctor_appointment_system_project:doctor_appointment_system:1.0:*:*:*:*:*:*:*,Doctor Appointment System Project,Doctor Appointment System
CVE-2021-27316,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.07826,CWE-89,Blind SQL injection in contactus.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via lastname parameter.,2021-03-24,Nuclei,cpe:2.3:a:doctor_appointment_system_project:doctor_appointment_system:1.0:*:*:*:*:*:*:*,Doctor Appointment System Project,Doctor Appointment System
CVE-2021-27319,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.07826,CWE-89,Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via email parameter.,2021-03-24,Nuclei,cpe:2.3:a:doctor_appointment_system_project:doctor_appointment_system:1.0:*:*:*:*:*:*:*,Doctor Appointment System Project,Doctor Appointment System
CVE-2021-27320,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.09299,CWE-89,Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via firstname parameter.,2021-03-24,Nuclei,cpe:2.3:a:doctor_appointment_system_project:doctor_appointment_system:1.0:*:*:*:*:*:*:*,Doctor Appointment System Project,Doctor Appointment System
CVE-2021-27330,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.06196,CWE-79,"Triconsole Datepicker Calendar <3.77 is affected by cross-site scripting (XSS) in calendar_form.php. Attackers can read authentication cookies that are still active, which can be used to perform further attacks such as reading browser history, directory listings, and file contents.",2021-02-25,Nuclei,cpe:2.3:a:triconsole:datepicker_calendar:*:*:*:*:*:*:*:*,Triconsole,Datepicker Calendar
CVE-2021-27358,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.83042,NVD-CWE-noinfo,The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.,2021-03-18,Nuclei,cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*,Grafana,Grafana
CVE-2021-27519,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.07604,CWE-79,"A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the ""srch"" parameter.",2021-03-19,Nuclei,cpe:2.3:a:fudforum:fudforum:3.1.0:*:*:*:*:*:*:*,Fudforum,Fudforum
CVE-2021-27520,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.06396,CWE-79,"A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the ""author"" parameter.",2021-03-19,Nuclei,cpe:2.3:a:fudforum:fudforum:3.1.0:*:*:*:*:*:*:*,Fudforum,Fudforum
CVE-2021-27561,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.82516,CWE-78,"Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication.",2021-10-15,CISA/Nuclei,cpe:2.3:a:yealink:device_management:*:*:*:*:*:*:*:*,Yealink,Device Management
CVE-2021-27562,5.5,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H,0.03093,CWE-787,"In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure data when calling secure functions under the NSPE handler mode.",2021-05-25,CISA,cpe:2.3:o:trustedfirmware:trusted_firmware-m:*:*:*:*:*:*:*:*,Trustedfirmware,Trusted Firmware-M
CVE-2021-27651,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.53841,CWE-287,"In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks.",2021-04-29,Nuclei,cpe:2.3:a:pega:infinity:*:*:*:*:*:*:*:*,Pega,Infinity
CVE-2021-27670,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.61274,CWE-918,Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter.,2021-02-25,Nuclei,cpe:2.3:a:appspace:appspace:6.2.4:*:*:*:*:*:*:*,Appspace,Appspace
CVE-2021-27850,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.93802,CWE-200,"A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. An attacker was able to download the file `AppModule.class` by requesting the URL `http://localhost:8080/assets/something/services/AppModule.class` which contains a HMAC secret key. The fix for that bug was a blacklist filter that checks if the URL ends with `.class`, `.properties` or `.xml`. Bypass: Unfortunately, the blacklist solution can simply be bypassed by appending a `/` at the end of the URL: `http://localhost:8080/assets/something/services/AppModule.class/` The slash is stripped after the blacklist check and the file `AppModule.class` is loaded into the response. This class usually contains the HMAC secret key which is used to sign serialized Java objects. With the knowledge of that key an attacker can sign a Java gadget chain that leads to RCE (e.g. CommonsBeanUtils1 from ysoserial). Solution for this vulnerability: * For Apache Tapestry 5.4.0 to 5.6.1, upgrade to 5.6.2 or later. * For Apache Tapestry 5.7.0, upgrade to 5.7.1 or later.",2021-04-15,Metasploit/Nuclei,cpe:2.3:a:apache:tapestry:*:*:*:*:*:*:*:*,Apache,Tapestry
CVE-2021-27852,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.31946,CWE-502,Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.,2021-05-27,CISA,cpe:2.3:a:checkbox:survey:*:*:*:*:*:*:*:*,Checkbox,Survey
CVE-2021-27856,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05598,NVD-CWE-Other,"FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 includes an account named ""cmuser"" that has administrative privileges and no password. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA002.",2021-12-15,Nuclei,cpe:2.3:h:fatpipeinc:ipvpn:-:*:*:*:*:*:*:*;cpe:2.3:h:fatpipeinc:mpvpn:-:*:*:*:*:*:*:*;cpe:2.3:h:fatpipeinc:warp:-:*:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p10:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p13:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p32:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p35:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p45:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p55:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p58:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p58s1:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p65:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p71:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p82:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.2.2:r10:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.2.2:r25:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.2.2:r38:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:5.2.0:r34:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:6.1.2:r70p26:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:6.1.2:r70p45-m:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:6.1.2:r70p75-m:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:7.1.2:r39:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r129:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r144:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r150:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r156:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r161p12:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r161p16:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r161p17:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r161p20:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r161p26:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r161p2:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r161p3:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r164:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r164p4:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r164p5:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r165:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r180p2:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r185:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p10:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p13:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p32:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p35:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p45:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p55:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p58:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p58s1:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p65:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p71:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p82:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.2.2:r10:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.2.2:r25:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.2.2:r38:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:5.2.0:r34:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:6.1.2:r70p26:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:6.1.2:r70p45-m:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:6.1.2:r70p75-m:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:7.1.2:r39:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r129:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r144:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r150:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r156:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r161p12:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r161p16:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r161p17:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r161p20:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r161p26:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r161p2:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r161p3:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r164:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r164p4:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r164p5:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r165:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r180p2:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r185:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p10:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p13:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p32:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p35:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p45:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p55:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p58:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p58s1:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p65:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p71:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p82:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.2.2:r10:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.2.2:r25:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.2.2:r38:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:5.2.0:r34:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:6.1.2:r70p26:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:6.1.2:r70p45-m:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:6.1.2:r70p75-m:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:7.1.2:r39:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r129:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r144:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r150:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r156:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r161p12:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r161p16:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r161p17:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r161p20:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r161p26:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r161p2:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r161p3:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r164:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r164p4:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r164p5:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r165:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r180p2:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r185:*:*:*:*:*:*,Fatpipeinc,Ipvpn Firmware
CVE-2021-27858,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.02703,CWE-862,"A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote attacker to access at least the URL ""/fpui/jsp/index.jsp"" leading to unknown impact, presumably some violation of confidentiality. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA004.",2021-12-15,Nuclei,cpe:2.3:h:fatpipeinc:ipvpn:-:*:*:*:*:*:*:*;cpe:2.3:h:fatpipeinc:mpvpn:-:*:*:*:*:*:*:*;cpe:2.3:h:fatpipeinc:warp:-:*:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p10:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p13:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p32:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p35:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p45:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p55:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p58:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p58s1:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p65:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p71:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p82:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.2.2:r10:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.2.2:r25:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.2.2:r38:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:5.2.0:r34:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:6.1.2:r70p26:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:6.1.2:r70p45-m:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:6.1.2:r70p75-m:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:7.1.2:r39:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r129:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r144:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r150:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r156:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r161p12:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r161p16:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r161p17:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r161p20:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r161p26:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r161p2:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r161p3:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r164:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r164p4:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r164p5:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r165:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r180p2:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r185:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p10:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p13:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p32:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p35:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p45:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p55:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p58:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p58s1:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p65:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p71:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p82:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.2.2:r10:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.2.2:r25:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.2.2:r38:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:5.2.0:r34:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:6.1.2:r70p26:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:6.1.2:r70p45-m:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:6.1.2:r70p75-m:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:7.1.2:r39:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r129:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r144:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r150:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r156:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r161p12:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r161p16:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r161p17:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r161p20:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r161p26:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r161p2:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r161p3:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r164:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r164p4:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r164p5:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r165:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r180p2:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r185:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p10:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p13:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p32:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p35:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p45:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p55:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p58:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p58s1:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p65:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p71:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p82:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.2.2:r10:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.2.2:r25:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.2.2:r38:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:5.2.0:r34:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:6.1.2:r70p26:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:6.1.2:r70p45-m:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:6.1.2:r70p75-m:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:7.1.2:r39:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r129:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r144:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r150:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r156:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r161p12:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r161p16:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r161p17:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r161p20:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r161p26:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r161p2:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r161p3:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r164:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r164p4:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r164p5:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r165:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r180p2:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r185:*:*:*:*:*:*,Fatpipeinc,Ipvpn Firmware
CVE-2021-27860,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.39824,CWE-434,"A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. The FatPipe advisory identifier for this vulnerability is FPSA006.",2021-12-08,CISA,cpe:2.3:h:fatpipeinc:ipvpn:-:*:*:*:*:*:*:*;cpe:2.3:h:fatpipeinc:mpvpn:-:*:*:*:*:*:*:*;cpe:2.3:h:fatpipeinc:warp:-:*:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p10:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p13:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p32:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p35:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p45:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p55:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p58:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p58s1:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p65:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p71:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.1.2:r60p82:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.2.2:r10:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.2.2:r25:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:10.2.2:r38:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:5.2.0:r34:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:6.1.2:r70p26:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:6.1.2:r70p45-m:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:6.1.2:r70p75-m:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:7.1.2:r39:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r129:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r144:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r150:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r156:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r161p12:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r161p16:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r161p17:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r161p20:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r161p26:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r161p2:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r161p3:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r164:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r164p4:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r164p5:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r165:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r180p2:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:ipvpn_firmware:9.1.2:r185:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p10:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p13:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p32:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p35:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p45:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p55:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p58:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p58s1:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p65:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p71:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.1.2:r60p82:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.2.2:r10:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.2.2:r25:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:10.2.2:r38:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:5.2.0:r34:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:6.1.2:r70p26:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:6.1.2:r70p45-m:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:6.1.2:r70p75-m:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:7.1.2:r39:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r129:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r144:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r150:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r156:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r161p12:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r161p16:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r161p17:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r161p20:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r161p26:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r161p2:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r161p3:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r164:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r164p4:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r164p5:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r165:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r180p2:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:mpvpn_firmware:9.1.2:r185:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p10:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p13:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p32:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p35:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p45:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p55:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p58:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p58s1:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p65:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p71:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.1.2:r60p82:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.2.2:r10:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.2.2:r25:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:10.2.2:r38:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:5.2.0:r34:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:6.1.2:r70p26:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:6.1.2:r70p45-m:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:6.1.2:r70p75-m:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:7.1.2:r39:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r129:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r144:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r150:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r156:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r161p12:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r161p16:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r161p17:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r161p20:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r161p26:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r161p2:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r161p3:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r164:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r164p4:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r164p5:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r165:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r180p2:*:*:*:*:*:*;cpe:2.3:o:fatpipeinc:warp_firmware:9.1.2:r185:*:*:*:*:*:*,Fatpipeinc,Ipvpn Firmware
CVE-2021-27876,8.1,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N,0.13411,NVD-CWE-noinfo,"An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. By using crafted input parameters in one of these commands, an attacker can access an arbitrary file on the system using System privileges.",2021-03-01,CISA/Metasploit,cpe:2.3:a:veritas:backup_exec:*:*:*:*:*:*:*:*,Veritas,Backup Exec
CVE-2021-27877,8.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N,0.6491,NVD-CWE-noinfo,"An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands.",2021-03-01,CISA/Metasploit/Nuclei,cpe:2.3:a:veritas:backup_exec:*:*:*:*:*:*:*:*,Veritas,Backup Exec
CVE-2021-27878,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.23952,NVD-CWE-noinfo,"An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. The attacker could use one of these commands to execute an arbitrary command on the system using system privileges.",2021-03-01,CISA/Metasploit,cpe:2.3:a:veritas:backup_exec:*:*:*:*:*:*:*:*,Veritas,Backup Exec
CVE-2021-27905,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.93053,CWE-918,"The ReplicationHandler (normally registered at ""/replication"" under a Solr core) in Apache Solr has a ""masterUrl"" (also ""leaderUrl"" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the ""shards"" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.",2021-04-13,Nuclei,cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*,Apache,Solr
CVE-2021-27909,6.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L,0.04067,CWE-79,"For Mautic versions prior to 3.3.4/4.0.0, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, ""bundle,"" in the URL could allow an attacker to execute Javascript code. The attacker would be required to convince or trick the target into clicking a password reset URL with the vulnerable parameter utilized.",2021-08-30,Nuclei,cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*;cpe:2.3:a:acquia:mautic:4.0.0:alpha1:*:*:*:*:*:*;cpe:2.3:a:acquia:mautic:4.0.0:beta:*:*:*:*:*:*;cpe:2.3:a:acquia:mautic:4.0.0:rc:*:*:*:*:*:*,Acquia,Mautic
CVE-2021-27931,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H,0.18132,CWE-611,LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service.,2021-03-03,Nuclei,cpe:2.3:a:lumis:lumis_experience_platform:*:*:*:*:*:*:*:*,Lumis,Lumis Experience Platform
CVE-2021-27964,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.4845,CWE-434,SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload. An attacker can send a POST request to /Config/SaveUploadedHotspotLogoFile without any authentication or session header. There is no check for the file extension or content of the uploaded file.,2021-03-05,Nuclei,cpe:2.3:a:sfcyazilim:sonlogger:*:*:*:*:*:*:*:*,Sfcyazilim,Sonlogger
CVE-2021-28149,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.1592,CWE-22,"Hongdian H8922 3.0.5 devices allow Directory Traversal. The /log_download.cgi log export handler does not validate user input and allows a remote attacker with minimal privileges to download any file from the device by substituting ../ (e.g., ../../etc/passwd) This can be carried out with a web browser by changing the file name accordingly. Upon visiting log_download.cgi?type=../../etc/passwd and logging in, the web server will allow a download of the contents of the /etc/passwd file.",2021-05-06,Nuclei,cpe:2.3:h:hongdian:h8922:-:*:*:*:*:*:*:*;cpe:2.3:o:hongdian:h8922_firmware:3.0.5:*:*:*:*:*:*:*,Hongdian,H8922 Firmware
CVE-2021-28150,5.5,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.02794,CWE-425,Hongdian H8922 3.0.5 devices allow the unprivileged guest user to read cli.conf (with the administrator password and other sensitive data) via /backup2.cgi.,2021-05-06,Nuclei,cpe:2.3:h:hongdian:h8922:-:*:*:*:*:*:*:*;cpe:2.3:o:hongdian:h8922_firmware:3.0.5:*:*:*:*:*:*:*,Hongdian,H8922 Firmware
CVE-2021-28151,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.27912,CWE-78,"Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) field to the tools.cgi ping command, which is accessible with the username guest and password guest.",2021-05-06,Nuclei,cpe:2.3:h:hongdian:h8922:-:*:*:*:*:*:*:*;cpe:2.3:o:hongdian:h8922_firmware:3.0.5:*:*:*:*:*:*:*,Hongdian,H8922 Firmware
CVE-2021-28164,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.82371,CWE-200,"In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.",2021-04-01,Metasploit/Nuclei,cpe:2.3:a:eclipse:jetty:9.4.37:20210219:*:*:*:*:*:*;cpe:2.3:a:eclipse:jetty:9.4.38:20210224:*:*:*:*:*:*;cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*;cpe:2.3:a:netapp:element_plug-in_for_vcenter_server:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:santricity_cloud_connector:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:snapcenter_plug-in:-:*:*:*:*:vmware_vsphere:*:*;cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:*:*:*:*:*:vmware_vsphere:*:*;cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vmware_vsphere:*:*;cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:siebel_core_-_automation:*:*:*:*:*:*:*:*,Eclipse,Jetty
CVE-2021-28169,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.7848,CWE-200,"For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.",2021-06-09,Nuclei,cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*;cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2021-28310,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.0833,CWE-787,Win32k Elevation of Privilege Vulnerability,2021-04-13,CISA,cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_1909:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2004:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1803
CVE-2021-28377,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.08389,CWE-22,ChronoForums 2.0.11 allows av Directory Traversal to read arbitrary files.,2022-01-12,Nuclei,cpe:2.3:a:chronoengine:chronoforums:2.0.11:*:*:*:*:joomla:*:*,Chronoengine,Chronoforums
CVE-2021-28480,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.71425,NVD-CWE-noinfo,Microsoft Exchange Server Remote Code Execution Vulnerability,2021-04-13,Nuclei,cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_20:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_9:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2021-28481,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.36486,NVD-CWE-noinfo,Microsoft Exchange Server Remote Code Execution Vulnerability,2021-04-13,Nuclei,cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_20:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_9:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2021-28550,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.52005,CWE-416,"Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",2021-09-02,CISA,cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:*;cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*;cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:*;cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2021-28663,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.12084,CWE-416,"The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-after-free. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r4p0 through r30p0.",2021-05-10,CISA,cpe:2.3:a:arm:bifrost_gpu_kernel_driver:*:*:*:*:*:*:*:*;cpe:2.3:a:arm:midgard_gpu_kernel_driver:*:*:*:*:*:*:*:*;cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:*,Arm,Bifrost Gpu Kernel Driver
CVE-2021-28664,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.05464,CWE-787,"The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achieve read/write access to read-only pages. This affects Bifrost r0p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r8p0 through r30p0 before r31p0.",2021-05-10,CISA,cpe:2.3:a:arm:bifrost_gpu_kernel_driver:*:*:*:*:*:*:*:*;cpe:2.3:a:arm:midgard_gpu_kernel_driver:*:*:*:*:*:*:*:*;cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:*,Arm,Bifrost Gpu Kernel Driver
CVE-2021-28799,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.7825,CWE-285,"An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .",2021-05-13,CISA/Nuclei,cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.4:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.5.2:*:*:*:*:*:*:*;cpe:2.3:o:qnap:quts_hero:h4.5.1:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*,Qnap,Qts
CVE-2021-28918,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.16657,CWE-704,"Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.",2021-04-01,Nuclei,cpe:2.3:a:netmask_project:netmask:*:*:*:*:*:node.js:*:*,Netmask Project,Netmask
CVE-2021-28937,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04121,CWE-312,The /password.html page of the Web management interface of the Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) contains the administrator account password in plaintext. The page can be intercepted on HTTP.,2021-03-29,Nuclei,cpe:2.3:h:acexy:wireless-n_wifi_repeater:1.0:*:*:*:*:*:*:*;cpe:2.3:o:acexy:wireless-n_wifi_repeater_firmware:28.08.06.1:*:*:*:*:*:*:*,Acexy,Wireless-N Wifi Repeater Firmware
CVE-2021-29006,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.05471,CWE-22,rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any file on the server.,2021-10-11,Nuclei,cpe:2.3:a:rconfig:rconfig:3.9.6:*:*:*:*:*:*:*,Rconfig,Rconfig
CVE-2021-29133,5.5,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.01082,NVD-CWE-noinfo,"Lack of verification in haserl, a component of Alpine Linux Configuration Framework, before 0.9.36 allows local users to read the contents of any file on the filesystem.",2021-03-24,Metasploit,cpe:2.3:a:haserl_project:haserl:*:*:*:*:*:*:*:*,Haserl Project,Haserl
CVE-2021-29156,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.76385,CWE-74,"ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key.",2021-03-25,Nuclei,cpe:2.3:a:forgerock:openam:*:*:*:*:*:*:*:*,Forgerock,Openam
CVE-2021-29200,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.5537,CWE-502,Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack,2021-04-27,Nuclei,cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*,Apache,Ofbiz
CVE-2021-29203,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.68293,CWE-306,"A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software, prior to version 1.22. The vulnerability could be remotely exploited to bypass remote authentication leading to execution of arbitrary commands, gaining privileged access, causing denial of service, and changing the configuration. HPE has released a software update to resolve the vulnerability in the HPE Edgeline Infrastructure Manager.",2021-05-06,Nuclei,cpe:2.3:a:hp:edgeline_infrastructure_manager:*:*:*:*:*:*:*:*,Hp,Edgeline Infrastructure Manager
CVE-2021-29256,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.0302,CWE-416,". The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation. This affects Bifrost r16p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r28p0 through r30p0.",2021-05-24,CISA,cpe:2.3:a:arm:bifrost_gpu_kernel_driver:*:*:*:*:*:*:*:*;cpe:2.3:a:arm:midgard_gpu_kernel_driver:*:*:*:*:*:*:*:*;cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:*,Arm,Bifrost Gpu Kernel Driver
CVE-2021-29441,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.74242,CWE-290,"Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any administrative tasks on the Nacos server.",2021-04-27,Nuclei,cpe:2.3:a:alibaba:nacos:*:*:*:*:*:*:*:*,Alibaba,Nacos
CVE-2021-29442,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.64697,CWE-306,"Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)",2021-04-27,Nuclei,cpe:2.3:a:alibaba:nacos:*:*:*:*:*:*:*:*,Alibaba,Nacos
CVE-2021-29449,6.3,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L,0.01863,CWE-269,Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities were discovered in version 5.2.4 of Pi-hole core. See the referenced GitHub security advisory for details.,2021-04-14,Metasploit,cpe:2.3:a:pi-hole:pi-hole:*:*:*:*:*:*:*:*,Pi-Hole,Pi-Hole
CVE-2021-29484,6.8,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N,0.07935,CWE-79,"Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and may not know they've visited a malicious site. Ghost(Pro) has already been patched. We can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. Self-hosters are impacted if running Ghost a version between 4.0.0 and 4.3.2. Immediate action should be taken to secure your site. The issue has been fixed in 4.3.3, all 4.x sites should upgrade as soon as possible. As the endpoint is unused, the patch simply removes it. As a workaround blocking access to /ghost/preview can also mitigate the issue.",2021-04-29,Nuclei,cpe:2.3:a:ghost:ghost:*:*:*:*:*:node.js:*:*,Ghost,Ghost
CVE-2021-29490,5.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N,0.6907,CWE-918,"Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to 10.7.3 vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter. This issue potentially exposes both internal and external HTTP servers or other resources available via HTTP `GET` that are visible from the Jellyfin server. The vulnerability is patched in version 10.7.3. As a workaround, disable external access to the API endpoints `/Items/*/RemoteImages/Download`, `/Items/RemoteSearch/Image` and `/Images/Remote` via reverse proxy, or limit to known-friendly IPs.",2021-05-06,Nuclei,cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:*,Jellyfin,Jellyfin
CVE-2021-29505,7.5,CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.77735,CWE-94,XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.,2021-05-28,Nuclei,cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*;cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*;cpe:2.3:a:oracle:banking_cash_management:14.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_cash_management:14.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_cash_management:14.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:11.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_customer_insights:15.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_customer_insights:16.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2021-29622,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N,0.1956,CWE-601,"Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.",2021-05-19,Nuclei,cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:*;cpe:2.3:a:prometheus:prometheus:2.27.0:-:*:*:*:*:*:*;cpe:2.3:a:prometheus:prometheus:2.27.0:rc0:*:*:*:*:*:*,Prometheus,Prometheus
CVE-2021-29625,7.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.08723,CWE-79,"Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected. The vulnerability is patched in version 4.8.1. As workarounds, one can use a browser supporting strict CSP or enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`).",2021-05-19,Nuclei,cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:*,Adminer,Adminer
CVE-2021-3002,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.04278,CWE-79,Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter.,2021-01-01,Nuclei,cpe:2.3:a:seopanel:seo_panel:4.8.0:*:*:*:*:*:*:*,Seopanel,Seo Panel
CVE-2021-30047,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.03073,NVD-CWE-noinfo,VSFTPD 3.0.3 allows attackers to cause a denial of service due to limited number of connections allowed.,2023-08-22,Nuclei,cpe:2.3:a:vsftpd_project:vsftpd:3.0.3:*:*:*:*:*:*:*,Vsftpd Project,Vsftpd
CVE-2021-30049,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0247,CWE-79,SysAid 20.3.64 b14 is affected by Cross Site Scripting (XSS) via a /KeepAlive.jsp?stamp= URI.,2021-07-22,Nuclei,cpe:2.3:a:sysaid:sysaid:20.3.64:b14:*:*:*:*:*:*,Sysaid,Sysaid
CVE-2021-3007,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.75313,CWE-502,"Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a ""vulnerability in the PHP language itself"" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized",2021-01-04,Nuclei,cpe:2.3:a:getlaminas:laminas-http:*:*:*:*:*:*:*:*;cpe:2.3:a:zend:zend_framework:3.0.0:*:*:*:*:*:*:*,Getlaminas,Laminas-Http
CVE-2021-30116,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.85619,CWE-522,"Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client for Windows and installs it, the file KaseyaD.ini is generated (C:\Program Files (x86)\Kaseya\XXXXXXXXXX\KaseyaD.ini) which contains an Agent_Guid and AgentPassword This Agent_Guid and AgentPassword can be used to log in on dl.asp (https://x.x.x.x/dl.asp?un=840997037507813&pw=113cc622839a4077a84837485ced6b93e440bf66d44057713cb2f95e503a06d9) This request authenticates the client and returns a sessionId cookie that can be used in subsequent attacks to bypass authentication. Security issues discovered --- * Unauthenticated download page leaks credentials * Credentials of agent software can be used to obtain a sessionId (cookie) that can be used for services not intended for use by agents * dl.asp accepts credentials via a GET request * Access to KaseyaD.ini gives an attacker access to sufficient information to penetrate the Kaseya installation and its clients. Impact --- Via the page /dl.asp enough information can be obtained to give an attacker a sessionId that can be used to execute further (semi-authenticated) attacks against the system.",2021-07-09,CISA/Nuclei,cpe:2.3:a:kaseya:vsa_agent:*:*:*:*:*:*:*:*;cpe:2.3:a:kaseya:vsa_server:*:*:*:*:*:*:*:*,Kaseya,Vsa Agent
CVE-2021-30118,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.60348,CWE-434,"An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management (RMM) 9.5.4.2149 and subsequently use these files to execute asp commands The api /SystemTab/uploader.aspx is vulnerable to an unauthenticated arbitrary file upload leading to RCE. An attacker can upload files with the privilege of the Web Server process and subsequently use these files to execute asp commands. Detailed description --- Given the following request: ``` POST /SystemTab/uploader.aspx?Filename=shellz.aspx&PathData=C%3A%5CKaseya%5CWebPages%5C&__RequestValidationToken=ac1906a5-d511-47e3-8500-47cc4b0ec219&qqfile=shellz.aspx HTTP/1.1 Host: 192.168.1.194 Cookie: sessionId=92812726; %5F%5FRequestValidationToken=ac1906a5%2Dd511%2D47e3%2D8500%2D47cc4b0ec219 Content-Length: 12 <%@ Page Language=""C#"" Debug=""true"" validateRequest=""false"" %> <%@ Import namespace=""System.Web.UI.WebControls"" %> <%@ Import namespace=""System.Diagnostics"" %> <%@ Import namespace=""System.IO"" %> <%@ Import namespace=""System"" %> <%@ Import namespace=""System.Data"" %> <%@ Import namespace=""System.Data.SqlClient"" %> <%@ Import namespace=""System.Security.AccessControl"" %> <%@ Import namespace=""System.Security.Principal"" %> <%@ Import namespace=""System.Collections.Generic"" %> <%@ Import namespace=""System.Collections"" %> <script runat=""server""> private const string password = ""pass""; // The password ( pass ) private const string style = ""dark""; // The style ( light / dark ) protected void Page_Load(object sender, EventArgs e) { //this.Remote(password); this.Login(password); this.Style(); this.ServerInfo(); <snip> ``` The attacker can control the name of the file written via the qqfile parameter and the location of the file written via the PathData parameter. Even though the call requires that a sessionId cookie is passed we have determined that the sessionId is not actually validated and any numeric value is accepted as valid. Security issues discovered --- * a sessionId cookie is required by /SystemTab/uploader.aspx, but is not actually validated, allowing an attacker to bypass authentication * /SystemTab/uploader.aspx allows an attacker to create a file with arbitrary content in any place the webserver has write access * The web server process has write access to the webroot where the attacker can execute it by requesting the URL of the newly created file. Impact --- This arbitrary file upload allows an attacker to place files of his own choosing on any location on the hard drive of the server the webserver process has access to, including (but not limited to) the webroot. If the attacker uploads files with code to the webroot (e.g. aspx code) he can then execute this code in the context of the webserver to breach either the integrity, confidentiality, or availability of the system or to steal credentials of other users. In other words, this can lead to a full system compromise.",2021-07-09,Nuclei,cpe:2.3:a:kaseya:vsa:*:*:*:*:-:*:*:*,Kaseya,Vsa
CVE-2021-30128,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.81079,CWE-502,Apache OFBiz has unsafe deserialization prior to 17.12.07 version,2021-04-27,Nuclei,cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*,Apache,Ofbiz
CVE-2021-30134,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01261,CWE-79,php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data to post_multidimensional.php.,2022-12-26,Nuclei,cpe:2.3:a:ht_slider_range_for_amazon_affiliates_project:ht_slider_range_for_amazon_affiliates:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:php_curl_class_project:php_curl_class:*:*:*:*:*:*:*:*;cpe:2.3:a:ptwooplugins:invoicing_with_invoicexpress_for_woocommerce:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:qiwi:woo-qiwi-payment-gateway:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:shopello_api_project:shopello_api:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:teamleade:teamleader_crm_forms:*:*:*:*:*:wordpress:*:*,Php Curl Class Project,Php Curl Class
CVE-2021-30151,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.04158,CWE-79,Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used.,2021-04-06,Nuclei,cpe:2.3:a:contribsys:sidekiq:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2021-3017,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.63023,NVD-CWE-noinfo,The web interface on Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the def_wirelesspassword line in the HTML source code.,2021-04-14,Nuclei,cpe:2.3:h:intelbras:win_300:-:*:*:*:*:*:*:*;cpe:2.3:h:intelbras:wrn_342:-:*:*:*:*:*:*:*;cpe:2.3:o:intelbras:win_300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:intelbras:wrn_342_firmware:*:*:*:*:*:*:*:*,Intelbras,Win 300 Firmware
CVE-2021-30175,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.08548,CWE-89,ZEROF Web Server 1.0 (April 2021) allows SQL Injection via the /HandleEvent endpoint for the login page.,2021-04-13,Nuclei,cpe:2.3:a:zerof:web_server:1.0:*:*:*:*:*:*:*,Zerof,Web Server
CVE-2021-3018,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.19506,CWE-89,ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerable to an unauthenticated Boolean-based SQL injection via the id parameter on the /cms/print.php page.,2021-01-05,Nuclei,cpe:2.3:a:ipeak:ipeakcms:3.5:*:*:*:*:*:*:*,Ipeak,Ipeakcms
CVE-2021-3019,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.18982,CWE-22,ffay lanproxy 0.1 allows Directory Traversal to read /../conf/config.properties to obtain credentials for a connection to the intranet.,2021-01-05,Nuclei,cpe:2.3:a:lanproxy_project:lanproxy:0.1:*:*:*:*:*:*:*,Lanproxy Project,Lanproxy
CVE-2021-30203,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00596,CWE-79,A reflected cross-site scripting (XSS) vulnerability in the zero parameter of dzzoffice 2.02.1_SC_UTF8 allows attackers to execute arbitrary web scripts or HTML.,2023-06-27,Nuclei,cpe:2.3:a:dzzoffice:dzzoffice:2.02.1:*:*:*:*:*:*:*,Dzzoffice,Dzzoffice
CVE-2021-30213,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02721,CWE-79,Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in '/servlet/AdapterHTTP' via the 'targetService' parameter.,2021-05-12,Nuclei,cpe:2.3:a:eng:knowage:7.3.0:*:*:*:*:*:*:*,Eng,Knowage
CVE-2021-30461,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.36632,CWE-94,"A remote code execution issue was discovered in the web UI of VoIPmonitor before 24.61. When the recheck option is used, the user-supplied SPOOLDIR value (which might contain PHP code) is injected into config/configuration.php.",2021-05-29,Nuclei,cpe:2.3:a:voipmonitor:voipmonitor:*:*:*:*:*:*:*:*,Voipmonitor,Voipmonitor
CVE-2021-30497,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.9658,CWE-22,"Ivanti Avalanche (Premise) 6.3.2 allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal. The imageFilePath parameter processed by the /AvalancheWeb/image endpoint is not verified to be within the scope of the image folder, e.g., the attacker can obtain sensitive information via the C:/Windows/system32/config/system.sav value.",2022-04-06,EPSS/Nuclei,cpe:2.3:a:ivanti:avalanche:6.3.2:*:*:*:*:windows:*:*,Ivanti,Avalanche
CVE-2021-30533,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N,0.16611,CWE-863,Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe.,2021-06-07,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-30551,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.64701,CWE-843,Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2021-06-15,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-30554,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.07367,CWE-416,Use after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2021-07-02,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-30563,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.08928,CWE-843,Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2021-08-03,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*,Google,Chrome
CVE-2021-30632,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.64546,CWE-787,Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2021-10-08,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-30633,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.32657,CWE-416,Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.,2021-10-08,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-30657,5.5,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N,0.68531,NVD-CWE-noinfo,"A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious application may bypass Gatekeeper checks. Apple is aware of a report that this issue may have been actively exploited..",2021-09-08,CISA/Metasploit,cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.6:-:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.6:supplemental_update:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-005:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-007:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:supplemental_update:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2021-30661,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.04528,CWE-416,"A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1, iOS 12.5.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..",2021-09-08,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2021-30663,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.0369,CWE-190,"An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, Safari 14.1.1, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution.",2021-09-08,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2021-30665,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.03692,CWE-787,"A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 7.4.1, iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..",2021-09-08,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2021-30666,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.03031,CWE-119,A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..,2021-09-08,CISA,cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*,Apple,Iphone Os
CVE-2021-30713,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.0658,CWE-862,A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass Privacy preferences. Apple is aware of a report that this issue may have been actively exploited..,2021-09-08,CISA,cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-005:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-007:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-002:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-003:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-004:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2021-30761,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.10591,CWE-787,A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..,2021-09-08,CISA,cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*,Apple,Iphone Os
CVE-2021-30762,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.10986,CWE-416,A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..,2021-09-08,CISA,cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*,Apple,Iphone Os
CVE-2021-30807,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.28839,CWE-787,"A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS 14.7.1, watchOS 7.6.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.",2021-10-19,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2021-30858,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.13486,CWE-416,"A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.",2021-08-24,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*,Apple,Ipados
CVE-2021-30860,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.75994,CWE-190,"An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.",2021-08-24,CISA,cpe:2.3:a:freedesktop:poppler:*:*:*:*:*:*:*:*;cpe:2.3:a:xpdfreader:xpdf:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-002:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-003:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-004:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2021-30869,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.0415,CWE-843,"A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 12.5.5, iOS 14.4 and iPadOS 14.4, macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, Security Update 2021-006 Catalina. A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of reports that an exploit for this issue exists in the wild.",2021-08-24,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-002:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-006:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-007:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-002:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-003:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-004:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-005:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-006:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-007:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-005:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-007:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-002:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-003:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-004:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-005:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:supplemental_update:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2021-30883,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.14721,CWE-787,"A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15.0.2 and iPadOS 15.0.2, macOS Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8.1, macOS Big Sur 11.6.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..",2021-08-24,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:12.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2021-30900,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.05204,CWE-787,"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 14.8.1 and iPadOS 14.8.1, iOS 15.1 and iPadOS 15.1. A malicious application may be able to execute arbitrary code with kernel privileges.",2021-08-24,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:15.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:15.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2021-30952,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.07617,CWE-190,"An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.",2021-08-24,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:*;cpe:2.3:a:wpewebkit:wpe_webkit:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*,Apple,Ipados
CVE-2021-30983,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.02934,CWE-120,A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 15.2 and iPadOS 15.2. An application may be able to execute arbitrary code with kernel privileges.,2021-08-24,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2021-31010,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N,0.03673,CWE-502,"A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. A sandboxed process may be able to circumvent sandbox restrictions. Apple was aware of a report that this issue may have been actively exploited at the time of release..",2021-08-24,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-005:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-007:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-002:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-003:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-006:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-007:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-008:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-002:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-003:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-004:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:supplemental_update:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2021-3110,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.20695,CWE-89,The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_products[] parameter.,2021-01-20,Nuclei,cpe:2.3:a:prestashop:prestashop:1.7.7.0:*:*:*:*:*:*:*,Prestashop,Prestashop
CVE-2021-31166,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99657,CWE-416,HTTP Protocol Stack Remote Code Execution Vulnerability,2021-05-11,CISA/EPSS/Metasploit,cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 2004
CVE-2021-31181,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.30045,NVD-CWE-noinfo,Microsoft SharePoint Remote Code Execution Vulnerability,2021-05-11,Metasploit,cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*,Microsoft,Sharepoint Enterprise Server
CVE-2021-31195,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.73676,NVD-CWE-noinfo,Microsoft Exchange Server Remote Code Execution Vulnerability,2021-05-11,Nuclei,cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_20:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_9:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2021-31196,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.4638,NVD-CWE-noinfo,Microsoft Exchange Server Remote Code Execution Vulnerability,2021-07-14,CISA,cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_20:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_9:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2021-31199,5.2,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N,0.02954,NVD-CWE-noinfo,Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability,2021-06-08,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2021-31201,5.2,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N,0.02617,NVD-CWE-noinfo,Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability,2021-06-08,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2021-31207,6.6,CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H,0.99782,CWE-434,Microsoft Exchange Server Security Feature Bypass Vulnerability,2021-05-11,CISA/EPSS/Metasploit,cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_20:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_9:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2021-3122,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.87383,CWE-78,"CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (within an XML document sent to port 8089) that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: the vendor's position is that exploitation occurs only on devices with a certain ""misconfiguration.""",2021-02-07,Metasploit/Nuclei,cpe:2.3:a:ncr:command_center_agent:16.3:*:*:*:*:*:*:*,Ncr,Command Center Agent
CVE-2021-31249,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.18003,CWE-74,"A CRLF injection vulnerability was found on BF-430, BF-431, and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of validation on the parameter redirect= available on multiple CGI components.",2021-06-04,Nuclei,cpe:2.3:h:chiyu-tech:bf-430:-:*:*:*:*:*:*:*;cpe:2.3:h:chiyu-tech:bf-431:-:*:*:*:*:*:*:*;cpe:2.3:h:chiyu-tech:bf-450m:-:*:*:*:*:*:*:*;cpe:2.3:o:chiyu-tech:bf-430_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:chiyu-tech:bf-431_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:chiyu-tech:bf-450m_firmware:-:*:*:*:*:*:*:*,Chiyu-Tech,Bf-430 Firmware
CVE-2021-31250,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.79605,CWE-79,"Multiple storage XSS vulnerabilities were discovered on BF-430, BF-431 and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of sanitization of the input on the components man.cgi, if.cgi, dhcpc.cgi, ppp.cgi.",2021-06-04,Nuclei,cpe:2.3:h:chiyu-tech:bf-430:-:*:*:*:*:*:*:*;cpe:2.3:h:chiyu-tech:bf-431:-:*:*:*:*:*:*:*;cpe:2.3:h:chiyu-tech:bf-450m:-:*:*:*:*:*:*:*;cpe:2.3:o:chiyu-tech:bf-430_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:chiyu-tech:bf-431_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:chiyu-tech:bf-450m_firmware:-:*:*:*:*:*:*:*,Chiyu-Tech,Bf-430 Firmware
CVE-2021-3129,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99943,NVD-CWE-noinfo,"Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.",2021-01-12,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:facade:ignition:*:*:*:*:*:laravel:*:*;cpe:2.3:a:laravel:laravel:*:*:*:*:*:*:*:*,Facade,Ignition
CVE-2021-31316,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.13029,CWE-89,The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter.,2021-05-18,Nuclei,cpe:2.3:a:control-webpanel:webpanel:-:*:*:*:*:*:*:*,Control-Webpanel,Webpanel
CVE-2021-31324,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.34062,CWE-78,The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution.,2021-05-18,Nuclei,cpe:2.3:a:control-webpanel:webpanel:-:*:*:*:*:*:*:*,Control-Webpanel,Webpanel
CVE-2021-3152,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.02231,CWE-22,"Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks against custom integrations. NOTE: the vendor's perspective is that the vulnerability itself is in custom integrations written by third parties, not in Home Assistant; however, Home Assistant does have a security update that is worthwhile in addressing this situation",2021-01-26,Nuclei,cpe:2.3:a:home-assistant:home-assistant:*:*:*:*:*:*:*:*,Home-Assistant,Home-Assistant
CVE-2021-31537,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.07781,CWE-79,"SIS SIS-REWE Go before 7.7 SP17 allows XSS: rewe/prod/web/index.php (affected parameters are config, version, win, db, pwd, and user) and /rewe/prod/web/rewe_go_check.php (version and all other parameters).",2021-05-11,Nuclei,cpe:2.3:a:sisinformatik:sis-rewe_go:*:*:*:*:*:*:*:*;cpe:2.3:a:sisinformatik:sis-rewe_go:7.7:-:*:*:*:*:*:*;cpe:2.3:a:sisinformatik:sis-rewe_go:7.7:sp16:*:*:*:*:*:*,Sisinformatik,Sis-Rewe Go
CVE-2021-3156,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.99295,CWE-193,"Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via ""sudoedit -s"" and a command-line argument that ends with a single backslash character.",2021-01-26,CISA/EPSS/Metasploit,cpe:2.3:a:beyondtrust:privilege_management_for_mac:*:*:*:*:*:*:*:*;cpe:2.3:a:beyondtrust:privilege_management_for_unix\/linux:*:*:*:*:basic:*:*:*;cpe:2.3:a:mcafee:web_gateway:10.0.4:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:web_gateway:8.2.17:*:*:*:*:*:*:*;cpe:2.3:a:mcafee:web_gateway:9.2.8:*:*:*:*:*:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*;cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_unified_manager_core_package:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:ontap_tools:9:*:*:*:*:vmware_vsphere:*:*;cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_performance_intelligence_center:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:tekelec_platform_distribution:*:*:*:*:*:*:*:*;cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*;cpe:2.3:a:sudo_project:sudo:1.9.5:-:*:*:*:*:*:*;cpe:2.3:a:sudo_project:sudo:1.9.5:patch1:*:*:*:*:*:*;cpe:2.3:a:synology:diskstation_manager_unified_controller:3.0:*:*:*:*:*:*:*;cpe:2.3:h:oracle:micros_compact_workstation_3:-:*:*:*:*:*:*:*;cpe:2.3:h:oracle:micros_es400:-:*:*:*:*:*:*:*;cpe:2.3:h:oracle:micros_kitchen_display_system:-:*:*:*:*:*:*:*;cpe:2.3:h:oracle:micros_workstation_5a:-:*:*:*:*:*:*:*;cpe:2.3:h:oracle:micros_workstation_6:-:*:*:*:*:*:*:*;cpe:2.3:h:synology:skynas:-:*:*:*:*:*:*:*;cpe:2.3:h:synology:vs960hd:-:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:oracle:micros_compact_workstation_3_firmware:310:*:*:*:*:*:*:*;cpe:2.3:o:oracle:micros_es400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:oracle:micros_kitchen_display_system_firmware:210:*:*:*:*:*:*:*;cpe:2.3:o:oracle:micros_workstation_5a_firmware:5a:*:*:*:*:*:*:*;cpe:2.3:o:oracle:micros_workstation_6_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:synology:diskstation_manager:6.2:*:*:*:*:*:*:*;cpe:2.3:o:synology:skynas_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:synology:vs960hd_firmware:-:*:*:*:*:*:*:*,Synology,Skynas Firmware
CVE-2021-31581,7.9,CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N,0.01217,CWE-269,"The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be escaped by abusing the 'Edit MySQL Configuration' command. This command launches a standard vi editor interface which can then be escaped. This issue was resolved in Akkadian OVA appliance version 3.0 (and later), Akkadian Provisioning Manager 5.0.2 (and later), and Akkadian Appliance Manager 3.3.0.314-4a349e0 (and later).",2021-07-22,Nuclei,cpe:2.3:a:akkadianlabs:ova_appliance:*:*:*:*:*:*:*:*;cpe:2.3:a:akkadianlabs:provisioning_manager:*:*:*:*:*:*:*:*,Akkadianlabs,Ova Appliance
CVE-2021-31589,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.28207,CWE-79,"A cross-site scripting (XSS) vulnerability has been reported and confirmed for BeyondTrust Secure Remote Access Base Software version 6.0.1 and older, which allows the injection of unauthenticated, specially-crafted web requests without proper sanitization.",2022-01-05,Nuclei,cpe:2.3:o:beyondtrust:appliance_base_software:*:*:*:*:*:*:*:*,Beyondtrust,Appliance Base Software
CVE-2021-31602,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.51653,CWE-287,"An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. The Security Model has different layers of Access Control. One of these layers is the applicationContext security, which is defined in the applicationContext-spring-security.xml file. The default configuration allows an unauthenticated user with no previous knowledge of the platform settings to extract pieces of information without possessing valid credentials.",2021-11-08,Nuclei,cpe:2.3:a:hitachi:vantara_pentaho:*:*:*:*:*:*:*:*;cpe:2.3:a:hitachi:vantara_pentaho_business_intelligence_server:*:*:*:*:*:*:*:*,Hitachi,Vantara Pentaho
CVE-2021-31682,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.10509,CWE-79,The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to a vulnerable GET parameter that is reflected in the output without sanitization.,2021-10-22,Nuclei,cpe:2.3:a:automatedlogic:webctrl:*:*:*:*:*:*:*:*,Automatedlogic,Webctrl
CVE-2021-31755,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.85849,CWE-787,An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request.,2021-05-07,CISA/Nuclei,cpe:2.3:h:tenda:ac11:-:*:*:*:*:*:*:*;cpe:2.3:o:tenda:ac11_firmware:*:*:*:*:*:*:*:*,Tenda,Ac11 Firmware
CVE-2021-31802,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.14177,CWE-787,NETGEAR R7000 1.0.11.116 devices have a heap-based Buffer Overflow that is exploitable from the local network without authentication. The vulnerability exists within the handling of an HTTP request. An attacker can leverage this to execute code as root. The problem is that a user-provided length value is trusted during a backup.cgi file upload. The attacker must add a \n before the Content-Length header.,2021-04-26,Metasploit,cpe:2.3:h:netgear:r7000:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r7000_firmware:*:*:*:*:*:*:*:*,Netgear,R7000 Firmware
CVE-2021-31805,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.85315,CWE-917,"The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.",2022-04-12,Nuclei,cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*,Apache,Struts
CVE-2021-31806,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H,0.95785,CWE-116,"An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a memory-management bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy) via HTTP Range request processing.",2021-05-27,EPSS/Metasploit,cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2021-31807,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H,0.15972,CWE-190,An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. An integer overflow problem allows a remote server to achieve Denial of Service when delivering responses to HTTP Range requests. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent.,2021-06-08,Metasploit,cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:2.5.stable10:*:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:2.5.stable11:*:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:2.5.stable12:*:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:2.5.stable13:*:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:2.5.stable14:*:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:2.5.stable2:*:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:2.5.stable3:*:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:2.5.stable4:*:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:2.5.stable5:*:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:2.5.stable6:*:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:2.5.stable7:*:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:2.5.stable8:*:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:2.5.stable9:*:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:2.6:*:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:2.7:-:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:2.7:stable2:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:2.7:stable3:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:2.7:stable4:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:2.7:stable5:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:2.7:stable6:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:2.7:stable7:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:2.7:stable8:*:*:*:*:*:*;cpe:2.3:a:squid-cache:squid:2.7:stable9:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-31856,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.75384,CWE-89,A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles endpoint (order parameter in GetMesheryPatterns in models/meshery_pattern_persister.go).,2021-04-28,Nuclei,cpe:2.3:a:layer5:meshery:0.5.2:*:*:*:*:*:*:*,Layer5,Meshery
CVE-2021-31862,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03922,CWE-79,SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication.,2021-10-29,Nuclei,cpe:2.3:a:sysaid:sysaid:20.4.74:*:*:*:*:*:*:*,Sysaid,Sysaid
CVE-2021-31955,5.5,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.81107,NVD-CWE-noinfo,Windows Kernel Information Disclosure Vulnerability,2021-06-08,CISA,cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1809
CVE-2021-31956,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.20268,CWE-191,Windows NTFS Elevation of Privilege Vulnerability,2021-06-08,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:sp2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2021-31979,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02634,CWE-119,Windows Kernel Elevation of Privilege Vulnerability,2021-07-14,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2021-32030,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99393,CWE-287,"The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\0' matches the device's default value of '\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN.",2021-05-06,CISA/EPSS/Nuclei,cpe:2.3:h:asus:gt-ac2900:-:*:*:*:*:*:*:*;cpe:2.3:h:asus:lyra_mini:-:*:*:*:*:*:*:*;cpe:2.3:o:asus:gt-ac2900_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:asus:lyra_mini_firmware:*:*:*:*:*:*:*:*,Asus,Lyra Mini Firmware
CVE-2021-32172,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.66433,CWE-862,Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin.,2021-10-07,Nuclei,cpe:2.3:a:maianscriptworld:maian_cart:3.8:*:*:*:*:*:*:*,Maianscriptworld,Maian Cart
CVE-2021-3223,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.18512,CWE-22,Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files.,2021-01-26,Nuclei,cpe:2.3:a:nodered:node-red-dashboard:*:*:*:*:*:node.js:*:*,Nodered,Node-Red-Dashboard
CVE-2021-32305,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.86716,CWE-78,WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter.,2021-05-18,Nuclei,cpe:2.3:a:websvn:websvn:*:*:*:*:*:*:*:*,Websvn,Websvn
CVE-2021-3239,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.17933,CWE-89,"E-Learning System 1.0 suffers from an unauthenticated SQL injection vulnerability, which allows remote attackers to execute arbitrary code on the hosting web server and gain a reverse shell.",2021-02-15,Nuclei,cpe:2.3:a:e-learning_system_project:e-learning_system:1.0:*:*:*:*:*:*:*,E-Learning System Project,E-Learning System
CVE-2021-32478,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01157,CWE-79,"The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected.",2022-03-11,Nuclei,cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*,Moodle,Moodle
CVE-2021-32618,3.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N,0.03289,CWE-601,"The Python ""Flask-Security-Too"" package is used for adding security features to your Flask application. It is an is an independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. All versions of Flask-Security-Too allow redirects after many successful views (e.g. /login) by honoring the ?next query param. There is code in FS to validate that the url specified in the next parameter is either relative OR has the same netloc (network location) as the requesting URL. This check utilizes Pythons urlsplit library. However many browsers are very lenient on the kind of URL they accept and 'fill in the blanks' when presented with a possibly incomplete URL. As a concrete example - setting http://login?next=\\\github.com will pass FS's relative URL check however many browsers will gladly convert this to http://github.com. Thus an attacker could send such a link to an unwitting user, using a legitimate site and have it redirect to whatever site they want. This is considered a low severity due to the fact that if Werkzeug is used (which is very common with Flask applications) as the WSGI layer, it by default ALWAYS ensures that the Location header is absolute - thus making this attack vector mute. It is possible for application writers to modify this default behavior by setting the 'autocorrect_location_header=False`.",2021-05-17,Nuclei,cpe:2.3:a:flask-security_project:flask-security:*:*:*:*:*:*:*:*,Flask-Security Project,Flask-Security
CVE-2021-32648,8.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N,0.90418,CWE-287,octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.,2021-08-26,CISA/Nuclei,cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*;cpe:2.3:a:octobercms:october:1.0.471:*:*:*:*:*:*:*,Octobercms,October
CVE-2021-32682,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.69934,CWE-22,"elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. The issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication.",2021-06-14,Metasploit/Nuclei,cpe:2.3:a:std42:elfinder:*:*:*:*:*:*:*:*,Std42,Elfinder
CVE-2021-32706,7.6,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H,0.60181,CWE-94,"Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the `validDomainWildcard` preg_match filter allows a malicious character through that can be used to execute code, list directories, and overwrite sensitive files. The issue lies in the fact that one of the periods is not escaped, allowing any character to be used in its place. A patch for this vulnerability was released in version 5.5.1.",2021-08-04,Metasploit,cpe:2.3:a:pi-hole:pi-hole:*:*:*:*:*:*:*:*,Pi-Hole,Pi-Hole
CVE-2021-32789,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.17227,CWE-89,"woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be executed against the `wc/store/products/collection-data?calculate_attribute_counts[][taxonomy]` endpoint that allows the execution of a read only sql query. There are patches for many versions of this package, starting with version 2.5.16. There are no known workarounds aside from upgrading.",2021-07-26,Nuclei,cpe:2.3:a:automattic:woocommerce_blocks:*:*:*:*:*:wordpress:*:*,Automattic,Woocommerce Blocks
CVE-2021-32819,8.0,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N,0.59844,CWE-200,Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. This issue is fixed in version 9.0.0. For complete details refer to the referenced GHSL-2021-023.,2021-05-14,Nuclei,cpe:2.3:a:squirrelly:squirrelly:8.0.8:*:*:*:*:*:*:*,Squirrelly,Squirrelly
CVE-2021-32820,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.17988,CWE-200,"Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability is somewhat restricted in that only files with existing extentions (i.e. file.extension) can be included, files that lack an extension will have .handlebars appended to them. For complete details refer to the referenced GHSL-2021-018 report. Notes in documentation have been added to help users avoid this potential information exposure vulnerability.",2021-05-14,Nuclei,cpe:2.3:a:express_handlebars_project:express_handlebars:*:*:*:*:*:node.js:*:*,Express Handlebars Project,Express Handlebars
CVE-2021-32853,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03125,CWE-79,"Erxes, an experience operating system (XOS) with a set of plugins, is vulnerable to cross-site scripting in versions 0.22.3 and prior. This results in client-side code execution. The victim must follow a malicious link or be redirected there from malicious web site. There are no known patches.",2023-02-20,Nuclei,cpe:2.3:a:erxes:erxes:*:*:*:*:*:*:*:*,Erxes,Erxes
CVE-2021-3287,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.51332,CWE-502,Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class.,2021-04-22,Metasploit/Nuclei,cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:-:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125002:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125102:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125108:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125110:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125111:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125112:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125113:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125114:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125116:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125117:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125118:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125120:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125121:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125123:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125124:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125125:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125136:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125137:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125139:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125140:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125143:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125144:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125145:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125156:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125157:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125158:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125159:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125161:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125163:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125174:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125175:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125176:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125177:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125178:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125180:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125181:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125192:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125193:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125194:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125195:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125196:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125197:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125198:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125201:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125204:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125212:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125213:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125214:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125215:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125216:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125228:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125229:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125230:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125231:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125232:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125233:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125312:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125323:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125324:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125326:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125328:*:*:*:*:*:*,Zohocorp,Manageengine Opmanager
CVE-2021-3293,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.17436,NVD-CWE-noinfo,"emlog v5.3.1 has full path disclosure vulnerability in t/index.php, which allows an attacker to see the path to the webroot/file.",2021-02-08,Nuclei,cpe:2.3:a:emlog:emlog:5.3.1:*:*:*:*:*:*:*,Emlog,Emlog
CVE-2021-3297,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.20514,CWE-287,"On Zyxel NBG2105 V1.00(AAGU.2)C0 devices, setting the login cookie to 1 provides administrator access.",2021-01-26,Nuclei,cpe:2.3:h:zyxel:nbg2105:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:nbg2105_firmware:v1.00\(aagu.2\)c0:*:*:*:*:*:*:*,Zyxel,Nbg2105 Firmware
CVE-2021-33044,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99871,CWE-287,The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.,2021-09-15,CISA/EPSS/Nuclei,cpe:2.3:h:dahuasecurity:ipc-hum7xxx:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:ipc-hx3xxx:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:ipc-hx5xxx:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:sd1a1:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:sd22:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:sd49:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:sd50:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:sd52c:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:sd6al:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:tpc-bf1241:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:tpc-bf2221:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:tpc-bf5x01:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:tpc-bf5x21:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:tpc-pt8x21b:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:tpc-sd2221:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:tpc-sd8x21:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:vth-542xh:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:vto-65xxx:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:vto-75x95x:-:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:ipc-hum7xxx_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:ipc-hx3xxx_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:ipc-hx5xxx_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:sd1a1_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:sd22_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:sd49_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:sd50_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:sd52c_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:sd6al_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:tpc-bf1241_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:tpc-bf2221_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:tpc-bf5x01_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:tpc-bf5x21_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:tpc-pt8x21b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:tpc-sd2221_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:tpc-sd8x21_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:vth-542xh_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:vto-65xxx_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:vto-75x95x_firmware:*:*:*:*:*:*:*:*,Dahuasecurity,Ipc-Hum7Xxx Firmware
CVE-2021-33045,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99556,CWE-287,The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.,2021-09-15,CISA/EPSS/Nuclei,cpe:2.3:h:dahuasecurity:ipc-hum7xxx:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:ipc-hx3xxx:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:ipc-hx5xxx:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:nvr-1xxx:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:nvr-2xxx:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:nvr-4xxx:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:nvr-5xxx:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:nvr-6xx:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:vth-542xh:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:vto-65xxx:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:vto-75x95x:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:xvr-4x04:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:xvr-4x08:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:xvr-5x04:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:xvr-5x08:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:xvr-5x16:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:xvr-7x16:-:*:*:*:*:*:*:*;cpe:2.3:h:dahuasecurity:xvr-7x32:-:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:ipc-hum7xxx_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:ipc-hx3xxx_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:ipc-hx5xxx_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:nvr-1xxx_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:nvr-2xxx_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:nvr-4xxx_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:nvr-5xxx_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:nvr-6xx_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:vth-542xh_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:vto-65xxx_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:vto-75x95x_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:xvr-4x04_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:xvr-4x04_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:xvr-4x08_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:xvr-5x04_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:xvr-5x08_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:xvr-5x16_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:xvr-7x16_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dahuasecurity:xvr-7x32_firmware:*:*:*:*:*:*:*:*,Dahuasecurity,Ipc-Hum7Xxx Firmware
CVE-2021-33221,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.5699,CWE-306,An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Unauthenticated API Endpoints.,2021-07-07,Nuclei,cpe:2.3:a:commscope:ruckus_iot_controller:*:*:*:*:*:*:*:*,Commscope,Ruckus Iot Controller
CVE-2021-33357,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.17905,CWE-78,"A vulnerability exists in RaspAP 2.6 to 2.6.5 in the ""iface"" GET parameter in /ajax/networking/get_netcfg.php, when the ""iface"" parameter value contains special characters such as "";"" which enables an unauthenticated attacker to execute arbitrary OS commands.",2021-06-09,Nuclei,cpe:2.3:a:raspap:raspap:*:*:*:*:*:*:*:*,Raspap,Raspap
CVE-2021-33393,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.58725,NVD-CWE-Other,"lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. It might be owned by an unprivileged account, which could potentially be used to install a Trojan horse backup.pl script that is later executed by root. Similar problems with the ownership/permissions of other files may be present as well.",2021-06-09,Metasploit,cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:*;cpe:2.3:a:ipfire:ipfire:2.25:core_update141:*:*:*:*:*:*;cpe:2.3:a:ipfire:ipfire:2.25:core_update142:*:*:*:*:*:*;cpe:2.3:a:ipfire:ipfire:2.25:core_update143:*:*:*:*:*:*;cpe:2.3:a:ipfire:ipfire:2.25:core_update144:*:*:*:*:*:*;cpe:2.3:a:ipfire:ipfire:2.25:core_update145:*:*:*:*:*:*;cpe:2.3:a:ipfire:ipfire:2.25:core_update146:*:*:*:*:*:*;cpe:2.3:a:ipfire:ipfire:2.25:core_update147:*:*:*:*:*:*;cpe:2.3:a:ipfire:ipfire:2.25:core_update148:*:*:*:*:*:*;cpe:2.3:a:ipfire:ipfire:2.25:core_update149:*:*:*:*:*:*;cpe:2.3:a:ipfire:ipfire:2.25:core_update150:*:*:*:*:*:*;cpe:2.3:a:ipfire:ipfire:2.25:core_update151:*:*:*:*:*:*;cpe:2.3:a:ipfire:ipfire:2.25:core_update152:*:*:*:*:*:*;cpe:2.3:a:ipfire:ipfire:2.25:core_update155:*:*:*:*:*:*;cpe:2.3:a:ipfire:ipfire:2.25:core_update156:*:*:*:*:*:*,Ipfire,Ipfire
CVE-2021-33543,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.8207,CWE-306,"Multiple camera devices by UDP Technology, Geutebrück and other vendors allow unauthenticated remote access to sensitive files due to default user authentication settings. This can lead to manipulation of the device and denial of service.",2021-09-13,Metasploit,cpe:2.3:h:geutebrueck:g-cam_ebc-2110:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ebc-2111:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ebc-2112:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2241:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2250:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2251:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2230:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2239:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2240:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2249:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2270:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2271:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2275:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_eec-2400:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_een-2010:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_een-2040:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:1.12.14.5:*:*:*:*:*:*:*,Geutebrueck,G-Cam Ebc-2110 Firmware
CVE-2021-33544,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.95547,CWE-78,"Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.",2021-09-13,EPSS/Metasploit/Nuclei,cpe:2.3:h:geutebrueck:g-cam_ebc-2110:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ebc-2111:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ebc-2112:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2241:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2250:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2251:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2230:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2239:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2240:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2249:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2270:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2271:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2275:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_eec-2400:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_een-2010:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_een-2040:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:1.12.14.5:*:*:*:*:*:*:*,Geutebrueck,G-Cam Ebc-2110 Firmware
CVE-2021-33548,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.5705,CWE-78,"Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.",2021-09-13,Metasploit,cpe:2.3:h:geutebrueck:g-cam_ebc-2110:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ebc-2111:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ebc-2112:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2241:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2250:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2251:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2230:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2239:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2240:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2249:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2270:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2271:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2275:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_eec-2400:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_een-2010:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_een-2040:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:1.12.14.5:*:*:*:*:*:*:*,Geutebrueck,G-Cam Ebc-2110 Firmware
CVE-2021-33549,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.66194,CWE-121,"Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the action parameter, which may allow an attacker to remotely execute arbitrary code.",2021-09-13,Metasploit,cpe:2.3:h:geutebrueck:g-cam_ebc-2110:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ebc-2111:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ebc-2112:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2241:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2250:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2251:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2230:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2239:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2240:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2249:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2270:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2271:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2275:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_eec-2400:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_een-2010:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_een-2040:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:1.12.14.5:*:*:*:*:*:*:*,Geutebrueck,G-Cam Ebc-2110 Firmware
CVE-2021-33550,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.5705,CWE-78,"Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.",2021-09-13,Metasploit,cpe:2.3:h:geutebrueck:g-cam_ebc-2110:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ebc-2111:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ebc-2112:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2241:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2250:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2251:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2230:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2239:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2240:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2249:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2270:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2271:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2275:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_eec-2400:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_een-2010:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_een-2040:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:1.12.14.5:*:*:*:*:*:*:*,Geutebrueck,G-Cam Ebc-2110 Firmware
CVE-2021-33551,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.48811,CWE-78,"Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.",2021-09-13,Metasploit,cpe:2.3:h:geutebrueck:g-cam_ebc-2110:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ebc-2111:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ebc-2112:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2241:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2250:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2251:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2230:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2239:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2240:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2249:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2270:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2271:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2275:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_eec-2400:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_een-2010:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_een-2040:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:1.12.14.5:*:*:*:*:*:*:*,Geutebrueck,G-Cam Ebc-2110 Firmware
CVE-2021-33552,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.48811,CWE-78,"Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.",2021-09-13,Metasploit,cpe:2.3:h:geutebrueck:g-cam_ebc-2110:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ebc-2111:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ebc-2112:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2241:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2250:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2251:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2230:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2239:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2240:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2249:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2270:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2271:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2275:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_eec-2400:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_een-2010:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_een-2040:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:1.12.14.5:*:*:*:*:*:*:*,Geutebrueck,G-Cam Ebc-2110 Firmware
CVE-2021-33553,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.48811,CWE-78,"Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.",2021-09-13,Metasploit,cpe:2.3:h:geutebrueck:g-cam_ebc-2110:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ebc-2111:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ebc-2112:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2241:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2250:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2251:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2230:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2239:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2240:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2249:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2270:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2271:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2275:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_eec-2400:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_een-2010:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_een-2040:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:1.12.14.5:*:*:*:*:*:*:*,Geutebrueck,G-Cam Ebc-2110 Firmware
CVE-2021-33554,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.5705,CWE-78,"Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.",2021-09-13,Metasploit,cpe:2.3:h:geutebrueck:g-cam_ebc-2110:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ebc-2111:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ebc-2112:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2241:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2250:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_efd-2251:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2230:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2239:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2240:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ethc-2249:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2270:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2271:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-cam_ewpc-2275:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_eec-2400:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_een-2010:*:*:*:*:*:*:*:*;cpe:2.3:h:geutebrueck:g-code_een-2040:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:1.12.14.5:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:1.12.13.2:*:*:*:*:*:*:*;cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:1.12.14.5:*:*:*:*:*:*:*,Geutebrueck,G-Cam Ebc-2110 Firmware
CVE-2021-33558,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.12307,NVD-CWE-noinfo,"Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, log.html, email.html, online-users.html, and config.js. NOTE: multiple third parties report that this is a site-specific issue because those files are not part of Boa.",2021-05-27,Nuclei,cpe:2.3:a:boa:boa:0.94.13:*:*:*:*:*:*:*,Boa,Boa
CVE-2021-33564,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.72249,CWE-88,An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility.,2021-05-29,Nuclei,cpe:2.3:a:dragonfly_project:dragonfly:*:*:*:*:*:ruby:*:*,Dragonfly Project,Dragonfly
CVE-2021-33690,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.67699,CWE-918,"Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who has access to the server to perform proxy attacks on server by sending crafted queries. Due to this, the threat actor could completely compromise sensitive data residing on the Server and impact its availability.Note: The impact of this vulnerability depends on whether SAP NetWeaver Development Infrastructure (NWDI) runs on the intranet or internet. The CVSS score reflects the impact considering the worst-case scenario that it runs on the internet.",2021-09-15,Nuclei,cpe:2.3:a:sap:netweaver_development_infrastructure:7.11:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_development_infrastructure:7.20:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_development_infrastructure:7.30:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_development_infrastructure:7.31:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_development_infrastructure:7.40:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_development_infrastructure:7.50:*:*:*:*:*:*:*,Sap,Netweaver Development Infrastructure
CVE-2021-33739,8.4,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06555,NVD-CWE-noinfo,Microsoft DWM Core Library Elevation of Privilege Vulnerability,2021-06-08,CISA,cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1909
CVE-2021-3374,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.14424,CWE-22,"Directory traversal in RStudio Shiny Server before 1.5.16 allows attackers to read the application source code, involving an encoded slash.",2021-04-02,Nuclei,cpe:2.3:a:rstudio:shiny_server:*:*:*:*:pro:*:*:*,Rstudio,Shiny Server
CVE-2021-33742,7.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.59139,CWE-787,Windows MSHTML Platform Remote Code Execution Vulnerability,2021-06-08,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:sp2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2021-33766,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.97502,NVD-CWE-noinfo,Microsoft Exchange Server Information Disclosure Vulnerability,2021-07-14,CISA/EPSS/Nuclei,cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_20:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_9:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2021-3377,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.08,CWE-79,"The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.",2021-03-05,Nuclei,cpe:2.3:a:ansi_up_project:ansi_up:*:*:*:*:*:node.js:*:*,Ansi Up Project,Ansi Up
CVE-2021-33771,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.06255,NVD-CWE-noinfo,Windows Kernel Elevation of Privilege Vulnerability,2021-07-14,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:r2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2021-3378,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97512,CWE-434,"FortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a ""Content-Type: image/png"" header to Config/SaveUploadedHotspotLogoFile and then visiting Assets/temp/hotspot/img/logohotspot.asp.",2021-02-01,EPSS/Metasploit/Nuclei,cpe:2.3:a:fortilogger:fortilogger:*:*:*:*:*:*:*:*,Fortilogger,Fortilogger
CVE-2021-33807,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.16139,CWE-22,Cartadis Gespage through 8.2.1 allows Directory Traversal in gespage/doDownloadData and gespage/webapp/doDownloadData.,2021-07-12,Nuclei,cpe:2.3:a:gespage:gespage:*:*:*:*:*:*:*:*,Gespage,Gespage
CVE-2021-33829,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03189,CWE-79,A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.,2021-06-09,Nuclei,cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:*;cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-33851,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01318,CWE-79,"A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given in the ""Custom logo link"" executes whenever the user opens the Settings Page of the ""Customize Login Image"" Plugin.",2022-03-10,Nuclei,cpe:2.3:a:apasionados:customize_login_image:3.4:*:*:*:*:wordpress:*:*,Apasionados,Customize Login Image
CVE-2021-33904,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.09972,CWE-79,"In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode is vulnerable to XSS. NOTE: The vendor states ""there are configurable security flags and we are unable to reproduce them with the available information.",2021-06-07,Nuclei,cpe:2.3:a:accela:civic_platform:*:*:*:*:*:*:*:*,Accela,Civic Platform
CVE-2021-34187,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.16181,CWE-89,"main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter.",2021-06-28,Nuclei,cpe:2.3:a:chamilo:chamilo:*:*:*:*:*:*:*:*,Chamilo,Chamilo
CVE-2021-34370,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.09996,CWE-79,"Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS. NOTE: the vendor states ""there are configurable security flags and we are unable to reproduce them with the available information.",2021-06-09,Nuclei,cpe:2.3:a:accela:civic_platform:*:*:*:*:*:*:*:*,Accela,Civic Platform
CVE-2021-34427,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.5771,CWE-20,"In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (current BIRT viewer dir) to inject JSP code into the running instance.",2021-06-25,Nuclei,cpe:2.3:a:eclipse:business_intelligence_and_reporting_tools:*:*:*:*:*:*:*:*,Eclipse,Business Intelligence And Reporting Tools
CVE-2021-34429,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.99298,CWE-200,"For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.",2021-07-15,EPSS/Metasploit/Nuclei,cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*;cpe:2.3:a:netapp:element_plug-in_for_vcenter_server:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:snapcenter_plug-in:-:*:*:*:*:vmware_vsphere:*:*;cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*;cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.10.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.14.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:*;cpe:2.3:a:oracle:retail_eftlink:20.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:stream_analytics:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:stream_analytics:19c:*:*:*:*:*:*:*,Eclipse,Jetty
CVE-2021-34448,6.8,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N,0.3067,CWE-787,Scripting Engine Memory Corruption Vulnerability,2021-07-16,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2021-34473,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.99999,CWE-918,Microsoft Exchange Server Remote Code Execution Vulnerability,2021-07-14,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_20:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_9:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2021-34484,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.14393,NVD-CWE-noinfo,Windows User Profile Service Elevation of Privilege Vulnerability,2021-08-12,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2021-34486,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.07428,CWE-416,Windows Event Tracing Elevation of Privilege Vulnerability,2021-08-12,CISA,cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1809
CVE-2021-34523,9.0,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N,0.99987,NVD-CWE-noinfo,Microsoft Exchange Server Elevation of Privilege Vulnerability,2021-07-14,CISA/EPSS/Metasploit,cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_20:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_9:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2021-34527,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.99759,NVD-CWE-noinfo,"<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>UPDATE July 7, 2021: The security update for Windows Server 2012, Windows Server 2016 and Windows 10, Version 1607 have been released. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. If you are unable to install these updates, see the FAQ and Workaround sections in this CVE for information on how to help protect your system from this vulnerability.</p>
<p>In addition to installing the updates, in order to secure your system, you must confirm that the following registry settings are set to 0 (zero) or are not defined (<strong>Note</strong>: These registry keys do not exist by default, and therefore are already at the secure setting.), also that your Group Policy setting are correct (see FAQ):</p>
<ul>
<li>HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint</li>
<li>NoWarningNoElevationOnInstall = 0 (DWORD) or not defined (default setting)</li>
<li>UpdatePromptSettings = 0 (DWORD) or not defined (default setting)</li>
</ul>
<p><strong>Having NoWarningNoElevationOnInstall set to 1 makes your system vulnerable by design.</strong></p>
<p>UPDATE July 6, 2021: Microsoft has completed the investigation and has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. If you are unable to install these updates, see the FAQ and Workaround sections in this CVE for information on how to help protect your system from this vulnerability. See also <a href=""https://support.microsoft.com/topic/31b91c02-05bc-4ada-a7ea-183b129578a7"">KB5005010: Restricting installation of new printer drivers after applying the July 6, 2021 updates</a>.</p>
<p>Note that the security updates released on and after July 6, 2021 contain protections for CVE-2021-1675 and the additional remote code execution exploit in the Windows Print Spooler service known as “PrintNightmare”, documented in CVE-2021-34527.</p>
",2021-07-02,CISA/EPSS/Metasploit,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2021-34621,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.68862,CWE-269,A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator. This issue affects versions 3.0.0 - 3.1.3. .,2021-07-07,Nuclei,cpe:2.3:a:properfraction:profilepress:*:*:*:*:*:wordpress:*:*,Properfraction,Profilepress
CVE-2021-34622,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0412,CWE-269,A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible for users to escalate their privileges to that of an administrator while editing their profile. This issue affects versions 3.0.0 - 3.1.3. .,2021-07-07,Nuclei,cpe:2.3:a:properfraction:profilepress:*:*:*:*:*:wordpress:*:*,Properfraction,Profilepress
CVE-2021-34624,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06744,CWE-434,A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. .,2021-07-07,Nuclei,cpe:2.3:a:properfraction:profilepress:*:*:*:*:*:wordpress:*:*,Properfraction,Profilepress
CVE-2021-34630,5.0,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L,0.01572,CWE-116,"In the Pro and Enterprise versions of GTranslate < 2.8.65, the gtranslate_request_uri_var function runs at the top of all pages and echoes out the contents of $_SERVER['REQUEST_URI']. Although this uses addslashes, and most modern browsers automatically URLencode requests, this plugin is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below, or in cases where an attacker is able to modify the request en route between the client and the server, or in cases where the user is using an atypical browsing solution.",2021-07-30,Nuclei,cpe:2.3:a:gtranslate:gtranslate:*:*:*:*:enterprise:wordpress:*:*;cpe:2.3:a:gtranslate:gtranslate:*:*:*:*:pro:wordpress:*:*,Gtranslate,Gtranslate
CVE-2021-34640,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02313,CWE-79,"The Securimage-WP-Fixed WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/securimage-wp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.5.4.",2021-08-11,Nuclei,cpe:2.3:a:securimage-wp-fixed_project:securimage-wp-fixed:*:*:*:*:*:wordpress:*:*,Securimage-Wp-Fixed Project,Securimage-Wp-Fixed
CVE-2021-34643,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02446,CWE-79,"The Skaut bazar WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/skaut-bazar.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.2.",2021-08-16,Nuclei,cpe:2.3:a:skaut-bazar_project:skaut-bazar:*:*:*:*:*:wordpress:*:*,Skaut-Bazar Project,Skaut-Bazar
CVE-2021-34805,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.26823,CWE-22,"An issue was discovered in FAUST iServer before 9.0.019.019.7. For each URL request, it accesses the corresponding .fau file on the operating system without preventing %2e%2e%5c directory traversal.",2022-01-31,Nuclei,cpe:2.3:a:land-software:faust_iserver:*:*:*:*:*:*:*:*,Land-Software,Faust Iserver
CVE-2021-34833,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.95655,CWE-416,This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14023.,2021-08-04,EPSS,cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*;cpe:2.3:a:foxitsoftware:pdf_editor:*:*:*:*:*:*:*:*;cpe:2.3:a:foxitsoftware:pdf_editor:11.0.0.49893:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2021-3490,7.8,CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H,0.27477,CWE-20,"The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e (""bpf: Fix alu32 const subreg bound tracking on bitwise operations"") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 (""bpf: Verifier, do explicit ALU32 bounds tracking"") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 (""bpf:Fix a verifier failure with xor"") ( 5.10-rc1).",2021-06-04,Metasploit,cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:20.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:21.04:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:5.13:-:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2021-3493,8.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.43988,CWE-270,"The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.",2021-04-17,CISA/Metasploit,cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:lts:*:*:*,Canonical,Ubuntu Linux
CVE-2021-35064,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.70753,CWE-269,"KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo. Sudoers permits running of multiple dangerous commands, including unzip, systemctl and dpkg.",2021-07-12,Nuclei,cpe:2.3:a:kramerav:viaware:*:*:*:*:*:*:*:*,Kramerav,Viaware
CVE-2021-35211,9.0,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H,0.9116,CWE-787,"Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.",2021-07-14,CISA/Nuclei,cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u:15.2.3:-:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u:15.2.3:hotfix1:*:*:*:*:*:*,Solarwinds,Serv-U
CVE-2021-35247,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N,0.03359,CWE-20,Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.,2022-01-10,CISA,cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*,Solarwinds,Serv-U
CVE-2021-35250,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.14656,CWE-22,A researcher reported a Directory Transversal Vulnerability in Serv-U 15.3. This may allow access to files relating to the Serv-U installation and server files. This issue has been resolved in Serv-U 15.3 Hotfix 1.,2022-04-25,Nuclei,cpe:2.3:a:solarwinds:serv-u:15.3:-:*:*:*:*:*:*,Solarwinds,Serv-U
CVE-2021-35265,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03436,CWE-79,A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attackers to inject arbitrary web script to a page.,2021-08-03,Nuclei,cpe:2.3:a:maxsite:maxsite_cms:*:*:*:*:*:*:*:*,Maxsite,Maxsite Cms
CVE-2021-35323,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.05621,CWE-79,Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login.,2021-10-19,Nuclei,cpe:2.3:a:bludit:bludit:3.13.1:*:*:*:*:*:*:*,Bludit,Bludit
CVE-2021-35336,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.11587,CWE-1188,Tieline IP Audio Gateway 2.6.4.8 and below is affected by Incorrect Access Control. A vulnerability in the Tieline Web Administrative Interface could allow an unauthenticated user to access a sensitive part of the system with a high privileged account.,2021-07-01,Nuclei,cpe:2.3:h:tieline:ip_audtio_gateway:-:*:*:*:*:*:*:*;cpe:2.3:o:tieline:ip_audtio_gateway_firmware:*:*:*:*:*:*:*:*,Tieline,Ip Audtio Gateway Firmware
CVE-2021-35380,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.38954,CWE-22,"A Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious user gain access to the files on the remote system by gaining access to the relative path of the file they want to download (http://url:port/file?valore).",2022-02-15,Nuclei,cpe:2.3:a:solari:termtalk_server:3.24.0.2:*:*:*:*:*:*:*,Solari,Termtalk Server
CVE-2021-35394,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99861,NVD-CWE-Other,Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.,2021-08-16,CISA/EPSS/Nuclei,cpe:2.3:a:realtek:rtl819x_jungle_software_development_kit:*:*:*:*:*:*:*:*,Realtek,Rtl819X Jungle Software Development Kit
CVE-2021-35395,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97961,NVD-CWE-Other,"Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the access point. Two versions of this management interface exists: one based on Go-Ahead named webs and another based on Boa named boa. Both of them are affected by these vulnerabilities. Specifically, these binaries are vulnerable to the following issues: - stack buffer overflow in formRebootCheck due to unsafe copy of submit-url parameter - stack buffer overflow in formWsc due to unsafe copy of submit-url parameter - stack buffer overflow in formWlanMultipleAP due to unsafe copy of submit-url parameter - stack buffer overflow in formWlSiteSurvey due to unsafe copy of ifname parameter - stack buffer overflow in formStaticDHCP due to unsafe copy of hostname parameter - stack buffer overflow in formWsc due to unsafe copy of 'peerPin' parameter - arbitrary command execution in formSysCmd via the sysCmd parameter - arbitrary command injection in formWsc via the 'peerPin' parameter Exploitability of identified issues will differ based on what the end vendor/manufacturer did with the Realtek SDK webserver. Some vendors use it as-is, others add their own authentication implementation, some kept all the features from the server, some remove some of them, some inserted their own set of features. However, given that Realtek SDK implementation is full of insecure calls and that developers tends to re-use those examples in their custom code, any binary based on Realtek SDK webserver will probably contains its own set of issues on top of the Realtek ones (if kept). Successful exploitation of these issues allows remote attackers to gain arbitrary code execution on the device.",2021-08-16,CISA/EPSS/Nuclei,cpe:2.3:a:realtek:rtl819x_jungle_software_development_kit:*:*:*:*:*:*:*:*,Realtek,Rtl819X Jungle Software Development Kit
CVE-2021-35449,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01413,CWE-732,"The Lexmark Universal Print Driver version 2.15.1.0 and below, G2 driver 2.7.1.0 and below, G3 driver 3.2.0.0 and below, and G4 driver 4.2.1.0 and below are affected by a privilege escalation vulnerability. A standard low priviliged user can use the driver to execute a DLL of their choosing during the add printer process, resulting in escalation of privileges to SYSTEM.",2021-07-19,Metasploit,cpe:2.3:a:lexmark:g2_driver:*:*:*:*:*:*:*:*;cpe:2.3:a:lexmark:g3_driver:*:*:*:*:*:*:*:*;cpe:2.3:a:lexmark:g4_driver:*:*:*:*:*:*:*:*;cpe:2.3:a:lexmark:universal_print_driver:*:*:*:*:*:*:*:*,Lexmark,G2 Driver
CVE-2021-35464,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99999,CWE-502,"ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier",2021-07-22,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:forgerock:access_management:*:*:*:*:*:*:*:*;cpe:2.3:a:forgerock:openam:*:*:*:*:*:*:*:*,Forgerock,Access Management
CVE-2021-35488,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02628,CWE-79,Thruk 2.40-2 allows /thruk/#cgi-bin/status.cgi?style=combined&title={TITLE] Reflected XSS via the host or title parameter. An attacker could inject arbitrary JavaScript into status.cgi. The payload would be triggered every time an authenticated user browses the page containing it.,2021-11-09,Nuclei,cpe:2.3:a:thruk:thruk:2.40-2:*:*:*:*:*:*:*,Thruk,Thruk
CVE-2021-35587,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96284,NVD-CWE-Other,"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",2022-01-19,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:oracle:access_manager:11.1.2.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:access_manager:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:access_manager:12.2.1.4.0:*:*:*:*:*:*:*,Oracle,Access Manager
CVE-2021-3560,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.22193,CWE-863,"It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",2022-02-16,CISA/Metasploit,cpe:2.3:a:polkit_project:polkit:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_container_platform:4.7:*:*:*:*:*:*:*;cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2021-3577,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.59893,CWE-78,An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker on the same network unauthorized access to the device.,2021-11-12,Nuclei,cpe:2.3:h:binatoneglobal:cn28:-:*:*:*:*:*:*:*;cpe:2.3:h:binatoneglobal:cn40:-:*:*:*:*:*:*:*;cpe:2.3:h:binatoneglobal:cn50:-:*:*:*:*:*:*:*;cpe:2.3:h:binatoneglobal:cn75:-:*:*:*:*:*:*:*;cpe:2.3:h:binatoneglobal:comfort_40:-:*:*:*:*:*:*:*;cpe:2.3:h:binatoneglobal:comfort_50_connect:-:*:*:*:*:*:*:*;cpe:2.3:h:binatoneglobal:comfort_85_connect:-:*:*:*:*:*:*:*;cpe:2.3:h:binatoneglobal:connect_20:-:*:*:*:*:*:*:*;cpe:2.3:h:binatoneglobal:connect_view_65:-:*:*:*:*:*:*:*;cpe:2.3:h:binatoneglobal:ease44:-:*:*:*:*:*:*:*;cpe:2.3:h:binatoneglobal:focus_68:v100:*:*:*:*:*:*:*;cpe:2.3:h:binatoneglobal:focus_68:v200:*:*:*:*:*:*:*;cpe:2.3:h:binatoneglobal:focus_72r:v100:*:*:*:*:*:*:*;cpe:2.3:h:binatoneglobal:focus_72r:v200:*:*:*:*:*:*:*;cpe:2.3:h:binatoneglobal:halo\+_camera:-:*:*:*:*:*:*:*;cpe:2.3:h:binatoneglobal:lux_64:-:*:*:*:*:*:*:*;cpe:2.3:h:binatoneglobal:lux_65:-:*:*:*:*:*:*:*;cpe:2.3:h:binatoneglobal:lux_85_connect:-:*:*:*:*:*:*:*;cpe:2.3:h:binatoneglobal:mbp3667:-:*:*:*:*:*:*:*;cpe:2.3:h:binatoneglobal:mbp3855:-:*:*:*:*:*:*:*;cpe:2.3:h:binatoneglobal:mbp4855:-:*:*:*:*:*:*:*;cpe:2.3:h:binatoneglobal:mbp669_connect:-:*:*:*:*:*:*:*;cpe:2.3:h:binatoneglobal:mbp6855:-:*:*:*:*:*:*:*;cpe:2.3:o:binatoneglobal:cn28_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:binatoneglobal:cn40_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:binatoneglobal:cn50_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:binatoneglobal:cn75_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:binatoneglobal:comfort_40_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:binatoneglobal:comfort_50_connect_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:binatoneglobal:comfort_85_connect_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:binatoneglobal:connect_20_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:binatoneglobal:connect_view_65_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:binatoneglobal:ease44_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:binatoneglobal:focus_68_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:binatoneglobal:focus_72r_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:binatoneglobal:halo\+_camera_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:binatoneglobal:lux_64_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:binatoneglobal:lux_65_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:binatoneglobal:lux_85_connect_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:binatoneglobal:mbp3667_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:binatoneglobal:mbp3855_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:binatoneglobal:mbp4855_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:binatoneglobal:mbp669_connect_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:binatoneglobal:mbp6855_firmware:-:*:*:*:*:*:*:*,Binatoneglobal,Halo+ Camera Firmware
CVE-2021-36260,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99869,CWE-78,"A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.",2021-09-22,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:h:hikvision:ds-2cd2021g1-i\(w\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2023g2-i\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2026g2-iu\/sl:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2027g2-l\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2027g2-lu\/sl:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2043g2-i\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2046g2-iu\/sl:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2047g2-l\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2063g2-i\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2066g2-i\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2066g2-iu\/sl:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2083g2-i\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2086g2-i\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2086g2-iu\/sl:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2087g2-l\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2121g0-i\(w\)\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2121g1-i\(w\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2121g1-idw:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2121g1:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2123g2-i\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2123g2-iu:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2127g2-\(-su\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2143g2-i\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2143g2-iu:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2147g2-l\(su\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2163g2-i\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2163g2-iu:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2166g2-i\(su\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2183g2-i\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2183g2-i\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2183g2-iu:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2186g2-i\(su\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2186g2-isu:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2321g0-i\/nf:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2323g2-i\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2326g2-isu\/sl:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2327g2-l\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2343g2-i\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2346g2-isu\/sl:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2347g2-l\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2347g2-lsu\/sl:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2363g2-i\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2366g2-i\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2366g2-isu\/sl:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2383g2-i\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2386g2-i\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2386g2-isu\/sl:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2387g2-l\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2421g0-i\(d\)\(w\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2421g0-i\(d\)w:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2426g2-i:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2446g2-i:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2523g2-i\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2523g2-i\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2526g2-i\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2526g2-is:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2527g2-ls:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2543g2-i\(ws\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2546g2-i\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2547g2-ls:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2547g2-lzs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2563g2-i\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2566g2-i\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2583g2-i\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2586g2-i\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2621g0-i\(z\)\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2623g2-izs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2626g2-izsu\/sl:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2643g2-izs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2646g2-izsu\/sl:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2663g2-izs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2666g2-izs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2666g2-izsu\/sl:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2683g2-izs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2686g2-izs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2686g2-izsu\/sl:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2721g0-i\(z\)\(s\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2723g2-izs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2743g2-izs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2763g2-izs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2766g2-izs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2783g2-izs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd2786g2-izs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3023g2-iu:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3026g2-is:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3026g2-iu\/sl:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3043g2-iu:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3047g2-ls:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3056g2-is:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3056g2-iu\/sl:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3056g2iu\/sl:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3063g2-iu:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3086g2-is:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3123g2-i\(s\)u:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3126g2-is:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3126g2-is\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3143g2-i\(s\)u:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3156g2-is:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3156g2-is\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3163g2-i\(s\)u:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3186g2-is\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3323g2-iu:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3326g2-isu\/sl:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3343g2-iu:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3347g2-ls\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3356g2-is:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3356g2-is\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3356g2-isu\/sl:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3363g2-iu:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3386g2-is:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3386g2-is\(u\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3523g2-is:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3526g2-is:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3543g2-is:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3547g2-ls:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3556g2-is:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3563g2-is:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3586g2-is:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3623g2-izs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3626g2-izs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3643g2-izs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3656g2-izs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3663g2-izs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3686g2-izs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3723g2-izs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3726g2-izs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3743g2-izs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3756g2-izs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3763g2-izs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2cd3786g2-izs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df5225x-ae3\(t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df5225x-ael\(t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df5232x-ae3\)t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df5232x-ael\(t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df6a225x-ael\)t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df6a236x-ael\(t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df6a425x-ael\(t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df6a436x-ael\(t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df6a436x-ael\(t5\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df6a436x-aely\(t5\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df6a825x-ael:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df6a836x-ael\(t5\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df7225ix-ael\(t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df7225ix-aelw\(t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df7232ix-ael\(t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df7232ix-aelw\(t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8225ih-ael:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8225ih-ael\(w\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8225ix-ael\(t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8225ix-ael\(t5\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8225ix-aelw\(t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8225ix-aelw\(t5\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8236i5x-aelw:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8242i5x-ael\(t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8242i5x-aelw\(t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8242i5x-aelw\(t5\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8242ix-ael\(t5\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8242ix-aelw\(t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8242ix-aely\(t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8250i8x-ael\(t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8425ix-ael\(t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8425ix-ael\(t5\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8425ix-aelw\(t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8425ix-aelw\(t5\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8436i5x-aelw\(t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8442ixs-ael\(t5\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8442ixs-aelw\(t2\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8442ixs-aelw\(t5\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8442ixs-aelwy\(t5\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8442ixs-aely\(t5\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8a442ixs-ael\(t2\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8a442ixs-ael\(t5\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8a442ixs-aely\(t5\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8a442ixs-af\/sp\(t5\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8a442nxs-ael\(t5\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2df8a842ixs-ael\(t5\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2dy9236i8x-a:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2dy9236i8x-a\(t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2dy9236ix-a\(t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2dy9236x-a\(t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2dy9240ix-a\(t5\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2dy92500x-a\(t5\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2dy9250izs-a\(t5\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2dyh2a0ixs-d\(t2\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td1117-2\/pa:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td1117-3\/pa:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td1117-6\/pa:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td1217b-3\/pa:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td1217b-6\/pa:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td4136t-9:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td4137-25\/w:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td4137-50\/w:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td4166t-9:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td4167-25\/w:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td4167-50\/w:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td6236t-50h2l:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td6237-50h4l\/w:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td6237-75c4l\/w:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td6266t-25h2l:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td6266t-50h2l:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td6267-100c4l\/w:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td6267-100c4l\/wy:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td6267-50h4l\/w:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td6267-75c4l\/w:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td6267-75c4l\/wy:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td8166-100c2f\/v2:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td8166-150ze2f\/v2:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td8166-150zh2f\/v2:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td8166-180ze2f\/v2:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td8166-75c2f\/v2:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td8167-150zc4f\/w:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td8167-190ze2f\/w:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td8167-190ze2f\/wy:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td8167-230zg2f\/w:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2td8167-230zg2f\/wy:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2xe6242f-is\/316l\(b\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2xe6422fwd-izhrs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2xe6442f-izhrs\(b\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2xe6452f-izh\(r\)s:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-2xe6482f-izhrs:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-7104ni-q1:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-7104ni-q1\/4p:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-7104ni-q1\/4p\/m:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-7104ni-q1\/m:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-7108ni-q1:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-7108ni-q1\/8p:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-7108ni-q1\/8p\/m:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-7108ni-q1\/m:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-7604ni-k1:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-7604ni-k1\/4p\/4g:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-7604ni-q1:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-7604ni-q1\/4p:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-7608ni-k1:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-7608ni-k1\/4g:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-7608ni-k1\/8p:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-7608ni-k1\/8p\/4g:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-7608ni-q1:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-7608ni-q1\/8p:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-7608ni-q2:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-7608ni-q2\/8p:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-760ni-k1\/4p:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-7616ni-k1:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-7616ni-q1:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-7616ni-q2:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-7616ni-q2\/16p:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ids-2pt9a144mxs-d\/t2:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ids-2sk718mxs-d:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ids-2sk8144ixs-d\/j:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ids-2vs435-f840-ey:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ids-2vs435-f840-ey\(t3\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ptz-n2204i-de3:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ptz-n2404i-de3:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ptz-n4215-de3:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ptz-n4215i-de:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ptz-n4225i-de:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ptz-n5225i-a:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2021g1-i\(w\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2023g2-i\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2026g2-iu\/sl_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2027g2-l\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2027g2-lu\/sl_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2043g2-i\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2046g2-iu\/sl_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2047g2-l\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2063g2-i\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2066g2-i\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2066g2-iu\/sl_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2083g2-i\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2086g2-i\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2086g2-iu\/sl_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2087g2-l\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2121g0-i\(w\)\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2121g1-i\(w\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2121g1-idw_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2121g1_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2123g2-i\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2123g2-iu_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2127g2-\(-su\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2143g2-i\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2143g2-iu_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2147g2-l\(su\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2163g2-i\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2163g2-iu_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2166g2-i\(su\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2183g2-i\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2183g2-i\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2183g2-iu_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2186g2-i\(su\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2186g2-isu_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2321g0-i\/nf_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2323g2-i\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2326g2-isu\/sl_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2327g2-l\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2343g2-i\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2346g2-isu\/sl_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2347g2-l\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2347g2-lsu\/sl_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2363g2-i\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2366g2-i\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2366g2-isu\/sl_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2383g2-i\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2386g2-i\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2386g2-isu\/sl_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2387g2-l\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2421g0-i\(d\)\(w\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2421g0-i\(d\)w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2426g2-i_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2446g2-i_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2523g2-i\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2523g2-i\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2526g2-i\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2526g2-is_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2527g2-ls_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2543g2-i\(ws\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2546g2-i\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2547g2-ls_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2547g2-lzs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2563g2-i\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2566g2-i\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2583g2-i\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2586g2-i\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2621g0-i\(z\)\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2623g2-izs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2626g2-izsu\/sl_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2643g2-izs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2646g2-izsu\/sl_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2663g2-izs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2666g2-izs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2666g2-izsu\/sl_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2683g2-izs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2686g2-izs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2686g2-izsu\/sl_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2721g0-i\(z\)\(s\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2723g2-izs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2743g2-izs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2763g2-izs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2766g2-izs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2783g2-izs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd2786g2-izs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3023g2-iu_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3026g2-is_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3026g2-iu\/sl_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3043g2-iu_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3047g2-ls_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3056g2-is_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3056g2-iu\/sl_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3056g2iu\/sl_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3063g2-iu_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3086g2-is_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3123g2-i\(s\)u_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3126g2-is\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3126g2-is_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3143g2-i\(s\)u_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3156g2-is\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3156g2-is_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3163g2-i\(s\)u_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3186g2-is\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3323g2-iu_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3326g2-isu\/sl_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3343g2-iu_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3347g2-ls\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3356g2-is\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3356g2-is_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3356g2-isu\/sl_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3363g2-iu_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3386g2-is\(u\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3386g2-is_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3523g2-is_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3526g2-is_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3543g2-is_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3547g2-ls_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3556g2-is_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3563g2-is_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3586g2-is_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3623g2-izs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3626g2-izs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3643g2-izs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3656g2-izs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3663g2-izs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3686g2-izs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3723g2-izs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3726g2-izs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3743g2-izs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3756g2-izs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3763g2-izs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2cd3786g2-izs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df5225x-ae3\(t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df5225x-ael\(t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df5232x-ae3\)t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df5232x-ael\(t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df6a225x-ael\)t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df6a236x-ael\(t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df6a425x-ael\(t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df6a436x-ael\(t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df6a436x-ael\(t5\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df6a436x-aely\(t5\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df6a825x-ael_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df6a836x-ael\(t5\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df7225ix-ael\(t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df7225ix-aelw\(t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df7232ix-ael\(t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df7232ix-aelw\(t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8225ih-ael\(w\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8225ih-ael_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8225ix-ael\(t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8225ix-ael\(t5\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8225ix-aelw\(t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8225ix-aelw\(t5\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8236i5x-aelw_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8242i5x-ael\(t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8242i5x-aelw\(t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8242i5x-aelw\(t5\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8242ix-ael\(t5\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8242ix-aelw\(t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8242ix-aely\(t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8250i8x-ael\(t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8425ix-ael\(t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8425ix-ael\(t5\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8425ix-aelw\(t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8425ix-aelw\(t5\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8436i5x-aelw\(t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8442ixs-ael\(t5\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8442ixs-aelw\(t2\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8442ixs-aelw\(t5\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8442ixs-aelwy\(t5\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8442ixs-aely\(t5\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8a442ixs-ael\(t2\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8a442ixs-ael\(t5\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8a442ixs-aely\(t5\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8a442ixs-af\/sp\(t5\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8a442nxs-ael\(t5\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2df8a842ixs-ael\(t5\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2dy9236i8x-a\(t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2dy9236i8x-a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2dy9236ix-a\(t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2dy9236x-a\(t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2dy9240ix-a\(t5\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2dy92500x-a\(t5\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2dy9250izs-a\(t5\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2dyh2a0ixs-d\(t2\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td1117-2\/pa_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td1117-3\/pa_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td1117-6\/pa_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td1217b-3\/pa_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td1217b-6\/pa_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td4136t-9_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td4137-25\/w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td4137-50\/w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td4166t-9_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td4167-25\/w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td4167-50\/w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td6236t-50h2l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td6237-50h4l\/w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td6237-75c4l\/w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td6266t-25h2l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td6266t-50h2l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td6267-100c4l\/w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td6267-100c4l\/wy_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td6267-50h4l\/w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td6267-75c4l\/w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td6267-75c4l\/wy_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td8166-100c2f\/v2_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td8166-150ze2f\/v2_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td8166-150zh2f\/v2_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td8166-180ze2f\/v2_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td8166-75c2f\/v2_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td8167-150zc4f\/w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td8167-190ze2f\/w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td8167-190ze2f\/wy_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td8167-230zg2f\/w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2td8167-230zg2f\/wy_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2xe6242f-is\/316l\(b\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2xe6422fwd-izhrs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2xe6442f-izhrs\(b\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2xe6452f-izh\(r\)s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-2xe6482f-izhrs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-7104ni-q1\/4p\/m_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-7104ni-q1\/4p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-7104ni-q1\/m_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-7104ni-q1_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-7108ni-q1\/8p\/m_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-7108ni-q1\/8p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-7108ni-q1\/m_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-7108ni-q1_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-7604ni-k1\/4p\/4g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-7604ni-k1_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-7604ni-q1\/4p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-7604ni-q1_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-7608ni-k1\/4g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-7608ni-k1\/8p\/4g_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-7608ni-k1\/8p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-7608ni-k1_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-7608ni-q1\/8p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-7608ni-q1_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-7608ni-q2\/8p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-7608ni-q2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-760ni-k1\/4p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-7616ni-k1_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-7616ni-q1_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-7616ni-q2\/16p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ds-7616ni-q2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ids-2pt9a144mxs-d\/t2_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ids-2sk718mxs-d_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ids-2sk8144ixs-d\/j_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ids-2vs435-f840-ey\(t3\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ids-2vs435-f840-ey_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ptz-n2204i-de3_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ptz-n2404i-de3_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ptz-n4215-de3_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ptz-n4215i-de_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ptz-n4225i-de_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:ptz-n5225i-a_firmware:-:*:*:*:*:*:*:*,Hikvision,Ds-2Cd2026G2-Iu/Sl Firmware
CVE-2021-36356,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.54393,CWE-434,KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames (even though browseSystemFiles.php is no longer reachable via the GUI). NOTE: this issue exists because of an incomplete fix for CVE-2019-17124.,2021-08-31,Nuclei,cpe:2.3:a:kramerav:viaware:*:*:*:*:*:*:*:*,Kramerav,Viaware
CVE-2021-36380,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97599,CWE-78,Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiag.cgi.,2021-08-13,CISA/EPSS/Nuclei,cpe:2.3:a:sunhillo:sureline:*:*:*:*:*:*:*:*,Sunhillo,Sureline
CVE-2021-36450,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.64921,CWE-79,Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter.,2021-12-15,Nuclei,cpe:2.3:a:verint:workforce_optimization:15.2.8.10048:*:*:*:*:*:*:*,Verint,Workforce Optimization
CVE-2021-3654,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.26792,CWE-601,"A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.",2022-03-02,Nuclei,cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openstack_platform:16.1:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openstack_platform:16.2:*:*:*:*:*:*:*,Openstack,Nova
CVE-2021-36580,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01529,CWE-601,Open Redirect vulnerability exists in IceWarp MailServer IceWarp Server Deep Castle 2 Update 1 (13.0.1.2) via the referer parameter.,2023-07-27,Nuclei,cpe:2.3:a:icewarp:icewarp_server:*:*:*:*:*:*:*:*;cpe:2.3:a:icewarp:mail_server:*:*:*:*:*:*:*:*,Icewarp,Icewarp Server
CVE-2021-36646,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00705,CWE-79,A Cross Site Scrtpting (XSS) vulnerability in KodExplorer 4.45 allows remote attackers to run arbitrary code via /index.php page.,2023-09-06,Nuclei,cpe:2.3:a:kodcloud:kodexplorer:4.45:*:*:*:*:*:*:*,Kodcloud,Kodexplorer
CVE-2021-36741,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.04951,CWE-434,"An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product�s management console in order to exploit this vulnerability.",2021-07-29,CISA,cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:*:*:*:*;cpe:2.3:a:trendmicro:officescan:xg:sp1:*:*:*:*:*:*;cpe:2.3:a:trendmicro:officescan_business_security:10.0:sp1:*:*:*:*:*:*;cpe:2.3:a:trendmicro:worry-free_business_security:10.0:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2021-36742,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01482,CWE-20,"A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",2021-07-29,CISA,cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:*:*:*:*;cpe:2.3:a:trendmicro:officescan:xg:sp1:*:*:*:*:*:*;cpe:2.3:a:trendmicro:officescan_business_security:10.0:sp1:*:*:*:*:*:*;cpe:2.3:a:trendmicro:worry-free_business_security:10.0:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2021-36748,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.15415,CWE-89,A SQL Injection issue in the list controller of the Prestahome Blog (aka ph_simpleblog) module before 1.7.8 for Prestashop allows a remote attacker to extract data from the database via the sb_category parameter.,2021-08-20,Nuclei,cpe:2.3:a:prestahome:blog:*:*:*:*:*:prestashop:*:*,Prestahome,Blog
CVE-2021-36749,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.81038,CWE-863,"In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource. This issue was previously mentioned as being fixed in 0.21.0 as per CVE-2021-26920 but was not fixed in 0.21.0 or 0.21.1.",2021-09-24,Nuclei,cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:*,Apache,Druid
CVE-2021-36754,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.64857,CWE-119,PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes an out-of-bounds exception.,2021-07-30,Nuclei,cpe:2.3:a:powerdns:authoritative_server:*:*:*:*:*:*:*:*,Powerdns,Authoritative Server
CVE-2021-36782,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.03105,CWE-312,"A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to use the Kubernetes API to retrieve plaintext version of sensitive data. This issue affects: SUSE Rancher Rancher versions prior to 2.5.16; Rancher versions prior to 2.6.7.",2022-09-07,Metasploit,cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*,Suse,Rancher
CVE-2021-36873,5.5,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N,0.01225,CWE-79,Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress iQ Block Country plugin (versions <= 1.2.11). Vulnerable parameter: &blockcountry_blockmessage.,2021-09-23,Nuclei,cpe:2.3:a:webence:iq_block_country:*:*:*:*:*:wordpress:*:*,Webence,Iq Block Country
CVE-2021-36888,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0674,CWE-284,Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin.,2021-12-15,Nuclei,cpe:2.3:a:blocksera:image_hover_effects:*:*:*:*:*:wordpress:*:*,Blocksera,Image Hover Effects
CVE-2021-36934,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.67252,NVD-CWE-Other,"<p>An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>An attacker must have the ability to execute code on a victim system to exploit this vulnerability.</p>
<p>After installing this security update, you <em>must</em> manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. <strong>Simply installing this security update will not fully mitigate this vulnerability.</strong> See <a href=""https://support.microsoft.com/topic/1ceaa637-aaa3-4b58-a48b-baf72a2fa9e7"">KB5005357- Delete Volume Shadow Copies</a>.</p>",2021-07-22,CISA/Metasploit,cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1809
CVE-2021-36942,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.65543,NVD-CWE-Other,Windows LSA Spoofing Vulnerability,2021-08-12,CISA/Metasploit,cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows Server 2004
CVE-2021-36948,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.1991,NVD-CWE-noinfo,Windows Update Medic Service Elevation of Privilege Vulnerability,2021-08-12,CISA,cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1809
CVE-2021-36955,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03229,NVD-CWE-noinfo,Windows Common Log File System Driver Elevation of Privilege Vulnerability,2021-09-15,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:-:*:-:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:-:*:-:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:r2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2021-37216,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03186,CWE-79,QSAN Storage Manager header page parameters does not filter special characters. Remote attackers can inject JavaScript without logging in and launch reflected XSS attacks to access and modify specific data.,2021-08-02,Nuclei,cpe:2.3:h:qsan:xn8008t:-:*:*:*:*:*:*:*;cpe:2.3:h:qsan:xn8024r:-:*:*:*:*:*:*:*;cpe:2.3:o:qsan:xn8008t_firmware:3.3.2:*:*:*:*:*:*:*;cpe:2.3:o:qsan:xn8024r_firmware:3.1.5:*:*:*:*:*:*:*,Qsan,Xn8024R Firmware
CVE-2021-37291,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.08146,CWE-89,An SQL Injection vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 ivia the input_id POST parameter in index.php.,2022-04-11,Nuclei,cpe:2.3:a:kevinlab:4st_l-bems:1.0.0:*:*:*:*:*:*:*,Kevinlab,4St L-Bems
CVE-2021-37292,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.06719,NVD-CWE-Other,An Access Control vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 due to an undocumented backdoor account. A malicious user can log in using the backdor account with admin highest privileges and obtain system control.,2022-04-11,Nuclei,cpe:2.3:a:kevinlab:4st_l-bems:1.0.0:*:*:*:*:*:*:*,Kevinlab,4St L-Bems
CVE-2021-37304,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04013,CWE-732,An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the httptrace interface.,2023-02-03,Nuclei,cpe:2.3:a:jeecg:jeecg:*:*:*:*:*:*:*:*,Jeecg,Jeecg
CVE-2021-37305,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.0352,CWE-732,An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: /sys/user/querySysUser?username=admin.,2023-02-03,Nuclei,cpe:2.3:a:jeecg:jeecg:*:*:*:*:*:*:*:*,Jeecg,Jeecg
CVE-2021-37343,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.2382,CWE-22,A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios.,2021-08-13,Metasploit,cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*,Nagios,Nagios Xi
CVE-2021-37344,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96772,CWE-78,Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution through improper neutralisation of special elements used in an OS Command (OS Command injection).,2021-08-13,EPSS,cpe:2.3:a:nagios:nagios_xi_switch_wizard:*:*:*:*:*:*:*:*,Nagios,Nagios Xi Switch Wizard
CVE-2021-37415,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99854,CWE-306,Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.,2021-09-01,CISA/EPSS/Nuclei,cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.0:11005:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.0:11006:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.0:11007:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.0:11008:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.0:11009:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.0:11010:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.0:11011:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:-:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11102:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11103:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11104:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11105:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11106:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11107:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11108:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11109:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11110:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11111:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11112:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11113:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11114:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11115:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11116:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11117:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11118:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11119:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11120:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11121:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11122:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11123:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11124:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11125:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11126:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11127:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11128:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11129:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11130:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11131:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11132:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11133:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11134:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11135:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11136:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11137:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11138:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11139:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11140:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11141:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11142:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11143:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11144:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:-:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11200:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11201:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11202:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11203:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11204:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11205:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11206:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11207:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.3:-:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.3:11300:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.3:11301:*:*:*:*:*:*,Zohocorp,Manageengine Servicedesk Plus
CVE-2021-37416,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02934,CWE-79,Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page.,2021-08-30,Nuclei,cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:-:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6102:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6103:*:*:*:*:*:*,Zohocorp,Manageengine Adselfservice Plus
CVE-2021-37538,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.74489,CWE-89,"Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote unauthenticated attacker to execute arbitrary SQL commands via the day, month, or year parameter to the controllers/front/archive.php archive controller, or the id_category parameter to the controllers/front/category.php category controller.",2021-08-24,Nuclei,cpe:2.3:a:smartdatasoft:smartblog:*:*:*:*:*:prestashop:*:*,Smartdatasoft,Smartblog
CVE-2021-37573,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03398,CWE-79,"A reflected cross-site scripting (XSS) vulnerability in the web server TTiny Java Web Server and Servlet Container (TJWS) <=1.115 allows an adversary to inject malicious code on the server's ""404 Page not Found"" error page",2021-08-09,Nuclei,cpe:2.3:a:tiny_java_web_server_project:tiny_java_web_server:*:*:*:*:*:*:*:*,Tiny Java Web Server Project,Tiny Java Web Server
CVE-2021-37580,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.40058,CWE-287,A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0,2021-11-16,Nuclei,cpe:2.3:a:apache:shenyu:2.3.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:shenyu:2.4.0:*:*:*:*:*:*:*,Apache,Shenyu
CVE-2021-37589,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.29667,CWE-89,Virtua Cobranca before 12R allows SQL Injection on the login page.,2022-06-07,Nuclei,cpe:2.3:a:virtuasoftware:cobranca:*:*:*:*:*:*:*:*,Virtuasoftware,Cobranca
CVE-2021-37598,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.0235,CWE-863,WP Cerber before 8.9.3 allows bypass of /wp-json access control via a trailing ? character.,2021-08-19,Nuclei,cpe:2.3:a:wpcerber:wp_cerber:*:*:*:*:*:*:*:*,Wpcerber,Wp Cerber
CVE-2021-37704,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L,0.06132,CWE-200,"PhpFastCache is a high-performance backend cache system (packagist package phpfastcache/phpfastcache). In versions before 6.1.5, 7.1.2, and 8.0.7 the `phpinfo()` can be exposed if the `/vendor` is not protected from public access. This is a rare situation today since the vendor directory is often located outside the web directory or protected via server rule (.htaccess, etc). Only the v6, v7 and v8 will be patched respectively in 8.0.7, 7.1.2, 6.1.5. Older versions such as v5, v4 are not longer supported and will **NOT** be patched. As a workaround, protect the `/vendor` directory from public access.",2021-08-12,Nuclei,cpe:2.3:a:phpfastcache:phpfastcache:*:*:*:*:*:*:*:*,Phpfastcache,Phpfastcache
CVE-2021-37833,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.04878,CWE-79,A reflected cross-site scripting (XSS) vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary execution of JavaScript commands.,2021-08-03,Nuclei,cpe:2.3:a:digitaldruid:hoteldruid:3.0.2:*:*:*:*:*:*:*,Digitaldruid,Hoteldruid
CVE-2021-37973,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.11735,CWE-416,Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.,2021-10-08,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-37975,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.34887,CWE-416,Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2021-10-08,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-37976,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.19901,CWE-862,Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.,2021-10-08,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-38000,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.04485,CWE-601,Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.,2021-11-23,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:google:android:-:*:*:*:*:*:*:*,Google,Android
CVE-2021-38003,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.36238,CWE-755,Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2021-11-23,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-38085,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01009,CWE-732,"The Canon TR150 print driver through 3.71.2.10 is vulnerable to a privilege escalation issue. During the add printer process, a local attacker can overwrite CNMurGE.dll and, if timed properly, the overwritten DLL will be loaded into a SYSTEM process resulting in escalation of privileges. This occurs because the driver drops a world-writable DLL into a CanonBJ %PROGRAMDATA% location that gets loaded by printisolationhost (a system process).",2021-08-11,Metasploit,cpe:2.3:h:canon:pixma_tr150:-:*:*:*:*:*:*:*;cpe:2.3:o:canon:pixma_tr150_firmware:*:*:*:*:*:*:*:*,Canon,Pixma Tr150 Firmware
CVE-2021-38146,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.11733,CWE-22,The File Download API in Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data.,2021-11-22,Nuclei,cpe:2.3:a:wipro:holmes:20.4.1:*:*:*:*:*:*:*,Wipro,Holmes
CVE-2021-38147,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.53008,CWE-306,"Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/Domain_Credential_Report_Excel, processexecution/DownloadExcelFile/User_Report_Excel, processexecution/DownloadExcelFile/Process_Report_Excel, processexecution/DownloadExcelFile/Infrastructure_Report_Excel, or processexecution/DownloadExcelFile/Resolver_Report_Excel.",2021-11-29,Nuclei,cpe:2.3:a:wipro:holmes:20.4.1:*:*:*:*:*:*:*,Wipro,Holmes
CVE-2021-38154,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04,CWE-732,"Certain Canon devices manufactured in 2012 through 2020 (such as imageRUNNER ADVANCE iR-ADV C5250), when Catwalk Server is enabled for HTTP access, allow remote attackers to modify an e-mail address setting, and thus cause the device to send sensitive information through e-mail to the attacker. For example, an incoming FAX may be sent through e-mail to the attacker. This occurs when a PIN is not required for General User Mode, as exploited in the wild in August 2021.",2021-08-29,Nuclei,cpe:2.3:h:canon:-:*:*:*:*:*:*:*:*,Canon,
CVE-2021-38156,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.88939,CWE-79,"In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.",2021-09-15,Nuclei,cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*,Nagios,Nagios Xi
CVE-2021-38163,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.36018,CWE-22,"SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.",2021-09-14,CISA,cpe:2.3:a:sap:netweaver:7.30:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver:7.31:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver:7.40:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver:7.50:*:*:*:*:*:*:*,Sap,Netweaver
CVE-2021-38294,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.84489,CWE-74,A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.,2021-10-25,Metasploit,cpe:2.3:a:apache:storm:*:*:*:*:*:*:*:*,Apache,Storm
CVE-2021-3831,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01812,CWE-79,gnuboard5 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'),2021-12-14,Nuclei,cpe:2.3:a:gnuboard:gnuboard5:*:*:*:*:*:*:*:*,Gnuboard,Gnuboard5
CVE-2021-38314,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.28961,CWE-200,"The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `redux-core/class-redux-core.php` that were unique to a given site but deterministic and predictable given that they were based on an md5 hash of the site URL with a known salt value of '-redux' and an md5 hash of the previous hash with a known salt value of '-support'. These AJAX actions could be used to retrieve a list of active plugins and their versions, the site's PHP version, and an unsalted md5 hash of site’s `AUTH_KEY` concatenated with the `SECURE_AUTH_KEY`.",2021-09-02,Nuclei,cpe:2.3:a:redux:gutenberg_template_library_\&_redux_framework:*:*:*:*:*:wordpress:*:*,Redux,Gutenberg Template Library & Redux Framework
CVE-2021-38406,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.77892,CWE-787,Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of the current process.,2021-09-17,CISA,cpe:2.3:a:deltaww:dopsoft:*:*:*:*:*:*:*:*,Deltaww,Dopsoft
CVE-2021-38540,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.80938,CWE-269,"The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0, <2.1.3.",2021-09-09,Nuclei,cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*,Apache,Airflow
CVE-2021-38645,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.0189,NVD-CWE-noinfo,Open Management Infrastructure Elevation of Privilege Vulnerability,2021-09-15,CISA,cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_diagnostics_\(lad\):-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_open_management_infrastructure:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_security_center:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_sentinel:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_stack_hub:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*,Microsoft,Azure Automation State Configuration
CVE-2021-38646,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.044,NVD-CWE-noinfo,Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability,2021-09-15,CISA,cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*;cpe:2.3:a:microsoft:office:2013:sp1:*:*:-:*:*:*;cpe:2.3:a:microsoft:office:2013:sp1:*:*:rt:*:*:*;cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*,Microsoft,365 Apps
CVE-2021-38647,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99723,NVD-CWE-noinfo,Open Management Infrastructure Remote Code Execution Vulnerability,2021-09-15,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_diagnostics_\(lad\):-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_open_management_infrastructure:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_security_center:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_sentinel:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_stack_hub:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*,Microsoft,Azure Automation State Configuration
CVE-2021-38648,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.11424,NVD-CWE-noinfo,Open Management Infrastructure Elevation of Privilege Vulnerability,2021-09-15,CISA/Metasploit,cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_diagnostics_\(lad\):-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_open_management_infrastructure:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_security_center:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_sentinel:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_stack_hub:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*,Microsoft,Azure Automation State Configuration
CVE-2021-38649,7.0,CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02,NVD-CWE-noinfo,Open Management Infrastructure Elevation of Privilege Vulnerability,2021-09-15,CISA,cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_diagnostics_\(lad\):-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_open_management_infrastructure:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_security_center:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_sentinel:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_stack_hub:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*,Microsoft,Azure Automation State Configuration
CVE-2021-38702,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.06929,CWE-79,Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 allow tweb/ft.php?u=[XSS] attacks.,2021-08-17,Nuclei,cpe:2.3:h:cyberoamworks:netgenie_c0101b1-20141120-ng11vo:-:*:*:*:*:*:*:*;cpe:2.3:o:cyberoamworks:netgenie_c0101b1-20141120-ng11vo_firmware:*:*:*:*:*:*:*:*,Cyberoamworks,Netgenie C0101B1-20141120-Ng11Vo Firmware
CVE-2021-38704,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03521,CWE-79,Multiple reflected cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in account takeover via session token theft.,2021-09-07,Nuclei,cpe:2.3:a:cliniccases:cliniccases:7.3.3:*:*:*:*:*:*:*,Cliniccases,Cliniccases
CVE-2021-38751,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N,0.02468,CWE-116,"A HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponent_constants.php. A modified HTTP header can change links on the webpage to an arbitrary value, leading to a possible attack vector for MITM.",2021-08-16,Nuclei,cpe:2.3:a:exponentcms:exponentcms:*:*:*:*:*:*:*:*,Exponentcms,Exponentcms
CVE-2021-39141,8.5,CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H,0.16118,CWE-434,"XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",2021-08-23,Nuclei,cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*;cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*;cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:11.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.10.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.3.0.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2021-39144,8.5,CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H,0.98124,CWE-94,"XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",2021-08-23,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*;cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*;cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:11.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.10.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.3.0.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2021-39146,8.5,CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H,0.143,CWE-434,"XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",2021-08-23,Nuclei,cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*;cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*;cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:11.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.10.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.3.0.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-39152,8.5,CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H,0.11377,CWE-502,"XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.",2021-08-23,Nuclei,cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*;cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*;cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:11.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.10.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.3.0.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-39165,8.1,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N,0.09752,CWE-89,"Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session. The original repository of Cachet <https://github.com/CachetHQ/Cachet> is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected.",2021-08-26,Nuclei,cpe:2.3:a:chachethq:cachet:*:*:*:*:*:*:*:*,Chachethq,Cachet
CVE-2021-39211,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.04699,CWE-200,"GLPI is a free Asset and IT management software package. Starting in version 9.2 and prior to version 9.5.6, the telemetry endpoint discloses GLPI and server information. This issue is fixed in version 9.5.6. As a workaround, remove the file `ajax/telemetry.php`, which is not needed for usual functions of GLPI.",2021-09-15,Nuclei,cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*,Glpi-Project,Glpi
CVE-2021-39226,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99888,CWE-287,"Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot ""public_mode"" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot ""public_mode"" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.",2021-10-05,CISA/EPSS/Nuclei,cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-39312,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.77944,CWE-22,"The True Ranker plugin <= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file.",2021-12-14,Nuclei,cpe:2.3:a:trueranker:true_ranker:*:*:*:*:*:wordpress:*:*,Trueranker,True Ranker
CVE-2021-39316,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.65763,CWE-22,"The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the `dzsap_download` action using directory traversal in the `link` parameter.",2021-08-31,Nuclei,cpe:2.3:a:digitalzoomstudio:zoomsounds:*:*:*:*:*:wordpress:*:*,Digitalzoomstudio,Zoomsounds
CVE-2021-39320,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02324,CWE-79,"The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file. On certain configurations including Apache+modPHP, this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path.",2021-09-01,Nuclei,cpe:2.3:a:underconstruction_project:underconstruction:*:*:*:*:*:wordpress:*:*,Underconstruction Project,Underconstruction
CVE-2021-39322,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02349,CWE-79,The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of `$_SERVER['PHP_SELF']` in its main file. On certain configurations including Apache+modPHP this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path.,2021-09-02,Nuclei,cpe:2.3:a:cybernetikz:easy_social_icons:*:*:*:*:*:wordpress:*:*,Cybernetikz,Easy Social Icons
CVE-2021-39327,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.71688,CWE-200,"The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up to, and including, 5.1.",2021-09-17,Metasploit/Nuclei,cpe:2.3:a:ait-pro:bulletproof_security:*:*:*:*:*:wordpress:*:*,Ait-Pro,Bulletproof Security
CVE-2021-39341,8.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N,0.24314,CWE-285,"The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the logged_in_or_has_api_key function in the ~/OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with the plugin installed. This affects versions up to, and including, 2.6.4.",2021-11-01,Nuclei,cpe:2.3:a:optinmonster:optinmonster:*:*:*:*:*:wordpress:*:*,Optinmonster,Optinmonster
CVE-2021-39350,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02126,CWE-79,"The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows attackers to inject arbitrary web scripts, in versions 7.5.0.727 - 7.5.2.727.",2021-10-06,Nuclei,cpe:2.3:a:foliovision:fv_flowplayer_video_player:*:*:*:*:*:wordpress:*:*,Foliovision,Fv Flowplayer Video Player
CVE-2021-39352,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.55729,CWE-434,"The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. This makes it possible for an attacker with administrative privileges to upload malicious files that can be used to achieve remote code execution.",2021-10-21,Metasploit,cpe:2.3:a:catchplugins:catch_themes_demo_import:*:*:*:*:*:wordpress:*:*,Catchplugins,Catch Themes Demo Import
CVE-2021-39411,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0089,CWE-79,"Multiple Cross Site Scripting (XSS) vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the (1) searchdata parameter in (a) doctor/search.php and (b) admin/patient-search.php, and the (2) fromdate and (3) todate parameters in admin/betweendates-detailsreports.php.",2021-11-05,Nuclei,cpe:2.3:a:phpgurukul:hospital_management_system:4.0:*:*:*:*:*:*:*,Phpgurukul,Hospital Management System
CVE-2021-39433,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.08224,NVD-CWE-Other,A local file inclusion (LFI) vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific payload as the file parameter to download/index.php. This allows the attacker to read arbitrary files from the server with the permissions of the configured web-user.,2021-10-04,Nuclei,cpe:2.3:a:biqs:biqsdrive:*:*:*:*:*:*:*:*,Biqs,Biqsdrive
CVE-2021-39501,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03588,CWE-601,EyouCMS 1.5.4 is vulnerable to Open Redirect. An attacker can redirect a user to a malicious url via the Logout function.,2021-09-07,Nuclei,cpe:2.3:a:eyoucms:eyoucms:1.5.4:*:*:*:*:*:*:*,Eyoucms,Eyoucms
CVE-2021-39793,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.00732,CWE-787,"In kbase_jd_user_buf_pin_pages of mali_kbase_mem.c, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210470189References: N/A",2022-03-16,CISA,cpe:2.3:o:google:android:-:*:*:*:*:*:*:*,Google,Android
CVE-2021-39935,6.8,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N,0.35649,CWE-918,"An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API",2021-12-13,CISA,cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*;cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*,Gitlab,Gitlab
CVE-2021-40149,5.9,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N,0.07443,CWE-552,The web server of the E1 Zoom camera through 3.0.0.716 discloses its SSL private key via the root web server directory. In this way an attacker can download the entire key via the /self.key URI.,2022-07-17,Nuclei,cpe:2.3:h:reolink:e1_zoom:-:*:*:*:*:*:*:*;cpe:2.3:o:reolink:e1_zoom_firmware:*:*:*:*:*:*:*:*,Reolink,E1 Zoom Firmware
CVE-2021-40150,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03643,CWE-552,The web server of the E1 Zoom camera through 3.0.0.716 discloses its configuration via the /conf/ directory that is mapped to a publicly accessible path. In this way an attacker can download the entire NGINX/FastCGI configurations by querying the /conf/nginx.conf or /conf/fastcgi.conf URI.,2022-07-17,Nuclei,cpe:2.3:h:reolink:e1_zoom:-:*:*:*:*:*:*:*;cpe:2.3:o:reolink:e1_zoom_firmware:*:*:*:*:*:*:*:*,Reolink,E1 Zoom Firmware
CVE-2021-40272,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01036,CWE-79,"OP5 Monitor 8.3.1, 8.3.2, and OP5 8.3.3 are vulnerable to Cross Site Scripting (XSS).",2022-11-14,Nuclei,cpe:2.3:a:op5:monitor:*:*:*:*:*:*:*:*,Op5,Monitor
CVE-2021-40323,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.88482,CWE-94,"Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.",2021-10-04,Nuclei,cpe:2.3:a:cobbler_project:cobbler:*:*:*:*:*:*:*:*,Cobbler Project,Cobbler
CVE-2021-4034,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.94921,CWE-787,A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.,2022-01-28,CISA/Metasploit,cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*;cpe:2.3:a:polkit_project:polkit:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.6:*:*:*:*:*:*:*;cpe:2.3:a:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.7:*:*:*:*:*:*:*;cpe:2.3:a:siemens:sinumerik_edge:*:*:*:*:*:*:*:*;cpe:2.3:a:starwindsoftware:command_center:1.0:update3_build5871:*:*:*:*:*:*;cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build14338:*:*:*:*:*:*;cpe:2.3:a:suse:enterprise_storage:7.0:*:*:*:*:*:*:*;cpe:2.3:a:suse:linux_enterprise_high_performance_computing:15.0:sp2:*:*:-:*:*:*;cpe:2.3:a:suse:manager_proxy:4.1:*:*:*:*:*:*:*;cpe:2.3:a:suse:manager_server:4.1:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_lpe9403:-:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_eus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*;cpe:2.3:o:siemens:scalance_lpe9403_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:15:sp2:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp2:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp2:*:*:*:sap:*:*;cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:sp5:*:*:*:*:*:*,Siemens,Scalance Lpe9403 Firmware
CVE-2021-40407,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.47915,CWE-78,"An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.",2022-01-28,CISA,cpe:2.3:h:reolink:rlc-410w:-:*:*:*:*:*:*:*;cpe:2.3:o:reolink:rlc-410w_firmware:3.0.0.136_20121102:*:*:*:*:*:*:*,Reolink,Rlc-410W Firmware
CVE-2021-40438,9.0,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H,0.99999,CWE-918,A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.,2021-09-16,CISA/EPSS/Nuclei,cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:secure_global_desktop:5.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*;cpe:2.3:a:siemens:ruggedcom_nms:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:sinec_nms:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:sinema_remote_connect_server:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:sinema_remote_connect_server:3.2:*:*:*:*:*:*:*;cpe:2.3:a:siemens:sinema_server:14.0:-:*:*:*:*:*:*;cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*;cpe:2.3:o:broadcom:brocade_fabric_operating_system_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:f5:f5os:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.8:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus_s390x:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:8.8:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.7:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_workstation:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*;cpe:2.3:o:resf:rocky_linux:8.0:*:*:*:*:*:*:*,Broadcom,Brocade Fabric Operating System Firmware
CVE-2021-40444,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L,0.96843,CWE-22,"<p>Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents.</p>
<p>An attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p>
<p>Microsoft Defender Antivirus and Microsoft Defender for Endpoint both provide detection and protections for the known vulnerability. Customers should keep antimalware products up to date. Customers who utilize automatic updates do not need to take additional action. Enterprise customers who manage updates should select the detection build 1.349.22.0 or newer and deploy it across their environments. Microsoft Defender for Endpoint alerts will be displayed as: “Suspicious Cpl File Execution”.</p>
<p>Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.</p>
<p>Please see the <strong>Mitigations</strong> and <strong>Workaround</strong> sections for important information about steps you can take to protect your system from this vulnerability.</p>
<p><strong>UPDATE</strong> September 14, 2021: Microsoft has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. Please see the FAQ for important information about which updates are applicable to your system.</p>
",2021-09-15,CISA/EPSS/Metasploit,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:r2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2021-40449,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.73381,CWE-416,Win32k Elevation of Privilege Vulnerability,2021-10-13,CISA/Metasploit,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2021-40450,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01968,NVD-CWE-noinfo,Win32k Elevation of Privilege Vulnerability,2021-10-13,CISA,cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1809
CVE-2021-40524,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.04285,CWE-434,"In Pure-FTPd before 1.0.50, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of unbounded size, which may lead to denial of service or a server hang. This occurs because a certain greater-than-zero test does not anticipate an initial -1 value. (Versions 1.0.23 through 1.0.49 are affected.)",2021-09-05,Nuclei,cpe:2.3:a:pureftpd:pure-ftpd:*:*:*:*:*:*:*:*,Pureftpd,Pure-Ftpd
CVE-2021-40539,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9896,CWE-706,Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.,2021-09-07,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:-:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6102:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6103:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6104:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6105:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6106:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6113:*:*:*:*:*:*,Zohocorp,Manageengine Adselfservice Plus
CVE-2021-40542,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02985,CWE-79,Opensis-Classic Version 8.0 is affected by cross-site scripting (XSS). An unauthenticated user can inject and execute JavaScript code through the link_url parameter in Ajax_url_encode.php.,2021-10-11,Nuclei,cpe:2.3:a:os4ed:opensis:8.0:*:*:*:*:*:*:*,Os4Ed,Opensis
CVE-2021-40651,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.17945,CWE-22,"OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arbitrary file from the server's filesystem as long as the application has access to the file.",2021-09-29,Nuclei,cpe:2.3:a:os4ed:opensis:8.0:*:*:*:community:*:*:*,Os4Ed,Opensis
CVE-2021-40655,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.87039,CWE-863,An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page,2021-09-24,CISA/Nuclei,cpe:2.3:h:dlink:dir-605l:b2:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-605l_firmware:2.01mt:*:*:*:*:*:*:*,D-Link,Dir-605L Firmware
CVE-2021-40661,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04613,CWE-22,"A remote, unauthenticated, directory traversal vulnerability was identified within the web interface used by IND780 Advanced Weighing Terminals Build 8.0.07 March 19, 2018 (SS Label 'IND780_8.0.07'), Version 7.2.10 June 18, 2012 (SS Label 'IND780_7.2.10'). It was possible to traverse the folders of the affected host by providing a traversal path to the 'webpage' parameter in AutoCE.ini This could allow a remote unauthenticated adversary to access additional files on the affected system. This could also allow the adversary to perform further enumeration against the affected host to identify the versions of the systems in use, in order to launch further attacks in future.",2022-10-31,Nuclei,cpe:2.3:h:mt:ind780:-:*:*:*:*:*:*:*;cpe:2.3:o:mt:ind780_firmware:7.2.10:*:*:*:*:*:*:*;cpe:2.3:o:mt:ind780_firmware:8.0.07:*:*:*:*:*:*:*,Mt,Ind780 Firmware
CVE-2021-4073,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07,CWE-287,"The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including administrators, if they knew a valid username on the site due to missing identity validation in the social login function social_login_using_email() of the plugin. This affects versions equal to, and less than, 5.0.1.7.",2021-12-14,Nuclei,cpe:2.3:a:metagauss:registrationmagic:*:*:*:*:*:wordpress:*:*,Metagauss,Registrationmagic
CVE-2021-40822,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.19761,CWE-918,GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host.,2022-05-02,Nuclei,cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*,Osgeo,Geoserver
CVE-2021-40856,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.5106,CWE-706,Auerswald COMfortel 1400 IP and 2600 IP before 2.8G devices allow Authentication Bypass via the /about/../ substring.,2021-12-13,Nuclei,cpe:2.3:h:auerswald:comfortel_1400_ip:-:*:*:*:*:*:*:*;cpe:2.3:h:auerswald:comfortel_2600_ip:-:*:*:*:*:*:*:*;cpe:2.3:h:auerswald:comfortel_3600_ip:-:*:*:*:*:*:*:*;cpe:2.3:o:auerswald:comfortel_1400_ip_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:auerswald:comfortel_2600_ip_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:auerswald:comfortel_3600_ip_firmware:*:*:*:*:*:*:*:*,Auerswald,Comfortel 3600 Ip Firmware
CVE-2021-40859,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.71979,NVD-CWE-Other,"Backdoors were discovered in Auerswald COMpact 5500R 7.8A and 8.0B devices, that allow attackers with access to the web based management application full administrative access to the device.",2021-12-07,Nuclei,cpe:2.3:h:auerswald:compact_5500r:-:*:*:*:*:*:*:*;cpe:2.3:o:auerswald:compact_5500r_firmware:7.8a:build002:*:*:*:*:*:*;cpe:2.3:o:auerswald:compact_5500r_firmware:8.0b:build000:*:*:*:*:*:*,Auerswald,Compact 5500R Firmware
CVE-2021-40868,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.09071,CWE-79,"In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS.",2021-09-21,Nuclei,cpe:2.3:a:cloudron:cloudron:6.2:*:*:*:*:*:*:*,Cloudron,Cloudron
CVE-2021-40870,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.93019,CWE-23,"An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.",2021-09-13,CISA/Nuclei,cpe:2.3:a:aviatrix:controller:*:*:*:*:*:*:*:*,Aviatrix,Controller
CVE-2021-40875,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.48417,CWE-425,"Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat actor can access the /files.md5 file on the client side of a Gurock TestRail application, disclosing a full list of application files and the corresponding file paths. The corresponding file paths can be tested, and in some cases, result in the disclosure of hardcoded credentials, API keys, or other sensitive data.",2021-09-22,Nuclei,cpe:2.3:a:gurock:testrail:*:*:*:*:*:*:*:*,Gurock,Testrail
CVE-2021-40960,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09768,CWE-22,Galera WebTemplate 1.0 is affected by a directory traversal vulnerability that could reveal information from /etc/passwd and /etc/shadow.,2021-10-01,Nuclei,cpe:2.3:a:galera:galera_webtemplate:1.0:*:*:*:*:*:*:*,Galera,Galera Webtemplate
CVE-2021-40968,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02204,CWE-79,Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the newpassword2 parameter.,2021-10-01,Nuclei,cpe:2.3:a:spotweb_project:spotweb:*:*:*:*:*:*:*:*,Spotweb Project,Spotweb
CVE-2021-40969,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02204,CWE-79,Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the firstname parameter.,2021-10-01,Nuclei,cpe:2.3:a:spotweb_project:spotweb:*:*:*:*:*:*:*:*,Spotweb Project,Spotweb
CVE-2021-40970,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02204,CWE-79,Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the username parameter.,2021-10-01,Nuclei,cpe:2.3:a:spotweb_project:spotweb:*:*:*:*:*:*:*:*,Spotweb Project,Spotweb
CVE-2021-40971,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02204,CWE-79,Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the newpassword1 parameter.,2021-10-01,Nuclei,cpe:2.3:a:spotweb_project:spotweb:*:*:*:*:*:*:*:*,Spotweb Project,Spotweb
CVE-2021-40972,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02214,CWE-79,Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the mail parameter.,2021-10-01,Nuclei,cpe:2.3:a:spotweb_project:spotweb:*:*:*:*:*:*:*:*,Spotweb Project,Spotweb
CVE-2021-40973,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02214,CWE-79,Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the lastname parameter.,2021-10-01,Nuclei,cpe:2.3:a:spotweb_project:spotweb:*:*:*:*:*:*:*:*,Spotweb Project,Spotweb
CVE-2021-40978,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.14759,CWE-22,"The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information. NOTE: the vendor has disputed this as described in https://github.com/mkdocs/mkdocs/issues/2601.] and https://github.com/nisdn/CVE-2021-40978/issues/1",2021-10-07,Nuclei,cpe:2.3:a:mkdocs:mkdocs:1.2.2:*:*:*:*:*:*:*,Mkdocs,Mkdocs
CVE-2021-4102,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.07836,CWE-416,Use after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2022-02-11,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*,Google,Chrome
CVE-2021-41097,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.04895,CWE-1321,aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in aurelia-path before version 1.1.7. The vulnerability exposes Aurelia application that uses `aurelia-path` package to parse a string. The majority of this will be Aurelia applications that employ the `aurelia-router` package. An example is this could allow an attacker to change the prototype of base object class `Object` by tricking an application to parse the following URL: `https://aurelia.io/blog/?__proto__[asdf]=asdf`. The problem is patched in version `1.1.7`.,2021-09-27,Nuclei,cpe:2.3:a:bluespire:aurelia-path:*:*:*:*:*:node.js:*:*,Bluespire,Aurelia-Path
CVE-2021-41174,6.9,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N,0.84607,CWE-79,"Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim's browser. The user visiting the malicious link must be unauthenticated and the link must be for a page that contains the login button in the menu bar. The url has to be crafted to exploit AngularJS rendering and contain the interpolation binding for AngularJS expressions. AngularJS uses double curly braces for interpolation binding: {{ }} ex: {{constructor.constructor(‘alert(1)’)()}}. When the user follows the link and the page renders, the login button will contain the original link with a query parameter to force a redirect to the login page. The URL is not validated and the AngularJS rendering engine will execute the JavaScript expression contained in the URL. Users are advised to upgrade as soon as possible. If for some reason you cannot upgrade, you can use a reverse proxy or similar to block access to block the literal string {{ in the path.",2021-11-03,Nuclei,cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*,Grafana,Grafana
CVE-2021-41192,8.1,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N,0.08017,CWE-1188,"Redash is a package for data visualization and sharing. If an admin sets up Redash versions 10.0.0 and prior without explicitly specifying the `REDASH_COOKIE_SECRET` or `REDASH_SECRET_KEY` environment variables, a default value is used for both that is the same across all installations. In such cases, the instance is vulnerable to attackers being able to forge sessions using the known default value. This issue only affects installations where the `REDASH_COOKIE_SECRET or REDASH_SECRET_KEY` environment variables have not been explicitly set. This issue does not affect users of the official Redash cloud images, Redash's Digital Ocean marketplace droplets, or the scripts in the `getredash/setup` repository. These instances automatically generate unique secret keys during installation. One can verify whether one's instance is affected by checking the value of the `REDASH_COOKIE_SECRET` environment variable. If it is `c292a0a3aa32397cdb050e233733900f`, should follow the steps to secure the instance, outlined in the GitHub Security Advisory.",2021-11-24,Nuclei,cpe:2.3:a:redash:redash:*:*:*:*:*:*:*:*,Redash,Redash
CVE-2021-41266,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L,0.46706,CWE-306,"Minio console is a graphical user interface for the for MinIO operator. Minio itself is a multi-cloud object storage project. Affected versions are subject to an authentication bypass issue in the Operator Console when an external IDP is enabled. All users on release v0.12.2 and before are affected and are advised to update to 0.12.3 or newer. Users unable to upgrade should add automountServiceAccountToken: false to the operator-console deployment in Kubernetes so no service account token will get mounted inside the pod, then disable the external identity provider authentication by unset the CONSOLE_IDP_URL, CONSOLE_IDP_CLIENT_ID, CONSOLE_IDP_SECRET and CONSOLE_IDP_CALLBACK environment variable and instead use the Kubernetes service account token.",2021-11-15,Nuclei,cpe:2.3:a:min:minio_console:*:*:*:*:*:*:*:*,Min,Minio Console
CVE-2021-41277,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L,0.97178,CWE-200,"Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.",2021-11-17,CISA/EPSS/Nuclei,cpe:2.3:a:metabase:metabase:0.40.0:-:*:*:-:*:*:*;cpe:2.3:a:metabase:metabase:0.40.1:*:*:*:-:*:*:*;cpe:2.3:a:metabase:metabase:0.40.2:*:*:*:-:*:*:*;cpe:2.3:a:metabase:metabase:0.40.3:*:*:*:-:*:*:*;cpe:2.3:a:metabase:metabase:0.40.4:*:*:*:-:*:*:*;cpe:2.3:a:metabase:metabase:1.40.0:-:*:*:enterprise:*:*:*;cpe:2.3:a:metabase:metabase:1.40.1:*:*:*:enterprise:*:*:*;cpe:2.3:a:metabase:metabase:1.40.2:*:*:*:enterprise:*:*:*;cpe:2.3:a:metabase:metabase:1.40.3:*:*:*:enterprise:*:*:*;cpe:2.3:a:metabase:metabase:1.40.4:*:*:*:enterprise:*:*:*,Metabase,Metabase
CVE-2021-41282,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.87113,CWE-74,"diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection mechanisms against command injection (i.e., the usage of the escapeshellarg function for the arguments) are used, it is still possible to inject sed-specific code and write an arbitrary file in an arbitrary location.",2022-03-01,Metasploit/Nuclei,cpe:2.3:a:pfsense:pfsense:2.5.2:*:*:*:*:*:*:*,Pfsense,Pfsense
CVE-2021-41291,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.79441,CWE-22,"ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Using the GET parameter in File Manager, unauthenticated attackers can remotely disclose directory content on the affected device.",2021-09-30,Nuclei,cpe:2.3:a:ecoa:riskterminator:-:*:*:*:*:*:*:*;cpe:2.3:h:ecoa:ecs_router_controller-ecs:-:*:*:*:*:*:*:*;cpe:2.3:h:ecoa:riskbuster:-:*:*:*:*:*:*:*;cpe:2.3:o:ecoa:ecs_router_controller-ecs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:ecoa:riskbuster_firmware:-:*:*:*:*:*:*:*,Ecoa,Ecs Router Controller-Ecs Firmware
CVE-2021-41293,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.20084,CWE-22,"ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files disclosure. Using the specific POST parameter, unauthenticated attackers can remotely disclose arbitrary files on the affected device and disclose sensitive and system information.",2021-09-30,Nuclei,cpe:2.3:a:ecoa:riskterminator:-:*:*:*:*:*:*:*;cpe:2.3:h:ecoa:ecs_router_controller-ecs:-:*:*:*:*:*:*:*;cpe:2.3:h:ecoa:riskbuster:-:*:*:*:*:*:*:*;cpe:2.3:o:ecoa:ecs_router_controller-ecs_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:ecoa:riskbuster_firmware:-:*:*:*:*:*:*:*,Ecoa,Ecs Router Controller-Ecs Firmware
CVE-2021-41349,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.93877,NVD-CWE-noinfo,Microsoft Exchange Server Spoofing Vulnerability,2021-11-10,Nuclei,cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2021-41357,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01968,NVD-CWE-noinfo,Win32k Elevation of Privilege Vulnerability,2021-10-13,CISA,cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 2004
CVE-2021-41379,5.5,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H,0.20099,CWE-59,Windows Installer Elevation of Privilege Vulnerability,2021-11-10,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2021-41381,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.52926,CWE-22,Payara Micro Community 5.2021.6 and below allows Directory Traversal.,2021-09-23,Nuclei,cpe:2.3:a:payara:micro_community:*:*:*:*:*:*:*:*,Payara,Micro Community
CVE-2021-41419,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.08517,CWE-502,QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization.,2022-07-18,Nuclei,cpe:2.3:h:qvis:dvr:-:*:*:*:*:*:*:*;cpe:2.3:h:qvis:nvr:-:*:*:*:*:*:*:*;cpe:2.3:o:qvis:dvr_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:qvis:nvr_firmware:*:*:*:*:*:*:*:*,Qvis,Dvr Firmware
CVE-2021-41432,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01675,CWE-79,A stored cross-site scripting (XSS) vulnerability exists in FlatPress 1.2.1 that allows for arbitrary execution of JavaScript commands through blog content.,2022-06-23,Nuclei,cpe:2.3:a:flatpress:flatpress:1.2.1:*:*:*:*:*:*:*,Flatpress,Flatpress
CVE-2021-41460,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.06788,CWE-89,"ECShop 4.1.0 has SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information.",2022-06-28,Nuclei,cpe:2.3:a:shopex:ecshop:4.1.0:*:*:*:*:*:*:*,Shopex,Ecshop
CVE-2021-41467,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03545,CWE-79,Cross-site scripting (XSS) vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter.,2021-10-01,Nuclei,cpe:2.3:a:justwriting_project:justwriting:1.0.0:*:*:*:*:*:*:*,Justwriting Project,Justwriting
CVE-2021-41569,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.07845,CWE-829,"SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion. The samples library (included by default) in the appstart.sas file, allows end-users of the application to access the sample.webcsf1.sas program, which contains user-controlled macro variables that are passed to the DS2CSF macro. Users can escape the context of the configured user-controllable variable and append additional functions native to the macro but not included as variables within the library. This includes a function that retrieves files from the host OS.",2021-11-19,Nuclei,cpe:2.3:a:sas:sas\/intrnet:*:*:*:*:*:*:*:*;cpe:2.3:a:sas:sas\/intrnet:9.4:-:*:*:*:*:*:*;cpe:2.3:a:sas:sas\/intrnet:9.4:build1520:*:*:*:*:*:*,Sas,Sas/Intrnet
CVE-2021-41648,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.10013,CWE-89,An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /action.php prId parameter. Using a post request does not sanitize the user input.,2021-10-01,Nuclei,cpe:2.3:a:online-shopping-system-advanced_project:online-shopping-system-advanced:-:*:*:*:*:*:*:*,Online-Shopping-System-Advanced Project,Online-Shopping-System-Advanced
CVE-2021-41649,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.5177,CWE-89,An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter. Using a post request does not sanitize the user input.,2021-10-01,Nuclei,cpe:2.3:a:online-shopping-system-advanced_project:online-shopping-system-advanced:-:*:*:*:*:*:*:*,Online-Shopping-System-Advanced Project,Online-Shopping-System-Advanced
CVE-2021-41653,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.75883,CWE-94,The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payload in an IP address input field.,2021-11-13,Nuclei,cpe:2.3:h:tp-link:tl-wr840n:v5:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:tl-wr840n_firmware:*:*:*:*:*:*:*:*,TP-Link,Tl-Wr840N Firmware
CVE-2021-41691,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01723,CWE-89,"A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the ""student_id"" and ""TRANSFER{SCHOOL]"" parameters in POST request sent to /TransferredOutModal.php.",2025-06-24,Nuclei,cpe:2.3:a:os4ed:opensis:8.0:*:*:*:community:*:*:*,Os4Ed,Opensis
CVE-2021-41749,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.17249,CWE-94,"In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.",2022-06-12,Nuclei,cpe:2.3:a:nystudio107:seomatic:*:*:*:*:*:craft_cms:*:*,Nystudio107,Seomatic
CVE-2021-41773,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99992,CWE-22,"A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration ""require all denied"", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.",2021-10-05,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:http_server:2.4.49:*:*:*:*:*:*:*;cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-41826,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.12056,CWE-601,PlaceOS Authentication Service before 1.29.10.0 allows app/controllers/auth/sessions_controller.rb open redirect.,2021-09-30,Nuclei,cpe:2.3:a:place:placeos_authentication:*:*:*:*:*:*:*:*,Place,Placeos Authentication
CVE-2021-41878,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.09912,CWE-79,A reflected cross-site scripting (XSS) vulnerability exists in the i-Panel Administration System Version 2.0 that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console and it is possible to insert a vulnerable malicious button.,2021-10-04,Nuclei,cpe:2.3:a:hkurl:i-panel_administration_system:2.0:*:*:*:*:*:*:*,Hkurl,I-Panel Administration System
CVE-2021-4191,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.80004,NVD-CWE-noinfo,"An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Private GitLab instances with restricted sign-ups may be vulnerable to user enumeration to unauthenticated users through the GraphQL API.",2022-03-28,Metasploit/Nuclei,cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*;cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*,Gitlab,Gitlab
CVE-2021-41951,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.77892,CWE-79,"ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php via the wordpress_user parameter. If an attacker is able to persuade a victim to visit a crafted URL, malicious JavaScript content may be executed within the context of the victim's browser.",2021-11-15,Nuclei,cpe:2.3:a:montala:resourcespace:*:*:*:*:*:*:*:*;cpe:2.3:a:montala:resourcespace:9.6:-:*:*:*:*:*:*,Montala,Resourcespace
CVE-2021-42013,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99964,CWE-22,"It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration ""require all denied"", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.",2021-10-07,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:http_server:2.4.49:*:*:*:*:*:*:*;cpe:2.3:a:apache:http_server:2.4.50:*:*:*:*:*:*:*;cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:secure_backup:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-42063,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.22224,CWE-79,"A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usage of one SAP KW component within a Web browser enables unauthorized attackers to conduct XSS attacks, which might lead to disclose sensitive data.",2021-12-14,Nuclei,cpe:2.3:a:sap:knowledge_warehouse:7.30:*:*:*:*:*:*:*;cpe:2.3:a:sap:knowledge_warehouse:7.31:*:*:*:*:*:*:*;cpe:2.3:a:sap:knowledge_warehouse:7.40:*:*:*:*:*:*:*;cpe:2.3:a:sap:knowledge_warehouse:7.50:*:*:*:*:*:*:*,Sap,Knowledge Warehouse
CVE-2021-42071,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.69882,CWE-78,"In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header.",2021-10-07,Nuclei,cpe:2.3:h:visual-tools:dvr_vx16:-:*:*:*:*:*:*:*;cpe:2.3:o:visual-tools:dvr_vx16_firmware:4.2.28.0:*:*:*:*:*:*:*,Visual-Tools,Dvr Vx16 Firmware
CVE-2021-42192,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.10066,CWE-863,Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation.,2022-05-04,Nuclei,cpe:2.3:a:konga_project:konga:0.14.9:*:*:*:*:*:*:*,Konga Project,Konga
CVE-2021-42237,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97904,CWE-502,Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.,2021-11-05,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:sitecore:experience_platform:7.5:-:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:7.5:update1:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:7.5:update2:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:8.0:-:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:8.0:sp1:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:8.0:update1:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:8.0:update2:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:8.0:update3:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:8.0:update4:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:8.0:update5:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:8.0:update6:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:8.0:update7:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:8.1:-:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:8.1:update1:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:8.1:update2:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:8.1:update3:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:8.2:-:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:8.2:update1:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:8.2:update2:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:8.2:update3:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:8.2:update4:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:8.2:update5:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:8.2:update6:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:8.2:update7:*:*:*:*:*:*,Sitecore,Experience Platform
CVE-2021-42258,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.73269,CWE-89,"BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.",2021-10-22,CISA/Metasploit/Nuclei,cpe:2.3:a:bqe:billquick_web_suite:*:*:*:*:*:*:*:*,Bqe,Billquick Web Suite
CVE-2021-42278,7.5,CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.70207,NVD-CWE-noinfo,Active Directory Domain Services Elevation of Privilege Vulnerability,2021-11-10,CISA,cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows Server 2004
CVE-2021-42287,7.5,CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.74265,NVD-CWE-noinfo,Active Directory Domain Services Elevation of Privilege Vulnerability,2021-11-10,CISA,cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*,Microsoft,Windows Server 2008
CVE-2021-42292,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.31949,NVD-CWE-Other,Microsoft Excel Security Feature Bypass Vulnerability,2021-11-10,CISA,cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*;cpe:2.3:a:microsoft:excel:2013:sp1:*:*:-:*:*:*;cpe:2.3:a:microsoft:excel:2013:sp1:*:*:rt:*:*:*;cpe:2.3:a:microsoft:office:2013:sp1:*:*:-:*:*:*;cpe:2.3:a:microsoft:office:2013:sp1:*:*:rt:*:*:*;cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office:2019:*:*:*:*:-:*:*;cpe:2.3:a:microsoft:office:2019:*:*:*:*:macos:*:*;cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:*:*;cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:macos:*:*,Microsoft,365 Apps
CVE-2021-42321,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.90388,NVD-CWE-Other,Microsoft Exchange Server Remote Code Execution Vulnerability,2021-11-10,CISA/Metasploit,cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2021-42359,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.0393,CWE-284,"WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanently delete an arbitrary post or page on the site by sending an AJAX request with the “action” parameter set to “admin-dismiss-unsubscribe” and the “id” parameter set to the post to be deleted. Sending such a request would move the post to the trash, and repeating the request would permanently delete the post in question.",2021-11-05,Nuclei,cpe:2.3:a:legalweb:wp_dsgvo_tools:*:*:*:*:*:wordpress:*:*,Legalweb,Wp Dsgvo Tools
CVE-2021-42362,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.79823,CWE-434,"The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain remote code execution, in versions up to and including 5.3.2.",2021-11-17,Metasploit,cpe:2.3:a:wordpress_popular_posts_project:wordpress_popular_posts:*:*:*:*:*:wordpress:*:*,Wordpress Popular Posts Project,Wordpress Popular Posts
CVE-2021-42551,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02671,CWE-79,Cross-site Scripting (XSS) vulnerability in the search functionality of AlCoda NetBiblio WebOPAC allows an unauthenticated user to craft a reflected Cross-Site Scripting attack. This issue affects: AlCoda NetBiblio WebOPAC versions prior to 4.0.0.320; versions later than 4.0.0.328. This issue does not affect: AlCoda NetBiblio WebOPAC version 4.0.0.335 and later versions.,2022-01-14,Nuclei,cpe:2.3:a:alcoda:netbiblio:*:*:*:*:*:*:*:*,Alcoda,Netbiblio
CVE-2021-42565,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.05832,CWE-79,myfactory.FMS before 7.1-912 allows XSS via the UID parameter.,2021-10-18,Nuclei,cpe:2.3:a:myfactory:fms:*:*:*:*:*:*:*:*,Myfactory,Fms
CVE-2021-42566,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.05832,CWE-79,myfactory.FMS before 7.1-912 allows XSS via the Error parameter.,2021-10-18,Nuclei,cpe:2.3:a:myfactory:fms:*:*:*:*:*:*:*:*,Myfactory,Fms
CVE-2021-42567,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.08064,CWE-79,Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.,2021-12-07,Nuclei,cpe:2.3:a:apereo:central_authentication_service:*:*:*:*:*:*:*:*,Apereo,Central Authentication Service
CVE-2021-42627,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.6307,NVD-CWE-Other,"The WAN configuration page ""wan.htm"" on D-Link DIR-615 devices with firmware 20.06 can be accessed directly without authentication which can lead to disclose the information about WAN settings and also leverage attacker to modify the data fields of page.",2022-08-23,Nuclei,cpe:2.3:h:dlink:dir-615:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-615_j1:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-615_t1:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-615jx10:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-615_firmware:20.06:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-615_j1_firmware:20.06:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-615_t1_firmware:20.06:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-615jx10_firmware:20.06:*:*:*:*:*:*:*,D-Link,Dir-615 Firmware
CVE-2021-42663,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N,0.03792,CWE-79,An HTML injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the msg parameter to /event-management/index.php. An attacker can leverage this vulnerability in order to change the visibility of the website. Once the target user clicks on a given link he will display the content of the HTML code of the attacker's choice.,2021-11-05,Nuclei,cpe:2.3:a:online_event_booking_and_reservation_system_project:online_event_booking_and_reservation_system:2.3.0:*:*:*:*:*:*:*,Online Event Booking And Reservation System Project,Online Event Booking And Reservation System
CVE-2021-42667,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.15806,CWE-89,A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-management/views. An attacker can leverage this vulnerability in order to manipulate the sql query performed. As a result he can extract sensitive data from the web server and in some cases he can use this vulnerability in order to get a remote code execution on the remote web server.,2021-11-05,Nuclei,cpe:2.3:a:online_event_booking_and_reservation_system_project:online_event_booking_and_reservation_system:2.3.0:*:*:*:*:*:*:*,Online Event Booking And Reservation System Project,Online Event Booking And Reservation System
CVE-2021-42840,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.58945,CWE-434,"SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled PHP file under the web root, because only the all-lowercase PHP file extensions were blocked. NOTE: this issue exists because of an incomplete fix for CVE-2020-28328.",2021-10-22,Metasploit,cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*,Salesagility,Suitecrm
CVE-2021-42847,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.70325,NVD-CWE-noinfo,"Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files.",2021-11-11,Metasploit,cpe:2.3:a:zohocorp:manageengine_adaudit_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:-:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7002:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7003:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7004:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7005:*:*:*:*:*:*,Zohocorp,Manageengine Adaudit Plus
CVE-2021-42887,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.42853,NVD-CWE-noinfo,"In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.",2022-06-03,Nuclei,cpe:2.3:h:totolink:ex1200t:-:*:*:*:*:*:*:*;cpe:2.3:o:totolink:ex1200t_firmware:4.1.2cu.5215:*:*:*:*:*:*:*,Totolink,Ex1200T Firmware
CVE-2021-43062,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.12936,CWE-79,"A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below, version 6.3.7 and below, version 6.0.11 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the FortiGuard URI protection service.",2022-02-02,Nuclei,cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*,Fortinet,Fortimail
CVE-2021-43226,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03072,NVD-CWE-noinfo,Windows Common Log File System Driver Elevation of Privilege Vulnerability,2021-12-15,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2021-43258,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.10523,CWE-434,"CartView.php in ChurchInfo 1.3.0 allows attackers to achieve remote code execution through insecure uploads. This requires authenticated access tot he ChurchInfo application. Once authenticated, a user can add names to their cart, and compose an email. Uploading an attachment for the email stores the attachment on the site in the /tmp_attach/ folder where it can be accessed with a GET request. There are no limitations on files that can be attached, allowing for malicious PHP code to be uploaded and interpreted by the server.",2022-11-23,Metasploit,cpe:2.3:a:churchdb:churchinfo:*:*:*:*:*:*:*:*,Churchdb,Churchinfo
CVE-2021-43287,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.28039,CWE-200,"An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD server to unauthenticated attackers.",2022-04-14,Nuclei,cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:*,Thoughtworks,Gocd
CVE-2021-43421,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.42781,CWE-434,"A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to upload arbitrary files and execute PHP code.",2022-04-07,Nuclei,cpe:2.3:a:std42:elfinder:*:*:*:*:*:*:*:*,Std42,Elfinder
CVE-2021-43495,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.09052,CWE-22,AlquistManager branch as of commit 280d99f43b11378212652e75f6f3159cde9c1d36 is affected by a directory traversal vulnerability in alquist/IO/input.py. This attack can cause the disclosure of critical secrets stored anywhere on the system and can significantly aid in getting remote code access.,2021-11-15,Nuclei,cpe:2.3:a:alquistai:alquist:2017-06-13:*:*:*:*:*:*:*,Alquistai,Alquist
CVE-2021-43496,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.15689,CWE-22,Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 is affected by a directory traversal vulnerability. This attack can cause the disclosure of critical secrets stored anywhere on the system and can significantly aid in getting remote code access.,2021-11-12,Nuclei,cpe:2.3:a:clustering_project:clustering:2019-07-26:*:*:*:*:*:*:*,Clustering Project,Clustering
CVE-2021-43510,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07515,CWE-89,SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the username field in login.php.,2022-02-01,Nuclei,cpe:2.3:a:simple_client_management_system_project:simple_client_management_system:1.0:*:*:*:*:*:*:*,Simple Client Management System Project,Simple Client Management System
CVE-2021-43574,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02422,CWE-79,WebAdmin Control Panel in Atmail 6.5.0 (a version released in 2012) allows XSS via the format parameter to the default URI. NOTE: This vulnerability only affects products that are no longer supported by the maintainer,2021-11-15,Nuclei,cpe:2.3:a:atmail:atmail:6.5.0:*:*:*:*:*:*:*,Atmail,Atmail
CVE-2021-43725,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02583,CWE-79,"There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remote attackers to inject arbitrary web script or HTML via the data[performredirect] parameter.",2022-03-28,Nuclei,cpe:2.3:a:spotweb_project:spotweb:*:*:*:*:*:*:*:*,Spotweb Project,Spotweb
CVE-2021-43734,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.10728,CWE-22,kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host.,2022-02-15,Nuclei,cpe:2.3:a:keking:kkfileview:4.0.0:*:*:*:*:*:*:*,Keking,Kkfileview
CVE-2021-4374,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H,0.16408,CWE-862,"The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.53.2. This is due to missing authorization and option validation in the process_form.php file. This makes it possible for unauthenticated attackers to arbitrarily update the settings of a vulnerable site and ultimately compromise the entire site.",2023-06-07,Metasploit/Nuclei,cpe:2.3:a:valvepress:wordpress_automatic_plugin:*:*:*:*:*:wordpress:*:*,Valvepress,Wordpress Automatic Plugin
CVE-2021-43778,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.52658,CWE-22,"Barcode is a GLPI plugin for printing barcodes and QR codes. GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable to a path traversal vulnerability. This issue was patched in version 2.6.1. As a workaround, delete the `front/send.php` file.",2021-11-24,Nuclei,cpe:2.3:a:glpi-project:barcode:*:*:*:*:*:*:*:*,Glpi-Project,Barcode
CVE-2021-43798,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.88849,CWE-22,"Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.",2021-12-07,CISA/Metasploit/Nuclei,cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*;cpe:2.3:a:grafana:grafana:8.0.0:beta1:*:*:*:*:*:*;cpe:2.3:a:grafana:grafana:8.0.0:beta2:*:*:*:*:*:*;cpe:2.3:a:grafana:grafana:8.0.0:beta3:*:*:*:*:*:*;cpe:2.3:a:grafana:grafana:8.3.0:*:*:*:*:*:*:*,Grafana,Grafana
CVE-2021-4380,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04528,CWE-284,"The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wp_pinterest_automatic_parse_request' function and the 'process_form.php' script in versions up to, and including, 1.14.3. This makes it possible for unauthenticated attackers to update arbitrary options on a site that can be used to create new administrative user accounts or redirect unsuspecting site visitors.",2023-06-07,Nuclei,cpe:2.3:a:valvepress:pinterest_automatic_pin:*:*:*:*:*:wordpress:*:*,Valvepress,Pinterest Automatic Pin
CVE-2021-43810,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.05784,CWE-79,"Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious scripts. This issue is patched in version 4.0.12.",2021-12-07,Nuclei,cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*,Admidio,Admidio
CVE-2021-43831,7.7,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N,0.03794,CWE-22,Gradio is an open source framework for building interactive machine learning models and demos. In versions prior to 2.5.0 there is a vulnerability that affects anyone who creates and publicly shares Gradio interfaces. File paths are not restricted and users who receive a Gradio link can access any files on the host computer if they know the file names or file paths. This is limited only by the host operating system. Paths are opened in read only mode. The problem has been patched in gradio 2.5.0.,2021-12-15,Nuclei,cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*,Gradio Project,Gradio
CVE-2021-43890,7.1,CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H,0.10295,NVD-CWE-noinfo,"We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Emotet/Trickbot/Bazaloader.
An attacker could craft a malicious attachment to be used in phishing campaigns. The attacker would then have to convince the user to open the specially crafted attachment. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Please see the Security Updates table for the link to the updated app. Alternatively you can download and install the Installer using the links provided in the FAQ section.
Please see the Mitigations and Workaround sections for important information about steps you can take to protect your system from this vulnerability.
December 27 2023 Update:
In recent months, Microsoft Threat Intelligence has seen an increase in activity from threat actors leveraging social engineering and phishing techniques to target Windows OS users and utilizing the ms-appinstaller URI scheme.
To address this increase in activity, we have updated the App Installer to disable the ms-appinstaller protocol by default and recommend other potential mitigations.",2021-12-15,CISA,cpe:2.3:a:microsoft:app_installer:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_2004:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1809
CVE-2021-44026,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.42751,CWE-89,Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.,2021-11-19,CISA,cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-44077,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.93514,CWE-306,"Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.",2021-11-29,CISA/Metasploit/Nuclei,cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11138:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11139:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11140:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11141:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11142:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11143:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11144:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11145:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11200:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11201:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11202:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11203:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11204:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11205:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11206:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11207:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11208:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11209:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11210:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11211:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.3:11300:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.3:11301:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.3:11302:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.3:11303:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.3:11304:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.3:11305:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10500:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10501:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10502:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10503:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10504:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10505:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10506:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10507:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10508:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10509:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10510:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10511:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10512:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10513:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10514:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10515:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10516:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10517:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10518:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10519:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10520:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10521:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10522:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10523:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10524:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10525:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10526:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10527:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10528:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.5:10529:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11001:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11002:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11003:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11004:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11005:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11006:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11007:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11008:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11009:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11010:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11011:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11012:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11013:*:*:*:*:*:*,Zohocorp,Manageengine Servicedesk Plus
CVE-2021-44138,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.14115,CWE-22,"There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to read files in arbitrary directories via a ; in a pathname within an HTTP request.",2022-04-04,Nuclei,cpe:2.3:a:caucho:resin:*:*:*:*:*:*:*:*,Caucho,Resin
CVE-2021-44139,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.06485,CWE-918,Sentinel 1.8.2 is vulnerable to Server-side request forgery (SSRF).,2022-03-23,Nuclei,cpe:2.3:a:hashicorp:sentinel:1.8.2:*:*:*:*:*:*:*,Hashicorp,Sentinel
CVE-2021-44152,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.58555,CWE-306,"An issue was discovered in Reprise RLM 14.2. Because /goform/change_password_process does not verify authentication or authorization, an unauthenticated user can change the password of any existing user. This allows an attacker to change the password of any known user, thereby preventing valid users from accessing the system and granting the attacker full access to that user's account.",2021-12-13,Nuclei,cpe:2.3:a:reprisesoftware:reprise_license_manager:*:*:*:*:*:*:*:*,Reprisesoftware,Reprise License Manager
CVE-2021-44168,3.3,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N,0.00873,CWE-494,"A download of code without integrity check vulnerability in the ""execute restore src-vis"" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.",2022-01-04,CISA,cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*,Fortinet,Fortios
CVE-2021-44207,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.17578,CWE-798,Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.,2021-12-21,CISA,cpe:2.3:a:acclaimsystems:usaherds:*:*:*:*:*:*:*:*,Acclaimsystems,Usaherds
CVE-2021-44228,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.99999,CWE-20,"Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.",2021-12-10,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*;cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*;cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*;cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*;cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*;cpe:2.3:a:bentley:synchro:*:*:*:*:pro:*:*:*;cpe:2.3:a:bentley:synchro_4d:*:*:*:*:pro:*:*:*;cpe:2.3:a:cisco:advanced_malware_protection_virtual_private_cloud_appliance:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:automated_subsea_tuning:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:automated_subsea_tuning:02.01.00:*:*:*:*:*:*:*;cpe:2.3:a:cisco:broadworks:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:broadworks:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:business_process_automation:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:cloud_connect:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:cloudcenter:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:cloudcenter_cost_optimizer:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:cloudcenter_suite:4.10.0.15:*:*:*:*:*:*:*;cpe:2.3:a:cisco:cloudcenter_suite:5.3.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:cloudcenter_suite:5.4.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:cloudcenter_suite:5.5.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:cloudcenter_suite:5.5.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:cloudcenter_suite_admin:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:cloudcenter_workload_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:common_services_platform_collector:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:common_services_platform_collector:002.009\(000.000\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:common_services_platform_collector:002.009\(000.001\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:common_services_platform_collector:002.009\(000.002\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:common_services_platform_collector:002.009\(001.000\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:common_services_platform_collector:002.009\(001.001\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:common_services_platform_collector:002.009\(001.002\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:common_services_platform_collector:002.010\(000.000\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:connected_mobile_experiences:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:contact_center_domain_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:contact_center_management_portal:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:crosswork_data_gateway:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:crosswork_data_gateway:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:crosswork_network_automation:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:crosswork_network_automation:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:crosswork_network_automation:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:crosswork_network_automation:4.1.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:crosswork_network_automation:4.1.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:crosswork_network_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:crosswork_network_controller:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:crosswork_optimization_engine:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:crosswork_optimization_engine:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:crosswork_platform_infrastructure:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:crosswork_platform_infrastructure:4.1.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:crosswork_zero_touch_provisioning:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:crosswork_zero_touch_provisioning:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:customer_experience_cloud_agent:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:cx_cloud_agent:001.012:*:*:*:*:*:*:*;cpe:2.3:a:cisco:cyber_vision:4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:cyber_vision_sensor_management_extension:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:cyber_vision_sensor_management_extension:4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:data_center_network_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:data_center_network_manager:11.3\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:dna_center:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:dna_center:2.2.2.8:*:*:*:*:*:*:*;cpe:2.3:a:cisco:dna_spaces:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:dna_spaces\:_connector:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:dna_spaces_connector:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:emergency_responder:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:emergency_responder:11.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:emergency_responder:11.5\(4.65000.14\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:emergency_responder:11.5\(4.66000.14\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:enterprise_chat_and_email:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:enterprise_chat_and_email:12.0\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:enterprise_chat_and_email:12.5\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:enterprise_chat_and_email:12.6\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:evolved_programmable_network_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:evolved_programmable_network_manager:3.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:evolved_programmable_network_manager:3.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:evolved_programmable_network_manager:4.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:evolved_programmable_network_manager:4.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:evolved_programmable_network_manager:5.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:evolved_programmable_network_manager:5.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:finesse:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:finesse:12.5\(1\):su1:*:*:*:*:*:*;cpe:2.3:a:cisco:finesse:12.5\(1\):su2:*:*:*:*:*:*;cpe:2.3:a:cisco:finesse:12.6\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:finesse:12.6\(1\):-:*:*:*:*:*:*;cpe:2.3:a:cisco:finesse:12.6\(1\):es01:*:*:*:*:*:*;cpe:2.3:a:cisco:finesse:12.6\(1\):es02:*:*:*:*:*:*;cpe:2.3:a:cisco:finesse:12.6\(1\):es03:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.3.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.5.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.7.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:fog_director:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine:002.004\(000.914\):-:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine:002.006\(000.156\):-:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine:002.007\(000.356\):-:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine:003.000\(000.458\):-:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine:003.001\(000.518\):-:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine:003.002\(000.116\):-:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine:2.4.0:-:*:*:*:*:*:*;cpe:2.3:a:cisco:integrated_management_controller_supervisor:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:integrated_management_controller_supervisor:002.003\(002.000\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:integrated_management_controller_supervisor:2.3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:intersight_virtual_appliance:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:intersight_virtual_appliance:1.0.9-343:*:*:*:*:*:*:*;cpe:2.3:a:cisco:iot_operations_dashboard:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:mobility_services_engine:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:network_assurance_engine:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:network_assurance_engine:6.0\(2.1912\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.0\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.1\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.2\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.3\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.4\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.5\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.5\(2\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:network_dashboard_fabric_controller:11.5\(3\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:network_insights_for_data_center:6.0\(2.1914\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:network_services_orchestrator:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:nexus_dashboard:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:nexus_insights:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:optical_network_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:optical_network_controller:1.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:packaged_contact_center_enterprise:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:packaged_contact_center_enterprise:11.6\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:paging_server:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:paging_server:12.5\(2\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:paging_server:14.0\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:paging_server:8.3\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:paging_server:8.4\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:paging_server:8.5\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:paging_server:9.0\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:paging_server:9.0\(2\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:paging_server:9.1\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_service_catalog:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_service_catalog:12.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan_vmanage:20.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan_vmanage:20.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan_vmanage:20.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan_vmanage:20.6.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan_vmanage:20.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan_vmanage:20.7:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan_vmanage:20.8:*:*:*:*:*:*:*;cpe:2.3:a:cisco:smart_phy:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:smart_phy:21.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:smart_phy:3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:smart_phy:3.1.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:smart_phy:3.1.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:smart_phy:3.1.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:smart_phy:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_central:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_central_software:2.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_central_software:2.0\(1a\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_central_software:2.0\(1b\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_central_software:2.0\(1c\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_central_software:2.0\(1d\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_central_software:2.0\(1e\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_central_software:2.0\(1f\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_central_software:2.0\(1g\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_central_software:2.0\(1h\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_central_software:2.0\(1k\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_central_software:2.0\(1l\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:ucs_director:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:-:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:session_management:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:11.5\(1.17900.52\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:11.5\(1.18119.2\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:11.5\(1.18900.97\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:11.5\(1.21900.40\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:11.5\(1.22900.28\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\):*:*:*:-:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\):*:*:*:session_management:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:11.5\(1\)su3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager_im_\&_presence_service:11.5\(1.22900.6\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager_im_\&_presence_service:11.5\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_computing_system:006.008\(001.000\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_contact_center_enterprise:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_contact_center_enterprise:11.6\(2\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_contact_center_enterprise:12.0\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_contact_center_enterprise:12.5\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_contact_center_enterprise:12.6\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_contact_center_enterprise:12.6\(2\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_contact_center_express:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\):-:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\):su1:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_contact_center_express:12.6\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_contact_center_express:12.6\(2\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_contact_center_management_portal:12.6\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_customer_voice_portal:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_customer_voice_portal:11.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_customer_voice_portal:11.6\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_customer_voice_portal:12.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_customer_voice_portal:12.0\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_customer_voice_portal:12.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_customer_voice_portal:12.5\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_customer_voice_portal:12.6\(1\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_intelligence_center:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_intelligence_center:12.6\(1\):-:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_intelligence_center:12.6\(1\):es01:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_intelligence_center:12.6\(1\):es02:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_intelligence_center:12.6\(2\):-:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_sip_proxy:010.000\(000\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_sip_proxy:010.000\(001\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_sip_proxy:010.002\(000\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_sip_proxy:010.002\(001\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_workforce_optimization:11.5\(1\):sr7:*:*:*:*:*:*;cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unity_connection:11.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unity_connection:11.5\(1.10000.6\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:video_surveillance_manager:7.14\(1.26\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:video_surveillance_manager:7.14\(2.26\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:video_surveillance_manager:7.14\(3.025\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:video_surveillance_manager:7.14\(4.018\):*:*:*:*:*:*:*;cpe:2.3:a:cisco:video_surveillance_operations_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:virtual_topology_system:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:virtual_topology_system:2.6.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:virtualized_infrastructure_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:virtualized_voice_browser:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:wan_automation_engine:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:wan_automation_engine:7.1.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:wan_automation_engine:7.2.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:wan_automation_engine:7.2.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:wan_automation_engine:7.2.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:wan_automation_engine:7.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:wan_automation_engine:7.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:wan_automation_engine:7.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:wan_automation_engine:7.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:3.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:3.0:-:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release1:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release2:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3:-:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3_security_patch4:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3_security_patch5:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3_service_pack_2:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3_service_pack_3:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release4:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:4.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:4.0:-:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:4.0:maintenance_release1:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:4.0:maintenance_release2:*:*:*:*:*:*;cpe:2.3:a:cisco:webex_meetings_server:4.0:maintenance_release3:*:*:*:*:*:*;cpe:2.3:a:cisco:workload_optimization_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:intel:computer_vision_annotation_tool:-:*:*:*:*:*:*:*;cpe:2.3:a:intel:datacenter_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:intel:genomics_kernel_library:-:*:*:*:*:*:*:*;cpe:2.3:a:intel:oneapi_sample_browser:-:*:*:*:*:eclipse:*:*;cpe:2.3:a:intel:secure_device_onboard:-:*:*:*:*:*:*:*;cpe:2.3:a:intel:system_studio:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*;cpe:2.3:a:netapp:brocade_san_navigator:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:cloud_insights:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:ontap_tools:-:*:*:*:*:vmware_vsphere:*:*;cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:vmware_vsphere:*:*;cpe:2.3:a:netapp:solidfire_\&_hci_storage_node:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:solidfire_enterprise_sds:-:*:*:*:*:*:*:*;cpe:2.3:a:percussion:rhythmyx:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:capital:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:capital:2019.1:-:*:*:*:*:*:*;cpe:2.3:a:siemens:capital:2019.1:sp1912:*:*:*:*:*:*;cpe:2.3:a:siemens:comos:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:desigo_cc_advanced_reports:3.0:*:*:*:*:*:*:*;cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.0:*:*:*:*:*:*:*;cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.1:*:*:*:*:*:*:*;cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.2:*:*:*:*:*:*:*;cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.0:*:*:*:*:*:*:*;cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.1:*:*:*:*:*:*:*;cpe:2.3:a:siemens:desigo_cc_info_center:5.0:*:*:*:*:*:*:*;cpe:2.3:a:siemens:desigo_cc_info_center:5.1:*:*:*:*:*:*:*;cpe:2.3:a:siemens:e-car_operation_center:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:energy_engage:3.1:*:*:*:*:*:*:*;cpe:2.3:a:siemens:energyip:8.5:*:*:*:*:*:*:*;cpe:2.3:a:siemens:energyip:8.6:*:*:*:*:*:*:*;cpe:2.3:a:siemens:energyip:8.7:*:*:*:*:*:*:*;cpe:2.3:a:siemens:energyip:9.0:*:*:*:*:*:*:*;cpe:2.3:a:siemens:energyip_prepay:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:head-end_system_universal_device_integration_system:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:industrial_edge_management:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:industrial_edge_management_hub:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:logo\!_soft_comfort:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:mendix:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:mindsphere:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:navigator:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:nx:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:opcenter_intelligence:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:sentron_powermanager:4.1:*:*:*:*:*:*:*;cpe:2.3:a:siemens:sentron_powermanager:4.2:*:*:*:*:*:*:*;cpe:2.3:a:siemens:siguard_dsa:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:*;cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:*;cpe:2.3:a:siemens:siveillance_command:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:siveillance_control_pro:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:*;cpe:2.3:a:siemens:siveillance_identity:1.6:*:*:*:*:*:*:*;cpe:2.3:a:siemens:siveillance_vantage:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:siveillance_viewpoint:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:solid_edge_cam_pro:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:solid_edge_harness_design:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:solid_edge_harness_design:2020:*:*:*:*:*:*:*;cpe:2.3:a:siemens:solid_edge_harness_design:2020:-:*:*:*:*:*:*;cpe:2.3:a:siemens:solid_edge_harness_design:2020:sp2002:*:*:*:*:*:*;cpe:2.3:a:siemens:spectrum_power_4:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:spectrum_power_4:4.70:-:*:*:*:*:*:*;cpe:2.3:a:siemens:spectrum_power_4:4.70:sp7:*:*:*:*:*:*;cpe:2.3:a:siemens:spectrum_power_4:4.70:sp8:*:*:*:*:*:*;cpe:2.3:a:siemens:spectrum_power_7:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:spectrum_power_7:2.30:*:*:*:*:*:*:*;cpe:2.3:a:siemens:spectrum_power_7:2.30:-:*:*:*:*:*:*;cpe:2.3:a:siemens:spectrum_power_7:2.30:sp2:*:*:*:*:*:*;cpe:2.3:a:siemens:teamcenter:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:vesys:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:vesys:2019.1:*:*:*:*:*:*:*;cpe:2.3:a:siemens:vesys:2019.1:-:*:*:*:*:*:*;cpe:2.3:a:siemens:vesys:2019.1:sp1912:*:*:*:*:*:*;cpe:2.3:a:siemens:vesys:2020.1:-:*:*:*:*:*:*;cpe:2.3:a:siemens:vesys:2021.1:-:*:*:*:*:*:*;cpe:2.3:a:siemens:xpedition_enterprise:-:*:*:*:*:*:*:*;cpe:2.3:a:siemens:xpedition_package_integrator:-:*:*:*:*:*:*:*;cpe:2.3:a:snowsoftware:snow_commander:*:*:*:*:*:*:*:*;cpe:2.3:a:snowsoftware:vm_access_proxy:*:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:email_security:*:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_1010:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_1120:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_1140:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_1150:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_2110:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_2120:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_2130:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_2140:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_4110:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_4112:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_4115:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_4120:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_4125:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_4140:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_4145:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_4150:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_9300:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:6bk1602-0aa12-0tp0:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:6bk1602-0aa22-0tp0:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:6bk1602-0aa32-0tp0:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:6bk1602-0aa42-0tp0:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:6bk1602-0aa52-0tp0:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:sppa-t3000_ses3000:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:fxos:6.2.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:fxos:6.3.0:*:*:*:*:*:*:*;cpe:2.3:o:cisco:fxos:6.4.0:*:*:*:*:*:*:*;cpe:2.3:o:cisco:fxos:6.5.0:*:*:*:*:*:*:*;cpe:2.3:o:cisco:fxos:6.6.0:*:*:*:*:*:*:*;cpe:2.3:o:cisco:fxos:6.7.0:*:*:*:*:*:*:*;cpe:2.3:o:cisco:fxos:7.0.0:*:*:*:*:*:*:*;cpe:2.3:o:cisco:fxos:7.1.0:*:*:*:*:*:*:*;cpe:2.3:o:cisco:unified_sip_proxy:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:unified_workforce_optimization:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*;cpe:2.3:o:siemens:6bk1602-0aa12-0tp0_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:6bk1602-0aa22-0tp0_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:6bk1602-0aa32-0tp0_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:6bk1602-0aa42-0tp0_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:6bk1602-0aa52-0tp0_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:sppa-t3000_ses3000_firmware:*:*:*:*:*:*:*:*,Siemens,6Bk1602-0Aa12-0Tp0 Firmware
CVE-2021-44260,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.07573,CWE-306,"A vulnerability is in the 'live_mfg.html' page of the WAVLINK AC1200, version WAVLINK-A42W-1.27.6-20180418, which can allow a remote attacker to access this page without any authentication. When processed, it exposes some key information of the manager of router.",2022-03-17,Nuclei,cpe:2.3:h:wavlink:wl-wn531g3:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wl-wn531g3_firmware:a42w-1.27.6-20180418:*:*:*:*:*:*:*,Wavlink,Wl-Wn531G3 Firmware
CVE-2021-4436,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06646,CWE-434,"The 3DPrint Lite WordPress plugin before 1.9.1.5 does not have any authorisation and does not check the uploaded file in its p3dlite_handle_upload AJAX action , allowing unauthenticated users to upload arbitrary file to the web server. However, there is a .htaccess, preventing the file to be accessed on Web servers such as Apache.",2024-02-05,Nuclei,cpe:2.3:a:wp3dprinting:3dprint_lite:*:*:*:*:*:wordpress:*:*,Wp3Dprinting,3Dprint Lite
CVE-2021-44427,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.50641,CWE-89,"An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.",2021-11-29,Nuclei,cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:*,Rosariosis,Rosariosis
CVE-2021-44451,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.07863,CWE-522,Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgrade to Apache Superset 1.4.0 or higher.,2022-02-01,Nuclei,cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*,Apache,Superset
CVE-2021-4448,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.01381,CWE-862,"The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability checking on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of unauthorized actions such as importing data, uploading arbitrary files, deleting arbitrary files, and more.",2024-10-16,Nuclei,cpe:2.3:a:kaswara_project:kaswara:*:*:*:*:*:wordpress:*:*,Kaswara Project,Kaswara
CVE-2021-4449,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05439,CWE-434,"The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in versions up to, and including, 5.96. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2021-4457 is a duplicate of this.",2024-10-16,Nuclei,cpe:2.3:a:digitalzoomstudio:zoomsounds:*:*:*:*:*:wordpress:*:*,Digitalzoomstudio,Zoomsounds
CVE-2021-44515,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99867,NVD-CWE-noinfo,"Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. For MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3.",2021-12-12,CISA/EPSS/Nuclei,cpe:2.3:a:zohocorp:manageengine_desktop_central:*:*:*:*:enterprise:*:*:*;cpe:2.3:a:zohocorp:manageengine_desktop_central:*:*:*:*:managed_service_providers:*:*:*,Zohocorp,Manageengine Desktop Central
CVE-2021-44521,9.1,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H,0.54727,CWE-94,"When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.",2022-02-11,Nuclei,cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*,Apache,Cassandra
CVE-2021-44528,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.04182,CWE-601,"A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a ""X-Forwarded-Host"" headers in combination with certain ""allowed host"" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.",2022-01-10,Nuclei,cpe:2.3:a:rubyonrails:rails:6.0.4.2:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:6.1.4.2:*:*:*:*:*:*:*;cpe:2.3:a:rubyonrails:rails:7.0.0:rc2:*:*:*:*:*:*,Rubyonrails,Rails
CVE-2021-44529,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99105,CWE-94,A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).,2021-12-08,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:ivanti:endpoint_manager_cloud_services_appliance:*:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager_cloud_services_appliance:4.6:-:*:*:*:*:*:*,Ivanti,Endpoint Manager Cloud Services Appliance
CVE-2021-4462,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03237,CWE-434,Employee Records System version 1.0 contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload arbitrary files via the uploadID.php endpoint; uploaded files can be executed because the application does not perform proper server-side validation. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.,2025-11-10,Nuclei,cpe:2.3:a:skittles:employee_records_system:1.0:*:*:*:*:*:*:*,Skittles,Employee Records System
CVE-2021-4463,0.0,,0.01473,CWE-22,"Longjing Technology BEMS API versions up to and including 1.21 contains an unauthenticated arbitrary file download vulnerability in the 'downloads' endpoint. The 'fileName' parameter is not properly sanitized, allowing attackers to craft traversal sequences and access sensitive files outside the intended directory.",2025-11-12,Nuclei,,,
CVE-2021-44790,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97108,CWE-787,A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.,2021-12-20,EPSS,cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_operations_monitor:4.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_operations_monitor:4.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_operations_monitor:5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*;cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-002:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-003:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-004:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-005:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-006:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-007:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-008:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-002:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-003:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-44832,6.6,CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H,0.97906,CWE-20,"Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.",2021-12-28,EPSS,cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*;cpe:2.3:a:apache:log4j:2.0:beta7:*:*:*:*:*:*;cpe:2.3:a:apache:log4j:2.0:beta8:*:*:*:*:*:*;cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*;cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*;cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*;cpe:2.3:a:cisco:cloudcenter:4.10.0.16:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_interactive_session_recorder:6.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_offline_mediation_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:health_sciences_data_management_workbench:2.5.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:health_sciences_data_management_workbench:3.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:health_sciences_data_management_workbench:3.1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:policy_automation_for_mobile_devices:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_gateway:21.12.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:21.12.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:*;cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_assortment_planning:16.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_fiscal_management:14.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_order_broker:18.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_order_broker:19.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:21.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:siebel_ui_framework:21.12:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2021-44848,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.23141,CWE-203,"In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exists.",2021-12-13,Nuclei,cpe:2.3:a:cybelesoft:thinfinity_virtualui:*:*:*:*:*:*:*:*,Cybelesoft,Thinfinity Virtualui
CVE-2021-45027,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01642,CWE-494,An arbitrary file download vulnerability in Oliver v5 Library Server Versions < 5.00.008.053 via the FileServlet function allows for arbitrary file download by an attacker using unsanitized user supplied input.,2022-09-01,Nuclei,cpe:2.3:a:softlinkint:oliver_v5_library:*:*:*:*:*:*:*:*,Softlinkint,Oliver V5 Library
CVE-2021-45043,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.33133,CWE-22,HD-Network Real-time Monitoring System 2.0 allows ../ directory traversal to read /etc/shadow via the /language/lang s_Language parameter.,2021-12-15,Nuclei,cpe:2.3:a:hd-network_real-time_monitoring_system_project:hd-network_real-time_monitoring_system:2.0:*:*:*:*:*:*:*,Hd-Network Real-Time Monitoring System Project,Hd-Network Real-Time Monitoring System
CVE-2021-45046,9.0,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H,0.99977,CWE-917,"It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.",2021-12-14,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*;cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*;cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*;cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*;cpe:2.3:a:cvat:computer_vision_annotation_tool:-:*:*:*:*:*:*:*;cpe:2.3:a:intel:audio_development_kit:-:*:*:*:*:*:*:*;cpe:2.3:a:intel:datacenter_manager:-:*:*:*:*:*:*:*;cpe:2.3:a:intel:genomics_kernel_library:-:*:*:*:*:*:*:*;cpe:2.3:a:intel:oneapi:-:*:*:*:*:eclipse:*:*;cpe:2.3:a:intel:secure_device_onboard:-:*:*:*:*:*:*:*;cpe:2.3:a:intel:sensor_solution_firmware_development_kit:-:*:*:*:*:*:*:*;cpe:2.3:a:intel:system_debugger:-:*:*:*:*:*:*:*;cpe:2.3:a:intel:system_studio:-:*:*:*:*:*:*:*;cpe:2.3:a:siemens:captial:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:captial:2019.1:-:*:*:*:*:*:*;cpe:2.3:a:siemens:captial:2019.1:sp1912:*:*:*:*:*:*;cpe:2.3:a:siemens:comos:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.0:*:*:*:*:*:*:*;cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.1:*:*:*:*:*:*:*;cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.2:*:*:*:*:*:*:*;cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.0:*:*:*:*:*:*:*;cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.1:*:*:*:*:*:*:*;cpe:2.3:a:siemens:desigo_cc_info_center:5.0:*:*:*:*:*:*:*;cpe:2.3:a:siemens:desigo_cc_info_center:5.1:*:*:*:*:*:*:*;cpe:2.3:a:siemens:e-car_operation_center:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:energy_engage:3.1:*:*:*:*:*:*:*;cpe:2.3:a:siemens:energyip:8.5:*:*:*:*:*:*:*;cpe:2.3:a:siemens:energyip:8.6:*:*:*:*:*:*:*;cpe:2.3:a:siemens:energyip:8.7:*:*:*:*:*:*:*;cpe:2.3:a:siemens:energyip:9.0:*:*:*:*:*:*:*;cpe:2.3:a:siemens:energyip_prepay:3.7:*:*:*:*:*:*:*;cpe:2.3:a:siemens:energyip_prepay:3.8:*:*:*:*:*:*:*;cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:head-end_system_universal_device_integration_system:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:industrial_edge_management:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:industrial_edge_management_hub:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:logo\!_soft_comfort:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:mendix:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:mindsphere:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:navigator:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:nx:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:opcenter_intelligence:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:sentron_powermanager:4.1:*:*:*:*:*:*:*;cpe:2.3:a:siemens:sentron_powermanager:4.2:*:*:*:*:*:*:*;cpe:2.3:a:siemens:siguard_dsa:4.2:*:*:*:*:*:*:*;cpe:2.3:a:siemens:siguard_dsa:4.3:*:*:*:*:*:*:*;cpe:2.3:a:siemens:siguard_dsa:4.4:*:*:*:*:*:*:*;cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:*;cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:*;cpe:2.3:a:siemens:siveillance_command:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:siveillance_control_pro:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:*;cpe:2.3:a:siemens:siveillance_identity:1.6:*:*:*:*:*:*:*;cpe:2.3:a:siemens:siveillance_vantage:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:siveillance_viewpoint:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:solid_edge_cam_pro:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:solid_edge_harness_design:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:solid_edge_harness_design:2020:*:*:*:*:*:*:*;cpe:2.3:a:siemens:solid_edge_harness_design:2020:-:*:*:*:*:*:*;cpe:2.3:a:siemens:solid_edge_harness_design:2020:sp2002:*:*:*:*:*:*;cpe:2.3:a:siemens:spectrum_power_4:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:spectrum_power_4:4.70:-:*:*:*:*:*:*;cpe:2.3:a:siemens:spectrum_power_4:4.70:sp7:*:*:*:*:*:*;cpe:2.3:a:siemens:spectrum_power_4:4.70:sp8:*:*:*:*:*:*;cpe:2.3:a:siemens:spectrum_power_7:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:spectrum_power_7:2.30:*:*:*:*:*:*:*;cpe:2.3:a:siemens:spectrum_power_7:2.30:-:*:*:*:*:*:*;cpe:2.3:a:siemens:spectrum_power_7:2.30:sp2:*:*:*:*:*:*;cpe:2.3:a:siemens:teamcenter:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:tracealertserverplus:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:vesys:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:vesys:2019.1:*:*:*:*:*:*:*;cpe:2.3:a:siemens:vesys:2019.1:-:*:*:*:*:*:*;cpe:2.3:a:siemens:vesys:2019.1:sp1912:*:*:*:*:*:*;cpe:2.3:a:siemens:xpedition_enterprise:-:*:*:*:*:*:*:*;cpe:2.3:a:siemens:xpedition_package_integrator:-:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:email_security:*:*:*:*:*:*:*:*;cpe:2.3:h:siemens:6bk1602-0aa12-0tp0:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:6bk1602-0aa22-0tp0:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:6bk1602-0aa32-0tp0:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:6bk1602-0aa42-0tp0:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:6bk1602-0aa52-0tp0:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:sppa-t3000_ses3000:-:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*;cpe:2.3:o:siemens:6bk1602-0aa12-0tp0_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:6bk1602-0aa22-0tp0_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:6bk1602-0aa32-0tp0_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:6bk1602-0aa42-0tp0_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:6bk1602-0aa52-0tp0_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:sppa-t3000_ses3000_firmware:*:*:*:*:*:*:*:*,Siemens,Sppa-T3000 Ses3000 Firmware
CVE-2021-45092,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.39973,NVD-CWE-Other,Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameter.,2021-12-16,Nuclei,cpe:2.3:a:cybelesoft:thinfinity_virtualui:*:*:*:*:*:*:*:*,Cybelesoft,Thinfinity Virtualui
CVE-2021-45105,5.9,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H,0.99999,CWE-20,"Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.",2021-12-18,EPSS,cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:*;cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:agile_plm_mcad_connector:3.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_deposits_and_lines_of_credit_servicing:2.12.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_loans_servicing:2.12.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_payments:14.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_platform:2.12.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_trade_finance:14.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:*;cpe:2.3:a:oracle:communications_asap:7.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_convergence:3.0.2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_convergence:3.0.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_convergent_charging_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_convergent_charging_controller:6.0.1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_eagle_element_management_system:46.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_eagle_ftp_table_base_retrieval:4.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_interactive_session_recorder:6.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_ip_service_activator:7.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_network_charging_and_control:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_network_integrity:7.3.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_performance_intelligence_center:10.4.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_service_broker:6.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_user_data_repository:12.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:e-business_suite:12.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_for_peoplesoft:13.4.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_for_peoplesoft:13.5.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.0.8.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:flexcube_universal_banking:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:flexcube_universal_banking:11.83.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:flexcube_universal_banking:14.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:health_sciences_empirica_signal:9.1.0.6:*:*:*:*:*:*:*;cpe:2.3:a:oracle:health_sciences_empirica_signal:9.2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:health_sciences_inform:6.2.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:health_sciences_inform:6.3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:health_sciences_inform:7.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:health_sciences_information_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:healthcare_data_repository:8.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:healthcare_foundation:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:healthcare_master_person_index:5.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:healthcare_translational_research:4.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:healthcare_translational_research:4.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hospitality_suite8:8.13.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hospitality_suite8:8.14.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hospitality_token_proxy_service:19.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hyperion_bi\+:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hyperion_data_relationship_management:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hyperion_infrastructure_technology:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hyperion_planning:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hyperion_profitability_and_cost_management:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:hyperion_tax_provision:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:identity_management_suite:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:identity_management_suite:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:identity_manager_connector:9.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_data_gateway:1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.6.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:management_cloud_engine:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:payment_interface:19.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:payment_interface:20.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*;cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_gateway:21.12.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:21.12.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*;cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_customer_insights:15.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_customer_insights:16.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_data_extractor_for_merchandising:15.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_data_extractor_for_merchandising:16.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_eftlink:16.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_eftlink:17.0.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_eftlink:18.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_eftlink:19.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_eftlink:20.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_eftlink:21.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_financial_integration:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_financial_integration:15.0.3.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_financial_integration:19.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_financial_integration:19.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:14.1.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:15.0.3.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:19.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:19.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_invoice_matching:15.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_invoice_matching:16.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_merchandising_system:19.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_order_broker:18.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_order_broker:19.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_order_management_system:19.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_predictive_application_server:14.1.3.46:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3.115:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3.240:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_price_management:13.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_price_management:14.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_price_management:14.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_price_management:15.0.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_price_management:16.0.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_service_backbone:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_service_backbone:14.1.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_service_backbone:15.0.3.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_service_backbone:19.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_service_backbone:19.0.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_service_backbone:19.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_store_inventory_management:14.0.4.13:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3.14:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3.8:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_store_inventory_management:16.0.3.7:*:*:*:*:*:*:*;cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:sql_developer:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:taleo_platform:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:email_security:*:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:network_security_manager:*:*:*:*:on-premises:*:*:*;cpe:2.3:a:sonicwall:network_security_manager:*:*:*:*:saas:*:*:*;cpe:2.3:a:sonicwall:web_application_firewall:*:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:6bk1602-0aa12-0tp0:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:6bk1602-0aa22-0tp0:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:6bk1602-0aa32-0tp0:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:6bk1602-0aa42-0tp0:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:6bk1602-0aa52-0tp0:-:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:6bk1602-0aa12-0tp0_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:6bk1602-0aa22-0tp0_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:6bk1602-0aa32-0tp0_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:6bk1602-0aa42-0tp0_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:6bk1602-0aa52-0tp0_firmware:*:*:*:*:*:*:*:*,Sonicwall,6Bk1602-0Aa12-0Tp0 Firmware
CVE-2021-45232,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.85943,CWE-306,"In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication.",2021-12-27,Nuclei,cpe:2.3:a:apache:apisix_dashboard:*:*:*:*:*:*:*:*,Apache,Apisix Dashboard
CVE-2021-45328,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00948,CWE-601,Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs.,2022-02-08,Nuclei,cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*,Gitea,Gitea
CVE-2021-45380,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02542,CWE-79,AppCMS 2.0.101 has a XSS injection vulnerability in \templates\m\inc_head.php,2022-01-23,Nuclei,cpe:2.3:a:appcms:appcms:2.0.101:*:*:*:*:*:*:*,Appcms,Appcms
CVE-2021-45382,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97836,CWE-78,"A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have reached their End of Life (""EOL"") /End of Service Life (""EOS"") Life-Cycle and as such this issue will not be patched.",2022-02-17,CISA/EPSS/Nuclei,cpe:2.3:h:dlink:dir-810l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-820l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-820lw:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-826l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-830l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dir-836l:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-810l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-820l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-820lw_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-826l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-830l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-836l_firmware:-:*:*:*:*:*:*:*,D-Link,Dir-820L Firmware
CVE-2021-45420,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.1755,CWE-200,"Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to denial of service and potentially remote code execution. Note: the product has not been supported since 2018 and should be removed or replaced.",2022-02-14,Nuclei,cpe:2.3:h:emerson:dixell_xweb-500:-:*:*:*:*:*:*:*;cpe:2.3:o:emerson:dixell_xweb-500_firmware:-:*:*:*:*:*:*:*,Emerson,Dixell Xweb-500 Firmware
CVE-2021-45422,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03241,CWE-79,"Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability in the /goform/activate_process ""count"" parameter via GET. No authentication is required.",2022-01-13,Nuclei,cpe:2.3:a:reprisesoftware:reprise_license_manager:*:*:*:*:*:*:*:*,Reprisesoftware,Reprise License Manager
CVE-2021-45428,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.56931,CWE-639,TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can upload arbitrary files including HTML and CGI formats.,2022-01-03,Nuclei,cpe:2.3:h:telesquare:tlr-2005ksh:-:*:*:*:*:*:*:*;cpe:2.3:o:telesquare:tlr-2005ksh_firmware:-:*:*:*:*:*:*:*,Telesquare,Tlr-2005Ksh Firmware
CVE-2021-45467,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.70947,NVD-CWE-noinfo,"In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/account_new_create&acc=guadaapi URI. Any number of %00 instances can be used, e.g., .%00%00%00./.%00%00%00./api/account_new_create could also be used for the scripts parameter.",2022-12-26,Nuclei,cpe:2.3:a:control-webpanel:webpanel:*:*:*:*:*:*:*:*,Control-Webpanel,Webpanel
CVE-2021-45511,6.8,CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.17641,NVD-CWE-noinfo,"Certain NETGEAR devices are affected by authentication bypass. This affects AC2100 before 2021-08-27, AC2400 before 2021-08-27, AC2600 before 2021-08-27, D7000 before 2021-08-27, R6220 before 2021-08-27, R6230 before 2021-08-27, R6260 before 2021-08-27, R6330 before 2021-08-27, R6350 before 2021-08-27, R6700v2 before 2021-08-27, R6800 before 2021-08-27, R6850 before 2021-08-27, R6900v2 before 2021-08-27, R7200 before 2021-08-27, R7350 before 2021-08-27, R7400 before 2021-08-27, and R7450 before 2021-08-27.",2021-12-26,Metasploit,cpe:2.3:h:netgear:ac2100:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:ac2400:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:ac2600:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:d7000:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6220:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6230:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6260:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6330:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6350:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6700v2:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6800:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6850:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r6900v2:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r7200:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r7350:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r7400:-:*:*:*:*:*:*:*;cpe:2.3:h:netgear:r7450:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:ac2100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:ac2400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:ac2600_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:d7000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6220_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6230_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6260_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6330_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6350_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6700v2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6800_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6850_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6900v2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r7200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r7350_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r7400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r7450_firmware:*:*:*:*:*:*:*:*,Netgear,Ac2100 Firmware
CVE-2021-45793,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04637,CWE-89,Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data can be obtained.,2022-03-17,Nuclei,cpe:2.3:a:slims:senayan_library_management_system:9.4.2:*:*:*:*:*:*:*,Slims,Senayan Library Management System
CVE-2021-45811,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.02454,CWE-89,"A SQL injection vulnerability in the ""Search"" functionality of ""tickets.php"" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the ""keywords"" and ""topic_id"" URL parameters combination.",2023-09-08,Nuclei,cpe:2.3:a:enhancesoft:osticket:*:*:*:*:*:*:*:*,Enhancesoft,Osticket
CVE-2021-45837,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.15727,NVD-CWE-noinfo,"It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending a specifically crafted input to /tos/index.php?app/del.",2022-04-25,Metasploit,cpe:2.3:h:terra-master:f2-210:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:f4-210:-:*:*:*:*:*:*:*;cpe:2.3:o:terra-master:tos:4.2.15-2107141517:*:*:*:*:*:*:*,Terra-Master,Tos
CVE-2021-45839,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.09716,NVD-CWE-noinfo,"It is possible to obtain the first administrator's hash set up on the system in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) as well as other information such as MAC address, internal IP address etc. by performing a request to the /module/api.php?mobile/webNasIPS endpoint.",2022-04-25,Metasploit,cpe:2.3:h:terra-master:f2-210:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:f4-210:-:*:*:*:*:*:*:*;cpe:2.3:o:terra-master:tos:4.2.15-2107141517:*:*:*:*:*:*:*,Terra-Master,Tos
CVE-2021-45841,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.08289,CWE-287,"In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address and the user's password hash. Guest users (disabled by default) can be abused using a null/empty hash and allow an unauthenticated attacker to login as guest.",2022-04-25,Metasploit,cpe:2.3:h:terra-master:f2-210:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:f4-210:-:*:*:*:*:*:*:*;cpe:2.3:o:terra-master:tos:4.2.15-2107141517:*:*:*:*:*:*:*,Terra-Master,Tos
CVE-2021-45967,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.208,CWE-22,"An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints.",2022-03-18,Nuclei,cpe:2.3:a:igniterealtime:openfire:*:*:*:*:*:*:*:*;cpe:2.3:a:igniterealtime:openfire:4.5.0:-:*:*:*:*:*:*;cpe:2.3:a:pascom:cloud_phone_system:*:*:*:*:*:*:*:*,Pascom,Cloud Phone System
CVE-2021-45968,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.10666,CWE-918,"An issue was discovered in xmppserver jar in the XMPP Server component of the JIve platform, as used in Pascom Cloud Phone System before 7.20.x (and in other products). An endpoint in the backend Tomcat server of the Pascom allows SSRF, a related issue to CVE-2019-18394.",2022-03-18,Nuclei,cpe:2.3:a:jivesoftware:jive:-:*:*:*:*:*:*:*;cpe:2.3:a:pascom:cloud_phone_system:*:*:*:*:*:*:*:*,Jivesoftware,Jive
CVE-2021-46005,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.02915,CWE-79,Sourcecodester Car Rental Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via vehicalorcview parameter.,2022-01-18,Nuclei,cpe:2.3:a:car_rental_management_system_project:car_rental_management_system:1.0:*:*:*:*:*:*:*,Car Rental Management System Project,Car Rental Management System
CVE-2021-46068,4.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N,0.02736,CWE-79,A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the My Account Section in login panel.,2022-01-06,Nuclei,cpe:2.3:a:vehicle_service_management_system_project:vehicle_service_management_system:*:*:*:*:*:*:*:*,Vehicle Service Management System Project,Vehicle Service Management System
CVE-2021-46069,4.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N,0.02736,CWE-79,A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Mechanic List Section in login panel.,2022-01-06,Nuclei,cpe:2.3:a:vehicle_service_management_system_project:vehicle_service_management_system:*:*:*:*:*:*:*:*,Vehicle Service Management System Project,Vehicle Service Management System
CVE-2021-46071,4.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N,0.02736,CWE-79,A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Category List Section in login panel.,2022-01-06,Nuclei,cpe:2.3:a:vehicle_service_management_system_project:vehicle_service_management_system:*:*:*:*:*:*:*:*,Vehicle Service Management System Project,Vehicle Service Management System
CVE-2021-46072,4.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N,0.02736,CWE-79,A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service List Section in login panel.,2022-01-06,Nuclei,cpe:2.3:a:vehicle_service_management_system_project:vehicle_service_management_system:*:*:*:*:*:*:*:*,Vehicle Service Management System Project,Vehicle Service Management System
CVE-2021-46073,4.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N,0.02759,CWE-79,A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the User List Section in login panel.,2022-01-06,Nuclei,cpe:2.3:a:vehicle_service_management_system_project:vehicle_service_management_system:*:*:*:*:*:*:*:*,Vehicle Service Management System Project,Vehicle Service Management System
CVE-2021-46104,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04231,CWE-22,An issue was discovered in webp_server_go 0.4.0. There is a directory traversal vulnerability that can read arbitrary file information on the server.,2022-01-19,Nuclei,cpe:2.3:a:webp:webp_server_go:0.4.0:*:*:*:*:*:*:*,Webp,Webp Server Go
CVE-2021-46107,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.07408,CWE-918,Ligeo Archives Ligeo Basics as of 02_01-2022 is vulnerable to Server Side Request Forgery (SSRF) which allows an attacker to read any documents via the download features.,2022-03-17,Nuclei,cpe:2.3:a:ligeo-archives:ligeo_basics:02_01-2022:*:*:*:*:*:*:*,Ligeo-Archives,Ligeo Basics
CVE-2021-46371,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04305,CWE-306,antd-admin 5.5.0 is affected by an incorrect access control vulnerability. Unauthorized access to some interfaces in the foreground leads to leakage of sensitive information.,2022-02-14,Nuclei,cpe:2.3:a:antd-admin_project:antd-admin:5.5.0:*:*:*:*:*:*:*,Antd-Admin Project,Antd-Admin
CVE-2021-46379,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.15701,CWE-601,DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through URL redirection to untrusted site.,2022-03-04,Nuclei,cpe:2.3:h:dlink:dir-850l:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-850l_firmware:1.08trb03:*:*:*:*:*:*:*,D-Link,Dir-850L Firmware
CVE-2021-46381,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.57984,CWE-22,Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd] and [/etc/shadow].,2022-03-04,Nuclei,cpe:2.3:h:dlink:dap-1620:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dap-1620_firmware:-:*:*:*:*:*:*:*,D-Link,Dap-1620 Firmware
CVE-2021-46387,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.21028,CWE-79,"ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS). Insecure URI handling leads to bypass security restriction to achieve Cross Site Scripting, which allows an attacker able to execute arbitrary JavaScript codes to perform multiple attacks such as clipboard hijacking and session hijacking.",2022-03-01,Nuclei,cpe:2.3:h:zyxel:zywall_2_plus_internet_security_appliance:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_2_plus_internet_security_appliance_firmware:-:*:*:*:*:*:*:*,Zyxel,Zywall 2 Plus Internet Security Appliance Firmware
CVE-2021-46417,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.59753,CWE-22,Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privileges in Franklin Fueling Systems Colibri Controller Module 1.8.19.8580.,2022-04-07,Nuclei,cpe:2.3:h:franklinfueling:colibri:-:*:*:*:*:*:*:*;cpe:2.3:o:franklinfueling:colibri_firmware:1.8.19.8580:*:*:*:*:*:*:*,Franklinfueling,Colibri Firmware
CVE-2021-46418,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N,0.23945,NVD-CWE-Other,An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts.,2022-04-07,Nuclei,cpe:2.3:h:telesquare:tlr-2855ks6:-:*:*:*:*:*:*:*;cpe:2.3:o:telesquare:tlr-2855ks6_firmware:-:*:*:*:*:*:*:*,Telesquare,Tlr-2855Ks6 Firmware
CVE-2021-46419,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H,0.71384,NVD-CWE-Other,An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts.,2022-04-07,Nuclei,cpe:2.3:h:telesquare:tlr-2855ks6:-:*:*:*:*:*:*:*;cpe:2.3:o:telesquare:tlr-2855ks6_firmware:-:*:*:*:*:*:*:*,Telesquare,Tlr-2855Ks6 Firmware
CVE-2021-46422,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.94629,CWE-78,Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.,2022-04-27,Nuclei,cpe:2.3:h:telesquare:sdt-cs3b1:-:*:*:*:*:*:*:*;cpe:2.3:o:telesquare:sdt-cs3b1_firmware:1.1.0:*:*:*:*:*:*:*,Telesquare,Sdt-Cs3B1 Firmware
CVE-2021-46424,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H,0.36459,NVD-CWE-noinfo,"Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to delete any file, even system internal files, via a DELETE request.",2022-04-27,Nuclei,cpe:2.3:h:telesquare:tlr-2005ksh:-:*:*:*:*:*:*:*;cpe:2.3:o:telesquare:tlr-2005ksh_firmware:1.0.0:*:*:*:*:*:*:*,Telesquare,Tlr-2005Ksh Firmware
CVE-2021-46704,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.21901,CWE-78,"In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts). The vulnerability arises from insufficient input validation combined with a missing authorization check.",2022-03-06,Nuclei,cpe:2.3:a:genieacs:genieacs:*:*:*:*:*:*:*:*,Genieacs,Genieacs
CVE-2021-47795,6.2,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.00876,CWE-22,"GeoVision GeoWebServer 5.3.3 contains multiple vulnerabilities including local file inclusion, cross-site scripting, and remote code execution through improper input sanitization. Attackers can exploit the WebStrings.srf endpoint by manipulating path traversal and injection parameters to access system files and execute malicious scripts.",2026-01-16,Nuclei,,,
CVE-2022-0028,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H,0.02126,CWE-406,"A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. The DoS attack would appear to originate from a Palo Alto Networks PA-Series (hardware), VM-Series (virtual) and CN-Series (container) firewall against an attacker-specified target. To be misused by an external attacker, the firewall configuration must have a URL filtering profile with one or more blocked categories assigned to a source zone that has an external facing interface. This configuration is not typical for URL filtering and, if set, is likely unintended by the administrator. If exploited, this issue would not impact the confidentiality, integrity, or availability of our products. However, the resulting denial-of-service (DoS) attack may help obfuscate the identity of the attacker and implicate the firewall as the source of the attack. We have taken prompt action to address this issue in our PAN-OS software. All software updates for this issue are expected to be released no later than the week of August 15, 2022. This issue does not impact Panorama M-Series or Panorama virtual appliances. This issue has been resolved for all Cloud NGFW and Prisma Access customers and no additional action is required from them.",2022-08-10,CISA,cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.0.11:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.1.6:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.1.6:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:8.1.23:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:9.0.16:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:9.0.16:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:9.1.14:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:9.1.14:h1:*:*:*:*:*:*,Paloaltonetworks,Pan-Os
CVE-2022-0087,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02601,CWE-79,keystone is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'),2022-01-12,Nuclei,cpe:2.3:a:keystonejs:keystone:*:*:*:*:*:node.js:*:*,Keystonejs,Keystone
CVE-2022-0140,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.0384,CWE-306,"The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint.",2022-04-12,Nuclei,cpe:2.3:a:vfbpro:visual_form_builder:*:*:*:*:*:wordpress:*:*,Vfbpro,Visual Form Builder
CVE-2022-0147,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01601,CWE-79,"The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue",2022-03-14,Nuclei,cpe:2.3:a:cookieinformation:wp-gdpr-compliance:*:*:*:*:*:wordpress:*:*,Cookieinformation,Wp-Gdpr-Compliance
CVE-2022-0148,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01572,CWE-79,"The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on the my-sticky-elements-leads admin page.",2022-02-07,Nuclei,cpe:2.3:a:premio:mystickyelements:*:*:*:*:*:wordpress:*:*,Premio,Mystickyelements
CVE-2022-0149,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02337,CWE-79,The WooCommerce Stored Exporter WordPress plugin before 2.7.1 was affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the woo_ce admin page.,2022-02-07,Nuclei,cpe:2.3:a:visser:store_exporter_for_woocommerce:*:*:*:*:*:wordpress:*:*,Visser,Store Exporter For Woocommerce
CVE-2022-0150,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01718,CWE-79,"The WP Accessibility Helper (WAH) WordPress plugin before 0.6.0.7 does not sanitise and escape the wahi parameter before outputting back its base64 decode value in the page, leading to a Reflected Cross-Site Scripting issue",2022-02-28,Nuclei,cpe:2.3:a:wp_accessibility_helper_project:wp_accessibility_helper:*:*:*:*:*:wordpress:*:*,Wp Accessibility Helper Project,Wp Accessibility Helper
CVE-2022-0165,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0428,CWE-601,The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX action available to both unauthenticated and authenticated users,2022-03-14,Nuclei,cpe:2.3:a:king-theme:kingcomposer:*:*:*:*:*:wordpress:*:*,King-Theme,Kingcomposer
CVE-2022-0169,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.74615,CWE-89,"The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL injection",2022-03-14,Metasploit/Nuclei,cpe:2.3:a:10web:photo_gallery:*:*:*:*:*:wordpress:*:*,10Web,Photo Gallery
CVE-2022-0185,8.4,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.25151,CWE-190,"A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.",2022-02-11,CISA,cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*,Netapp,H410C Firmware
CVE-2022-0188,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.02315,CWE-306,"The CMP WordPress plugin before 4.0.19 allows any user, even not logged in, to arbitrarily change the coming soon page layout.",2022-02-14,Nuclei,cpe:2.3:a:niteothemes:cmp:*:*:*:*:*:wordpress:*:*,Niteothemes,Cmp
CVE-2022-0189,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02228,CWE-79,"The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the response, leading to a Reflected Cross-Site Scripting",2022-02-28,Nuclei,cpe:2.3:a:wprssaggregator:wp_rss_aggregator:*:*:*:*:*:wordpress:*:*,Wprssaggregator,Wp Rss Aggregator
CVE-2022-0201,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03368,CWE-79,"The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue",2022-02-14,Nuclei,cpe:2.3:a:permalink_manager_lite_project:permalink_manager_lite:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:permalink_manager_project:permalink_manager:*:*:*:*:pro:wordpress:*:*,Permalink Manager Lite Project,Permalink Manager Lite
CVE-2022-0206,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01458,CWE-79,"The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues",2022-02-14,Nuclei,cpe:2.3:a:newstatpress_project:newstatpress:*:*:*:*:*:wordpress:*:*,Newstatpress Project,Newstatpress
CVE-2022-0208,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02038,CWE-79,"The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting it back in the ""Bad mapid"" error message, leading to a Reflected Cross-Site Scripting",2022-02-14,Nuclei,cpe:2.3:a:mappresspro:mappress:*:*:*:*:*:wordpress:*:*,Mappresspro,Mappress
CVE-2022-0212,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02291,CWE-79,"The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue.",2022-02-14,Nuclei,cpe:2.3:a:10web:spidercalendar:*:*:*:*:*:wordpress:*:*,10Web,Spidercalendar
CVE-2022-0218,8.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L,0.70511,CWE-79,"The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the ~/includes/class-template-designer.php file, in versions up to and including 3.0.9. This makes it possible for attackers with no privileges to execute the endpoint and add malicious JavaScript to a vulnerable WordPress site.",2022-02-04,Nuclei,cpe:2.3:a:codemiq:wordpress_email_template_designer:*:*:*:*:*:wordpress:*:*,Codemiq,Wordpress Email Template Designer
CVE-2022-0220,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02329,CWE-116,"The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, responds with JSON data without an ""application/json"" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. Due to v1.9.26 adding a CSRF check, the XSS is only exploitable against unauthenticated users (as they all share the same nonce)",2022-02-01,Nuclei,cpe:2.3:a:welaunch:wordpress_gdpr\&ccpa:*:*:*:*:*:wordpress:*:*,Welaunch,Wordpress Gdpr&Ccpa
CVE-2022-0228,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.05887,CWE-89,"The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection",2022-02-21,Nuclei,cpe:2.3:a:sygnoos:popup_builder:*:*:*:*:*:wordpress:*:*,Sygnoos,Popup Builder
CVE-2022-0234,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01752,CWE-79,"The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting",2022-02-21,Nuclei,cpe:2.3:a:pluginus:woocs:*:*:*:*:*:wordpress:*:*,Pluginus,Woocs
CVE-2022-0250,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01513,CWE-79,"The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, leading to a Reflected Cross-Site Scripting",2022-07-04,Nuclei,cpe:2.3:a:redirection-for-contact-form7:redirection_for_contact_form_7:*:*:*:*:*:wordpress:*:*,Redirection-For-Contact-Form7,Redirection For Contact Form 7
CVE-2022-0271,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02254,CWE-79,"The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX action, leading to a Reflected Cross-Site Scripting",2022-04-11,Nuclei,cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:*,Thimpress,Learnpress
CVE-2022-0281,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.1201,CWE-200,Exposure of Sensitive Information to an Unauthorized Actor in Packagist microweber/microweber prior to 1.2.11.,2022-01-20,Nuclei,cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*,Microweber,Microweber
CVE-2022-0288,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02389,CWE-79,"The Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escape the html_element_selection parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting",2022-02-21,Nuclei,cpe:2.3:a:ad_inserter_pro_project:ad_inserter_pro:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:ad_inserter_project:ad_inserter:*:*:*:*:*:wordpress:*:*,Ad Inserter Pro Project,Ad Inserter Pro
CVE-2022-0342,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.84839,CWE-287,"An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.",2022-03-28,Nuclei,cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:nsg300:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg40:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg40w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg60:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg60w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_1100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_110:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_310:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:nsg300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:nsg300_firmware:1.33:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:nsg300_firmware:1.33:p4:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg40_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg40w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg60_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg60w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_1100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_110_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_310_firmware:*:*:*:*:*:*:*:*,Zyxel,Usg40 Firmware
CVE-2022-0346,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02353,CWE-79,"The XML Sitemap Generator for Google WordPress plugin before 2.0.4 does not validate a parameter which can be set to an arbitrary value, thus causing XSS via error message or RCE if allow_url_include is turned on.",2022-05-23,Nuclei,cpe:2.3:a:xmlsitemapgenerator:xml_sitemap_generator:*:*:*:*:*:wordpress:*:*,Xmlsitemapgenerator,Xml Sitemap Generator
CVE-2022-0349,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.34359,CWE-89,"The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading to an Unauthenticated Blind SQL Injection",2022-03-07,Nuclei,cpe:2.3:a:wpdeveloper:notificationx:*:*:*:*:*:wordpress:*:*,Wpdeveloper,Notificationx
CVE-2022-0378,5.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N,0.03866,CWE-79,Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.,2022-01-26,Nuclei,cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*,Microweber,Microweber
CVE-2022-0381,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03865,CWE-79,"The Embed Swagger WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation via the url parameter found in the ~/swagger-iframe.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and including 1.0.0.",2022-02-04,Nuclei,cpe:2.3:a:embed_swagger_project:embed_swagger:*:*:*:*:*:wordpress:*:*,Embed Swagger Project,Embed Swagger
CVE-2022-0412,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.73998,CWE-89,"The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the item_id parameter before using it in a SQL statement via the wishlist/remove_product REST endpoint, allowing unauthenticated attackers to perform SQL injection attacks",2022-02-28,Nuclei,cpe:2.3:a:templateinvaders:ti_woocommerce_wishlist:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:templateinvaders:ti_woocommerce_wishlist:*:*:*:*:pro:wordpress:*:*,Templateinvaders,Ti Woocommerce Wishlist
CVE-2022-0415,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.65237,CWE-20,Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.,2022-03-21,Nuclei,cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*,Gogs,Gogs
CVE-2022-0422,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0812,CWE-79,"The White Label CMS WordPress plugin before 2.2.9 does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewing, leading to a Reflected Cross-Site Scripting issue",2022-03-07,Nuclei,cpe:2.3:a:videousermanuals:white_label_cms:*:*:*:*:*:wordpress:*:*,Videousermanuals,White Label Cms
CVE-2022-0424,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.02869,CWE-306,"The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses of subscribed users",2022-05-09,Nuclei,cpe:2.3:a:supsystic:popup:*:*:*:*:*:wordpress:*:*,Supsystic,Popup
CVE-2022-0429,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01378,CWE-79,"The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability.",2022-03-07,Nuclei,"cpe:2.3:a:cerber:wp_cerber_security\,_anti-spam_\&_malware_scan:*:*:*:*:*:wordpress:*:*",Cerber,"Wp Cerber Security, Anti-Spam & Malware Scan"
CVE-2022-0432,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.04062,CWE-1321,Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0.,2022-02-02,Nuclei,cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*,Joinmastodon,Mastodon
CVE-2022-0434,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.14783,CWE-89,"The Page View Count WordPress plugin before 2.4.15 does not sanitise and escape the post_ids parameter before using it in a SQL statement via a REST endpoint, available to both unauthenticated and authenticated users. As a result, unauthenticated attackers could perform SQL injection attacks",2022-03-07,Nuclei,cpe:2.3:a:a3rev:page_view_count:*:*:*:*:*:wordpress:*:*,A3Rev,Page View Count
CVE-2022-0437,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.15174,CWE-79,Cross-site Scripting (XSS) - DOM in NPM karma prior to 6.3.14.,2022-02-05,Nuclei,cpe:2.3:a:karma_project:karma:*:*:*:*:*:node.js:*:*,Karma Project,Karma
CVE-2022-0439,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.04184,CWE-89,"The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protection in place for the action, allowing an attacker to trick any logged in user to perform the action by clicking a link.",2022-03-07,Nuclei,cpe:2.3:a:icegram:email_subscribers_\&_newsletters:*:*:*:*:*:wordpress:*:*,Icegram,Email Subscribers & Newsletters
CVE-2022-0441,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.84943,CWE-269,"The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an admin",2022-03-07,Metasploit/Nuclei,cpe:2.3:a:stylemixthemes:masterstudy_lms:*:*:*:*:*:wordpress:*:*,Stylemixthemes,Masterstudy Lms
CVE-2022-0479,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.43174,CWE-89,"The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboard, leading to a SQL injection, which could also be used to perform Reflected Cross-Site Scripting attack against a logged in admin opening a malicious link",2022-03-28,Nuclei,cpe:2.3:a:sygnoos:popup_builder:*:*:*:*:*:wordpress:*:*,Sygnoos,Popup Builder
CVE-2022-0482,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.38133,CWE-359,Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.,2022-03-09,Nuclei,cpe:2.3:a:easyappointments:easyappointments:*:*:*:*:*:wordpress:*:*,Easyappointments,Easyappointments
CVE-2022-0492,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.05528,CWE-287,"A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.",2022-03-03,CISA/Metasploit,"cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder:8.2:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:8.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:8.2:*:*:*:*:*:*:*;cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*;cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv_tus:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv_tus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_real_time_tus:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_real_time_tus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*",Netapp,H300S Firmware
CVE-2022-0533,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01857,CWE-79,The Ditty (formerly Ditty News Ticker) WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting (XSS) vulnerability.,2022-03-07,Nuclei,cpe:2.3:a:metaphorcreations:ditty:*:*:*:*:*:wordpress:*:*,Metaphorcreations,Ditty
CVE-2022-0535,4.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N,0.01262,CWE-79,"The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed",2022-03-07,Nuclei,cpe:2.3:a:e2pdf:e2pdf:*:*:*:*:*:wordpress:*:*,E2Pdf,E2Pdf
CVE-2022-0540,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.88057,NVD-CWE-noinfo,"A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.",2022-04-20,Nuclei,cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*;cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*,Atlassian,Jira Data Center
CVE-2022-0543,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.9967,CWE-862,"It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.",2022-02-18,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:redis:redis:-:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:-:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2022-0591,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.20249,CWE-918,"The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users",2022-03-21,Nuclei,cpe:2.3:a:subtlewebinc:formcraft3:*:*:*:*:*:wordpress:*:*,Subtlewebinc,Formcraft3
CVE-2022-0592,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.10279,CWE-89,"The MapSVG WordPress plugin before 6.2.20 does not validate and escape a parameter via a REST endpoint before using it in a SQL statement, leading to a SQL Injection exploitable by unauthenticated users.",2022-05-09,Nuclei,cpe:2.3:a:mapsvg:mapsvg:*:*:*:*:*:wordpress:*:*,Mapsvg,Mapsvg
CVE-2022-0594,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.02013,CWE-863,"The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one of the AJAX action, available to unauthenticated (in v < 9.7.5) and author+ (in v9.7.5) users, allowing them to call it and retrieve various information such as the list of active plugins, various version like PHP, cURL, WP etc.",2022-07-25,Nuclei,cpe:2.3:a:shareaholic:shareaholic:*:*:*:*:*:wordpress:*:*,Shareaholic,Shareaholic
CVE-2022-0595,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.13575,CWE-79,"The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue",2022-03-28,Nuclei,cpe:2.3:a:codedropz:drag_and_drop_multiple_file_upload_-_contact_form_7:*:*:*:*:*:wordpress:*:*,Codedropz,Drag And Drop Multiple File Upload - Contact Form 7
CVE-2022-0597,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03019,CWE-601,Open Redirect in Packagist microweber/microweber prior to 1.2.11.,2022-02-15,Nuclei,cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*,Microweber,Microweber
CVE-2022-0599,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01713,CWE-79,"The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 does not sanitize and escape the mmursp_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.",2022-03-28,Nuclei,cpe:2.3:a:mapping_multiple_urls_redirect_same_page_project:mapping_multiple_urls_redirect_same_page:*:*:*:*:*:wordpress:*:*,Mapping Multiple Urls Redirect Same Page Project,Mapping Multiple Urls Redirect Same Page
CVE-2022-0609,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.23546,CWE-416,Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2022-04-05,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*,Google,Chrome
CVE-2022-0651,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.3298,CWE-89,"The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.",2022-02-24,Nuclei,cpe:2.3:a:veronalabs:wp_statistics:*:*:*:*:*:wordpress:*:*,Veronalabs,Wp Statistics
CVE-2022-0653,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02703,CWE-79,The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the site_url parameter found in the ~/assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 3.6.1.,2022-02-24,Nuclei,cpe:2.3:a:cozmoslabs:profile_builder:*:*:*:*:*:wordpress:*:*,Cozmoslabs,Profile Builder
CVE-2022-0656,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.07879,CWE-552,"The Web To Print Shop : uDraw WordPress plugin before 3.3.3 does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function and returning its content base64 encoded in the response. As a result, unauthenticated users could read arbitrary files on the web server (such as /etc/passwd, wp-config.php etc)",2022-04-25,Nuclei,cpe:2.3:a:webtoprint:web_to_print_shop\:udraw:*:*:*:*:*:wordpress:*:*,Webtoprint,Web To Print Shop
CVE-2022-0658,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.08852,CWE-89,"The CommonsBooking WordPress plugin before 2.6.8 does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queries, leading to an unauthenticated SQL injection",2022-03-14,Nuclei,cpe:2.3:a:wielebenwir:commonsbooking:*:*:*:*:*:wordpress:*:*,Wielebenwir,Commonsbooking
CVE-2022-0660,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.06923,CWE-209,Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.,2022-02-18,Nuclei,cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*,Microweber,Microweber
CVE-2022-0666,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.44259,CWE-93,CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11.,2022-02-18,Nuclei,cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*,Microweber,Microweber
CVE-2022-0678,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02273,CWE-79,Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.,2022-02-19,Nuclei,cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*,Microweber,Microweber
CVE-2022-0679,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.4783,CWE-22,The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the lib_path parameter before it is passed into a call to require() via the narnoo_distributor_lib_request AJAX action (available to both unauthenticated and authenticated users) which results in the disclosure of arbitrary files as the content of the file is then displayed in the response as JSON data. This could also lead to RCE with various tricks but depends on the underlying system and it's configuration.,2022-03-28,Nuclei,cpe:2.3:a:narnoo_distributor_project:narnoo_distributor:*:*:*:*:*:wordpress:*:*,Narnoo Distributor Project,Narnoo Distributor
CVE-2022-0692,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03378,CWE-601,Open Redirect on Rudloff/alltube in Packagist rudloff/alltube prior to 3.0.1.,2022-02-21,Nuclei,cpe:2.3:a:alltube_project:alltube:*:*:*:*:*:*:*:*,Alltube Project,Alltube
CVE-2022-0693,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07097,CWE-89,"The Master Elements WordPress plugin through 8.0 does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL Injection",2022-04-25,Nuclei,cpe:2.3:a:devbunch:master_elements:*:*:*:*:*:wordpress:*:*,Devbunch,Master Elements
CVE-2022-0735,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.13227,NVD-CWE-noinfo,"An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8 before 14.8.2. An unauthorised user was able to steal runner registration tokens through an information disclosure vulnerability using quick actions commands.",2022-03-28,Nuclei,cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*;cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*,Gitlab,Gitlab
CVE-2022-0739,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.37171,CWE-89,"The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection",2022-03-21,Metasploit,cpe:2.3:a:reputeinfosystems:bookingpress:*:*:*:*:*:wordpress:*:*,Reputeinfosystems,Bookingpress
CVE-2022-0747,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.15254,CWE-89,"The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection",2022-03-21,Nuclei,cpe:2.3:a:quantumcloud:infographic_maker:*:*:*:*:*:wordpress:*:*,Quantumcloud,Infographic Maker
CVE-2022-0760,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.10825,CWE-89,"The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection",2022-03-21,Nuclei,cpe:2.3:a:quantumcloud:simple_link_directory:*:*:*:*:*:wordpress:*:*,Quantumcloud,Simple Link Directory
CVE-2022-0765,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.03932,CWE-79,"The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin (Translator and Administrator by default) to add arbitrary javascript payloads to the source strings leading to a stored cross-site scripting (XSS) vulnerability.",2022-04-18,Nuclei,cpe:2.3:a:loco_translate_project:loco_translate:*:*:*:*:*:wordpress:*:*,Loco Translate Project,Loco Translate
CVE-2022-0769,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0854,CWE-89,"The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (available to both unauthenticated and authenticated users), leading to an SQL Injection.",2022-04-25,Nuclei,cpe:2.3:a:usersultra:users_ultra:*:*:*:*:*:wordpress:*:*,Usersultra,Users Ultra
CVE-2022-0773,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.43259,CWE-89,"The Documentor WordPress plugin through 1.5.3 fails to sanitize and escape user input before it is being interpolated in an SQL statement and then executed, leading to an SQL Injection exploitable by unauthenticated users.",2022-05-02,Nuclei,cpe:2.3:a:documentor_project:documentor:*:*:*:*:*:wordpress:*:*,Documentor Project,Documentor
CVE-2022-0776,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03679,CWE-79,Cross-site Scripting (XSS) - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0.,2022-03-01,Nuclei,cpe:2.3:a:revealjs:reveal.js:*:*:*:*:*:node.js:*:*,Revealjs,Reveal.Js
CVE-2022-0781,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.13207,CWE-89,"The Nirweb support WordPress plugin before 2.8.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users), leading to an SQL injection",2022-05-23,Nuclei,cpe:2.3:a:nirweb:nirweb_support:*:*:*:*:*:wordpress:*:*,Nirweb,Nirweb Support
CVE-2022-0783,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07984,CWE-89,"The Multiple Shipping Address Woocommerce WordPress plugin before 2.0 does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX actions available to unauthenticated users, leading to unauthenticated SQL injections",2022-05-02,Nuclei,cpe:2.3:a:themehigh:multiple_shipping_addresses_for_woocommerce:*:*:*:*:*:*:*:*,Themehigh,Multiple Shipping Addresses For Woocommerce
CVE-2022-0784,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.10079,CWE-89,"The Title Experiments Free WordPress plugin before 9.0.1 does not sanitise and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection",2022-03-28,Nuclei,cpe:2.3:a:title_experiments_free_project:title_experiments_free:*:*:*:*:*:wordpress:*:*,Title Experiments Free Project,Title Experiments Free
CVE-2022-0785,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09103,CWE-89,"The Daily Prayer Time WordPress plugin before 2022.03.01 does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection",2022-04-18,Nuclei,cpe:2.3:a:daily_prayer_time_project:daily_prayer_time:*:*:*:*:*:wordpress:*:*,Daily Prayer Time Project,Daily Prayer Time
CVE-2022-0786,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.12619,CWE-89,"The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route, leading to SQL Injections exploitable by unauthenticated users",2022-06-13,Nuclei,cpe:2.3:a:iqonic:kivicare:*:*:*:*:*:wordpress:*:*,Iqonic,Kivicare
CVE-2022-0787,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.08852,CWE-89,"The Limit Login Attempts (Spam Protection) WordPress plugin before 5.1 does not sanitise and escape some parameters before using them in SQL statements via AJAX actions (available to unauthenticated users), leading to SQL Injections",2022-03-28,Nuclei,cpe:2.3:a:limit_login_attempts_project:limit_login_attempts:*:*:*:*:*:wordpress:*:*,Limit Login Attempts Project,Limit Login Attempts
CVE-2022-0788,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07879,CWE-89,"The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST route, leading to an SQL injection exploitable by unauthenticated users",2022-06-08,Nuclei,cpe:2.3:a:wpmet:fundengine:*:*:*:*:*:wordpress:*:*,Wpmet,Fundengine
CVE-2022-0814,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09495,CWE-89,"The Ubigeo de Perú para Woocommerce WordPress plugin before 3.6.4 does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actions, some of which are available to unauthenticated users, leading to SQL Injections",2022-05-09,Nuclei,cpe:2.3:a:ubigeo_de_peru_para_woocommerce_project:ubigeo_de_peru_para_woocommerce:*:*:*:*:*:wordpress:*:*,Ubigeo De Peru Para Woocommerce Project,Ubigeo De Peru Para Woocommerce
CVE-2022-0817,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.11725,CWE-89,"The BadgeOS WordPress plugin through 3.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users",2022-05-09,Nuclei,cpe:2.3:a:badgeos:badgeos:*:*:*:*:*:wordpress:*:*,Badgeos,Badgeos
CVE-2022-0824,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.96977,CWE-284,Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.,2022-03-02,EPSS/Metasploit/Nuclei,cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*,Webmin,Webmin
CVE-2022-0826,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09238,CWE-89,"The WP Video Gallery WordPress plugin through 1.7.1 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users",2022-05-09,Nuclei,cpe:2.3:a:wp-video-gallery-free_project:wp-video-gallery-free:*:*:*:*:*:wordpress:*:*,Wp-Video-Gallery-Free Project,Wp-Video-Gallery-Free
CVE-2022-0827,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09047,CWE-89,"The Bestbooks WordPress plugin through 2.6.3 does not sanitise and escape some parameters before using them in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users",2022-06-13,Nuclei,cpe:2.3:a:presspage:bestbooks:*:*:*:*:*:wordpress:*:*,Presspage,Bestbooks
CVE-2022-0846,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.08785,CWE-89,"The SpeakOut! Email Petitions WordPress plugin before 2.14.15.1 does not sanitise and escape the id parameter before using it in a SQL statement via the dk_speakout_sendmail AJAX action, leading to an SQL Injection exploitable by unauthenticated users",2022-03-28,Nuclei,cpe:2.3:a:speakout\!_email_petitions_project:speakout\!_email_petitions:*:*:*:*:*:wordpress:*:*,Speakout! Email Petitions Project,Speakout! Email Petitions
CVE-2022-0847,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.89063,CWE-665,"A flaw was found in the way the ""flags"" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.",2022-03-10,CISA/Metasploit,cpe:2.3:a:ovirt:ovirt-engine:4.4.10.2:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_lpe9403:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma1000:-:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_real_time:8:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv:8:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv_tus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv_tus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_real_time_tus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_real_time_tus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*;cpe:2.3:o:siemens:scalance_lpe9403_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma1000_firmware:*:*:*:*:*:*:*:*,Netapp,H300S Firmware
CVE-2022-0864,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.07355,CWE-79,"The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.",2022-04-04,Nuclei,cpe:2.3:a:updraftplus:updraftplus:*:*:*:*:*:wordpress:*:*,Updraftplus,Updraftplus
CVE-2022-0867,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.13256,CWE-89,The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolated in an SQL statement and then executed via an AJAX action available to unauthenticated users,2022-05-16,Nuclei,cpe:2.3:a:reputeinfosystems:pricing_table:*:*:*:*:*:wordpress:*:*,Reputeinfosystems,Pricing Table
CVE-2022-0869,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0262,CWE-601,Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3.,2022-03-06,Nuclei,cpe:2.3:a:spirit-project:spirit:*:*:*:*:*:*:*:*,Spirit-Project,Spirit
CVE-2022-0870,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.03422,CWE-918,Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5.,2022-03-11,Nuclei,cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*,Gogs,Gogs
CVE-2022-0873,4.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N,0.00872,CWE-79,"The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the Album's name before outputting it in pages/posts with a media embed, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed",2022-05-16,Nuclei,cpe:2.3:a:codeasily:gmedia_gallery:*:*:*:*:*:wordpress:*:*,Codeasily,Gmedia Gallery
CVE-2022-0879,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01195,CWE-79,"The Caldera Forms WordPress plugin before 1.9.7 does not validate and escape the cf-api parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting",2022-04-18,Nuclei,cpe:2.3:a:calderaforms:caldera_forms:*:*:*:*:*:wordpress:*:*,Calderaforms,Caldera Forms
CVE-2022-0885,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09105,CWE-94,"The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments.",2022-06-13,Nuclei,cpe:2.3:a:memberhero:member_hero:*:*:*:*:*:wordpress:*:*,Memberhero,Member Hero
CVE-2022-0899,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01323,CWE-79,"The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting.",2022-07-25,Nuclei,cpe:2.3:a:draftpress:header_footer_code_manager:*:*:*:*:*:wordpress:*:*,Draftpress,Header Footer Code Manager
CVE-2022-0928,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.02389,CWE-79,Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.12.,2022-03-11,Nuclei,cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*,Microweber,Microweber
CVE-2022-0948,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09999,CWE-89,"The Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated users, leading to an SQL injection",2022-05-09,Nuclei,cpe:2.3:a:pluginbazaar:order_listener_for_woocommerce:*:*:*:*:*:wordpress:*:*,Pluginbazaar,Order Listener For Woocommerce
CVE-2022-0949,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07867,CWE-89,"The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJAX action, available to unauthenticated users, leading to a SQL injection",2022-04-11,Nuclei,cpe:2.3:a:stopbadbots:block_and_stop_bad_bots:*:*:*:*:*:wordpress:*:*,Stopbadbots,Block And Stop Bad Bots
CVE-2022-0952,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.13171,CWE-352,"The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin. As a result, unauthenticated attackers could change arbitrary blog options, such as the users_can_register and default_role, allowing them to create a new admin account and take over the blog.",2022-05-02,Nuclei,cpe:2.3:a:sitemap_project:sitemap:*:*:*:*:*:wordpress:*:*,Sitemap Project,Sitemap
CVE-2022-0954,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.03197,CWE-79,"Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in GitHub repository microweber/microweber prior to 1.2.11.",2022-03-15,Nuclei,cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*,Microweber,Microweber
CVE-2022-0963,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01877,CWE-79,Unrestricted XML Files Leads to Stored XSS in GitHub repository microweber/microweber prior to 1.2.12.,2022-03-15,Nuclei,cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*,Microweber,Microweber
CVE-2022-0968,5.5,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H,0.03731,CWE-190,"The microweber application allows large characters to insert in the input field ""fist & last name"" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in GitHub repository microweber/microweber prior to 1.2.12.",2022-03-15,Nuclei,cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*,Microweber,Microweber
CVE-2022-0995,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.06197,CWE-787,"An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system.",2022-03-25,Metasploit,cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h610c:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h615c:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:5.17:rc4:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:5.17:rc5:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:5.17:rc6:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:5.17:rc7:*:*:*:*:*:*;cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*,Netapp,H300E Firmware
CVE-2022-1007,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01868,CWE-79,"The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue",2022-04-11,Nuclei,cpe:2.3:a:elbtide:advanced_booking_calendar:*:*:*:*:*:wordpress:*:*,Elbtide,Advanced Booking Calendar
CVE-2022-1013,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07775,CWE-89,"The Personal Dictionary WordPress plugin before 1.3.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to a blind SQL injection vulnerability.",2022-05-09,Nuclei,cpe:2.3:a:ays-pro:personal_dictionary:*:*:*:*:*:wordpress:*:*,Ays-Pro,Personal Dictionary
CVE-2022-1020,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.25937,CWE-352,"The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users), as well as does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary functions with either none or one user controlled argument",2022-04-18,Nuclei,cpe:2.3:a:codeastrology:woo_product_table:*:*:*:*:*:wordpress:*:*,Codeastrology,Woo Product Table
CVE-2022-1026,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.15102,CWE-522,"Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, through an insufficiently protected address book export function.",2022-04-04,Nuclei,cpe:2.3:a:kyocera:net_viewer:*:*:*:*:*:*:*:*,Kyocera,Net Viewer
CVE-2022-1029,4.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N,0.00848,CWE-79,"The Limit Login Attempts WordPress plugin before 4.0.72 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)",2022-06-27,Nuclei,cpe:2.3:a:miniorange:limit_login_attempts:*:*:*:*:*:wordpress:*:*,Miniorange,Limit Login Attempts
CVE-2022-1040,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99796,NVD-CWE-noinfo,An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.,2022-03-25,CISA/EPSS/Nuclei,cpe:2.3:o:sophos:sfos:*:*:*:*:*:*:*:*,Sophos,Sfos
CVE-2022-1043,8.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.03718,CWE-416,"A flaw was found in the Linux kernel’s io_uring implementation. This flaw allows an attacker with a local account to corrupt system memory, crash the system or escalate privileges.",2022-08-29,Metasploit,cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2022-1054,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.04213,CWE-862,"The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action. As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and email address of user registered for events",2022-04-18,Nuclei,cpe:2.3:a:wpchill:rsvp_and_event_management:*:*:*:*:*:wordpress:*:*,Wpchill,Rsvp And Event Management
CVE-2022-1057,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07942,CWE-89,"The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection",2022-07-11,Nuclei,cpe:2.3:a:varktech:pricing_deals_for_woocommerce:*:*:*:*:*:wordpress:*:*,Varktech,Pricing Deals For Woocommerce
CVE-2022-1058,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.50687,CWE-601,Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5.,2022-03-24,Nuclei,cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*,Gitea,Gitea
CVE-2022-1096,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.24237,CWE-843,Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2022-07-23,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*,Google,Chrome
CVE-2022-1119,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.19958,CWE-22,"The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in versions up to and including 3.2.7.",2022-04-19,Nuclei,cpe:2.3:a:simplefilelist:simple-file-list:*:*:*:*:*:wordpress:*:*,Simplefilelist,Simple-File-List
CVE-2022-1162,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.76177,CWE-798,"A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts",2022-04-04,Nuclei,cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*;cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*,Gitlab,Gitlab
CVE-2022-1168,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01847,CWE-79,There is a Cross-Site Scripting vulnerability in the JobSearch WP JobSearch WordPress plugin before 1.5.1.,2022-04-04,Nuclei,cpe:2.3:a:eyecix:jobsearch_wp_job_board:*:*:*:*:*:wordpress:*:*,Eyecix,Jobsearch Wp Job Board
CVE-2022-1170,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01836,CWE-79,In the Noo JobMonster WordPress theme before 4.5.2.9 JobMonster there is a XSS vulnerability as the input for the search form is provided through unsanitized GET requests.,2022-04-04,Nuclei,cpe:2.3:a:nootheme:jobmonster:*:*:*:*:*:wordpress:*:*,Nootheme,Jobmonster
CVE-2022-1221,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02136,CWE-79,"The Gwyn's Imagemap Selector WordPress plugin through 0.3.3 does not sanitise and escape some parameters before outputting them back in attributes, leading to a Reflected Cross-Site Scripting.",2022-05-23,Nuclei,cpe:2.3:a:gwyn\'s_imagemap_selector_project:gwyn\'s_imagemap_selector:*:*:*:*:*:wordpress:*:*,Gwyn'S Imagemap Selector Project,Gwyn'S Imagemap Selector
CVE-2022-1329,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.92658,CWE-434,"The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files that can be used to obtain remote code execution, in versions 3.6.0 to 3.6.2.",2022-04-19,Metasploit/Nuclei,cpe:2.3:a:elementor:website_builder:*:*:*:*:*:wordpress:*:*,Elementor,Website Builder
CVE-2022-1364,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.1372,CWE-843,Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2022-07-26,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*,Google,Chrome
CVE-2022-1373,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.10639,CWE-23,"The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vulnerability when processing zip files. An attacker can craft a zip file to load an arbitrary dll and execute code. Using the ""restore configuration"" feature to upload a zip file containing a path traversal file may cause a file to be created and executed upon touching the disk.",2022-08-17,Metasploit,cpe:2.3:a:softing:edgeaggregator:3.1:*:*:*:*:*:*:*;cpe:2.3:a:softing:edgeconnector:3.1:*:*:*:*:*:*:*;cpe:2.3:a:softing:opc:5.2:*:*:*:*:*:*:*;cpe:2.3:a:softing:opc_ua_c\+\+_software_development_kit:6:*:*:*:*:*:*:*;cpe:2.3:a:softing:secure_integration_server:1.22:*:*:*:*:*:*:*;cpe:2.3:a:softing:uagates:1.74:*:*:*:*:*:*:*,Softing,Edgeaggregator
CVE-2022-1386,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.71722,CWE-918,"The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the server's local network bypassing firewalls and access control measures.",2022-05-16,Nuclei,cpe:2.3:a:fusion_builder_project:fusion_builder:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:theme-fusion:avada:*:*:*:*:*:wordpress:*:*,Fusion Builder Project,Fusion Builder
CVE-2022-1388,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99958,CWE-306,"On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated",2022-05-05,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*,F5,Big-Ip Access Policy Manager
CVE-2022-1390,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.21881,CWE-22,"The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a Phar Deserialization technique",2022-04-25,Nuclei,cpe:2.3:a:admin_word_count_column_project:admin_word_count_column:*:*:*:*:*:wordpress:*:*,Admin Word Count Column Project,Admin Word Count Column
CVE-2022-1391,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.13791,CWE-22,"The Cab fare calculator WordPress plugin before 1.0.4 does not validate the controller parameter before using it in require statements, which could lead to Local File Inclusion issues.",2022-04-25,Nuclei,cpe:2.3:a:kanev:cab_fare_calculator:*:*:*:*:*:wordpress:*:*,Kanev,Cab Fare Calculator
CVE-2022-1392,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.1129,CWE-22,"The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include statement, which could lead to Local File Inclusion issues",2022-04-25,Nuclei,cpe:2.3:a:commoninja:videos_sync_pdf:*:*:*:*:*:wordpress:*:*,Commoninja,Videos Sync Pdf
CVE-2022-1398,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.02941,CWE-918,"The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that medias added via URLs are external medias, which could allow any authenticated users, such as subscriber to perform blind SSRF attacks",2022-05-16,Nuclei,cpe:2.3:a:external_media_without_import_project:external_media_without_import:*:*:*:*:*:wordpress:*:*,External Media Without Import Project,External Media Without Import
CVE-2022-1439,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0327,CWE-79,"Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press ""tab"" but there is probably a paylaod that runs without user interaction.",2022-04-22,Nuclei,cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*,Microweber,Microweber
CVE-2022-1442,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.09699,CWE-862,"The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attacker to view all API keys and secrets of integrated third-party APIs like that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA and many more, in versions up to and including 2.1.3.",2022-05-10,Nuclei,cpe:2.3:a:wpmet:metform_elementor_contact_form_builder:*:*:*:*:*:wordpress:*:*,Wpmet,Metform Elementor Contact Form Builder
CVE-2022-1453,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07053,CWE-89,The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.5.,2022-05-10,Nuclei,cpe:2.3:a:carrcommunications:rsvpmaker:*:*:*:*:*:wordpress:*:*,Carrcommunications,Rsvpmaker
CVE-2022-1471,8.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L,0.99615,CWE-20,SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.,2022-12-01,EPSS/Metasploit,cpe:2.3:a:snakeyaml_project:snakeyaml:*:*:*:*:*:*:*:*,Snakeyaml Project,Snakeyaml
CVE-2022-1574,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.11866,CWE-352,"The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthenticated attackers can upload arbitrary files (such as PHP) on the remote server",2022-06-27,Nuclei,cpe:2.3:a:html2wp_project:html2wp:*:*:*:*:*:wordpress:*:*,Html2Wp Project,Html2Wp
CVE-2022-1580,4.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N,0.0135,CWE-639,The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature.,2022-09-19,Nuclei,cpe:2.3:a:freehtmldesigns:site_offline:*:*:*:*:*:wordpress:*:*,Freehtmldesigns,Site Offline
CVE-2022-1595,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.02621,CWE-200,The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request,2022-06-13,Nuclei,cpe:2.3:a:hc_custom_wp-admin_url_project:hc_custom_wp-admin_url:*:*:*:*:*:wordpress:*:*,Hc Custom Wp-Admin Url Project,Hc Custom Wp-Admin Url
CVE-2022-1597,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0291,CWE-79,"The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its reset password form which makes it possible to perform Reflected Cross-Site Scripting attacks",2022-06-08,Nuclei,cpe:2.3:a:2code:wpqa_builder:*:*:*:*:*:wordpress:*:*,2Code,Wpqa Builder
CVE-2022-1598,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.05076,CWE-306,"The WPQA Builder WordPress plugin before 5.5 which is a companion to the Discy and Himer , lacks authentication in a REST API endpoint, allowing unauthenticated users to discover private questions sent between users on the site.",2022-06-08,Nuclei,cpe:2.3:a:2code:wpqa_builder:*:*:*:*:*:wordpress:*:*,2Code,Wpqa Builder
CVE-2022-1609,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.64321,CWE-94,"The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site.",2024-01-16,Nuclei,cpe:2.3:a:weblizar:school_management:*:*:*:*:pro:wordpress:*:*,Weblizar,School Management
CVE-2022-1692,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.1036,CWE-89,"The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embed, allowing unauthenticated users to perform an SQL injection attack",2022-06-08,Nuclei,cpe:2.3:a:dwbooster:cp_image_store_with_slideshow:*:*:*:*:*:wordpress:*:*,Dwbooster,Cp Image Store With Slideshow
CVE-2022-1711,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.05727,CWE-918,Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5.,2022-05-17,Nuclei,cpe:2.3:a:diagrams:drawio:*:*:*:*:*:*:*:*,Diagrams,Drawio
CVE-2022-1713,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.09233,CWE-918,SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This can lead to a leak of sensitive information.,2022-05-16,Nuclei,cpe:2.3:a:diagrams:drawio:*:*:*:*:*:*:*:*,Diagrams,Drawio
CVE-2022-1724,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01693,CWE-79,"The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting",2022-06-13,Nuclei,cpe:2.3:a:simple-membership-plugin:simple_membership:*:*:*:*:*:wordpress:*:*,Simple-Membership-Plugin,Simple Membership
CVE-2022-1756,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01785,CWE-79,"The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below.",2022-06-13,Nuclei,cpe:2.3:a:thenewsletterplugin:newsletter:*:*:*:*:*:wordpress:*:*,Thenewsletterplugin,Newsletter
CVE-2022-1768,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.12003,CWE-89,"The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user supplied data passed to multiple SQL queries in the ~/rsvpmaker-email.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to, and including, 9.3.2. 

Please note that this is separate from CVE-2022-1453 & CVE-2022-1505.",2022-06-13,Nuclei,cpe:2.3:a:carrcommunications:rsvpmaker:*:*:*:*:*:wordpress:*:*,Carrcommunications,Rsvpmaker
CVE-2022-1815,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.06081,CWE-200,Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2.,2022-05-25,Nuclei,cpe:2.3:a:diagrams:drawio:*:*:*:*:*:*:*:*,Diagrams,Drawio
CVE-2022-1883,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.06843,CWE-89,SQL Injection in GitHub repository camptocamp/terraboard prior to 2.2.0.,2022-05-25,Nuclei,cpe:2.3:a:camptocamp:terraboard:*:*:*:*:*:*:*:*,Camptocamp,Terraboard
CVE-2022-1903,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0852,CWE-862,"The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username",2022-06-27,Nuclei,cpe:2.3:a:armemberplugin:armember:*:*:*:*:*:wordpress:*:*,Armemberplugin,Armember
CVE-2022-1904,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01421,CWE-79,"The Pricing Tables WordPress Plugin WordPress plugin before 3.2.1 does not sanitise and escape parameter before outputting it back in a page available to any user (both authenticated and unauthenticated) when a specific setting is enabled, leading to a Reflected Cross-Site Scripting",2022-06-27,Nuclei,cpe:2.3:a:fatcatapps:easy_pricing_tables:*:*:*:*:*:wordpress:*:*,Fatcatapps,Easy Pricing Tables
CVE-2022-1906,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00955,CWE-79,"The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting when a specific setting is enabled.",2022-08-01,Nuclei,cpe:2.3:a:digiprove:copyright_proof:*:*:*:*:*:wordpress:*:*,Digiprove,Copyright Proof
CVE-2022-1910,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01347,CWE-79,"The Shortcodes and extra features for Phlox WordPress plugin before 2.9.8 does not sanitise and escape a parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting",2022-07-11,Nuclei,cpe:2.3:a:averta:shortcodes_and_extra_features_for_phlox_theme:*:*:*:*:*:wordpress:*:*,Averta,Shortcodes And Extra Features For Phlox Theme
CVE-2022-1916,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01872,CWE-79,"The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store WordPress plugin before 1.0.5 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected cross-Site Scripting",2022-06-27,Nuclei,cpe:2.3:a:pluginus:woot:*:*:*:*:*:wordpress:*:*,Pluginus,Woot
CVE-2022-1933,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01566,CWE-79,"The CDI WordPress plugin before 5.1.9 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting",2022-07-17,Nuclei,cpe:2.3:a:collect_and_deliver_interface_for_woocommerce_project:collect_and_deliver_interface_for_woocommerce:*:*:*:*:*:wordpress:*:*,Collect And Deliver Interface For Woocommerce Project,Collect And Deliver Interface For Woocommerce
CVE-2022-1937,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01686,CWE-79,"The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting",2022-07-11,Nuclei,cpe:2.3:a:awin:awin_data_feed:*:*:*:*:*:wordpress:*:*,Awin,Awin Data Feed
CVE-2022-1946,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01626,CWE-79,"The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue",2022-07-04,Nuclei,cpe:2.3:a:wpdevart:gallery:*:*:*:*:*:wordpress:*:*,Wpdevart,Gallery
CVE-2022-1950,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04278,CWE-89,"The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection",2022-08-01,Nuclei,cpe:2.3:a:kainelabs:youzify:*:*:*:*:*:wordpress:*:*,Kainelabs,Youzify
CVE-2022-1952,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.23487,CWE-434,"The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation which leads to arbitrary file upload and subsequently to remote code execution. An AJAX action accessible to unauthenticated users is affected by this issue. An allowlist of valid file extensions is defined but is not used during the validation steps.",2022-07-11,Nuclei,cpe:2.3:a:syntacticsinc:easync:*:*:*:*:*:wordpress:*:*,Syntacticsinc,Easync
CVE-2022-2024,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97839,CWE-78,OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.,2023-02-25,EPSS,cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*,Gogs,Gogs
CVE-2022-2034,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01868,CWE-639,"The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers",2022-08-29,Nuclei,cpe:2.3:a:automattic:sensei_lms:*:*:*:*:*:wordpress:*:*,Automattic,Sensei Lms
CVE-2022-2068,7.3,CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H,0.95764,CWE-78,"In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).",2022-06-21,EPSS,cpe:2.3:a:broadcom:sannav:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:ontap_antivirus_connector:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:hyper-v:*:*;cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*;cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:*;cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*;cpe:2.3:a:siemens:sinec_ins:1.0:sp2:*:*:*:*:*:*;cpe:2.3:h:netapp:aff_8300:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:aff_8700:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:aff_a400:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:fas_8300:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:fas_8700:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:fas_a400:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h610c:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h615c:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*;cpe:2.3:o:netapp:aff_8300_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:aff_8700_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:aff_a400_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:fas_8300_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:fas_8700_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:fas_a400_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*,Netapp,H615C Firmware
CVE-2022-20699,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.72458,CWE-121,"Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.",2022-02-10,CISA/Metasploit,cpe:2.3:h:cisco:rv340:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv340w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv345:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv345p:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv340_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv340w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv345_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv345p_firmware:*:*:*:*:*:*:*:*,Cisco,Rv340 Firmware
CVE-2022-20700,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.05655,CWE-121,"Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.",2022-02-10,CISA,cpe:2.3:h:cisco:rv160:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv160w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv260:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv260p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv260w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv340:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv340w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv345:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv345p:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv160_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv160w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv260_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv260p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv260w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv340_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv340w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv345_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv345p_firmware:*:*:*:*:*:*:*:*,Cisco,Rv340 Firmware
CVE-2022-20701,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.09747,CWE-121,"Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.",2022-02-10,CISA,cpe:2.3:h:cisco:rv340:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv340w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv345:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv345p:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv340_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv340w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv345_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv345p_firmware:*:*:*:*:*:*:*:*,Cisco,Rv340 Firmware
CVE-2022-20703,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.09203,CWE-121,"Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.",2022-02-10,CISA,cpe:2.3:h:cisco:rv160:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv160w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv260:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv260p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv260w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv340:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv340w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv345:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv345p:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv160_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv160w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv260_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv260p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv260w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv340_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv340w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv345_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv345p_firmware:*:*:*:*:*:*:*:*,Cisco,Rv340 Firmware
CVE-2022-20705,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.80031,CWE-121,"Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.",2022-02-10,Metasploit,cpe:2.3:h:cisco:rv160:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv160w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv260:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv260p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv260w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv340:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv340w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv345:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv345p:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv160_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv160w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv260_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv260p_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv260w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv340_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv340w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv345_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv345p_firmware:*:*:*:*:*:*:*:*,Cisco,Rv340 Firmware
CVE-2022-20707,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.75322,CWE-121,"Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.",2022-02-10,Metasploit,cpe:2.3:h:cisco:rv340:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv340w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv345:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv345p:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv340_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv340w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv345_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv345p_firmware:*:*:*:*:*:*:*:*,Cisco,Rv340 Firmware
CVE-2022-20708,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.14863,CWE-121,"Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.",2022-02-10,CISA,cpe:2.3:h:cisco:rv340:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv340w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv345:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv345p:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv340_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv340w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv345_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv345p_firmware:*:*:*:*:*:*:*:*,Cisco,Rv340 Firmware
CVE-2022-20775,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.12475,CWE-25,"A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges.

This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF",2022-09-30,CISA,cpe:2.3:a:cisco:catalyst_8000v_edge:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_cg418-e:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_cg522-e:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.8:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan:20.8:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:20.8:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan_vedge_cloud:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan_vedge_cloud:20.8:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan_vsmart_controller:20.8:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-6g_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1100_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1101_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109-2p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109-4p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1109_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1111x-8p_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1111x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:111x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1120_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1131_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:1160_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4000_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4221_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321\/k9_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4321_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331\/k9_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4331_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351\/k9_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4351_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4431_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4451-x_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4451_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:4461_integrated_services_router:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8101-32fh:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8101-32h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8102-64h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8201-32fh:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8201:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8202:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8804:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8808:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8812:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8818:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8831:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1000:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-hx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-hx_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001-x_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1001:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-hx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-hx_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002-x_r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1002:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1004:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1006-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1006:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1009-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1013:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:asr_1023:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8200:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-1n1s-4t2x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-1n1s-6t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-2n2s-4t2x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300-2n2s-6t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8300:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8500-4qc:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8500:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8500l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8510csr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8510msr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8540csr:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_8540msr:-:*:*:*:*:*:*:*,Cisco,1100-4G Integrated Services Router
CVE-2022-20821,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.1176,CWE-200,"A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system.",2022-05-26,CISA,cpe:2.3:h:cisco:8201:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8202:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8208:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8212:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:8218:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs-55a1-24h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs-55a1-24q6h-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs-55a1-36h-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs-55a1-36h-se-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs-55a1-36h-se:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs-55a2-mod-hd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs-55a2-mod-hx-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs-55a2-mod-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs-55a2-mod-se-h-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs-55a2-mod-se-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_1001:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_1002:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_1004:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_5001:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_5002:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_5501-se:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_5502-se:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_5504:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_5508:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_5516:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_55a1:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_55a2:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:-:*:*:*:*:*:*:*,Cisco,Ios Xr
CVE-2022-20828,6.5,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N,0.4831,CWE-236,"A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER module could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected ASA FirePOWER module as the root user. This vulnerability is due to improper handling of undefined command parameters. An attacker could exploit this vulnerability by using a crafted command on the CLI or by submitting a crafted HTTPS request to the web-based management interface of the Cisco ASA that is hosting the ASA FirePOWER module. Note: To exploit this vulnerability, the attacker must have administrative access to the Cisco ASA. A user who has administrative access to a particular Cisco ASA is also expected to have administrative access to the ASA FirePOWER module that is hosted by that Cisco ASA.",2022-06-24,Metasploit,cpe:2.3:a:cisco:asa_firepower:*:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_1010:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_1120:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_1140:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_1150:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_2110:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_2120:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_2130:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_2140:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_4110:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_4112:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_4115:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_4120:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_4125:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_4140:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_4145:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_4150:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_9300:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_management_center:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:firepower_management_center_virtual_appliance:-:*:*:*:*:*:*:*,Cisco,Firepower 1010
CVE-2022-2130,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L,0.02907,CWE-79,Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.17.,2022-06-20,Nuclei,cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*,Microweber,Microweber
CVE-2022-21371,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.92331,CWE-22,"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).",2022-01-19,Nuclei,cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*,Oracle,Weblogic Server
CVE-2022-2143,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.59184,CWE-77,"The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.",2022-07-22,Metasploit,cpe:2.3:a:advantech:iview:*:*:*:*:*:*:*:*,Advantech,Iview
CVE-2022-21445,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.62478,CWE-502,"Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces).  Supported versions that are affected are 12.2.1.3.0 and  12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Development Framework (ADF).  Successful attacks of this vulnerability can result in takeover of Oracle Application Development Framework (ADF). Note: Oracle Application Development Framework (ADF) is downloaded via Oracle JDeveloper Product. Please refer to Fusion Middleware Patch Advisor for more details. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",2022-04-19,CISA,cpe:2.3:a:oracle:application_development_framework:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:application_development_framework:12.2.1.4.0:*:*:*:*:*:*:*,Oracle,Application Development Framework
CVE-2022-21500,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.70589,NVD-CWE-noinfo,"Vulnerability in Oracle E-Business Suite (component: Manage Proxies). The supported version that is affected is 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle E-Business Suite. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle E-Business Suite accessible data. Note: Authentication is required for successful attack, however the user may be self-registered. <br> <br>Oracle E-Business Suite 12.1 is not impacted by this vulnerability. Customers should refer to the Patch Availability Document for details. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).",2022-05-20,Nuclei,cpe:2.3:a:oracle:e-business_suite:12.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:user_management:*:*:*:*:*:*:*:*,Oracle,E-Business Suite
CVE-2022-21587,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98342,CWE-306,"Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",2022-10-18,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:oracle:e-business_suite:*:*:*:*:*:*:*:*,Oracle,E-Business Suite
CVE-2022-21661,8.0,CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H,0.97795,CWE-89,"WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.",2022-01-06,EPSS/Nuclei,cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2022-2168,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0128,CWE-79,"The Download Manager WordPress plugin before 3.2.44 does not escape a generated URL before outputting it back in an attribute of the history dashboard, leading to Reflected Cross-Site Scripting",2022-07-17,Nuclei,cpe:2.3:a:w3eden:download_manager:*:*:*:*:free:wordpress:*:*,W3Eden,Download Manager
CVE-2022-21705,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.08682,CWE-74,"Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass `cms.safe_mode` / `cms.enableSafeMode` in order to execute arbitrary code. This issue only affects admin panels that rely on safe mode and restricted permissions. To exploit this vulnerability, an attacker must first have access to the backend area. The issue has been patched in Build 474 (v1.0.474) and v1.1.10. Users unable to upgrade should apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe to your installation manually.",2022-02-23,Nuclei,cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*,Octobercms,October
CVE-2022-2174,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02811,CWE-79,Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.18.,2022-06-22,Nuclei,cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*,Microweber,Microweber
CVE-2022-2185,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.76884,CWE-78,"A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where an authenticated user authorized to import projects could import a maliciously crafted project leading to remote code execution.",2022-07-01,Nuclei,cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*;cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*;cpe:2.3:a:gitlab:gitlab:15.1.0:*:*:*:community:*:*:*;cpe:2.3:a:gitlab:gitlab:15.1.0:*:*:*:enterprise:*:*:*,Gitlab,Gitlab
CVE-2022-2187,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01428,CWE-79,"The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers",2022-07-17,Nuclei,cpe:2.3:a:contact_form_7_captcha_project:contact_form_7_captcha:*:*:*:*:*:wordpress:*:*,Contact Form 7 Captcha Project,Contact Form 7 Captcha
CVE-2022-21882,7.0,CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.55711,CWE-787,Win32k Elevation of Privilege Vulnerability,2022-01-11,CISA/Metasploit,cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1809
CVE-2022-21919,7.0,CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.0295,CWE-59,Windows User Profile Service Elevation of Privilege Vulnerability,2022-01-11,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2022-21971,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.53655,CWE-824,Windows Runtime Remote Code Execution Vulnerability,2022-02-09,CISA,cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1809
CVE-2022-21999,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.41683,CWE-22,Windows Print Spooler Elevation of Privilege Vulnerability,2022-02-09,CISA/Metasploit,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2022-22047,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.18765,CWE-426,Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability,2022-07-12,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2022-22071,8.4,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0045,CWE-416,"Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music",2022-06-14,CISA,cpe:2.3:h:qualcomm:apq8053:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ar8031:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ar8035:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:csra6620:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:csra6640:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:mdm9150:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:msm8953:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6174a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6390:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6426:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6436:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6595au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6696:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca8081:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca8337:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca9377:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm2290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm4290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm6490:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs2290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs405:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs410:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs4290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs610:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs6490:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qrb5165:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qrb5165m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qrb5165n:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qualcomm215:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6155p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8155p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8195p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd439:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd460:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd480:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd662:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd680:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd690_5g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd695:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd750g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd765:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd765g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd768g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd778g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd780g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd855:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd865_5g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd870:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd888_5g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx12:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx55:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx55m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx65:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdxr2_5g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm4125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7250p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7325p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9326:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9335:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9341:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3615:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3660b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3680b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3910:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3980:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3988:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3991:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3998:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3999:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6740:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6750:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6850:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6851:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6855:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6856:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn7850:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn7851:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8053_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ar8031_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ar8035_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:csra6620_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:csra6640_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:mdm9150_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:msm8953_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6174a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6390_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6426_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6436_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6595au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6696_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca8081_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca8337_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca9377_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm2290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm4290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm6490_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs2290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs405_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs410_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs4290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs610_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs6490_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qrb5165_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qrb5165m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qrb5165n_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qualcomm215_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6155p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8155p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8195p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd439_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd460_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd480_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd662_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd680_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd690_5g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd695_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd750g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd765_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd765g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd768g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd778g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd780g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd855_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd865_5g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd870_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd888_5g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx12_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx55_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx55m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx65_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdxr2_5g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm4125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7250p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7325p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9326_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9335_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9341_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3615_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3660b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3680b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3910_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3980_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3991_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3998_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3999_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6740_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6750_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6850_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6851_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6855_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6856_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn7850_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn7851_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*,Qualcomm,Apq8053 Firmware
CVE-2022-2219,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.01786,CWE-79,"The Unyson WordPress plugin before 2.7.27 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting",2022-07-25,Nuclei,cpe:2.3:a:brizy:unyson:*:*:*:*:*:wordpress:*:*,Brizy,Unyson
CVE-2022-22242,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02468,CWE-79,"A Cross-site Scripting (XSS) vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker to run malicious scripts reflected off of J-Web to the victim's browser in the context of their session within J-Web. This issue affects Juniper Networks Junos OS all versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S7; 19.4 versions prior to 19.4R2-S7, 19.4R3-S8; 20.1 versions prior to 20.1R3-S5; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R3; 21.4 versions prior to 21.4R2; 22.1 versions prior to 22.1R2.",2022-10-18,Nuclei,cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r1-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r1-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r1-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r1-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r2-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r3-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r3-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r3-s7:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r3-s8:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.1:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.2:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.2:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.2:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.2:r1-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.2:r1-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.2:r1-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.2:r1-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.2:r1-s7:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.2:r1-s8:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.2:r1-s9:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.2:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.2:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.2:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.2:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.2:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.2:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.2:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.2:r3-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.2:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.3:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.3:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.3:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.3:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.3:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.3:r2-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.3:r2-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.3:r2-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.3:r2-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.3:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.3:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.3:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.3:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.3:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.3:r3-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.3:r3-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.3:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.4:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.4:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.4:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.4:r1-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.4:r1-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.4:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.4:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.4:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.4:r2-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.4:r2-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.4:r2-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.4:r2-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.4:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.4:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.4:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.4:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.4:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.4:r3-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.4:r3-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.4:r3-s7:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.4:r3-s8:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:19.4:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.1:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.1:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.1:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.1:r1-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.1:r1-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.1:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.1:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.1:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.1:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.1:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.1:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.1:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.1:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.1:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.2:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.2:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.2:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.2:r1-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.2:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.2:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.2:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.2:r2-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.2:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.2:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.2:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.2:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.2:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.2:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.3:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.3:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.3:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.3:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.3:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.3:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.3:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.3:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.3:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.3:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.3:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r1:*:*:*:*:*:*,Juniper,Junos
CVE-2022-22265,5.0,CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L,0.00392,CWE-703,An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.,2022-01-10,CISA,cpe:2.3:h:samsung:exynos:-:*:*:*:*:*:*:*;cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:9.0:*:*:*:*:*:*:*,Google,Android
CVE-2022-22536,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.97945,CWE-444,"SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.",2022-02-09,CISA/EPSS/Nuclei,cpe:2.3:a:sap:content_server:7.53:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_application_server_abap:7.22:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_application_server_abap:7.49:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_application_server_abap:7.53:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_application_server_abap:7.77:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_application_server_abap:7.81:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_application_server_abap:7.85:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_application_server_abap:7.86:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_application_server_abap:7.87:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_application_server_abap:8.04:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_application_server_abap:krnl64nuc_7.22:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_application_server_abap:krnl64nuc_7.22ext:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_application_server_abap:krnl64nuc_7.49:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_7.22:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_7.22ext:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_7.49:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_7.53:*:*:*:*:*:*:*;cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_8.04:*:*:*:*:*:*:*;cpe:2.3:a:sap:web_dispatcher:7.22ext:*:*:*:*:*:*:*;cpe:2.3:a:sap:web_dispatcher:7.49:*:*:*:*:*:*:*;cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:*;cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:*;cpe:2.3:a:sap:web_dispatcher:7.81:*:*:*:*:*:*:*;cpe:2.3:a:sap:web_dispatcher:7.85:*:*:*:*:*:*:*;cpe:2.3:a:sap:web_dispatcher:7.86:*:*:*:*:*:*:*;cpe:2.3:a:sap:web_dispatcher:7.87:*:*:*:*:*:*:*,Sap,Content Server
CVE-2022-22587,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.11638,CWE-787,"A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, macOS Big Sur 11.6.3, macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..",2022-03-18,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2022-22616,5.5,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N,0.07749,NVD-CWE-noinfo,"This issue was addressed with improved checks. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks.",2022-05-26,Metasploit,cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-005:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-007:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-002:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-003:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-006:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-007:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-008:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-002:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:supplemental_update:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2022-22620,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.16342,CWE-416,"A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS 15.3.1 and iPadOS 15.3.1, Safari 15.3 (v. 16612.4.9.1.8 and 15612.4.9.1.8). Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..",2022-03-18,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2022-22674,5.5,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.01133,CWE-125,"An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Monterey 12.3.1, Security Update 2022-004 Catalina, macOS Big Sur 11.6.6. A local user may be able to read kernel memory.",2022-05-26,CISA,cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-005:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-007:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-002:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-003:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-006:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-007:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-008:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-002:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-003:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:supplemental_update:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*,Apple,Mac Os X
CVE-2022-22675,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.12642,CWE-787,"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.3.1, iOS 15.4.1 and iPadOS 15.4.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..",2022-05-26,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2022-22706,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01176,CWE-119,"Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages. This affects Midgard r26p0 through r31p0, Bifrost r0p0 through r35p0, and Valhall r19p0 through r35p0.",2022-03-03,CISA,cpe:2.3:a:arm:bifrost_gpu_kernel_driver:*:*:*:*:*:*:*:*;cpe:2.3:a:arm:midgard_gpu_kernel_driver:*:*:*:*:*:*:*:*;cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:*,Arm,Bifrost Gpu Kernel Driver
CVE-2022-22718,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.18464,NVD-CWE-noinfo,Windows Print Spooler Elevation of Privilege Vulnerability,2022-02-09,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2022-22733,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.37594,CWE-200,Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache ShardingSphere ElasticJob-UI allows an attacker who has guest account to do privilege escalation. This issue affects Apache ShardingSphere ElasticJob-UI Apache ShardingSphere ElasticJob-UI 3.x version 3.0.0 and prior versions.,2022-01-20,Nuclei,cpe:2.3:a:apache:shardingsphere_elasticjob-ui:3.0.0:-:*:*:*:*:*:*;cpe:2.3:a:apache:shardingsphere_elasticjob-ui:3.0.0:alpha:*:*:*:*:*:*;cpe:2.3:a:apache:shardingsphere_elasticjob-ui:3.0.0:beta:*:*:*:*:*:*;cpe:2.3:a:apache:shardingsphere_elasticjob-ui:3.0.0:rc1:*:*:*:*:*:*,Apache,Shardingsphere Elasticjob-Ui
CVE-2022-22897,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.10814,CWE-89,A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop allows unauthenticated attackers to exfiltrate database data.,2022-08-29,Nuclei,cpe:2.3:a:apollotheme:ap_pagebuilder:*:*:*:*:*:prestashop:*:*,Apollotheme,Ap Pagebuilder
CVE-2022-2290,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03096,CWE-79,"Cross-site Scripting (XSS) - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta.",2022-07-03,Nuclei,cpe:2.3:a:triliumnotes:trilium:*:*:*:*:*:*:*:*,Triliumnotes,Trilium
CVE-2022-2294,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.70461,CWE-787,Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2022-07-28,CISA,cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:*;cpe:2.3:a:webrtc_project:webrtc:-:*:*:*:*:*:*:*;cpe:2.3:a:wpewebkit:wpe_webkit:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-005:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-007:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-002:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-003:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-004:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-005:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-006:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-007:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-008:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-001:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-002:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-003:*:*:*:*:*:*;cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-004:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2022-22942,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02579,CWE-416,The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by other processes on the system through a dangling 'file' pointer.,2023-12-13,Metasploit,cpe:2.3:o:vmware:photon_os:3.0:-:*:*:*:*:*:*;cpe:2.3:o:vmware:photon_os:4.0:-:*:*:*:*:*:*,Vmware,Photon Os
CVE-2022-22947,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.98253,CWE-94,"In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.",2022-03-03,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_console:22.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:22.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:spring_cloud_gateway:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:spring_cloud_gateway:3.1.0:*:*:*:*:*:*:*,Vmware,Spring Cloud Gateway
CVE-2022-22948,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.13825,CWE-276,The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.,2022-03-29,CISA/Metasploit,cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:e:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:f:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update1b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update1c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update1d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update1e:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update1g:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update2:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update2b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update2c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update2d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update2g:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update3:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update3d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update3f:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update3k:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update3n:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update3p:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.5:update3q:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update1b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update2:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update2a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update2c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3f:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3g:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3j:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3l:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3m:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3n:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:6.7:update3o:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3c:*:*:*:*:*:*,Vmware,Cloud Foundation
CVE-2022-22954,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99997,CWE-94,VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.,2022-04-11,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.3:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.4:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.6:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_automation:7.6:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workspace_one_access:20.10.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workspace_one_access:20.10.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workspace_one_access:21.08.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workspace_one_access:21.08.0.1:*:*:*:*:*:*:*,Vmware,Identity Manager
CVE-2022-22956,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.50694,CWE-287,VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework.,2022-04-13,Metasploit/Nuclei,cpe:2.3:a:vmware:identity_manager:3.3.3:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.4:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.6:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_automation:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_automation:7.6:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workspace_one_access:20.10.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workspace_one_access:20.10.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workspace_one_access:21.08.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workspace_one_access:21.08.0.1:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2022-22957,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.23084,CWE-502,"VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote code execution.",2022-04-13,Metasploit,cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.3:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.4:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.6:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_automation:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_automation:7.6:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workspace_one_access:20.10.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workspace_one_access:20.10.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workspace_one_access:21.08.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workspace_one_access:21.08.0.1:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2022-22960,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.37171,CWE-732,"VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate privileges to 'root'.",2022-04-13,CISA/Metasploit,cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.3:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.4:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.6:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_automation:7.6:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workspace_one_access:20.10.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workspace_one_access:20.10.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workspace_one_access:21.08.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workspace_one_access:21.08.0.1:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2022-22963,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99939,CWE-94,"In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.",2022-04-01,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:oracle:banking_branch:14.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_cash_management:14.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_electronic_data_exchange_for_corporates:14.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_liquidity_management:14.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_liquidity_management:14.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_origination:14.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_supply_chain_finance:14.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:banking_virtual_account_management:14.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:22.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_console:22.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:22.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:22.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_communications_policy_management:12.6.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:21.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:sd-wan_edge:9.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:*,Vmware,Spring Cloud Function
CVE-2022-22965,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99677,CWE-94,"A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.",2022-04-01,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:cisco:cx_cloud_agent:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:commerce_platform:11.3.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:22.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_console:22.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:22.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:22.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_policy_management:12.6.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:communications_unified_inventory_management:7.5.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*;cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_financial_integration:15.0.3.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_financial_integration:16.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_financial_integration:19.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:15.0.3.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:16.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_integration_bus:19.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_merchandising_system:19.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_point_of_service:21.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:sd-wan_edge:9.1:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:simatic_speech_assistant_for_machines:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:sinec_network_management_system:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:*;cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:*;cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:*;cpe:2.3:a:siemens:siveillance_identity:1.6:*:*:*:*:*:*:*;cpe:2.3:a:veritas:access_appliance:7.4.3.100:*:*:*:*:*:*:*;cpe:2.3:a:veritas:access_appliance:7.4.3.200:*:*:*:*:*:*:*;cpe:2.3:a:veritas:access_appliance:7.4.3:*:*:*:*:*:*:*;cpe:2.3:a:veritas:flex_appliance:1.3:*:*:*:*:*:*:*;cpe:2.3:a:veritas:flex_appliance:2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:veritas:flex_appliance:2.0.2:*:*:*:*:*:*:*;cpe:2.3:a:veritas:flex_appliance:2.0:*:*:*:*:*:*:*;cpe:2.3:a:veritas:flex_appliance:2.1:*:*:*:*:*:*:*;cpe:2.3:a:veritas:netbackup_flex_scale_appliance:2.1:*:*:*:*:*:*:*;cpe:2.3:a:veritas:netbackup_flex_scale_appliance:3.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*;cpe:2.3:h:veritas:netbackup_appliance:4.0.0.1:maintenance_release1:*:*:*:*:*:*;cpe:2.3:h:veritas:netbackup_appliance:4.0.0.1:maintenance_release2:*:*:*:*:*:*;cpe:2.3:h:veritas:netbackup_appliance:4.0.0.1:maintenance_release3:*:*:*:*:*:*;cpe:2.3:h:veritas:netbackup_appliance:4.0:*:*:*:*:*:*:*;cpe:2.3:h:veritas:netbackup_appliance:4.1.0.1:maintenance_release1:*:*:*:*:*:*;cpe:2.3:h:veritas:netbackup_appliance:4.1.0.1:maintenance_release2:*:*:*:*:*:*;cpe:2.3:h:veritas:netbackup_appliance:4.1:*:*:*:*:*:*:*;cpe:2.3:h:veritas:netbackup_virtual_appliance:4.0.0.1:maintenance_release1:*:*:*:*:*:*;cpe:2.3:h:veritas:netbackup_virtual_appliance:4.0.0.1:maintenance_release2:*:*:*:*:*:*;cpe:2.3:h:veritas:netbackup_virtual_appliance:4.0.0.1:maintenance_release3:*:*:*:*:*:*;cpe:2.3:h:veritas:netbackup_virtual_appliance:4.0:*:*:*:*:*:*:*;cpe:2.3:h:veritas:netbackup_virtual_appliance:4.1.0.1:maintenance_release1:*:*:*:*:*:*;cpe:2.3:h:veritas:netbackup_virtual_appliance:4.1.0.1:maintenance_release2:*:*:*:*:*:*;cpe:2.3:h:veritas:netbackup_virtual_appliance:4.1:*:*:*:*:*:*:*,Veritas,Netbackup Appliance
CVE-2022-2297,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.03271,CWE-434,"A vulnerability, which was classified as critical, was found in SourceCodester Clinics Patient Management System 2.0. Affected is an unknown function of the file /pms/update_user.php?user_id=1. The manipulation of the argument profile_picture with the input <?php phpinfo();?> leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",2022-07-12,Metasploit,cpe:2.3:a:oretnom23:clinic\'s_patient_management_system:2.0:*:*:*:*:*:*:*,Oretnom23,Clinic'S Patient Management System
CVE-2022-22972,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.55801,NVD-CWE-noinfo,"VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.",2022-05-20,Nuclei,cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.10.1.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.10.1.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.10.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.10.2.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.10.2.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.10:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.11.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.11:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.7.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.7.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.7:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.8.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.8:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.9.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:3.9:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:4.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:4.1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:4.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:4.2.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:4.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:4.3.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:4.3:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.3:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.4:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.6:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_automation:7.6:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.2:patch1:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.2:patch2:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.2:patch3:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.3:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.3:patch1:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.3:patch2:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.3:patch3:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.4.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.4.1:patch1:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.4.1:patch2:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.4.1:patch3:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.4:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.4:patch1:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.6.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.6.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.6:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.6:patch1:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.7:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:8.8:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workspace_one_access:20.10.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workspace_one_access:20.10.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workspace_one_access:21.08.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workspace_one_access:21.08.0.1:*:*:*:*:*:*:*,Vmware,Identity Manager
CVE-2022-23102,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.05265,CWE-601,A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Affected products contain an open redirect vulnerability. An attacker could trick a valid authenticated user to the device into clicking a malicious link there by leading to phishing attacks.,2022-02-09,Nuclei,cpe:2.3:a:siemens:sinema_remote_connect_server:*:*:*:*:*:*:*:*,Siemens,Sinema Remote Connect Server
CVE-2022-23131,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.95683,CWE-290,"In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).",2022-01-13,CISA/EPSS/Nuclei,cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:6.0.0:alpha1:*:*:*:*:*:*,Zabbix,Zabbix
CVE-2022-23134,3.7,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N,0.84657,CWE-284,"After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.",2022-01-13,CISA/Nuclei,cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:6.0.0:alpha1:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:6.0.0:alpha2:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:6.0.0:alpha3:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:6.0.0:alpha4:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:6.0.0:alpha5:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:6.0.0:alpha6:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:6.0.0:alpha7:*:*:*:*:*:*;cpe:2.3:a:zabbix:zabbix:6.0.0:beta1:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2022-2314,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.12937,CWE-78,The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site.,2022-08-15,Nuclei,cpe:2.3:a:vr_calendar_project:vr_calendar:*:*:*:*:*:wordpress:*:*,Vr Calendar Project,Vr Calendar
CVE-2022-23176,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.12793,NVD-CWE-noinfo,"WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. This vulnerability impacts Fireware OS before 12.7.2_U1, 12.x before 12.1.3_U3, and 12.2.x through 12.5.x before 12.5.7_U3.",2022-02-24,CISA,cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*;cpe:2.3:o:watchguard:fireware:12.1.3:-:*:*:*:*:*:*;cpe:2.3:o:watchguard:fireware:12.1.3:u1:*:*:*:*:*:*;cpe:2.3:o:watchguard:fireware:12.1.3:u2:*:*:*:*:*:*;cpe:2.3:o:watchguard:fireware:12.5.7:-:*:*:*:*:*:*;cpe:2.3:o:watchguard:fireware:12.5.7:u1:*:*:*:*:*:*;cpe:2.3:o:watchguard:fireware:12.5.7:u2:*:*:*:*:*:*;cpe:2.3:o:watchguard:fireware:12.7.2:-:*:*:*:*:*:*,Watchguard,Fireware
CVE-2022-23178,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.75711,CWE-287,"An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, user credentials are disclosed that are valid to authenticate to the web interface. Specifically, aj.html sends a JSON document with uname and upassword fields.",2022-01-15,Nuclei,cpe:2.3:h:crestron:hd-md4x2-4k-e:-:*:*:*:*:*:*:*;cpe:2.3:o:crestron:hd-md4x2-4k-e_firmware:1.0.0.2159:*:*:*:*:*:*:*,Crestron,Hd-Md4X2-4K-E Firmware
CVE-2022-23227,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.49431,CWE-306,"NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.",2022-01-14,CISA,cpe:2.3:h:nuuo:nvrmini2:-:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrmini2_firmware:*:*:*:*:*:*:*:*,Nuuo,Nvrmini2 Firmware
CVE-2022-23277,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.40789,NVD-CWE-noinfo,Microsoft Exchange Server Remote Code Execution Vulnerability,2022-03-09,Metasploit,cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2022-2334,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.09883,CWE-427,"The application searches for a library dll that is not found. If an attacker can place a dll with this name, then the attacker can leverage it to execute arbitrary code on the targeted Softing Secure Integration Server V1.22.",2022-08-17,Metasploit,cpe:2.3:a:softing:edgeaggregator:3.1:*:*:*:*:*:*:*;cpe:2.3:a:softing:edgeconnector:3.1:*:*:*:*:*:*:*;cpe:2.3:a:softing:opc:5.2:*:*:*:*:*:*:*;cpe:2.3:a:softing:opc_ua_c\+\+_software_development_kit:6:*:*:*:*:*:*:*;cpe:2.3:a:softing:secure_integration_server:1.22:*:*:*:*:*:*:*;cpe:2.3:a:softing:uagates:1.74:*:*:*:*:*:*:*,Softing,Edgeaggregator
CVE-2022-23347,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.11993,CWE-22,BigAnt Software BigAnt Server v5.6.06 was discovered to be vulnerable to directory traversal attacks.,2022-03-21,Nuclei,cpe:2.3:a:bigantsoft:bigant_server:5.6.06:*:*:*:*:*:*:*,Bigantsoft,Bigant Server
CVE-2022-23348,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.02899,CWE-916,BigAnt Software BigAnt Server v5.6.06 was discovered to utilize weak password hashes.,2022-03-21,Nuclei,cpe:2.3:a:bigantsoft:bigant_server:5.6.06:*:*:*:*:*:*:*,Bigantsoft,Bigant Server
CVE-2022-23397,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00913,CWE-79,"The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent in through a URL parameter. This leads to a Reflected Cross-Site Scripting vulnerability. NOTE: the vendor disputes this because the ado.im reference has ""no clear steps of reproduction.""",2022-03-04,Nuclei,cpe:2.3:a:cedargate:ez-net_portal:6.5.5:*:*:*:*:*:*:*;cpe:2.3:a:cedargate:ez-net_portal:6.6.3:*:*:*:*:*:*:*;cpe:2.3:a:cedargate:ez-net_portal:6.7.0:*:*:*:*:*:*:*;cpe:2.3:a:cedargate:ez-net_portal:6.8.0:*:*:*:*:*:*:*,Cedargate,Ez-Net Portal
CVE-2022-23544,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.01607,CWE-79,"MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.0 are subject to a Server-Side Request Forgery that leads to Cross-Site Scripting. A Server-Side request forgery in `IssueProxyResourceService::getMdImageByUrl` allows an attacker to access internal resources, as well as executing JavaScript code in the context of Metersphere's origin by a victim of a reflected XSS. This vulnerability has been fixed in v2.5.0. There are no known workarounds. ",2022-12-28,Nuclei,cpe:2.3:a:metersphere:metersphere:*:*:*:*:*:*:*:*,Metersphere,Metersphere
CVE-2022-23642,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.7431,CWE-94,"Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the `gitserver` service. The service acts as a git exec proxy, and fails to properly restrict calling `git config`. This allows an attacker to set the git `core.sshCommand` option, which sets git to use the specified command instead of ssh when they need to connect to a remote system. Exploitation of this vulnerability depends on how Sourcegraph is deployed. An attacker able to make HTTP requests to internal services like gitserver is able to exploit it. This issue is patched in Sourcegraph version 3.37. As a workaround, ensure that requests to gitserver are properly protected.",2022-02-18,Metasploit,cpe:2.3:a:sourcegraph:sourcegraph:*:*:*:*:*:*:*:*,Sourcegraph,Sourcegraph
CVE-2022-2373,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01424,CWE-862,"The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users to retrieve WordPress users details such as name and email address",2022-08-29,Nuclei,cpe:2.3:a:nsqua:simply_schedule_appointments:*:*:*:*:*:wordpress:*:*,Nsqua,Simply Schedule Appointments
CVE-2022-23748,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.09092,CWE-114,"mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under what conditions. In these scenarios, a malicious attacker could be using the valid and legitimate executable to load malicious files.",2022-11-17,CISA,cpe:2.3:a:audinate:dante_application_library:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2022-2376,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01408,CWE-862,The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users,2022-09-05,Nuclei,cpe:2.3:a:wpwax:directorist:*:*:*:*:*:wordpress:*:*,Wpwax,Directorist
CVE-2022-23779,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.1514,CWE-200,Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses.,2022-03-02,Nuclei,cpe:2.3:a:zohocorp:manageengine_desktop_central:*:*:*:*:*:*:*:*,Zohocorp,Manageengine Desktop Central
CVE-2022-2379,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.029,CWE-862,"The Easy Student Results WordPress plugin through 2.2.8 lacks authorisation in its REST API, allowing unauthenticated users to retrieve information related to the courses, exams, departments as well as student's grades and PII such as email address, physical address, phone number etc",2022-08-15,Nuclei,cpe:2.3:a:easy_student_results_project:easy_student_results:*:*:*:*:*:wordpress:*:*,Easy Student Results Project,Easy Student Results
CVE-2022-23808,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.07228,CWE-79,"An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.",2022-01-22,Nuclei,cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*,Phpmyadmin,Phpmyadmin
CVE-2022-2383,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.04873,CWE-79,"The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting",2022-08-22,Nuclei,cpe:2.3:a:slickremix:feed_them_social:*:*:*:*:*:wordpress:*:*,Slickremix,Feed Them Social
CVE-2022-23854,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.45957,CWE-23,AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with network access to read files on the system outside of the secure gateway web server.,2022-12-23,Nuclei,cpe:2.3:a:aveva:intouch_access_anywhere:*:*:*:*:*:*:*:*;cpe:2.3:a:aveva:intouch_access_anywhere:2020:-:*:*:*:*:*:*;cpe:2.3:a:aveva:intouch_access_anywhere:2020:r2:*:*:*:*:*:*,Aveva,Intouch Access Anywhere
CVE-2022-23881,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.56509,NVD-CWE-Other,ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php.,2022-03-23,Nuclei,cpe:2.3:a:zzzcms:zzzphp:2.1.0:*:*:*:*:*:*:*,Zzzcms,Zzzphp
CVE-2022-23898,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07734,CWE-89,MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml.,2022-03-03,Nuclei,cpe:2.3:a:mingsoft:mcms:5.2.5:*:*:*:*:*:*:*,Mingsoft,Mcms
CVE-2022-23944,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.79007,CWE-862,User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.,2022-01-25,Nuclei,cpe:2.3:a:apache:shenyu:2.4.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:shenyu:2.4.1:*:*:*:*:*:*:*,Apache,Shenyu
CVE-2022-24086,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99199,CWE-20,Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.,2022-02-16,CISA/EPSS/Nuclei,cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.3:p1:*:*:*:*:*:*;cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.3.7:p1:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.3.7:p2:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.3:-:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.3:p1:*:*:open_source:*:*:*,Adobe,Commerce
CVE-2022-24112,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96182,CWE-290,"An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.",2022-02-11,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:*,Apache,Apisix
CVE-2022-24124,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.58927,CWE-89,"The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.",2022-01-29,Nuclei,cpe:2.3:a:casbin:casdoor:*:*:*:*:*:*:*:*,Casbin,Casdoor
CVE-2022-24129,8.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N,0.06139,CWE-918,The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery (SSRF) due to insufficient restriction of the request_uri parameter. This allows attackers to interact with arbitrary third-party HTTP services.,2022-02-04,Nuclei,cpe:2.3:a:shibboleth:oidc_op:*:*:*:*:*:identity_provider:*:*,Shibboleth,Oidc Op
CVE-2022-2414,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.85323,CWE-611,Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.,2022-07-29,Nuclei,cpe:2.3:a:dogtagpki:dogtagpki:10.11.2:*:*:*:*:*:*:*;cpe:2.3:a:dogtagpki:dogtagpki:10.12.4:*:*:*:*:*:*:*;cpe:2.3:a:dogtagpki:dogtagpki:10.5.18:*:*:*:*:*:*:*;cpe:2.3:a:dogtagpki:dogtagpki:10.7.4:*:*:*:*:*:*:*;cpe:2.3:a:dogtagpki:dogtagpki:10.8.3:*:*:*:*:*:*:*;cpe:2.3:a:dogtagpki:dogtagpki:11.0.5:*:*:*:*:*:*:*;cpe:2.3:a:dogtagpki:dogtagpki:11.1.0:*:*:*:*:*:*:*,Dogtagpki,Dogtagpki
CVE-2022-24181,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0608,CWE-79,Cross-site scripting (XSS) via Host Header injection in PKP Open Journals System 2.4.8 >= 3.3 allows remote attackers to inject arbitary code via the X-Forwarded-Host Header.,2022-04-01,Nuclei,cpe:2.3:a:public_knowledge_project:open_journal_systems:*:*:*:*:*:*:*:*,Public Knowledge Project,Open Journal Systems
CVE-2022-24223,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.61965,CWE-89,AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php.,2022-02-01,Nuclei,cpe:2.3:a:thedigitalcraft:atomcms:2.0:*:*:*:*:*:*:*,Thedigitalcraft,Atomcms
CVE-2022-24260,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.49992,CWE-89,A SQL injection vulnerability in Voipmonitor GUI before v24.96 allows attackers to escalate privileges to the Administrator level.,2022-02-04,Nuclei,cpe:2.3:a:voipmonitor:voipmonitor:*:*:*:*:*:*:*:*,Voipmonitor,Voipmonitor
CVE-2022-24264,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.06711,CWE-89,Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via the search_word parameter.,2022-01-31,Nuclei,cpe:2.3:a:cuppacms:cuppacms:1.0:*:*:*:*:*:*:*,Cuppacms,Cuppacms
CVE-2022-24265,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.06711,CWE-89,Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/menu/ via the path=component/menu/&menu_filter=3 parameter.,2022-01-31,Nuclei,cpe:2.3:a:cuppacms:cuppacms:1.0:*:*:*:*:*:*:*,Cuppacms,Cuppacms
CVE-2022-24266,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.06391,CWE-89,Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via the order_by parameter.,2022-01-31,Nuclei,cpe:2.3:a:cuppacms:cuppacms:1.0:*:*:*:*:*:*:*,Cuppacms,Cuppacms
CVE-2022-24288,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.7788,CWE-78,"In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.",2022-02-25,Nuclei,cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*,Apache,Airflow
CVE-2022-24384,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.04737,CWE-79,Cross-site Scripting (XSS) vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.,2022-03-14,Nuclei,cpe:2.3:a:smartertools:smartertrack:*:*:*:*:*:*:*:*,Smartertools,Smartertrack
CVE-2022-24521,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.07304,NVD-CWE-noinfo,Windows Common Log File System Driver Elevation of Privilege Vulnerability,2022-04-15,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2022-2461,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.03644,CWE-862,"The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_translation' AJAX action and default settings which makes it possible for unauthenticated attackers to influence the data shown on the site.",2022-09-06,Nuclei,cpe:2.3:a:transposh:transposh_wordpress_translation:*:*:*:*:*:wordpress:*:*,Transposh,Transposh Wordpress Translation
CVE-2022-2462,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.0305,CWE-200,"The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_history' AJAX action and insufficient restriction on the data returned in the response. This makes it possible for unauthenticated users to exfiltrate usernames of individuals who have translated text.",2022-09-06,Nuclei,cpe:2.3:a:transposh:transposh_wordpress_translation:*:*:*:*:*:wordpress:*:*,Transposh,Transposh Wordpress Translation
CVE-2022-24627,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.26389,CWE-89,An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL injection in the p parameter of the process_login.php login form.,2023-05-29,Nuclei,cpe:2.3:a:audiocodes:device_manager_express:*:*:*:*:*:*:*:*,Audiocodes,Device Manager Express
CVE-2022-24637,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99055,CWE-269,"Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended ""<?php sequence) aren't handled by the PHP interpreter.",2022-03-18,EPSS/Metasploit/Nuclei,cpe:2.3:a:openwebanalytics:open_web_analytics:*:*:*:*:*:*:*:*,Openwebanalytics,Open Web Analytics
CVE-2022-2467,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.0453,CWE-89,A vulnerability has been found in SourceCodester Garage Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument username with the input 1@a.com' AND (SELECT 6427 FROM (SELECT(SLEEP(5)))LwLu) AND 'hsvT'='hsvT leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.,2022-07-19,Nuclei,cpe:2.3:a:garage_management_system_project:garage_management_system:1.0:*:*:*:*:*:*:*,Garage Management System Project,Garage Management System
CVE-2022-24681,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03619,CWE-79,"Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen.",2022-04-07,Nuclei,cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:-:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6102:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6103:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6104:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6105:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6106:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6107:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6108:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6109:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6110:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6111:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6112:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6113:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6114:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6115:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6116:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6117:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6118:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6119:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6120:*:*:*:*:*:*,Zohocorp,Manageengine Adselfservice Plus
CVE-2022-24682,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.3106,CWE-116,"An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.",2022-02-09,CISA/Nuclei,cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p10:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p11:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p12:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p13:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p14:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p15:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p16:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p17:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p18:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p19:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p20:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p21:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p22:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p23:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p24:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p25:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p26:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p27:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p28:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p29:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p6:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p7:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p8:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p9:*:*:*:*:*:*,Synacor,Zimbra Collaboration Suite
CVE-2022-24706,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9251,CWE-1188,"In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.",2022-04-26,CISA/Metasploit/Nuclei,cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*,Apache,Couchdb
CVE-2022-24716,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.89378,CWE-22,"Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including `icingaweb2` configuration files with database credentials. This issue has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated.",2022-03-08,Metasploit/Nuclei,cpe:2.3:a:icinga:icinga_web_2:*:*:*:*:*:*:*:*,Icinga,Icinga Web 2
CVE-2022-24734,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.77677,CWE-94,"MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type `php` with PHP code, executed on on _Change Settings_ pages. This results in a Remote Code Execution (RCE) vulnerability. The vulnerable module requires Admin CP access with the `Can manage settings?` permission. MyBB's Settings module, which allows administrators to add, edit, and delete non-default settings, stores setting data in an options code string ($options_code; mybb_settings.optionscode database column) that identifies the setting type and its options, separated by a new line character (\n). In MyBB 1.2.0, support for setting type php was added, for which the remaining part of the options code is PHP code executed on Change Settings pages (reserved for plugins and internal use). MyBB 1.8.30 resolves this issue. There are no known workarounds.",2022-03-09,Metasploit,cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*,Mybb,Mybb
CVE-2022-24816,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.98739,CWE-94,"JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.",2022-04-13,CISA/EPSS/Nuclei,cpe:2.3:a:geosolutionsgroup:jai-ext:*:*:*:*:*:*:*:*,Geosolutionsgroup,Jai-Ext
CVE-2022-24819,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.03282,CWE-359,"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents related to users of the wiki. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1. There is no known workaround for this problem.",2022-04-08,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:13.9:-:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2022-24856,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.1029,CWE-918,"FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery (SSRF) when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server or other unauthenticated URLs. Passing of headers to an unauthorized actor may occur. The patch for this issue deletes the entire `cors_proxy`, as this is not required for console anymore. A patch is available in FlyteConsole version 0.52.0. Disable FlyteConsole availability on the internet as a workaround.",2022-05-17,Nuclei,cpe:2.3:a:flyte:flyte_console:*:*:*:*:*:*:*:*,Flyte,Flyte Console
CVE-2022-2486,8.0,CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.29763,CWE-78,"A vulnerability, which was classified as critical, was found in WAVLINK WN535K2 and WN535K3. This affects an unknown part of the file /cgi-bin/mesh.cgi?page=upgrade. The manipulation of the argument key leads to os command injection. The exploit has been disclosed to the public and may be used.",2022-07-20,Nuclei,cpe:2.3:h:wavlink:wl-wn535k2:-:*:*:*:*:*:*:*;cpe:2.3:h:wavlink:wl-wn535k3:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wl-wn535k2_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wl-wn535k3_firmware:-:*:*:*:*:*:*:*,Wavlink,Wl-Wn535K2 Firmware
CVE-2022-2487,8.0,CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.79513,CWE-78,A vulnerability has been found in WAVLINK WN535K2 and WN535K3 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/nightled.cgi. The manipulation of the argument start_hour leads to os command injection. The exploit has been disclosed to the public and may be used.,2022-07-20,Nuclei,cpe:2.3:h:wavlink:wl-wn535k2:-:*:*:*:*:*:*:*;cpe:2.3:h:wavlink:wl-wn535k3:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wl-wn535k2_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wl-wn535k3_firmware:-:*:*:*:*:*:*:*,Wavlink,Wl-Wn535K2 Firmware
CVE-2022-2488,8.0,CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.32947,CWE-78,A vulnerability was found in WAVLINK WN535K2 and WN535K3 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/touchlist_sync.cgi. The manipulation of the argument IP leads to os command injection. The exploit has been disclosed to the public and may be used.,2022-07-20,Nuclei,cpe:2.3:h:wavlink:wl-wn535k2:-:*:*:*:*:*:*:*;cpe:2.3:h:wavlink:wl-wn535k3:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wl-wn535k2_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wl-wn535k3_firmware:-:*:*:*:*:*:*:*,Wavlink,Wl-Wn535K2 Firmware
CVE-2022-24899,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.04478,CWE-79,Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings.,2022-05-06,Nuclei,cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*,Contao,Contao
CVE-2022-24900,9.9,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L,0.0841,CWE-22,"Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. Version 1.3 and prior are vulnerable to a path traversal attack. The `os.path.join` call is unsafe for use with untrusted input. When the `os.path.join` call encounters an absolute path, it ignores all the parameters it has encountered till that point and starts working with the new absolute path. Since the ""malicious"" parameter represents an absolute path, the result of `os.path.join` ignores the static directory completely. Hence, untrusted input is passed via the `os.path.join` call to `flask.send_file` can lead to path traversal attacks. A patch with a fix is available on the `master` branch of the GitHub repository. This can also be fixed by preventing flow of untrusted data to the vulnerable `send_file` function. In case the application logic necessiates this behaviour, one can either use the `flask.safe_join` to join untrusted paths or replace `flask.send_file` calls with `flask.send_from_directory` calls.",2022-04-29,Nuclei,cpe:2.3:a:piano_led_visualizer_project:piano_led_visualizer:*:*:*:*:*:*:*:*,Piano Led Visualizer Project,Piano Led Visualizer
CVE-2022-24989,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.31881,CWE-74,TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because popen is used without any sanitization.) The credentials from CVE-2022-24990 exploitation can be used.,2023-08-20,Metasploit,cpe:2.3:h:terra-master:f2-210:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:f2-221:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:f2-223:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:f2-422:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:f2-423:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:f4-421:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:f4-422:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:f4-423:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:f5-221:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:f5-422:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:t12-423:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:t12-450:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:t6-423:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:t9-423:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:t9-450:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u12-322-9100:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u12-423:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u12-722-2224:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u16-322-9100:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u16-722-2224:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u24-722-2224:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u4-111:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u4-211:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u4-423:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u8-111:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u8-322-9100:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u8-423:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u8-522-9400:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u8-722-2224:-:*:*:*:*:*:*:*;cpe:2.3:o:terra-master:terramaster_operating_system:*:*:*:*:*:*:*:*,Terra-Master,Terramaster Operating System
CVE-2022-24990,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.8405,CWE-306,"TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending ""User-Agent: TNAS"" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.",2023-02-07,CISA/Metasploit/Nuclei,cpe:2.3:h:terra-master:f2-210:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:f2-221:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:f2-223:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:f2-422:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:f2-423:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:f4-421:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:f4-422:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:f4-423:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:f5-221:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:f5-422:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:t12-423:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:t12-450:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:t6-423:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:t9-423:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:t9-450:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u12-322-9100:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u12-423:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u12-722-2224:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u16-322-9100:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u16-722-2224:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u24-722-2224:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u4-111:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u4-211:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u4-423:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u8-111:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u8-322-9100:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u8-423:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u8-522-9400:-:*:*:*:*:*:*:*;cpe:2.3:h:terra-master:u8-722-2224:-:*:*:*:*:*:*:*;cpe:2.3:o:terra-master:terramaster_operating_system:*:*:*:*:*:*:*:*,Terra-Master,Terramaster Operating System
CVE-2022-25061,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.66934,CWE-78,TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_setIp6DefaultRoute.,2022-02-25,Nuclei,cpe:2.3:h:tp-link:tl-wr840n:-:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:tl-wr840n_firmware:6.20_180709:*:*:*:*:*:*:*,TP-Link,Tl-Wr840N Firmware
CVE-2022-25082,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.15673,CWE-78,"TOTOLink A950RG V5.9c.4050_B20190424 and V4.1.2cu.5204_B20210112 were discovered to contain a command injection vulnerability in the ""Main"" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.",2022-02-24,Nuclei,cpe:2.3:h:totolink:a950rg:-:*:*:*:*:*:*:*;cpe:2.3:o:totolink:a950rg_firmware:4.1.2cu.5204_b20210112:*:*:*:*:*:*:*;cpe:2.3:o:totolink:a950rg_firmware:5.9c.4050_b20190424:*:*:*:*:*:*:*,Totolink,A950Rg Firmware
CVE-2022-25125,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06981,CWE-89,MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp.,2022-03-03,Nuclei,cpe:2.3:a:mingsoft:mcms:5.2.4:*:*:*:*:*:*:*,Mingsoft,Mcms
CVE-2022-25148,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.8093,CWE-89,"The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.",2022-02-24,Nuclei,cpe:2.3:a:veronalabs:wp_statistics:*:*:*:*:*:wordpress:*:*,Veronalabs,Wp Statistics
CVE-2022-25149,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.77956,CWE-89,"The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.",2022-02-24,Nuclei,cpe:2.3:a:veronalabs:wp_statistics:*:*:*:*:*:wordpress:*:*,Veronalabs,Wp Statistics
CVE-2022-25216,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.13835,CWE-22,"An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player (recently renamed PlayerFab) has read-access, by means of an HTTP GET request to http://<IP_ADDRESS>:32080/download/<URL_ENCODED_PATH>.",2022-03-11,Nuclei,cpe:2.3:a:dvdfab:12_player:*:*:*:*:*:*:*:*;cpe:2.3:a:dvdfab:playerfab:*:*:*:*:*:*:*:*,Dvdfab,12 Player
CVE-2022-25226,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.11027,NVD-CWE-Other,ThinVNC version 1.0b1 allows an unauthenticated user to bypass the authentication process via 'http://thin-vnc:8080/cmd?cmd=connect' by obtaining a valid SID without any kind of authentication. It is possible to achieve code execution on the server by sending keyboard or mouse events to the server.,2022-04-18,Nuclei,cpe:2.3:a:cybelsoft:thinvnc:1.0:b1:*:*:*:*:*:*,Cybelsoft,Thinvnc
CVE-2022-25237,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.56222,NVD-CWE-Other,"Bonita Web 2021.2 is affected by a authentication/authorization bypass vulnerability due to an overly broad exclude pattern used in the RestAPIAuthorizationFilter. By appending ;i18ntranslation or /../i18ntranslation/ to the end of a URL, users with no privileges can access privileged API endpoints. This can lead to remote code execution by abusing the privileged API actions.",2022-06-02,Nuclei,cpe:2.3:a:bonitasoft:bonita_web:2021.2:*:*:*:*:*:*:*,Bonitasoft,Bonita Web
CVE-2022-25322,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.08346,CWE-89,ZEROF Web Server 2.0 allows /HandleEvent SQL Injection.,2022-02-18,Nuclei,cpe:2.3:a:zerof:web_server:2.0:*:*:*:*:*:*:*,Zerof,Web Server
CVE-2022-25323,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03245,CWE-79,ZEROF Web Server 2.0 allows /admin.back XSS.,2022-02-18,Nuclei,cpe:2.3:a:zerof:web_server:2.0:*:*:*:*:*:*:*,Zerof,Web Server
CVE-2022-2535,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01548,CWE-639,"The SearchWP Live Ajax Search WordPress plugin before 1.6.2 does not ensure that users making a live search are limited to published posts only, allowing unauthenticated users to make a crafted query disclosing private/draft/pending post titles along with their permalink",2022-08-15,Nuclei,cpe:2.3:a:searchwp:searchwp_live_ajax_search:*:*:*:*:*:wordpress:*:*,Searchwp,Searchwp Live Ajax Search
CVE-2022-25356,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.05879,CWE-91,Alt-N MDaemon Security Gateway through 8.5.0 allows SecurityGateway.dll?view=login XML Injection.,2022-04-05,Nuclei,cpe:2.3:a:altn:securitygateway:*:*:*:*:*:*:*:*,Altn,Securitygateway
CVE-2022-25369,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.40739,CWE-287,"An issue was discovered in Dynamicweb before 9.12.8. An attacker can add a new administrator user without authentication. This flaw exists due to a logic issue when determining if the setup phases of the product can be run again. Once an attacker is authenticated as the new admin user they have added, it is possible to upload an executable file and achieve command execution. This is fixed in 9.5.9, 9.6.16, 9.7.8, 9.8.11, 9.9.8, 9.10.18, 9.12.8, and 9.13.0 (and later).",2026-01-23,Nuclei,,,
CVE-2022-2544,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03158,CWE-425,"The Ninja Job Board WordPress plugin before 1.3.3 does not protect the directory where it stores uploaded resumes, making it vulnerable to unauthenticated Directory Listing which allows the download of uploaded resumes.",2022-08-22,Nuclei,cpe:2.3:a:wpmanageninja:ninja_job_board:*:*:*:*:*:wordpress:*:*,Wpmanageninja,Ninja Job Board
CVE-2022-2546,4.7,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01204,Missing_Data,"The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wm_export AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response that will be executed in the victims session. Note: This requires knowledge of a static secret key",2023-02-02,Nuclei,cpe:2.3:a:servmask:all-in-one_wp_migration:*:*:*:*:*:wordpress:*:*,Servmask,All-In-One Wp Migration
CVE-2022-25481,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04748,CWE-668,ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode.,2022-03-21,Nuclei,cpe:2.3:a:thinkphp:thinkphp:5.0.24:*:*:*:*:*:*:*,Thinkphp,Thinkphp
CVE-2022-25485,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.07927,CWE-829,CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php.,2022-03-15,Nuclei,cpe:2.3:a:cuppacms:cuppacms:1.0:*:*:*:*:*:*:*,Cuppacms,Cuppacms
CVE-2022-25486,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.09966,CWE-829,CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php.,2022-03-15,Nuclei,cpe:2.3:a:cuppacms:cuppacms:1.0:*:*:*:*:*:*:*,Cuppacms,Cuppacms
CVE-2022-25487,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.54766,CWE-434,Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php.,2022-03-15,Nuclei,cpe:2.3:a:thedigitalcraft:atomcms:2.0:*:*:*:*:*:*:*,Thedigitalcraft,Atomcms
CVE-2022-25488,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07148,CWE-89,Atom CMS v2.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/ajax/avatar.php.,2022-03-15,Nuclei,cpe:2.3:a:thedigitalcraft:atomcms:2.0:*:*:*:*:*:*:*,Thedigitalcraft,Atomcms
CVE-2022-25489,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01459,CWE-79,"Atom CMS v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the ""A"" parameter in /widgets/debug.php.",2022-03-15,Nuclei,cpe:2.3:a:thedigitalcraft:atomcms:2.0:*:*:*:*:*:*:*,Thedigitalcraft,Atomcms
CVE-2022-25497,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.03642,CWE-552,CuppaCMS v1.0 was discovered to contain an arbitrary file read via the copy function.,2022-03-15,Nuclei,cpe:2.3:a:cuppacms:cuppacms:1.0:*:*:*:*:*:*:*,Cuppacms,Cuppacms
CVE-2022-2551,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.12485,CWE-425,"The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.",2022-08-22,Nuclei,cpe:2.3:a:awesomemotive:duplicator:*:*:*:*:lite:wordpress:*:*,Awesomemotive,Duplicator
CVE-2022-2552,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.08415,CWE-306,"The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path to the site.",2022-08-22,Nuclei,cpe:2.3:a:awesomemotive:duplicator:*:*:*:*:lite:wordpress:*:*,Awesomemotive,Duplicator
CVE-2022-25568,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.06829,CWE-1188,"MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured.",2022-03-24,Nuclei,cpe:2.3:a:motioneye_project:motioneye:*:*:*:*:*:*:*:*,Motioneye Project,Motioneye
CVE-2022-2586,5.3,CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H,0.10458,CWE-416,"It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.",2024-01-08,CISA,cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:6.0:-:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2022-2599,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0102,CWE-79,"The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.21.83 does not sanitise and escape some parameters before outputting them back in an admin dashboard, leading to Reflected Cross-Site Scripting",2022-08-29,Nuclei,cpe:2.3:a:anti-malware_security_and_brute-force_firewall_project:anti-malware_security_and_brute-force_firewall:*:*:*:*:*:wordpress:*:*,Anti-Malware Security And Brute-Force Firewall Project,Anti-Malware Security And Brute-Force Firewall
CVE-2022-26134,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99999,CWE-917,"In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.",2022-06-03,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:confluence_data_center:7.18.0:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:confluence_server:7.18.0:*:*:*:*:*:*:*,Atlassian,Confluence Data Center
CVE-2022-26138,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9817,CWE-798,"The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.",2022-07-20,CISA/EPSS/Nuclei,cpe:2.3:a:atlassian:confluence_data_center:-:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:confluence_server:-:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:questions_for_confluence:2.7.34:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:questions_for_confluence:2.7.35:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:questions_for_confluence:3.0.2:*:*:*:*:*:*:*,Atlassian,Questions For Confluence
CVE-2022-26143,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.87565,CWE-306,The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.,2022-03-10,CISA/Nuclei,cpe:2.3:a:mitel:micollab:*:*:*:*:*:-:*:*;cpe:2.3:a:mitel:micollab:9.4:-:*:*:*:-:*:*;cpe:2.3:a:mitel:micollab:9.4:sp1:*:*:*:-:*:*;cpe:2.3:a:mitel:mivoice_business_express:*:*:*:*:*:*:*:*,Mitel,Micollab
CVE-2022-26148,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.53439,CWE-312,"An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address.",2022-03-21,Nuclei,cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:ceph_storage:4.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:ceph_storage:5.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:storage:3.0:*:*:*:*:*:*:*,Grafana,Grafana
CVE-2022-26159,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.13372,CWE-425,"The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/<domain>/en.xml (and similar pathnames for other languages), which contain all characters typed by all users, including the content of private pages. For example, a private page may contain usernames, e-mail addresses, and possibly passwords.",2022-02-28,Nuclei,cpe:2.3:a:ametys:ametys:*:*:*:*:*:*:*:*,Ametys,Ametys
CVE-2022-26233,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.15028,CWE-22,"Barco Control Room Management through Suite 2.9 Build 0275 was discovered to be vulnerable to directory traversal, allowing attackers to access sensitive information and components. Requests must begin with the ""GET /..\.."" substring.",2022-04-03,Nuclei,cpe:2.3:a:barco:control_room_management_suite:*:*:*:*:*:*:*:*,Barco,Control Room Management Suite
CVE-2022-26258,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.81099,CWE-78,D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp.,2022-03-28,CISA,cpe:2.3:h:dlink:dir-820l:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-820l_firmware:1.05b03:*:*:*:*:*:*:*,D-Link,Dir-820L Firmware
CVE-2022-26263,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.41454,CWE-79,Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability via the component /u8sl/WebHelp.,2022-03-25,Nuclei,cpe:2.3:a:yonyou:u8\+:13.0:*:*:*:*:*:*:*,Yonyou,U8+
CVE-2022-2627,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00969,CWE-79,"The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, leading to a Reflected Cross-Site Scripting.",2022-10-31,Nuclei,cpe:2.3:a:tagdiv:newspaper:*:*:*:*:*:wordpress:*:*,Tagdiv,Newspaper
CVE-2022-26271,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04633,CWE-552,74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php.,2022-03-28,Nuclei,cpe:2.3:a:74cms:74cms:3.4.1:*:*:*:*:*:*:*,74Cms,74Cms
CVE-2022-26318,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.78303,NVD-CWE-Other,"On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.",2022-03-04,CISA/Metasploit,cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*;cpe:2.3:o:watchguard:fireware:12.1.3:*:*:*:*:*:*:*;cpe:2.3:o:watchguard:fireware:12.1.3:u1:*:*:*:*:*:*;cpe:2.3:o:watchguard:fireware:12.1.3:u2:*:*:*:*:*:*;cpe:2.3:o:watchguard:fireware:12.1.3:u3:*:*:*:*:*:*;cpe:2.3:o:watchguard:fireware:12.1.3:u4:*:*:*:*:*:*;cpe:2.3:o:watchguard:fireware:12.1.3:u5:*:*:*:*:*:*;cpe:2.3:o:watchguard:fireware:12.1.3:u6:*:*:*:*:*:*;cpe:2.3:o:watchguard:fireware:12.1.3:u7:*:*:*:*:*:*;cpe:2.3:o:watchguard:fireware:12.5.9:u1:*:*:*:*:*:*;cpe:2.3:o:watchguard:fireware:12.7.2:u1:*:*:*:*:*:*,Watchguard,Fireware
CVE-2022-2633,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.25869,CWE-610,"The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the ~/public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensitive files hosted on the affected server and forge requests to the server.",2022-09-06,Nuclei,cpe:2.3:a:plugins360:all-in-one_video_gallery:*:*:*:*:*:wordpress:*:*,Plugins360,All-In-One Video Gallery
CVE-2022-26352,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.91501,NVD-CWE-Other,"An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.",2022-07-17,CISA/Metasploit/Nuclei,cpe:2.3:a:dotcms:dotcms:*:*:*:*:*:*:*:*,Dotcms,Dotcms
CVE-2022-26485,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.14261,CWE-416,"Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.",2022-12-22,CISA,cpe:2.3:a:mozilla:firefox:*:*:*:*:*:android:*:*;cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*;cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*;cpe:2.3:a:mozilla:firefox_focus:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*,Mozilla,Firefox
CVE-2022-26486,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.02349,CWE-416,"An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.",2022-12-22,CISA,cpe:2.3:a:mozilla:firefox:*:*:*:*:*:android:*:*;cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*;cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*;cpe:2.3:a:mozilla:firefox_focus:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*,Mozilla,Firefox
CVE-2022-26500,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.0594,CWE-22,"Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.",2022-03-17,CISA,cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:*;cpe:2.3:a:veeam:veeam_backup_\&_replication:10.0.1.4854:-:*:*:*:*:*:*;cpe:2.3:a:veeam:veeam_backup_\&_replication:10.0.1.4854:p20201202:*:*:*:*:*:*;cpe:2.3:a:veeam:veeam_backup_\&_replication:10.0.1.4854:p20210609:*:*:*:*:*:*;cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:-:*:*:*:*:*:*;cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20211123:*:*:*:*:*:*;cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20211211:*:*:*:*:*:*;cpe:2.3:a:veeam:veeam_backup_\&_replication:9.5.0.1536:*:*:*:*:*:*:*;cpe:2.3:a:veeam:veeam_backup_\&_replication:9.5.4.2615:*:*:*:*:*:*:*,Veeam,Veeam Backup & Replication
CVE-2022-26501,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04278,CWE-306,Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).,2022-03-17,CISA,cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:*;cpe:2.3:a:veeam:veeam_backup_\&_replication:10.0.1.4854:-:*:*:*:*:*:*;cpe:2.3:a:veeam:veeam_backup_\&_replication:10.0.1.4854:p20201202:*:*:*:*:*:*;cpe:2.3:a:veeam:veeam_backup_\&_replication:10.0.1.4854:p20210609:*:*:*:*:*:*;cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:-:*:*:*:*:*:*;cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20211123:*:*:*:*:*:*;cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20211211:*:*:*:*:*:*,Veeam,Veeam Backup & Replication
CVE-2022-26564,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02759,CWE-79,HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting (XSS) vulnerability via the prezzoperiodo4 parameter in creaprezzi.php.,2022-04-26,Nuclei,cpe:2.3:a:digitaldruid:hoteldruid:3.0.3:*:*:*:*:*:*:*,Digitaldruid,Hoteldruid
CVE-2022-26585,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05617,CWE-89,Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.,2022-04-05,Nuclei,cpe:2.3:a:mingsoft:mcms:5.2.7:*:*:*:*:*:*:*,Mingsoft,Mcms
CVE-2022-26833,9.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H,0.37177,CWE-306,An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this vulnerability.,2022-05-25,Nuclei,cpe:2.3:a:openautomationsoftware:oas_platform:16.00.0112:*:*:*:*:*:*:*,Openautomationsoftware,Oas Platform
CVE-2022-26871,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.19633,CWE-345,An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.,2022-03-29,CISA,cpe:2.3:a:trendmicro:apex_central:2019:-:*:*:*:*:*:*;cpe:2.3:a:trendmicro:apex_one:-:*:*:*:*:saas:*:*,Trendmicro,Apex Central
CVE-2022-26904,7.0,CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.09817,CWE-362,Windows User Profile Service Elevation of Privilege Vulnerability,2022-04-15,CISA/Metasploit,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2022-26923,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.83277,CWE-295,Active Directory Domain Services Elevation of Privilege Vulnerability,2022-05-10,CISA/Metasploit,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2022-26925,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.10461,CWE-306,Windows LSA Spoofing Vulnerability,2022-05-10,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2022-26960,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.50993,CWE-22,"connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.",2022-03-21,Nuclei,cpe:2.3:a:std42:elfinder:*:*:*:*:*:*:*:*,Std42,Elfinder
CVE-2022-27043,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.06299,CWE-22,Yearning versions 2.3.1 and 2.3.2 Interstellar GA and 2.3.4 - 2.3.6 Neptune is vulnerable to Directory Traversal.,2022-04-15,Nuclei,cpe:2.3:a:yearning:yearning:*:*:*:*:*:*:*:*;cpe:2.3:a:yearning:yearning:2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:yearning:yearning:2.3.2:*:*:*:*:*:*:*,Yearning,Yearning
CVE-2022-27228,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.20318,CWE-20,"In the vote (aka ""Polls, Votes"") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code.",2022-03-22,Nuclei,cpe:2.3:a:bitrix24:bitrix24:*:*:*:*:*:*:*:*,Bitrix24,Bitrix24
CVE-2022-2733,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.95839,CWE-79,Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.,2022-08-09,EPSS/Nuclei,cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*,Open-Emr,Openemr
CVE-2022-27518,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06875,CWE-664,Unauthenticated remote arbitrary code execution,2022-12-13,CISA,cpe:2.3:h:citrix:application_delivery_controller:-:*:*:*:*:*:*:*;cpe:2.3:h:citrix:gateway:-:*:*:*:*:*:*:*;cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:fips:*:*:*;cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:ndcpp:*:*:*;cpe:2.3:o:citrix:gateway_firmware:*:*:*:*:*:*:*:*,Citrix,Application Delivery Controller Firmware
CVE-2022-2756,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.0243,CWE-918,Server-Side Request Forgery (SSRF) in GitHub repository kareadita/kavita prior to 0.5.4.1.,2022-08-10,Nuclei,cpe:2.3:a:kavitareader:kavita:*:*:*:*:*:*:*:*,Kavitareader,Kavita
CVE-2022-27593,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H,0.87908,CWE-610,"An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later",2022-09-08,CISA/Nuclei,cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.2.6:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:5.0.0:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:5.0.1:*:*:*:*:*:*:*,Qnap,Qts
CVE-2022-27849,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.04619,CWE-200,Sensitive Information Disclosure (sac-export.csv) in Simple Ajax Chat (WordPress plugin) <= 20220115,2022-04-15,Nuclei,cpe:2.3:a:plugin-planet:simple_ajax_chat:*:*:*:*:*:wordpress:*:*,Plugin-Planet,Simple Ajax Chat
CVE-2022-27924,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N,0.85398,CWE-74,"Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries.",2022-04-21,CISA/Nuclei,cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p10:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p11:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p12:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p13:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p14:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p15:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p16:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p17:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p18:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p19:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p20:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p21:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p22:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p23:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p24:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p25:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p26:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p27:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p28:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p29:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p30:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p6:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p7:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p8:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p9:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p12:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p15:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p21:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p5:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p6:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p8:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p9:*:*:*:*:*:*,Synacor,Zimbra Collaboration Suite
CVE-2022-27925,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.98586,CWE-22,"Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.",2022-04-21,CISA/EPSS/Metasploit,cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p10:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p11:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p12:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p13:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p14:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p15:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p16:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p17:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p18:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p19:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p20:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p21:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p22:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p23:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p24:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p25:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p26:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p27:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p28:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p29:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p30:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p6:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p7:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p8:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p9:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p12:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p15:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p21:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p5:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p6:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p8:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p9:*:*:*:*:*:*,Synacor,Zimbra Collaboration Suite
CVE-2022-27926,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.17634,CWE-79,A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.,2022-04-21,CISA/Nuclei,cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p12:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p15:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p21:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p5:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p6:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p8:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p9:*:*:*:*:*:*,Synacor,Zimbra Collaboration Suite
CVE-2022-27927,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.13829,CWE-89,A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application database. An attacker can issue SQL commands to the MySQL database through the vulnerable course_code and/or customer_number parameter.,2022-04-19,Nuclei,cpe:2.3:a:microfinance_management_system_project:microfinance_management_system:1.0:*:*:*:*:*:*:*,Microfinance Management System Project,Microfinance Management System
CVE-2022-27984,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0678,CWE-89,CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the menu_filter parameter at /administrator/templates/default/html/windows/right.php.,2022-04-26,Nuclei,cpe:2.3:a:cuppacms:cuppacms:1.0:*:*:*:*:*:*:*,Cuppacms,Cuppacms
CVE-2022-27985,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06598,CWE-89,CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via /administrator/alerts/alertLightbox.php.,2022-04-26,Nuclei,cpe:2.3:a:cuppacms:cuppacms:1.0:*:*:*:*:*:*:*,Cuppacms,Cuppacms
CVE-2022-28032,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05922,CWE-89,AtomCMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_ajax_pages.php,2022-04-12,Nuclei,cpe:2.3:a:thedigitalcraft:atomcms:2.0:*:*:*:*:*:*:*,Thedigitalcraft,Atomcms
CVE-2022-28033,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05412,CWE-89,Atom.CMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_uploads.php,2022-04-12,Nuclei,cpe:2.3:a:thedigitalcraft:atomcms:2.0:*:*:*:*:*:*:*,Thedigitalcraft,Atomcms
CVE-2022-28079,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.28512,CWE-89,College Management System v1.0 was discovered to contain a SQL injection vulnerability via the course_code parameter.,2022-05-05,Nuclei,cpe:2.3:a:college_management_system_project:college_management_system:1.0:*:*:*:*:*:*:*,College Management System Project,College Management System
CVE-2022-28080,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.56907,CWE-89,Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter.,2022-05-05,Nuclei,cpe:2.3:a:event_management_system_project:event_management_system:1.0:*:*:*:*:*:*:*,Event Management System Project,Event Management System
CVE-2022-28117,4.9,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N,0.22903,CWE-918,A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the feed parameter.,2022-04-28,Nuclei,cpe:2.3:a:naviwebs:navigate_cms:2.9.4:*:*:*:*:*:*:*,Naviwebs,Navigate Cms
CVE-2022-28219,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97011,CWE-611,Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution.,2022-04-05,EPSS/Metasploit/Nuclei,cpe:2.3:a:zohocorp:manageengine_adaudit_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7002:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7003:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7004:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7005:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7006:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7007:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7008:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7050:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7051:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7052:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7053:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7054:*:*:*:*:*:*,Zohocorp,Manageengine Adaudit Plus
CVE-2022-28290,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01436,CWE-79,Reflective Cross-Site Scripting vulnerability in WordPress Country Selector Plugin Version 1.6.5. The XSS payload executes whenever the user tries to access the country selector page with the specified payload as a part of the HTTP request,2022-04-25,Nuclei,cpe:2.3:a:welaunch:wordpress_country_selector:1.6.5:*:*:*:*:wordpress:*:*,Welaunch,Wordpress Country Selector
CVE-2022-28363,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0492,CWE-79,Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/login_process username parameter via GET. No authentication is required.,2022-04-09,Nuclei,cpe:2.3:a:reprisesoftware:reprise_license_manager:*:*:*:*:*:*:*:*,Reprisesoftware,Reprise License Manager
CVE-2022-28365,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.09149,CWE-425,"Reprise License Manager 14.2 is affected by an Information Disclosure vulnerability via a GET request to /goforms/rlminfo. No authentication is required. The information disclosed is associated with software versions, process IDs, network configuration, hostname(s), system architecture, and file/directory details.",2022-04-09,Nuclei,cpe:2.3:a:reprisesoftware:reprise_license_manager:*:*:*:*:*:*:*:*,Reprisesoftware,Reprise License Manager
CVE-2022-28368,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.82438,CWE-79,Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).,2022-04-03,Metasploit,cpe:2.3:a:dompdf_project:dompdf:*:*:*:*:*:*:*:*,Dompdf Project,Dompdf
CVE-2022-28381,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.68733,CWE-787,"Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long string to TCP port 888, a related issue to CVE-2017-17932.",2022-04-03,Metasploit,cpe:2.3:a:allmediaserver:allmediaserver:1.6:*:*:*:*:*:*:*,Allmediaserver,Allmediaserver
CVE-2022-28508,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.05324,CWE-79,An XSS issue was discovered in browser_search_plugin.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.,2022-05-04,Nuclei,cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*,Mantisbt,Mantisbt
CVE-2022-2856,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N,0.04493,NVD-CWE-noinfo,Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a malicious website via a crafted HTML page.,2022-09-26,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*;cpe:2.3:o:google:android:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Apple,Macos
CVE-2022-2863,4.9,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N,0.19624,CWE-22,"The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server via a Traversal attack",2022-09-16,Nuclei,"cpe:2.3:a:wpvivid:migration\,_backup\,_staging:*:*:*:*:*:wordpress:*:*",Wpvivid,"Migration, Backup, Staging"
CVE-2022-28666,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.0137,CWE-287,Broken Access Control vulnerability in YIKES Inc. Custom Product Tabs for WooCommerce plugin <= 1.7.7 at WordPress leading to &yikes-the-content-toggle option update.,2022-07-21,Nuclei,cpe:2.3:a:yikesinc:custom_product_tabs_for_woocommerce:*:*:*:*:*:wordpress:*:*,Yikesinc,Custom Product Tabs For Woocommerce
CVE-2022-28810,6.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H,0.70966,CWE-78,"Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.",2022-04-18,CISA/Metasploit,cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:-:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6102:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6103:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6104:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6105:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6106:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6107:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6108:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6109:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6110:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6111:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6112:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6113:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6114:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6115:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6116:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6117:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6118:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6119:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6120:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6121:*:*:*:*:*:*,Zohocorp,Manageengine Adselfservice Plus
CVE-2022-28923,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01431,CWE-601,Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs.,2023-02-06,Nuclei,cpe:2.3:a:caddyserver:caddy:2.4.6:*:*:*:*:*:*:*,Caddyserver,Caddy
CVE-2022-28955,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.38289,CWE-287,An access control issue in D-Link DIR816L_FW206b01 allows unauthenticated attackers to access folders folder_view.php and category_view.php.,2022-05-18,Nuclei,cpe:2.3:h:dlink:dir-816l:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-816l_firmware:206b01:*:*:*:*:*:*:*,D-Link,Dir-816L Firmware
CVE-2022-28987,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.0991,NVD-CWE-noinfo,Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/accounts/login.,2022-05-20,Nuclei,cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6121:*:*:*:*:*:*,Zohocorp,Manageengine Adselfservice Plus
CVE-2022-29004,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02866,CWE-79,Diary Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name parameter in search-result.php.,2022-05-23,Nuclei,cpe:2.3:a:phpgurukul:e-diary_management_system:1.0:*:*:*:*:*:*:*,Phpgurukul,E-Diary Management System
CVE-2022-29005,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0212,CWE-79,Multiple cross-site scripting (XSS) vulnerabilities in the component /obcs/user/profile.php of Online Birth Certificate System v1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fname or lname parameters.,2022-05-23,Nuclei,cpe:2.3:a:phpgurukul:online_birth_certificate_system:1.2:*:*:*:*:*:*:*,Phpgurukul,Online Birth Certificate System
CVE-2022-29006,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.19478,CWE-89,Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Directory Management System v1.0 allows attackers to bypass authentication.,2022-05-11,Nuclei,cpe:2.3:a:phpgurukul:directory_management_system:1.0:*:*:*:*:*:*:*,Phpgurukul,Directory Management System
CVE-2022-29007,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.19478,CWE-89,Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Dairy Farm Shop Management System v1.0 allows attackers to bypass authentication.,2022-05-11,Nuclei,cpe:2.3:a:phpgurukul:dairy_farm_shop_management_system:1.0:*:*:*:*:*:*:*,Phpgurukul,Dairy Farm Shop Management System
CVE-2022-29009,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.22593,CWE-89,Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Cyber Cafe Management System Project v1.0 allows attackers to bypass authentication.,2022-05-11,Nuclei,cpe:2.3:a:phpgurukul:cyber_cafe_management_system:1.0:*:*:*:*:*:*:*,Phpgurukul,Cyber Cafe Management System
CVE-2022-29013,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.77136,CWE-78,A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request.,2022-06-09,Nuclei,cpe:2.3:h:razer:sila:-:*:*:*:*:*:*:*;cpe:2.3:o:razer:sila_firmware:2.0.441_api-2.0.418:*:*:*:*:*:*:*,Razer,Sila Firmware
CVE-2022-29014,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.10612,NVD-CWE-noinfo,A local file inclusion vulnerability in Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to read arbitrary files.,2022-06-09,Nuclei,cpe:2.3:h:razer:sila:-:*:*:*:*:*:*:*;cpe:2.3:o:razer:sila_firmware:2.0.441_api-2.0.418:*:*:*:*:*:*:*,Razer,Sila Firmware
CVE-2022-29078,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.32808,CWE-94,"The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).",2022-04-25,Nuclei,cpe:2.3:a:ejs:ejs:3.1.6:*:*:*:*:node.js:*:*,Ejs,Ejs
CVE-2022-29081,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.83543,CWE-22,"Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize) via the ../RestAPI substring.",2022-04-28,Nuclei,cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.0:build4000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.1:build4100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.1:build4101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.2:build4200:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.2:build4201:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.2:build4202:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.2:build4203:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4300:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4301:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:4.0:build4001:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:4.0:build4002:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:4.1:build4100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:4.1:build4101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:4.5:build4500:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:4.5:build4501:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.0:build5000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.0:build5001:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.0:build5002:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.0:build5003:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.0:build5004:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.1:build5100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.2:build5200:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.3:build5300:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.3:build5301:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.3:build5302:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.4:build5400:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.1:build10103:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.1:build10104:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.2:build10200:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.3:build10300:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.3:build10301:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.3:build10302:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.4:build10400:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.4:build10401:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.4:build10402:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.1:11104:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.1:build_11101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.1:build_11102:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.1:build_11103:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.2:build11200:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.2:build11201:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.3:build11300:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.3:build11301:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12001:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12002:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12003:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12004:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12005:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12006:*:*:*:*:*:*,Zohocorp,Manageengine Access Manager Plus
CVE-2022-29153,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N,0.08676,CWE-918,"HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.",2022-04-19,Nuclei,cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*;cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*;cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2022-29272,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03953,CWE-601,"In Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that could lead to spoofing.",2022-06-29,Nuclei,cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*,Nagios,Nagios Xi
CVE-2022-29298,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.45256,CWE-22,SolarView Compact ver.6.00 allows attackers to access sensitive files via directory traversal.,2022-05-12,Nuclei,cpe:2.3:h:contec:sv-cpt-mc310:-:*:*:*:*:*:*:*;cpe:2.3:o:contec:sv-cpt-mc310_firmware:6.00:*:*:*:*:*:*:*,Contec,Sv-Cpt-Mc310 Firmware
CVE-2022-29303,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97961,CWE-78,SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.,2022-05-12,CISA/EPSS/Nuclei,cpe:2.3:h:contec:sv-cpt-mc310:-:*:*:*:*:*:*:*;cpe:2.3:o:contec:sv-cpt-mc310_firmware:6.00:*:*:*:*:*:*:*,Contec,Sv-Cpt-Mc310 Firmware
CVE-2022-29316,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03139,CWE-89,Complete Online Job Search System v1.0 was discovered to contain a SQL injection vulnerability via /eris/index.php?q=result&searchfor=advancesearch.,2022-05-11,Nuclei,cpe:2.3:a:complete_online_job_search_system_project:complete_online_job_search_system:1.0:*:*:*:*:*:*:*,Complete Online Job Search System Project,Complete Online Job Search System
CVE-2022-29349,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01717,CWE-79,kkFileView v4.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java.,2022-05-25,Nuclei,cpe:2.3:a:keking:kkfileview:4.0.0:*:*:*:*:*:*:*,Keking,Kkfileview
CVE-2022-29383,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.48957,CWE-89,NETGEAR ProSafe SSL VPN firmware FVS336Gv2 and FVS336Gv3 was discovered to contain a SQL injection vulnerability via USERDBDomains.Domainname at cgi-bin/platform.cgi.,2022-05-13,Nuclei,cpe:2.3:h:netgear:ssl312:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:ssl312_firmware:fvs336gv2:*:*:*:*:*:*:*;cpe:2.3:o:netgear:ssl312_firmware:fvs336gv3:*:*:*:*:*:*:*,Netgear,Ssl312 Firmware
CVE-2022-29455,4.7,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N,0.2318,CWE-79,DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions.,2022-06-13,Nuclei,cpe:2.3:a:elementor:website_builder:*:*:*:*:*:wordpress:*:*,Elementor,Website Builder
CVE-2022-29464,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99999,CWE-22,"Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.",2022-04-18,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:wso2:enterprise_integrator:*:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_analytics:5.4.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_analytics:5.4.1:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_analytics:5.5.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_analytics:5.6.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:wso2:open_banking_am:*:*:*:*:*:*:*:*;cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:open_banking_km:*:*:*:*:*:*:*:*,Wso2,Api Manager
CVE-2022-29495,5.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N,0.00495,CWE-352,Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.11 at WordPress allows an attacker to update plugin settings.,2022-07-22,Nuclei,cpe:2.3:a:sygnoos:popup_builder:*:*:*:*:*:wordpress:*:*,Sygnoos,Popup Builder
CVE-2022-29499,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.56556,CWE-20,"The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.",2022-04-26,CISA,cpe:2.3:a:mitel:mivoice_connect:*:*:*:*:*:*:*:*,Mitel,Mivoice Connect
CVE-2022-29548,4.6,CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N,0.41078,CWE-79,"A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0, 6.5.0, and 6.6.0; IS as Key Manager 5.5.0, 5.6.0, 5.7.0, 5.9.0, and 5.10.0; Identity Server 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0, and 5.11.0; Identity Server Analytics 5.5.0 and 5.6.0; and WSO2 Micro Integrator 1.0.0.",2022-04-21,Nuclei,cpe:2.3:a:wso2:api_manager:2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:2.5.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:2.6.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager_analytics:2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager_analytics:2.5.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager_analytics:2.6.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_microgateway:2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:data_analytics_server:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:enterprise_integrator:6.2.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:enterprise_integrator:6.3.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:enterprise_integrator:6.4.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:enterprise_integrator:6.5.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:5.5.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:5.6.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:5.7.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:5.9.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_analytics:5.5.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_analytics:5.6.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_as_key_manager:5.5.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_as_key_manager:5.6.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_as_key_manager:5.7.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_as_key_manager:5.9.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:micro_integrator:1.0.0:*:*:*:*:*:*:*,Wso2,Api Manager
CVE-2022-29775,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.60667,CWE-287,iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL.,2022-06-21,Nuclei,cpe:2.3:a:ispyconnect:ispy:7.2.2.0:*:*:*:*:*:*:*,Ispyconnect,Ispy
CVE-2022-29806,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.67128,CWE-22,ZoneMinder before 1.36.13 allows remote code execution via an invalid language. Ability to create a debug log file at an arbitrary pathname contributes to exploitability.,2022-04-26,Metasploit,cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*,Zoneminder,Zoneminder
CVE-2022-29845,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.03914,CWE-829,"In Progress Ipswitch WhatsUp Gold 21.1.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow them to read the contents of a local file.",2022-05-11,Metasploit,cpe:2.3:a:progress:whatsup_gold:21.1.0:*:*:*:*:*:*:*;cpe:2.3:a:progress:whatsup_gold:21.1.1:*:*:*:*:*:*:*;cpe:2.3:a:progress:whatsup_gold:22.0.0:*:*:*:*:*:*:*,Progress,Whatsup Gold
CVE-2022-29846,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.05132,NVD-CWE-noinfo,"In Progress Ipswitch WhatsUp Gold 16.1 through 21.1.1, and 22.0.0, it is possible for an unauthenticated attacker to obtain the WhatsUp Gold installation serial number.",2022-05-11,Metasploit,cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*;cpe:2.3:a:progress:whatsup_gold:22.0.0:*:*:*:*:*:*:*,Progress,Whatsup Gold
CVE-2022-29847,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.55861,CWE-918,"In Progress Ipswitch WhatsUp Gold 21.0.0 through 21.1.1, and 22.0.0, it is possible for an unauthenticated attacker to invoke an API transaction that would allow them to relay encrypted WhatsUp Gold user credentials to an arbitrary host.",2022-05-11,Metasploit,cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*;cpe:2.3:a:progress:whatsup_gold:22.0.0:*:*:*:*:*:*:*,Progress,Whatsup Gold
CVE-2022-29848,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.03513,CWE-918,"In Progress Ipswitch WhatsUp Gold 17.0.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow them to read sensitive operating-system attributes from a host that is accessible by the WhatsUp Gold system.",2022-05-11,Metasploit,cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*;cpe:2.3:a:progress:whatsup_gold:22.0.0:*:*:*:*:*:*:*,Progress,Whatsup Gold
CVE-2022-2992,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.86194,CWE-74,"A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.",2022-10-17,Metasploit,cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*;cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*,Gitlab,Gitlab
CVE-2022-30073,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01573,CWE-79,WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via /admin/users/save.php.,2022-05-17,Nuclei,cpe:2.3:a:wbce:wbce_cms:1.5.2:*:*:*:*:*:*:*,Wbce,Wbce Cms
CVE-2022-30190,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.99374,NVD-CWE-noinfo,"A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights.
Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.",2022-06-01,CISA/EPSS/Metasploit,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2022-30333,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N,0.98975,CWE-22,"RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.",2022-05-09,CISA/EPSS/Metasploit,cpe:2.3:a:rarlab:unrar:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:opengroup:unix:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2022-3038,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.24738,CWE-416,Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.,2022-09-26,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2022-30489,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.04083,CWE-79,WAVLINK WN535 G3 was discovered to contain a cross-site scripting (XSS) vulnerability via the hostname parameter at /cgi-bin/login.cgi.,2022-05-13,Nuclei,cpe:2.3:h:wavlink:wn535g3:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wn535g3_firmware:-:*:*:*:*:*:*:*,Wavlink,Wn535G3 Firmware
CVE-2022-30512,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09823,CWE-89,School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/payment_history.php:31.,2022-06-02,Nuclei,cpe:2.3:a:school_dormitory_management_system_project:school_dormitory_management_system:1.0:*:*:*:*:*:*:*,School Dormitory Management System Project,School Dormitory Management System
CVE-2022-30513,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03568,CWE-79,School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.php:125,2022-06-02,Nuclei,cpe:2.3:a:school_dormitory_management_system_project:school_dormitory_management_system:1.0:*:*:*:*:*:*:*,School Dormitory Management System Project,School Dormitory Management System
CVE-2022-30514,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03568,CWE-79,School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.php:126.,2022-06-02,Nuclei,cpe:2.3:a:school_dormitory_management_system_project:school_dormitory_management_system:1.0:*:*:*:*:*:*:*,School Dormitory Management System Project,School Dormitory Management System
CVE-2022-30525,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99938,CWE-78,"A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.",2022-05-12,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:*,Zyxel,Usg Flex 100W Firmware
CVE-2022-30526,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01126,CWE-269,"A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32 through 5.30, VPN series firmware versions 4.30 through 5.30, USG/ZyWALL series firmware versions 4.09 through 4.72, which could allow a local attacker to execute some OS commands with root privileges in some directories on a vulnerable device.",2022-07-19,Metasploit,cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg40:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg40w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg60:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg60w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_2200-vpn:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_1100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_110:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_310:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg40_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg40w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg60_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg60w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_2200-vpn_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_1100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_110_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_310_firmware:*:*:*:*:*:*:*:*,Zyxel,Usg Flex 100W Firmware
CVE-2022-3062,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.44095,CWE-79,"The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting",2022-09-26,Nuclei,cpe:2.3:a:simplefilelist:simple-file-list:*:*:*:*:*:wordpress:*:*,Simplefilelist,Simple-File-List
CVE-2022-3075,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.0568,CWE-20,Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.,2022-09-26,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2022-30776,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.04212,CWE-79,atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter.,2022-05-16,Nuclei,cpe:2.3:a:atmail:atmail:6.5.0:*:*:*:*:*:*:*,Atmail,Atmail
CVE-2022-30777,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02243,CWE-79,Parallels H-Sphere 3.6.1713 allows XSS via the index_en.php from parameter.,2022-05-16,Nuclei,cpe:2.3:a:parallels:h-sphere:3.6.2:*:*:*:*:*:*:*,Parallels,H-Sphere
CVE-2022-30781,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N,0.86145,CWE-116,Gitea before 1.16.7 does not escape git fetch remote.,2022-05-16,Metasploit,cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*,Gitea,Gitea
CVE-2022-30995,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03265,CWE-287,"Sensitive information disclosure due to improper authentication. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 29486, Acronis Cyber Backup 12.5 (Windows, Linux) before build 16545.",2023-05-03,Metasploit,cpe:2.3:a:acronis:cyber_backup:12.5:-:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:10130:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:10330:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:11010:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:13160:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:13400:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:14280:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:14330:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:16180:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:16318:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:16327:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:7641:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:7970:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:8850:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:9010:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_protect:15:-:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_protect:15:update1:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_protect:15:update2:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_protect:15:update3:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2022-31101,8.1,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N,0.24146,CWE-89,prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.,2022-06-27,Nuclei,cpe:2.3:a:prestashop:blockwishlist:*:*:*:*:*:*:*:*,Prestashop,Blockwishlist
CVE-2022-31126,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L,0.49937,CWE-74,"Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to code execution by sending a specially crafted HTTP request to /app/options.py file. This affects Roxy-wi versions before 6.1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.",2022-07-06,Nuclei,cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*,Roxy-Wi,Roxy-Wi
CVE-2022-31137,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.90387,CWE-78,"Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability. System commands can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Attackers need not be authenticated to exploit this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.",2022-07-08,Metasploit/Nuclei,cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*,Roxy-Wi,Roxy-Wi
CVE-2022-31161,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L,0.26819,CWE-77,"Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Version 6.1.1.0 contains a patch for this issue.",2022-07-15,Nuclei,cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*,Roxy-Wi,Roxy-Wi
CVE-2022-31181,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0517,CWE-74,PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which can be chained to call PHP's Eval function on attacker input. The problem is fixed in version 1.7.8.7. Users are advised to upgrade. Users unable to upgrade may delete the MySQL Smarty cache feature.,2022-08-01,Nuclei,cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:*,Prestashop,Prestashop
CVE-2022-31199,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.36009,CWE-502,"Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents installed on monitored systems. The remote code execution vulnerabilities exist within the underlying protocol used by the component, and potentially allow an unauthenticated remote attacker to execute arbitrary code as the NT AUTHORITY\SYSTEM user on affected systems, including on systems Netwrix Auditor monitors.",2022-11-08,CISA,cpe:2.3:a:netwrix:auditor:*:*:*:*:*:*:*:*,Netwrix,Auditor
CVE-2022-3124,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.06263,CWE-862,"The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server",2022-10-03,Nuclei,cpe:2.3:a:najeebmedia:frontend_file_manager:*:*:*:*:*:wordpress:*:*,Najeebmedia,Frontend File Manager
CVE-2022-31260,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.01862,CWE-306,"In Montala ResourceSpace through 9.8 before r19636, csv_export_results_metadata.php allows attackers to export collection metadata via a non-NULL k value.",2022-07-17,Nuclei,cpe:2.3:a:montala:resourcespace:*:*:*:*:*:*:*:*;cpe:2.3:a:montala:resourcespace:9.8:-:*:*:*:*:*:*,Montala,Resourcespace
CVE-2022-31268,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.10225,CWE-22,"A Path Traversal vulnerability in Gitblit 1.9.3 can lead to reading website files via /resources//../ (e.g., followed by a WEB-INF or META-INF pathname).",2022-05-21,Nuclei,cpe:2.3:a:gitblit:gitblit:1.9.3:*:*:*:*:*:*:*,Gitblit,Gitblit
CVE-2022-31269,8.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N,0.05055,CWE-798,Nortek Linear eMerge E3-Series devices through 0.32-09c place admin credentials in /test.txt that allow an attacker to open a building's doors. (This occurs in situations where the CVE-2019-7271 default credentials have been changed.),2022-08-25,Nuclei,cpe:2.3:h:nortekcontrol:emerge_e3:-:*:*:*:*:*:*:*;cpe:2.3:o:nortekcontrol:emerge_e3_firmware:*:*:*:*:*:*:*:*,Nortekcontrol,Emerge E3 Firmware
CVE-2022-31299,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.04731,CWE-79,Haraj v3.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the User Upgrade Form.,2022-06-16,Nuclei,cpe:2.3:a:angtech:haraj:3.7:*:*:*:*:*:*:*,Angtech,Haraj
CVE-2022-31373,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.05119,CWE-79,SolarView Compact v6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Solar_AiConf.php.,2022-06-21,Nuclei,cpe:2.3:h:contec:sv-cpt-mc310:-:*:*:*:*:*:*:*;cpe:2.3:o:contec:sv-cpt-mc310_firmware:6.0:*:*:*:*:*:*:*,Contec,Sv-Cpt-Mc310 Firmware
CVE-2022-3142,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.10977,CWE-89,"The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.",2022-09-19,Nuclei,cpe:2.3:a:basixonline:nex-forms:*:*:*:*:*:wordpress:*:*,Basixonline,Nex-Forms
CVE-2022-31470,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.52088,CWE-79,"An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session (for a logged-in user), can access and retrieve mailbox content.",2022-06-07,Nuclei,cpe:2.3:a:axigen:axigen_mobile_webmail:*:*:*:*:*:*:*:*,Axigen,Axigen Mobile Webmail
CVE-2022-31474,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.63761,CWE-22,Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in iThemes BackupBuddy allows Path Traversal.This issue affects BackupBuddy: from 8.5.8.0 through 8.7.4.1.,2023-03-13,Nuclei,cpe:2.3:a:ithemes:backupbuddy:*:*:*:*:*:wordpress:*:*,Ithemes,Backupbuddy
CVE-2022-31499,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.64589,CWE-78,Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo. NOTE: this issue exists because of an incomplete fix for CVE-2019-7256.,2022-08-25,Nuclei,cpe:2.3:h:nortekcontrol:emerge_e3:-:*:*:*:*:*:*:*;cpe:2.3:o:nortekcontrol:emerge_e3_firmware:*:*:*:*:*:*:*:*,Nortekcontrol,Emerge E3 Firmware
CVE-2022-31656,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.18994,NVD-CWE-noinfo,"VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.",2022-08-05,Nuclei,cpe:2.3:a:vmware:access_connector:21.08.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:access_connector:21.08.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:access_connector:22.05:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.4:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.6:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager_connector:19.03.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager_connector:3.3.4:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager_connector:3.3.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager_connector:3.3.6:*:*:*:*:*:*:*;cpe:2.3:a:vmware:one_access:21.08.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:one_access:21.08.0.1:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2022-31660,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01101,NVD-CWE-noinfo,"VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'.",2022-08-05,Metasploit,cpe:2.3:a:vmware:access_connector:21.08.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:access_connector:21.08.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:access_connector:22.05:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.4:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager:3.3.6:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager_connector:19.03.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager_connector:3.3.4:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager_connector:3.3.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:identity_manager_connector:3.3.6:*:*:*:*:*:*:*;cpe:2.3:a:vmware:one_access:21.08.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:one_access:21.08.0.1:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2022-31678,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H,0.08019,CWE-611,"VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information disclosure.",2022-10-28,Nuclei,cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:nsx_data_center:*:*:*:*:*:vsphere:*:*,Vmware,Cloud Foundation
CVE-2022-31704,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.81011,NVD-CWE-Other,The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into sensitive files of an impacted appliance which can result in remote code execution.,2023-01-26,Metasploit/Nuclei,cpe:2.3:a:vmware:vrealize_log_insight:*:*:*:*:*:*:*:*,Vmware,Vrealize Log Insight
CVE-2022-31706,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.87077,CWE-22,"The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.",2023-01-26,Metasploit/Nuclei,cpe:2.3:a:vmware:vrealize_log_insight:*:*:*:*:*:*:*:*,Vmware,Vrealize Log Insight
CVE-2022-31711,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.21657,NVD-CWE-noinfo,VMware vRealize Log Insight contains an Information Disclosure Vulnerability. A malicious actor can remotely collect sensitive session and application information without authentication.,2023-01-26,Metasploit/Nuclei,cpe:2.3:a:vmware:vrealize_log_insight:*:*:*:*:*:*:*:*,Vmware,Vrealize Log Insight
CVE-2022-31793,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.12001,CWE-22,"do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and NVG510 devices and Arris-derived BGW210 and BGW320 devices are affected.",2022-08-04,Nuclei,cpe:2.3:a:inglorion:muhttpd:*:*:*:*:*:*:*:*;cpe:2.3:h:arris:bgw210:-:*:*:*:*:*:*:*;cpe:2.3:h:arris:bgw320:-:*:*:*:*:*:*:*;cpe:2.3:h:arris:nvg443:-:*:*:*:*:*:*:*;cpe:2.3:h:arris:nvg510:-:*:*:*:*:*:*:*;cpe:2.3:h:arris:nvg589:-:*:*:*:*:*:*:*;cpe:2.3:h:arris:nvg599:-:*:*:*:*:*:*:*;cpe:2.3:o:arris:bgw210_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:arris:bgw320_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:arris:nvg443_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:arris:nvg510_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:arris:nvg589_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:arris:nvg599_firmware:-:*:*:*:*:*:*:*,Arris,Nvg443 Firmware
CVE-2022-31798,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.06652,CWE-384,Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /card_scan.php?CardFormatNo= XSS with session fixation (via PHPSESSID) when they are chained together. This would allow an attacker to take over an admin account or a user account.,2022-08-25,Nuclei,cpe:2.3:h:nortekcontrol:emerge_e3:-:*:*:*:*:*:*:*;cpe:2.3:o:nortekcontrol:emerge_e3_firmware:*:*:*:*:*:*:*:*,Nortekcontrol,Emerge E3 Firmware
CVE-2022-31814,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.87247,CWE-78,pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected.,2022-09-05,Metasploit/Nuclei,cpe:2.3:a:netgate:pfblockerng:*:*:*:*:*:pfsense:*:*,Netgate,Pfblockerng
CVE-2022-31845,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.08364,CWE-668,A vulnerability in live_check.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec cmd function.,2022-06-14,Nuclei,cpe:2.3:h:wavlink:wn535g3:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wn535g3_firmware:m35g3r.v5030.180927:*:*:*:*:*:*:*,Wavlink,Wn535G3 Firmware
CVE-2022-31846,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.07142,CWE-668,A vulnerability in live_mfg.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec cmd function.,2022-06-14,Nuclei,cpe:2.3:h:wavlink:wn535g3:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wn535g3_firmware:m35g3r.v5030.180927:*:*:*:*:*:*:*,Wavlink,Wn535G3 Firmware
CVE-2022-31847,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.05482,CWE-425,A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN579 X3 M79X3.V5030.180719 allows attackers to obtain sensitive router information via a crafted POST request.,2022-06-14,Nuclei,cpe:2.3:h:wavlink:wn579x3:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wn579x3_firmware:m79x3.v5030.180719:*:*:*:*:*:*:*,Wavlink,Wn579X3 Firmware
CVE-2022-31854,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.32233,CWE-434,Codoforum v5.1 was discovered to contain an arbitrary file upload vulnerability via the logo change option in the admin panel.,2022-07-07,Nuclei,cpe:2.3:a:codologic:codoforum:5.1:*:*:*:*:*:*:*,Codologic,Codoforum
CVE-2022-31974,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.04903,CWE-89,Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=reports&date=.,2022-06-02,Nuclei,cpe:2.3:a:online_fire_reporting_system_project:online_fire_reporting_system:1.0:*:*:*:*:*:*:*,Online Fire Reporting System Project,Online Fire Reporting System
CVE-2022-31975,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.04863,CWE-89,Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=user/manage_user&id=.,2022-06-02,Nuclei,cpe:2.3:a:online_fire_reporting_system_project:online_fire_reporting_system:1.0:*:*:*:*:*:*:*,Online Fire Reporting System Project,Online Fire Reporting System
CVE-2022-31976,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0716,CWE-89,Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=delete_request.,2022-06-02,Nuclei,cpe:2.3:a:online_fire_reporting_system_project:online_fire_reporting_system:1.0:*:*:*:*:*:*:*,Online Fire Reporting System Project,Online Fire Reporting System
CVE-2022-31977,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0716,CWE-89,Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=delete_team.,2022-06-02,Nuclei,cpe:2.3:a:online_fire_reporting_system_project:online_fire_reporting_system:1.0:*:*:*:*:*:*:*,Online Fire Reporting System Project,Online Fire Reporting System
CVE-2022-31978,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0716,CWE-89,Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=delete_inquiry.,2022-06-02,Nuclei,cpe:2.3:a:online_fire_reporting_system_project:online_fire_reporting_system:1.0:*:*:*:*:*:*:*,Online Fire Reporting System Project,Online Fire Reporting System
CVE-2022-31984,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.04863,CWE-89,Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/requests/take_action.php?id=.,2022-06-02,Nuclei,cpe:2.3:a:online_fire_reporting_system_project:online_fire_reporting_system:1.0:*:*:*:*:*:*:*,Online Fire Reporting System Project,Online Fire Reporting System
CVE-2022-32007,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.04522,CWE-89,Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/company/index.php?view=edit&id=.,2022-06-02,Nuclei,cpe:2.3:a:complete_online_job_search_system_project:complete_online_job_search_system:1.0:*:*:*:*:*:*:*,Complete Online Job Search System Project,Complete Online Job Search System
CVE-2022-32015,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.04522,CWE-89,Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=category&search=.,2022-06-02,Nuclei,cpe:2.3:a:complete_online_job_search_system_project:complete_online_job_search_system:1.0:*:*:*:*:*:*:*,Complete Online Job Search System Project,Complete Online Job Search System
CVE-2022-32018,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.04522,CWE-89,Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=hiring&search=.,2022-06-02,Nuclei,cpe:2.3:a:complete_online_job_search_system_project:complete_online_job_search_system:1.0:*:*:*:*:*:*:*,Complete Online Job Search System Project,Complete Online Job Search System
CVE-2022-32022,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.04879,CWE-89,Car Rental Management System v1.0 is vulnerable to SQL Injection via /ip/car-rental-management-system/admin/ajax.php?action=login.,2022-06-02,Nuclei,cpe:2.3:a:car_rental_management_system_project:car_rental_management_system:1.0:*:*:*:*:*:*:*,Car Rental Management System Project,Car Rental Management System
CVE-2022-32024,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.04522,CWE-89,Car Rental Management System v1.0 is vulnerable to SQL Injection via car-rental-management-system/booking.php?car_id=.,2022-06-02,Nuclei,cpe:2.3:a:car_rental_management_system_project:car_rental_management_system:1.0:*:*:*:*:*:*:*,Car Rental Management System Project,Car Rental Management System
CVE-2022-32025,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.04522,CWE-89,Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/view_car.php?id=.,2022-06-02,Nuclei,cpe:2.3:a:car_rental_management_system_project:car_rental_management_system:1.0:*:*:*:*:*:*:*,Car Rental Management System Project,Car Rental Management System
CVE-2022-32026,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.05261,CWE-89,Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/manage_booking.php?id=.,2022-06-02,Nuclei,cpe:2.3:a:car_rental_management_system_project:car_rental_management_system:1.0:*:*:*:*:*:*:*,Car Rental Management System Project,Car Rental Management System
CVE-2022-32028,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.04879,CWE-89,Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/manage_user.php?id=.,2022-06-02,Nuclei,cpe:2.3:a:car_rental_management_system_project:car_rental_management_system:1.0:*:*:*:*:*:*:*,Car Rental Management System Project,Car Rental Management System
CVE-2022-32094,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07476,CWE-89,Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the loginid parameter at doctorlogin.php.,2022-07-01,Nuclei,cpe:2.3:a:hospital_management_system_project:hospital_management_system:1.0:*:*:*:*:*:*:*,Hospital Management System Project,Hospital Management System
CVE-2022-3218,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.73475,CWE-603,"Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution.",2022-09-19,Metasploit,cpe:2.3:a:necta:wifi_mouse_server:1.7.8.5:*:*:*:*:*:*:*,Necta,Wifi Mouse Server
CVE-2022-32195,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02301,CWE-79,"Open edX platform before 2022-06-06 allows XSS via the ""next"" parameter in the logout URL.",2022-06-09,Nuclei,cpe:2.3:a:edx:open_edx:*:*:*:*:*:*:*:*,Edx,Open Edx
CVE-2022-3229,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.66354,CWE-285,"Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker can change or disable authentication requirements for the Unified Remote protocol, and leverage this now-unauthenticated access to run code of the attacker's choosing.",2023-02-06,Metasploit,cpe:2.3:a:unifiedremote:unified_remote:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2022-3236,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98905,CWE-94,A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.,2022-09-23,CISA/EPSS/Nuclei,cpe:2.3:a:sophos:firewall:*:*:*:*:*:*:*:*,Sophos,Firewall
CVE-2022-32409,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.12593,CWE-22,A local file inclusion (LFI) vulnerability in the component codemirror.php of Portal do Software Publico Brasileiro i3geo v7.0.5 allows attackers to execute arbitrary PHP code via a crafted HTTP request.,2022-07-14,Nuclei,cpe:2.3:a:softwarepublico:i3geo:7.0.5:*:*:*:*:*:*:*,Softwarepublico,I3Geo
CVE-2022-3242,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01437,CWE-94,Code Injection in GitHub repository microweber/microweber prior to 1.3.2.,2022-09-20,Nuclei,cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*,Microweber,Microweber
CVE-2022-32429,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.75556,CWE-287,"An authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technologies Inc MSNSwitch MNT.2408 allows unauthenticated attackers to arbitrarily configure settings within the application, leading to remote code execution.",2022-08-10,Nuclei,cpe:2.3:h:megatech:msnswitch:-:*:*:*:*:*:*:*;cpe:2.3:o:megatech:msnswitch_firmware:mnt.2408:*:*:*:*:*:*:*,Megatech,Msnswitch Firmware
CVE-2022-32430,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04645,NVD-CWE-Other,An access control issue in Lin CMS Spring Boot v0.2.1 allows attackers to access the backend information and functions within the application.,2022-07-21,Nuclei,cpe:2.3:a:talelin:lin-cms-spring-boot:0.2.1:*:*:*:*:*:*:*,Talelin,Lin-Cms-Spring-Boot
CVE-2022-32444,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02246,CWE-601,An issue was discovered in u5cms verion 8.3.5 There is a URL redirection vulnerability that can cause a user's browser to be redirected to another site via /loginsave.php.,2022-06-17,Nuclei,cpe:2.3:a:yuba:u5cms:8.3.5:*:*:*:*:*:*:*,Yuba,U5Cms
CVE-2022-3254,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05103,CWE-89,"The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users and when a specific premium module is active, leading to a SQL injection",2022-10-31,Nuclei,cpe:2.3:a:strategy11:awp_classifieds:*:*:*:*:*:wordpress:*:*,Strategy11,Awp Classifieds
CVE-2022-32770,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03355,CWE-79,"A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the ""toast"" parameter which is inserted into the document with insufficient sanitization.",2022-08-22,Nuclei,cpe:2.3:a:wwbn:avideo:11.6:*:*:*:*:*:*:*,Wwbn,Avideo
CVE-2022-32771,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03187,CWE-79,"A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the ""success"" parameter which is inserted into the document with insufficient sanitization.",2022-08-22,Nuclei,cpe:2.3:a:wwbn:avideo:11.6:*:*:*:*:*:*:*,Wwbn,Avideo
CVE-2022-32772,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0303,CWE-79,"A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the ""msg"" parameter which is inserted into the document with insufficient sanitization.",2022-08-22,Nuclei,cpe:2.3:a:wwbn:avideo:11.6:*:*:*:*:*:*:*,Wwbn,Avideo
CVE-2022-32893,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.09785,CWE-787,"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.",2022-08-24,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:*;cpe:2.3:a:wpewebkit:wpe_webkit:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*,Apple,Ipados
CVE-2022-32894,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.03259,CWE-787,"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.",2022-08-24,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2022-32917,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.05557,CWE-787,"The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..",2022-09-20,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2022-33119,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01531,CWE-79,NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via login.php.,2022-06-21,Nuclei,cpe:2.3:h:nuuo:nvrsolo:-:*:*:*:*:*:*:*;cpe:2.3:o:nuuo:nvrsolo_firmware:03.06.02:*:*:*:*:*:*:*,Nuuo,Nvrsolo Firmware
CVE-2022-33174,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.13425,CWE-863,"Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext.",2022-06-13,Nuclei,cpe:2.3:h:powertekpdus:basic_pdu:-:*:*:*:*:*:*:*;cpe:2.3:h:powertekpdus:piml_pdu:-:*:*:*:*:*:*:*;cpe:2.3:h:powertekpdus:pm_pdu:-:*:*:*:*:*:*:*;cpe:2.3:h:powertekpdus:smart_pim:-:*:*:*:*:*:*:*;cpe:2.3:h:powertekpdus:smart_pom:-:*:*:*:*:*:*:*;cpe:2.3:h:powertekpdus:smart_poms:-:*:*:*:*:*:*:*;cpe:2.3:h:powertekpdus:smart_pos:-:*:*:*:*:*:*:*;cpe:2.3:o:powertekpdus:basic_pdu_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:powertekpdus:piml_pdu_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:powertekpdus:pm_pdu_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:powertekpdus:smart_pim_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:powertekpdus:smart_pom_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:powertekpdus:smart_poms_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:powertekpdus:smart_pos_firmware:*:*:*:*:*:*:*:*,Powertekpdus,Basic Pdu Firmware
CVE-2022-33198,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03225,CWE-264,Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin <= 2.0.2 at WordPress.,2022-07-21,Nuclei,cpe:2.3:a:oxilab:accordions:*:*:*:*:*:wordpress:*:*,Oxilab,Accordions
CVE-2022-3358,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02976,CWE-476,"OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mechanism in order to implement custom ciphers. OpenSSL versions 3.0.0 to 3.0.5 incorrectly handle legacy custom ciphers passed to the EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() and EVP_CipherInit_ex2() functions (as well as other similarly named encryption and decryption initialisation functions). Instead of using the custom cipher directly it incorrectly tries to fetch an equivalent cipher from the available providers. An equivalent cipher is found based on the NID passed to EVP_CIPHER_meth_new(). This NID is supposed to represent the unique NID for a given cipher. However it is possible for an application to incorrectly pass NID_undef as this value in the call to EVP_CIPHER_meth_new(). When NID_undef is used in this way the OpenSSL encryption/decryption initialisation function will match the NULL cipher as being equivalent and will fetch this from the available providers. This will succeed if the default provider has been loaded (or if a third party provider has been loaded that offers this cipher). Using the NULL cipher means that the plaintext is emitted as the ciphertext. Applications are only affected by this issue if they call EVP_CIPHER_meth_new() using NID_undef and subsequently use it in a call to an encryption/decryption initialisation function. Applications that only use SSL/TLS are not impacted by this issue. Fixed in OpenSSL 3.0.6 (Affected 3.0.0-3.0.5).",2022-10-11,Metasploit,cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*,Openssl,Openssl
CVE-2022-3365,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02044,CWE-327,"Due to reliance on a trivial substitution cipher, sent in cleartext, and the reliance on a default password when the user does not set a password, the Remote Mouse Server by Emote Interactive can be abused by attackers to inject OS commands over theproduct's custom control protocol. A Metasploit module was written and tested against version 4.110, the current version when this CVE was reserved.",2025-01-28,Metasploit,,,
CVE-2022-33891,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.92984,CWE-78,"The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.",2022-07-18,CISA/Metasploit/Nuclei,cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*,Apache,Spark
CVE-2022-33901,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.02599,NVD-CWE-noinfo,Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress.,2022-07-22,Nuclei,cpe:2.3:a:multisafepay:multisafepay_plugin_for_woocommerce:*:*:*:*:*:wordpress:*:*,Multisafepay,Multisafepay Plugin For Woocommerce
CVE-2022-33965,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N,0.04234,CWE-89,Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin <= 5.7 at WordPress.,2022-07-25,Nuclei,cpe:2.3:a:codepress:visitor_statistics:*:*:*:*:-:wordpress:*:*,Codepress,Visitor Statistics
CVE-2022-34045,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03119,CWE-798,Wavlink WN530HG4 M30HG4.V5030.191116 was discovered to contain a hardcoded encryption/decryption key for its configuration files at /etc_ro/lighttpd/www/cgi-bin/ExportAllSettings.sh.,2022-07-20,Nuclei,cpe:2.3:h:wavlink:wl-wn530hg4:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wl-wn530hg4_firmware:m30hg4.v5030.191116:*:*:*:*:*:*:*,Wavlink,Wl-Wn530Hg4 Firmware
CVE-2022-34046,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.20351,CWE-863,An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtml?r=52300 and searching for [logincheck(user);].,2022-07-20,Nuclei,cpe:2.3:h:wavlink:wn533a8:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wn533a8_firmware:m33a8.v5030.190716:*:*:*:*:*:*:*,Wavlink,Wn533A8 Firmware
CVE-2022-34047,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.21387,CWE-668,An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/set_safety.shtml?r=52300 and searching for [var syspasswd].,2022-07-20,Nuclei,cpe:2.3:h:wavlink:wl-wn530hg4:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wl-wn530hg4_firmware:m30hg4.v5030.191116:*:*:*:*:*:*:*,Wavlink,Wl-Wn530Hg4 Firmware
CVE-2022-34048,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.06313,CWE-79,Wavlink WN533A8 M33A8.V5030.190716 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login_page parameter.,2022-07-20,Nuclei,cpe:2.3:h:wavlink:wn533a8:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wn533a8_firmware:m33a8.v5030.190716:*:*:*:*:*:*:*,Wavlink,Wn533A8 Firmware
CVE-2022-34049,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.02579,CWE-552,An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows unauthenticated attackers to download log files and configuration data.,2022-07-20,Nuclei,cpe:2.3:h:wavlink:wl-wn530hg4:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wl-wn530hg4_firmware:m30hg4.v5030.191116:*:*:*:*:*:*:*,Wavlink,Wl-Wn530Hg4 Firmware
CVE-2022-3405,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05325,CWE-269,"Code execution and sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 29486, Acronis Cyber Backup 12.5 (Windows, Linux) before build 16545.",2023-05-03,Metasploit,cpe:2.3:a:acronis:cyber_backup:12.5:-:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:10130:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:10330:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:11010:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:13160:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:13400:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:14280:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:14330:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:16180:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:16318:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:16327:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:7641:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:7970:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:8850:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_backup:12.5:9010:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_protect:15:-:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_protect:15:update1:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_protect:15:update2:*:*:*:*:*:*;cpe:2.3:a:acronis:cyber_protect:15:update3:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2022-34093,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02804,CWE-79,Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via access_token.php.,2022-07-14,Nuclei,cpe:2.3:a:softwarepublico:i3geo:7.0.5:*:*:*:*:*:*:*,Softwarepublico,I3Geo
CVE-2022-34094,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02804,CWE-79,Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via request_token.php.,2022-07-14,Nuclei,cpe:2.3:a:softwarepublico:i3geo:7.0.5:*:*:*:*:*:*:*,Softwarepublico,I3Geo
CVE-2022-34121,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03059,CWE-829,Cuppa CMS v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the component /templates/default/html/windows/right.php.,2022-07-27,Nuclei,cpe:2.3:a:cuppacms:cuppacms:1.0:*:*:*:*:*:*:*,Cuppacms,Cuppacms
CVE-2022-34267,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.42162,CWE-287,An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Java code can be uploaded and executed via a .jar archive to the ws-api/v2/customizations/api endpoint.,2023-12-25,Nuclei,cpe:2.3:a:rws:worldserver:*:*:*:*:*:*:*:*,Rws,Worldserver
CVE-2022-34305,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.06156,CWE-79,"In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.",2022-06-23,Nuclei,cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*,Apache,Tomcat
CVE-2022-34328,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02154,CWE-79,PMB 7.3.10 allows reflected XSS via the id parameter in an lvl=author_see request to index.php.,2022-06-23,Nuclei,cpe:2.3:a:sigb:pmb:7.3.10:*:*:*:*:*:*:*,Sigb,Pmb
CVE-2022-34487,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03225,CWE-264,Unauthenticated Arbitrary Option Update vulnerability in biplob018's Shortcode Addons plugin <= 3.0.2 at WordPress.,2022-07-21,Nuclei,cpe:2.3:a:oxilab:shortcode_addons:*:*:*:*:*:wordpress:*:*,Oxilab,Shortcode Addons
CVE-2022-34534,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.024,NVD-CWE-noinfo,Digital Watchdog DW Spectrum Server 4.2.0.32842 allows attackers to access sensitive infromation via a crafted API call.,2022-07-19,Nuclei,cpe:2.3:h:dw:spectrum_server:-:*:*:*:*:*:*:*;cpe:2.3:o:dw:spectrum_server_firmware:4.2.0.32842:*:*:*:*:*:*:*,Dw,Spectrum Server Firmware
CVE-2022-34576,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.0364,NVD-CWE-noinfo,A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request.,2022-07-25,Nuclei,cpe:2.3:h:wavlink:wn535g3:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wn535g3_firmware:m35g3r.v5030.180927:*:*:*:*:*:*:*,Wavlink,Wn535G3 Firmware
CVE-2022-34590,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.04475,CWE-89,Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in /HMS/admin.php.,2022-07-20,Nuclei,cpe:2.3:a:hospital_management_system_project:hospital_management_system:1.0:*:*:*:*:*:*:*,Hospital Management System Project,Hospital Management System
CVE-2022-34713,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.6798,NVD-CWE-noinfo,Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability,2022-08-09,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2022-34753,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.71084,CWE-78,"A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote root exploit when the command is compromised. Affected Products: SpaceLogic C-Bus Home Controller (5200WHC2), formerly known as C-Bus Wiser Homer Controller MK2 (V1.31.460 and prior)",2022-07-13,Nuclei,cpe:2.3:h:schneider-electric:spacelogic_c-bus_home_controller:-:*:*:*:*:*:*:*;cpe:2.3:o:schneider-electric:spacelogic_c-bus_home_controller_firmware:*:*:*:*:*:*:*:*,Schneider-Electric,Spacelogic C-Bus Home Controller Firmware
CVE-2022-3477,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03546,CWE-287,"The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address",2022-11-14,Nuclei,cpe:2.3:a:newsmag_project:newsmag:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:newspaper_project:newspaper:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:tagdiv_composer_project:tagdiv_composer:*:*:*:*:*:wordpress:*:*,Newsmag Project,Newsmag
CVE-2022-3481,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03686,CWE-89,"The WooCommerce Dropshipping WordPress plugin before 4.4 does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection",2022-11-07,Nuclei,cpe:2.3:a:opmc:woocommerce_dropshipping:*:*:*:*:*:wordpress:*:*,Opmc,Woocommerce Dropshipping
CVE-2022-3484,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00902,CWE-79,"The WPB Show Core WordPress plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.",2022-11-14,Nuclei,cpe:2.3:a:wpb_show_core_project:wpb_show_core:-:*:*:*:*:wordpress:*:*,Wpb Show Core Project,Wpb Show Core
CVE-2022-34876,5.5,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N,0.03272,CWE-89,"SQL Injection vulnerability in admin interface (/vicidial/admin.php) of VICIdial via modify_email_accounts, access_recordings, and agentcall_email parameters allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. This issue affects: VICIdial 2.14b0.5 versions prior to 3555.",2022-07-05,Metasploit,cpe:2.3:a:vicidial:vicidial:2.14b0.5:3555:*:*:*:*:*:*,Vicidial,Vicidial
CVE-2022-34877,6.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N,0.03213,CWE-89,"SQL Injection vulnerability in AST Agent Time Sheet interface ((/vicidial/AST_agent_time_sheet.php) of VICIdial via the agent parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. This issue affects: VICIdial 2.14b0.5 versions prior to 3555.",2022-07-05,Metasploit,cpe:2.3:a:vicidial:vicidial:2.14b0.5:3555:*:*:*:*:*:*,Vicidial,Vicidial
CVE-2022-34878,5.5,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N,0.03512,CWE-89,"SQL Injection vulnerability in User Stats interface (/vicidial/user_stats.php) of VICIdial via the file_download parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server.",2022-07-05,Metasploit,cpe:2.3:a:vicidial:vicidial:2.14b0.5:3555:*:*:*:*:*:*,Vicidial,Vicidial
CVE-2022-34918,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.05496,CWE-843,"An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data in net/netfilter/nf_tables_api.c.",2022-07-04,Metasploit,cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*,Netapp,H300S Firmware
CVE-2022-3506,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01113,CWE-79,Cross-site Scripting (XSS) - Stored in GitHub repository barrykooij/related-posts-for-wp prior to 2.1.3.,2022-10-14,Nuclei,cpe:2.3:a:never5:related_posts:*:*:*:*:*:wordpress:*:*,Never5,Related Posts
CVE-2022-35151,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01192,CWE-79,kkFileView v4.1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java.,2022-08-17,Nuclei,cpe:2.3:a:keking:kkfileview:4.1.0:*:*:*:*:*:*:*,Keking,Kkfileview
CVE-2022-35405,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9994,CWE-502,Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.),2022-07-19,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:zohocorp:manageengine_access_manager_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4300:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4301:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4302:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.5:build5500:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12100:*:*:*:*:*:*,Zohocorp,Manageengine Access Manager Plus
CVE-2022-35413,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.13518,CWE-798,WAPPLES through 6.0 has a hardcoded systemi account. A threat actor could use this account to access the system configuration and confidential information (such as SSL keys) via an HTTPS request to the /webapi/ URI on port 443 or 5001.,2022-09-13,Nuclei,cpe:2.3:a:pentasecurity:wapples:*:*:*:*:*:*:*:*,Pentasecurity,Wapples
CVE-2022-35416,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02886,CWE-79,H3C SSL VPN through 2022-07-10 allows wnm/login/login.json svpnlang cookie XSS.,2022-07-11,Nuclei,cpe:2.3:a:h3c:ssl_vpn:*:*:*:*:*:*:*:*,H3C,Ssl Vpn
CVE-2022-35493,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01503,CWE-79,"A Cross-site scripting (XSS) vulnerability in json search parse and the json response in wrteam.in, eShop - Multipurpose Ecommerce Store Website version 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the get_products?search parameter.",2022-08-08,Nuclei,cpe:2.3:a:wrteam:eshop_-_ecommerce_\/_store_website:*:*:*:*:*:*:*:*,Wrteam,Eshop - Ecommerce / Store Website
CVE-2022-35507,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H,0.0138,CWE-74,"A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than the server expects, causing a client-side DoS. This affects Chromium-based browsers because they allow injection of response headers with %0d. This is fixed in pve-http-server 4.1-3.",2022-12-04,Nuclei,cpe:2.3:a:proxmox:proxmox_mail_gateway:-:*:*:*:*:*:*:*;cpe:2.3:a:proxmox:pve_http_server:*:*:*:*:*:*:*:*;cpe:2.3:a:proxmox:virtual_environment:-:*:*:*:*:*:*:*,Proxmox,Proxmox Mail Gateway
CVE-2022-35653,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.04458,CWE-79,"A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks. This vulnerability does not impact authenticated users.",2022-07-25,Nuclei,cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:4.0.0:-:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:4.0.0:beta:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:4.0.0:rc1:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:4.0.0:rc2:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:4.0.0:rc3:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:4.0.0:rc4:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:4.0.1:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2022-3569,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.00695,CWE-271,"Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a local privilege escalation issue in versions 9.0.0 and prior, where the 'zimbra' user can effectively coerce postfix into running arbitrary commands as 'root'.",2022-10-17,Metasploit,cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*,Synacor,Zimbra Collaboration Suite
CVE-2022-3578,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00946,CWE-79,"The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting",2022-11-14,Nuclei,cpe:2.3:a:metagauss:profilegrid:*:*:*:*:*:wordpress:*:*,Metagauss,Profilegrid
CVE-2022-3590,5.9,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N,0.0315,CWE-367,"WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.",2022-12-14,Nuclei,cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:4.1:-:*:*:*:*:*:*,Wordpress,Wordpress
CVE-2022-35914,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99696,CWE-74,/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.,2022-09-19,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*,Glpi-Project,Glpi
CVE-2022-36446,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96049,CWE-116,software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.,2022-07-25,EPSS/Metasploit/Nuclei,cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*,Webmin,Webmin
CVE-2022-36534,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.51804,NVD-CWE-noinfo,Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below was discovered to contain multiple remote code execution (RCE) vulnerabilities via the Job_ExecuteBefore and Job_ExecuteAfter parameters at post_profilesettings.php.,2022-09-16,Metasploit,cpe:2.3:a:syncovery:syncovery:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2022-36536,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03958,CWE-330,An issue in the component post_applogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privileges via creating crafted session tokens.,2022-09-16,Metasploit,cpe:2.3:a:syncovery:syncovery:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2022-36537,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.95335,NVD-CWE-Other,"ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.",2022-08-26,CISA/EPSS/Nuclei,cpe:2.3:a:zkoss:zk_framework:*:*:*:*:*:*:*:*,Zkoss,Zk Framework
CVE-2022-36553,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.90798,CWE-77,Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi.,2022-08-29,Nuclei,cpe:2.3:h:hytec:hwl-2511-ss:-:*:*:*:*:*:*:*;cpe:2.3:o:hytec:hwl-2511-ss_firmware:*:*:*:*:*:*:*:*,Hytec,Hwl-2511-Ss Firmware
CVE-2022-36642,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09572,CWE-862,A local file disclosure vulnerability in /appConfig/userDB.json of Telos Alliance Omnia MPX Node through 1.0.0-1.4.9 allows attackers to access users credentials which makes him able to gain initial access to the control panel with high privilege because the cleartext storage of sensitive information which can be unlatched by exploiting the LFD vulnerability.,2022-09-02,Nuclei,cpe:2.3:h:telosalliance:omnia_mpx_node:-:*:*:*:*:*:*:*;cpe:2.3:o:telosalliance:omnia_mpx_node_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:telosalliance:omnia_mpx_node_firmware:1.5.0:-:*:*:*:*:*:*;cpe:2.3:o:telosalliance:omnia_mpx_node_firmware:1.5.0:r1:*:*:*:*:*:*,Telosalliance,Omnia Mpx Node Firmware
CVE-2022-36804,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.99077,CWE-78,"Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.",2022-08-25,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:bitbucket:8.3.0:*:*:*:*:*:*:*,Atlassian,Bitbucket
CVE-2022-36883,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N,0.05563,CWE-862,A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.,2022-07-27,Nuclei,cpe:2.3:a:jenkins:git:*:*:*:*:*:jenkins:*:*,Jenkins,Git
CVE-2022-36923,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.08206,CWE-755,"Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow unauthenticated attackers to obtain a user's API key, and then access external APIs.",2022-08-10,Nuclei,cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.5:build125450:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.5:build125451:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.5:build125452:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.5:build125453:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.5:build125455:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.5:build125456:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.5:build125664:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.6:build126000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.6:build126001:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.6:build126100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.6:build126101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.6:build126102:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.6:build126103:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.6:build126113:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.6:build126114:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.6:build126115:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.6:build126116:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.6:build126117:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.5:build125450:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.5:build125451:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.5:build125452:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.5:build125453:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.5:build125455:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.5:build125456:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.5:build125664:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.6:build126000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.6:build126001:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.6:build126100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.6:build126101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.6:build126102:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.6:build126103:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.6:build126113:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.6:build126114:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.6:build126115:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.6:build126116:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.6:build126117:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.5:build125450:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.5:build125451:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.5:build125452:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.5:build125453:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.5:build125455:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.5:build125456:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.5:build125664:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.6:build126000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.6:build126001:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.6:build126100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.6:build126101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.6:build126102:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.6:build126103:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.6:build126113:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.6:build126114:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.6:build126115:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.6:build126116:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.6:build126117:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125450:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125451:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125452:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125453:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125455:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125456:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125664:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126001:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126102:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126103:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126113:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126114:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126115:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126116:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.6:build126117:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.5:build125450:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.5:build125656:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.5:build125664:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126001:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126103:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126113:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.6:build126117:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.5:build125450:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.5:build125656:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.5:build125664:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126001:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126103:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126113:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.6:build126117:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.5:build125450:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.5:build125451:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.5:build125452:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.5:build125453:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.5:build125455:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.5:build125456:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.5:build125664:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.6:build126000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.6:build126001:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.6:build126100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.6:build126101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.6:build126102:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.6:build126103:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.6:build126113:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.6:build126114:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.6:build126115:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.6:build126116:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.6:build126117:*:*:*:*:*:*,Zohocorp,Manageengine Firewall Analyzer
CVE-2022-3699,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.04284,CWE-787,"
A privilege escalation vulnerability was reported in the Lenovo HardwareScanPlugin prior to version 1.3.1.2 and Lenovo Diagnostics prior to version 4.45



 that could allow a local user to execute code with elevated privileges.",2023-10-25,Metasploit,cpe:2.3:a:lenovo:diagnostics:*:*:*:*:*:*:*:*;cpe:2.3:a:lenovo:hardwarescan_addin:*:*:*:*:*:*:*:*;cpe:2.3:a:lenovo:hardwarescan_plugin:*:*:*:*:*:*:*:*,Lenovo,Diagnostics
CVE-2022-37042,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.88795,CWE-22,"Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.",2022-08-12,CISA/Metasploit/Nuclei,cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p10:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p11:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p12:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p13:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p14:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p15:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p16:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p17:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p18:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p19:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p20:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p21:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p22:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p23:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p24:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p25:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p26:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p27:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p28:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p29:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p30:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31.1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p32:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p6:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p7:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p8:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p9:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p12:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p15:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p21:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24.1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p5:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p6:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p8:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p9:*:*:*:*:*:*,Synacor,Zimbra Collaboration Suite
CVE-2022-37055,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.57037,CWE-120,"D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,",2022-08-28,CISA,cpe:2.3:h:dlink:go-rt-ac750:revision_a:*:*:*:*:*:*:*;cpe:2.3:h:dlink:go-rt-ac750:revision_b:*:*:*:*:*:*:*;cpe:2.3:o:dlink:go-rt-ac750_firmware:1.01b03:*:*:*:*:*:*:*;cpe:2.3:o:dlink:go-rt-ac750_firmware:2.00b02:*:*:*:*:*:*:*,D-Link,Go-Rt-Ac750 Firmware
CVE-2022-37061,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99607,CWE-78,"All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in the res.php endpoint. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the root privileges. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.",2022-08-18,EPSS/Metasploit/Nuclei,cpe:2.3:h:flir:flir_ax8:-:*:*:*:*:*:*:*;cpe:2.3:o:flir:flir_ax8_firmware:*:*:*:*:*:*:*:*,Flir,Flir Ax8 Firmware
CVE-2022-37122,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.19669,CWE-22,"Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.",2022-08-31,Nuclei,cpe:2.3:a:carel:applica:16_13020200:*:*:*:*:*:*:*;cpe:2.3:a:carel:applica:2.154a:*:*:*:*:*:*:*;cpe:2.3:a:carel:pcoweb_hvac_bacnet_gateway:2.1.0:*:*:*:*:*:*:*;cpe:2.3:h:carel:pcoweb_card:-:*:*:*:*:*:*:*;cpe:2.3:o:carel:pcoweb_card_firmware:*:*:*:*:*:*:*:*,Carel,Pcoweb Card Firmware
CVE-2022-37153,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01393,CWE-79,An issue was discovered in Artica Proxy 4.30.000000. There is a XSS vulnerability via the password parameter in /fw.login.php.,2022-08-24,Nuclei,cpe:2.3:a:articatech:artica_proxy:4.30.000000:*:*:*:*:*:*:*,Articatech,Artica Proxy
CVE-2022-37190,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.45769,NVD-CWE-Other,"CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE). An authenticated user can control both parameters (action and function) from ""/api/index.php.",2022-09-13,Nuclei,cpe:2.3:a:cuppacms:cuppacms:1.0:*:*:*:*:*:*:*,Cuppacms,Cuppacms
CVE-2022-37191,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.02646,CWE-829,"The component ""cuppa/api/index.php"" of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files via crafted POST request using [function] parameter value as LFI payload.",2022-09-13,Nuclei,cpe:2.3:a:cuppacms:cuppacms:1.0:*:*:*:*:*:*:*,Cuppacms,Cuppacms
CVE-2022-3723,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.0675,CWE-843,Type confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High),2022-11-01,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*,Google,Chrome
CVE-2022-37299,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.02998,CWE-22,An issue was discovered in Shirne CMS 1.2.0. There is a Path Traversal vulnerability which could cause arbitrary file read via /static/ueditor/php/controller.php,2022-09-09,Nuclei,cpe:2.3:a:shirne_cms_project:shirne_cms:1.2.0:*:*:*:*:*:*:*,Shirne Cms Project,Shirne Cms
CVE-2022-37393,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01745,CWE-284,"Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root.",2022-08-16,Metasploit,cpe:2.3:a:zimbra:collaboration:8.7.10:*:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.7.11:-:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.7.11:p10:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.7.11:p11:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.7.11:p12:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.7.11:p13:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.7.11:p14:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.7.11:p15:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.7.11:p1:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.7.11:p2:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.7.11:p3:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.7.11:p4:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.7.11:p5:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.7.11:p6:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.7.11:p7:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.7.11:p8:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.7.11:p9:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.7.6:*:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.7.7:*:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.7.9:*:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.0:beta1:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.10:-:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.10:p8:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.11:-:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.11:p3:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.11:p4:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.11:p5:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.12:-:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.12:p3:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.12:p4:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.15:-:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.15:p11:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.15:p26:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.15:p30:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.15:p31:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.15:p32:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.15:p33:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.15:p34:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.15:p3:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.15:p5:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.2:*:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.3:*:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.4:*:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.6:*:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.7:*:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.8:-:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.8:p1:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.8:p3:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.8:p4:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.8:p7:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.9:-:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.9:p10:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.9:p1:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:8.8.9:p3:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p19:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p23:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p25:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p26:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p27:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:*,Zimbra,Collaboration
CVE-2022-3766,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.05743,CWE-79,Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8.,2022-10-31,Nuclei,cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*,Phpmyfaq,Phpmyfaq
CVE-2022-3768,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03663,CWE-89,"The WPSmartContracts WordPress plugin before 1.3.12 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author",2022-11-28,Nuclei,cpe:2.3:a:wpsmartcontracts:wpsmartcontracts:*:*:*:*:*:wordpress:*:*,Wpsmartcontracts,Wpsmartcontracts
CVE-2022-37706,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.05486,CWE-269,"enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring.",2022-12-25,Metasploit,cpe:2.3:a:enlightenment:enlightenment:*:*:*:*:*:*:*:*,Enlightenment,Enlightenment
CVE-2022-37932,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02641,NVD-CWE-noinfo,"A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches. The vulnerability could be remotely exploited to allow authentication bypass. HPE has made the following software updates to resolve the vulnerability in Hewlett Packard Enterprise OfficeConnect 1820, 1850 and 1920S Network switches versions: Prior to PT.02.14; Prior to PC.01.22; Prior to PO.01.21; Prior to PD.02.22;

",2022-12-12,Nuclei,cpe:2.3:h:hpe:officeconnect_1820_j9979a:-:*:*:*:*:*:*:*;cpe:2.3:h:hpe:officeconnect_1820_j9980a:-:*:*:*:*:*:*:*;cpe:2.3:h:hpe:officeconnect_1820_j9981a:-:*:*:*:*:*:*:*;cpe:2.3:h:hpe:officeconnect_1820_j9982a:-:*:*:*:*:*:*:*;cpe:2.3:h:hpe:officeconnect_1820_j9983a:-:*:*:*:*:*:*:*;cpe:2.3:h:hpe:officeconnect_1820_j9984a:-:*:*:*:*:*:*:*;cpe:2.3:h:hpe:officeconnect_1850_24g_2xgt:-:*:*:*:*:*:*:*;cpe:2.3:h:hpe:officeconnect_1850_24g_2xgt_poe\+:-:*:*:*:*:*:*:*;cpe:2.3:h:hpe:officeconnect_1850_2xgt\/spf\+:-:*:*:*:*:*:*:*;cpe:2.3:h:hpe:officeconnect_1850_48g_4xgt:-:*:*:*:*:*:*:*;cpe:2.3:h:hpe:officeconnect_1850_48g_4xgt_poe\+:-:*:*:*:*:*:*:*;cpe:2.3:h:hpe:officeconnect_1850_6xgt:-:*:*:*:*:*:*:*;cpe:2.3:h:hpe:officeconnect_1920s_24g_2sfp:-:*:*:*:*:*:*:*;cpe:2.3:h:hpe:officeconnect_1920s_24g_2sfp_poe\+:-:*:*:*:*:*:*:*;cpe:2.3:h:hpe:officeconnect_1920s_24g_2sfp_ppoe\+:-:*:*:*:*:*:*:*;cpe:2.3:h:hpe:officeconnect_1920s_48g_4sfp:-:*:*:*:*:*:*:*;cpe:2.3:h:hpe:officeconnect_1920s_48g_4sfp_ppoe\+:-:*:*:*:*:*:*:*;cpe:2.3:h:hpe:officeconnect_1920s_8g:-:*:*:*:*:*:*:*;cpe:2.3:h:hpe:officeconnect_1920s_8g_ppoe\+:-:*:*:*:*:*:*:*;cpe:2.3:o:hpe:officeconnect_1820_j9979a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hpe:officeconnect_1820_j9980a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hpe:officeconnect_1820_j9981a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hpe:officeconnect_1820_j9982a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hpe:officeconnect_1820_j9983a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hpe:officeconnect_1820_j9984a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hpe:officeconnect_1850_24g_2xgt_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hpe:officeconnect_1850_24g_2xgt_poe\+_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hpe:officeconnect_1850_2xgt\/spf\+_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hpe:officeconnect_1850_48g_4xgt_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hpe:officeconnect_1850_48g_4xgt_poe\+_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hpe:officeconnect_1850_6xgt_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hpe:officeconnect_1920s_24g_2sfp_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hpe:officeconnect_1920s_24g_2sfp_poe\+_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hpe:officeconnect_1920s_24g_2sfp_ppoe\+_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hpe:officeconnect_1920s_48g_4sfp_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hpe:officeconnect_1920s_48g_4sfp_ppoe\+_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hpe:officeconnect_1920s_8g_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:hpe:officeconnect_1920s_8g_ppoe\+_firmware:*:*:*:*:*:*:*:*,Hpe,Officeconnect 1820 J9979A Firmware
CVE-2022-37969,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.28483,CWE-787,Windows Common Log File System Driver Elevation of Privilege Vulnerability,2022-09-13,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2022-3800,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.02241,CWE-707,"A vulnerability, which was classified as critical, has been found in IBAX go-ibax. Affected by this issue is some unknown functionality of the file /api/v2/open/rowsInfo. The manipulation of the argument table_name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212636.",2022-11-01,Nuclei,cpe:2.3:a:ibax:go-ibax:-:*:*:*:*:*:*:*,Ibax,Go-Ibax
CVE-2022-38028,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.14949,NVD-CWE-noinfo,Windows Print Spooler Elevation of Privilege Vulnerability,2022-10-11,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2022-3805,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L,0.01594,CWE-639,"The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the MailChimp API key, global styles, 404 page settings, and enabled elements.",2022-12-22,Nuclei,cpe:2.3:a:jegtheme:jeg_elementor_kit:*:*:*:*:*:wordpress:*:*,Jegtheme,Jeg Elementor Kit
CVE-2022-38108,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.69546,CWE-502,SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.,2022-10-20,Metasploit,cpe:2.3:a:solarwinds:orion_platform:*:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:orion_platform:2020.2.6:-:*:*:*:*:*:*;cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix1:*:*:*:*:*:*;cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix2:*:*:*:*:*:*;cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix3:*:*:*:*:*:*;cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix4:*:*:*:*:*:*;cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix5:*:*:*:*:*:*;cpe:2.3:a:solarwinds:orion_platform:2022.2:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:orion_platform:2022.3:*:*:*:*:*:*:*,Solarwinds,Orion Platform
CVE-2022-38120,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.05575,CWE-22,UPSMON PRO’s has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to bypass authentication and access arbitrary system files.,2022-11-10,Metasploit,cpe:2.3:a:upspowercom:upsmon_pro:2.57:*:*:*:*:*:*:*,Upspowercom,Upsmon Pro
CVE-2022-38121,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.0338,CWE-522,UPSMON PRO configuration file stores user password in plaintext under public user directory. A remote attacker with general user privilege can access all users‘ and administrators' account names and passwords via this unprotected configuration file.,2022-11-10,Metasploit,cpe:2.3:a:upspowercom:upsmon_pro:2.57:*:*:*:*:*:*:*,Upspowercom,Upsmon Pro
CVE-2022-38130,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.53389,CWE-89,"The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip() method is used to restore the HSQLDB database used in SMS. It takes the path of the zipped database file as the single parameter. An unauthenticated, remote attacker can specify an UNC path for the database file (i.e., \\<attacker-host>\sms\<attacker-db.zip>), effectively controlling the content of the database to be restored.",2022-08-10,Nuclei,cpe:2.3:a:keysight:sensor_management_server:2.4.0:*:*:*:*:*:*:*,Keysight,Sensor Management Server
CVE-2022-38131,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01343,CWE-601,RStudio Connect prior to 2023.01.0 is affected by an Open Redirect issue. The vulnerability could allow an attacker to redirect users to malicious websites.,2022-09-06,Nuclei,cpe:2.3:a:rstudio:connect:*:*:*:*:*:*:*:*,Rstudio,Connect
CVE-2022-38181,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.12588,CWE-416,"The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p0 through r38p1, and r39p0; Valhall r19p0 through r38p1, and r39p0; and Midgard r4p0 through r32p0.",2022-10-25,CISA,cpe:2.3:a:arm:bifrost_gpu_kernel_driver:*:*:*:*:*:*:*:*;cpe:2.3:a:arm:bifrost_gpu_kernel_driver:r39p0:*:*:*:*:*:*:*;cpe:2.3:a:arm:midgard_gpu_kernel_driver:*:*:*:*:*:*:*:*;cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:*;cpe:2.3:a:arm:valhall_gpu_kernel_driver:r39p0:*:*:*:*:*:*:*,Arm,Bifrost Gpu Kernel Driver
CVE-2022-38295,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01072,CWE-79,Cuppa CMS v1.0 was discovered to contain a cross-site scripting vulnerability at /table_manager/view/cu_user_groups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field under the Add New Group function.,2022-09-12,Nuclei,cpe:2.3:a:cuppacms:cuppacms:1.0:*:*:*:*:*:*:*,Cuppacms,Cuppacms
CVE-2022-38296,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03893,CWE-434,Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager.,2022-09-12,Nuclei,cpe:2.3:a:cuppacms:cuppacms:1.0:*:*:*:*:*:*:*,Cuppacms,Cuppacms
CVE-2022-38463,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02258,CWE-79,ServiceNow through San Diego Patch 4b and Patch 6 allows reflected XSS in the logout functionality.,2022-08-23,Nuclei,cpe:2.3:a:servicenow:servicenow:san_diego:patch_4:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:san_diego:patch_4a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:san_diego:patch_6:*:*:*:*:*:*,Servicenow,Servicenow
CVE-2022-38467,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0081,CWE-79,Reflected Cross-Site Scripting (XSS) vulnerability in CRM Perks Forms – WordPress Form Builder <= 1.1.0 ver.,2023-01-14,Nuclei,cpe:2.3:a:crmperks:crm_perks_forms:*:*:*:*:*:wordpress:*:*,Crmperks,Crm Perks Forms
CVE-2022-38553,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02316,CWE-79,Academy Learning Management System before v5.9.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Search parameter.,2022-09-26,Nuclei,cpe:2.3:a:creativeitem:academy_learning_management_system:*:*:*:*:*:*:*:*,Creativeitem,Academy Learning Management System
CVE-2022-38627,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0427,CWE-89,"Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a SQL injection vulnerability via the idt parameter.",2023-01-03,Nuclei,cpe:2.3:h:niceforyou:linear_emerge_e3_access_control:-:*:*:*:*:*:*:*;cpe:2.3:o:niceforyou:linear_emerge_e3_access_control_firmware:0.32-07e:*:*:*:*:*:*:*;cpe:2.3:o:niceforyou:linear_emerge_e3_access_control_firmware:0.32-07p:*:*:*:*:*:*:*;cpe:2.3:o:niceforyou:linear_emerge_e3_access_control_firmware:0.32-08e:*:*:*:*:*:*:*;cpe:2.3:o:niceforyou:linear_emerge_e3_access_control_firmware:0.32-08f:*:*:*:*:*:*:*;cpe:2.3:o:niceforyou:linear_emerge_e3_access_control_firmware:0.32-09a:*:*:*:*:*:*:*;cpe:2.3:o:niceforyou:linear_emerge_e3_access_control_firmware:0.32-09c:*:*:*:*:*:*:*,Niceforyou,Linear Emerge E3 Access Control Firmware
CVE-2022-38637,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04822,CWE-89,Hospital Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the Username and Password parameters on the Login page.,2022-09-13,Nuclei,cpe:2.3:a:hospital_management_system_project:hospital_management_system:1.0:*:*:*:*:*:*:*,Hospital Management System Project,Hospital Management System
CVE-2022-3869,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01265,CWE-94,Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2.,2022-11-05,Nuclei,cpe:2.3:a:froxlor:froxlor:*:*:*:*:*:*:*:*,Froxlor,Froxlor
CVE-2022-38794,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03599,CWE-22,Zaver through 2020-12-15 allows directory traversal via the GET /.. substring.,2022-08-27,Nuclei,cpe:2.3:a:zaver_project:zaver:*:*:*:*:*:*:*:*,Zaver Project,Zaver
CVE-2022-38812,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.02181,CWE-89,AeroCMS 0.1.1 is vulnerable to SQL Injection via the author parameter.,2022-08-31,Nuclei,cpe:2.3:a:aerocms_project:aerocms:0.1.1:*:*:*:*:*:*:*,Aerocms Project,Aerocms
CVE-2022-38817,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03026,CWE-306,Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data.,2022-10-03,Nuclei,cpe:2.3:a:linuxfoundation:dapr_dashboard:*:*:*:*:*:*:*:*,Linuxfoundation,Dapr Dashboard
CVE-2022-38840,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.09803,CWE-611,"cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity (XXE) issue via XML file upload, which leads to local file disclosure.",2023-04-16,Nuclei,cpe:2.3:a:guralp:man-eam-0003:3.2.4:*:*:*:*:*:*:*,Guralp,Man-Eam-0003
CVE-2022-38870,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02863,CWE-306,Free5gc v3.2.1 is vulnerable to Information disclosure.,2022-10-25,Nuclei,cpe:2.3:a:free5gc:free5gc:3.2.1:*:*:*:*:*:*:*,Free5Gc,Free5Gc
CVE-2022-39048,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01089,CWE-79,"A XSS vulnerability was identified in the ServiceNow UI page assessment_redirect. To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side attacks, including, but not limited to, phishing, redirection, theft of CSRF tokens, and use of an authenticated user's browser or session to attack other systems.

",2023-04-10,Nuclei,cpe:2.3:a:servicenow:servicenow:quebec:-:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:quebec:patch_10:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_10:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_2a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_3:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_2_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_2_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_3:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_3_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_4:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_5:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_5_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_5_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_6:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_6_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_6_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_7:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_7_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_7a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_7b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_8:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_8_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_8_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_9:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_9_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_9a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:rome:patch_9b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:san_diego:patch_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:san_diego:patch_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:san_diego:patch_2_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:san_diego:patch_3:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_3:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_4:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:san_diego:patch_4:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:san_diego:patch_4a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:san_diego:patch_4b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:san_diego:patch_6:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:san_diego:patch_7:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:san_diego:patch_8:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:tokyo:-:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:tokyo:patch1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:-:*:*:*:*:*:*,Servicenow,Servicenow
CVE-2022-3908,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00897,Missing_Data,"The Helloprint WordPress plugin before 1.4.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting",2022-12-12,Nuclei,cpe:2.3:a:helloprint:helloprint:*:*:*:*:*:wordpress:*:*,Helloprint,Helloprint
CVE-2022-39195,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.06314,CWE-79,A cross-site scripting (XSS) vulnerability in the LISTSERV 17 web interface allows remote attackers to inject arbitrary JavaScript or HTML via the c parameter.,2023-01-17,Nuclei,cpe:2.3:a:lsoft:listserv:17.0:*:*:*:*:*:*:*,Lsoft,Listserv
CVE-2022-39197,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.46446,CWE-79,"An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the payload (or create a new payload with the extracted information and then modify that username field to be malformed).",2022-09-22,CISA,cpe:2.3:a:helpsystems:cobalt_strike:*:*:*:*:*:*:*:*,Helpsystems,Cobalt Strike
CVE-2022-3933,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.00869,Missing_Data,"The Essential Real Estate WordPress plugin before 3.9.6 does not sanitize and escapes some parameters, which could allow users with a role as low as Admin to perform Cross-Site Scripting attacks.",2022-12-12,Nuclei,cpe:2.3:a:g5theme:essential_real_estate:*:*:*:*:*:wordpress:*:*,G5Theme,Essential Real Estate
CVE-2022-3934,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.00869,Missing_Data,"The FlatPM WordPress plugin before 3.0.13 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin",2022-12-12,Nuclei,cpe:2.3:a:mehanoid:flat_pm:*:*:*:*:*:wordpress:*:*,Mehanoid,Flat Pm
CVE-2022-3980,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.08087,CWE-611,An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4.,2022-11-16,Nuclei,cpe:2.3:a:sophos:mobile:*:*:*:*:*:*:*:*,Sophos,Mobile
CVE-2022-3982,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04493,Missing_Data,"The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE",2022-12-12,Nuclei,cpe:2.3:a:wpdevart:booking_calendar:*:*:*:*:*:wordpress:*:*,Wpdevart,Booking Calendar
CVE-2022-39952,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99815,CWE-73,"A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP request.",2023-02-16,EPSS/Metasploit/Nuclei,cpe:2.3:a:fortinet:fortinac:*:*:*:*:*:*:*:*,Fortinet,Fortinac
CVE-2022-39960,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.2568,CWE-862,The Netic Group Export add-on before 1.0.3 for Atlassian Jira does not perform authorization checks. This might allow an unauthenticated user to export all groups from the Jira instance by making a groupexport_download=true request to a plugins/servlet/groupexportforjira/admin/ URI.,2022-09-17,Nuclei,cpe:2.3:a:netic:group_export:*:*:*:*:*:jira:*:*,Netic,Group Export
CVE-2022-39986,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98725,CWE-77,A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfg_id parameter in /ajax/openvpn/activate_ovpncfg.php and /ajax/openvpn/del_ovpncfg.php.,2023-08-01,EPSS/Metasploit/Nuclei,cpe:2.3:a:raspap:raspap:*:*:*:*:*:*:*:*,Raspap,Raspap
CVE-2022-40022,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.92472,CWE-77,Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.,2023-02-13,Metasploit/Nuclei,cpe:2.3:h:microchip:syncserver_s650:-:*:*:*:*:*:*:*;cpe:2.3:o:microchip:syncserver_s650_firmware:-:*:*:*:*:*:*:*,Microchip,Syncserver S650 Firmware
CVE-2022-40032,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.20693,CWE-89,"SQL Injection vulnerability in Simple Task Managing System version 1.0 in login.php in 'username' and 'password' parameters, allows attackers to execute arbitrary code and gain sensitive information.",2023-02-17,Nuclei,cpe:2.3:a:simple_task_managing_system_project:simple_task_managing_system:1.0:*:*:*:*:*:*:*,Simple Task Managing System Project,Simple Task Managing System
CVE-2022-40047,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01144,CWE-79,Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php.,2022-10-11,Nuclei,cpe:2.3:a:flatpress:flatpress:1.2.1:*:*:*:*:*:*:*,Flatpress,Flatpress
CVE-2022-40083,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.02333,CWE-601,Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF).,2022-09-28,Nuclei,cpe:2.3:a:labstack:echo:4.8.0:*:*:*:*:*:*:*,Labstack,Echo
CVE-2022-40127,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.85653,CWE-94,"A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.",2022-11-14,Nuclei,cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*,Apache,Airflow
CVE-2022-40139,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.02837,NVD-CWE-noinfo,"Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution. Please note: an attacker must first obtain Apex One server administration console access in order to exploit this vulnerability.",2022-09-19,CISA,cpe:2.3:a:trendmicro:apex_one:-:*:*:*:saas:*:*:*;cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2022-40300,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99268,CWE-89,"Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have multiple SQL injection vulnerabilities.",2022-09-16,EPSS,cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.0:build4000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.1:build4100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.1:build4101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.2:build4200:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.2:build4201:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.2:build4202:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.2:build4203:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4300:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4301:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4302:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4303:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4304:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:4.0:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:4.0:build4001:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:4.0:build4002:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:4.1:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:4.1:build4100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:4.1:build4101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:4.5:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:4.5:build4500:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:4.5:build4501:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.0:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.0:build5000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.0:build5001:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.0:build5002:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.0:build5003:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.0:build5004:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.1:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.1:build5100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.2:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.2:build5200:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.3:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.3:build5300:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.3:build5301:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.3:build5302:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.3:build5303:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.3:build5304:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.3:build5305:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.3:build5306:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.4:build5400:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.4:build5401:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.5:build5500:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.5:build5510:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.5:build5520:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.5:build5550:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.0:-:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.0:build10000:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.0:build10000:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.0:build10001:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.0:build10001:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.0:build10001:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.1:build10100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.1:build10100:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.1:build10100:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.1:build10101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.1:build10101:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.1:build10101:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.1:build10102:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.1:build10102:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.1:build10102:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.1:build10103:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.1:build10103:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.1:build10103:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.1:build10104:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.2:build10200:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.3:build10300:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.3:build10301:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.3:build10302:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.4:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.4:-:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.4:build10400:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.4:build10401:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.4:build10402:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.1:-:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.1:11104:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.1:build_11101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.1:build_11102:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.1:build_11103:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.2:-:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.2:build11200:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.2:build11201:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.3:build11300:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.3:build11301:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12001:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12002:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12003:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12004:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12005:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12006:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.0:build12007:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12110:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12120:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:4.6:build4600:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:4.6:build4600:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:4.7:build4700:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:4.7:build4700:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:4.8:build4803:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:4.8:build4803:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:5.0:*:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:5.0:*:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:5.1:*:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:5.1:*:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:5.2:*:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:5.2:*:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:5.3:*:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:5.3:*:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:5.4:*:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:5.4:*:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.0:*:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.0:*:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.0:build6002:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.0:build6002:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.1:*:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.1:build6104:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.1:build6104:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.2:*:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.2:*:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.2:build6201:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.2:build6201:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.3:*:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.3:*:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.4:*:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.4:*:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.4:build6401:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.4:build6401:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.4:build6402:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.4:build6402:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.4:build6403:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.4:build6403:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.4:build6404:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.4:build6404:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.5:*:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.5:*:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.5:build6503:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.5:build6503:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.5:build6504:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.5:build6504:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.5:build6505:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.5:build6505:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.6:build6600:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.6:build6600:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.7:build6700:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.7:build6700:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.7:build6701:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.7:build6701:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.8:build6800:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.8:build6800:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.8:build6801:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.8:build6801:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.8:build6802:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.8:build6802:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.8:build6803:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.8:build6803:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.9:*:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.9:*:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.9:build6900:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.9:build6900:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.9:build6901:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.9:build6901:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.9:build6902:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.9:build6902:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.9:build6903:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.9:build6903:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.9:build6904:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.9:build6904:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.0:*:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.0:*:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.0:build7000:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.0:build7000:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.0:build7001:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.0:build7001:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.0:build7002:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.0:build7002:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.0:build7003:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.0:build7003:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.1:*:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.1:*:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.1:build7100:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.1:build7100:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.1:build7101:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.1:build7101:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.1:build7102:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.1:build7102:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.1:build7103:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.1:build7103:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.1:build7104:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.1:build7104:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.1:build7105:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.1:build7105:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.5:build7500:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.5:build7500:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.5:build7501:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.5:build7501:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.6:build7600:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.6:build7600:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.0:build8000:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.0:build8000:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.0:build8001:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.0:build8001:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.1:build8100:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.1:build8100:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.1:build8101:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.1:build8101:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.1:build8102:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.1:build8102:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.2:build8200:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.2:build8200:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.3:build8300:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.3:build8300:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.3:build8301:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.3:build8301:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.3:build8302:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.3:build8302:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.3:build8303:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.3:build8303:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.4:build8041:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.4:build8041:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.4:build8400:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.4:build8400:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.4:build8402:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.4:build8402:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.4:build8403:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.4:build8403:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.4:build8404:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.4:build8404:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.5:build8500:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.5:build8500:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.5:build8501:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.5:build8501:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.5:build8502:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.5:build8502:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.5:build8503:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.5:build8503:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.5:build8504:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.5:build8504:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.5:build8505:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.5:build8505:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.6:build8600:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.6:build8600:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.6:build8601:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.6:build8601:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.6:build8602:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.6:build8602:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.6:build8603:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.6:build8603:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.6:build8604:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.6:build8604:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.7:build8700:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.7:build8700:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.7:build8701:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.7:build8701:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.7:build8702:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.7:build8702:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.7:build8703:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.7:build8703:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.7:build8704:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.7:build8704:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.0:-:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.0:build9000:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.0:build9000:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.0:build9001:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.0:build9001:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.0:build9002:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.0:build9002:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.0:build9003:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.0:build9003:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.1:-:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.1:build9100:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.1:build9100:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.1:build9101:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.1:build9101:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.2:-:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.2:build9200:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.2:build9200:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.3:-:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.3:build9300:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.3:build9300:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.4:build9400:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.4:build9400:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.4:build9401:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.4:build9401:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.4:build9402:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.4:build9402:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.5:build9500:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.5:build9500:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.5:build9501:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.5:build9501:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.5:build9502:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.5:build9502:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.6:build9600:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.6:build9600:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.6:build9601:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.6:build9601:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.7:build9700:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.7:build9700:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.7:build9701:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.7:build9701:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.7:build9702:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.7:build9702:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.8:build9800:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.8:build9800:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.8:build9801:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.8:build9801:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.8:build9802:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.8:build9802:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.8:build9803:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.8:build9803:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.9:-:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.9:build9900:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.9:build9900:*:*:managed_service_providers:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.9:build9901:*:*:-:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.9:build9901:*:*:managed_service_providers:*:*:*,Zohocorp,Manageengine Access Manager Plus
CVE-2022-40359,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01346,CWE-79,Cross site scripting (XSS) vulnerability in kfm through 1.4.7 via crafted GET request to /kfm/index.php.,2022-09-23,Nuclei,cpe:2.3:a:kfm_project:kfm:*:*:*:*:*:*:*:*,Kfm Project,Kfm
CVE-2022-40443,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.02104,CWE-22,An absolute path traversal vulnerability in ZZCMS 2022 allows attackers to obtain sensitive information via a crafted GET request sent to /one/siteinfo.php.,2022-09-22,Nuclei,cpe:2.3:a:zzcms:zzcms:2022:*:*:*:*:*:*:*,Zzcms,Zzcms
CVE-2022-40471,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.19373,CWE-434,Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload functionality in users.php,2022-10-31,Metasploit,cpe:2.3:a:oretnom23:clinic\'s_patient_management_system:1.0:*:*:*:*:*:*:*,Oretnom23,Clinic'S Patient Management System
CVE-2022-4049,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04756,Missing_Data,"The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.",2023-01-02,Nuclei,cpe:2.3:a:wp_user_project:wp_user:*:*:*:*:*:wordpress:*:*,Wp User Project,Wp User
CVE-2022-4050,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04756,Missing_Data,"The JoomSport WordPress plugin before 5.2.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users",2022-12-19,Nuclei,cpe:2.3:a:beardev:joomsport:*:*:*:*:*:wordpress:*:*,Beardev,Joomsport
CVE-2022-4057,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.0146,CWE-425,The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs.,2023-01-02,Nuclei,cpe:2.3:a:optimizingmatters:autooptimize:*:*:*:*:*:wordpress:*:*,Optimizingmatters,Autooptimize
CVE-2022-4059,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04756,CWE-89,"The Cryptocurrency Widgets Pack WordPress plugin before 2.0 does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.",2023-01-02,Nuclei,cpe:2.3:a:blocksera:cryptocurrency_widgets_pack:*:*:*:*:*:wordpress:*:*,Blocksera,Cryptocurrency Widgets Pack
CVE-2022-4060,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.42723,Missing_Data,"The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, making it possible to any visitors to run code on sites running it.",2023-01-16,Nuclei,cpe:2.3:a:odude:user_post_gallery:*:*:*:*:*:wordpress:*:*,Odude,User Post Gallery
CVE-2022-40624,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.17107,CWE-78,"pfSense pfBlockerNG through 2.1.4_27 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header, a different vulnerability than CVE-2022-31814.",2022-12-20,Nuclei,cpe:2.3:a:pfsense:pfblockerng:*:*:*:*:*:*:*:*,Pfsense,Pfblockerng
CVE-2022-4063,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09519,CWE-22,"The InPost Gallery WordPress plugin before 2.1.4.1 insecurely uses PHP's extract() function when rendering HTML views, allowing attackers to force the inclusion of malicious files & URLs, which may enable them to run code on servers.",2022-12-19,Nuclei,cpe:2.3:a:pluginus:inpost_gallery:*:*:*:*:*:wordpress:*:*,Pluginus,Inpost Gallery
CVE-2022-40684,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99984,CWE-287,"An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.",2022-10-18,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortiswitchmanager:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortiswitchmanager:7.2.0:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*,Fortinet,Fortios
CVE-2022-40734,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.04298,CWE-22,"UniSharp laravel-filemanager (aka Laravel Filemanager) before 2.6.4 allows download?working_dir=%2F.. directory traversal to read arbitrary files, as exploited in the wild in June 2022. This is related to league/flysystem before 2.0.0.",2022-09-14,Nuclei,cpe:2.3:a:unisharp:laravel_filemanager:*:*:*:*:*:*:*:*,Unisharp,Laravel Filemanager
CVE-2022-40765,6.8,CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.10481,CWE-77,"A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters.",2022-11-22,CISA,cpe:2.3:a:mitel:mivoice_connect:*:*:*:*:*:*:*:*,Mitel,Mivoice Connect
CVE-2022-40799,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.31328,CWE-494,Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the device.,2022-11-29,CISA,cpe:2.3:h:dlink:dnr-322l:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dnr-322l_firmware:*:*:*:*:*:*:*:*,D-Link,Dnr-322L Firmware
CVE-2022-40843,4.9,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N,0.28802,NVD-CWE-Other,The Tenda AC1200 V-W15Ev2 V15.11.0.10(1576) router is vulnerable to improper authorization / improper session management that allows the router login page to be bypassed. This leads to authenticated attackers having the ability to read the routers syslog.log file which contains the MD5 password of the Administrator's user account.,2022-11-15,Nuclei,cpe:2.3:h:tenda:w15e:2.0:*:*:*:*:*:*:*;cpe:2.3:o:tenda:w15e_firmware:15.11.0.10\(1576\):*:*:*:*:*:*:*,Tenda,W15E Firmware
CVE-2022-40879,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01131,CWE-79,kkFileView v4.1.0 is vulnerable to Cross Site Scripting (XSS) via the parameter 'errorMsg.',2022-09-29,Nuclei,cpe:2.3:a:keking:kkfileview:4.1.0:*:*:*:*:*:*:*,Keking,Kkfileview
CVE-2022-40881,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.29451,CWE-77,SolarView Compact 6.00 was discovered to contain a command injection vulnerability via network_test.php,2022-11-17,Nuclei,cpe:2.3:h:contec:solarview_compact:-:*:*:*:*:*:*:*;cpe:2.3:o:contec:solarview_compact_firmware:6.00:*:*:*:*:*:*:*,Contec,Solarview Compact Firmware
CVE-2022-41033,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01811,CWE-843,Windows COM+ Event System Service Elevation of Privilege Vulnerability,2022-10-11,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2022-41034,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.67469,NVD-CWE-noinfo,Visual Studio Code Remote Code Execution Vulnerability,2022-10-11,Metasploit,cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:*:*:*,Microsoft,Visual Studio Code
CVE-2022-41040,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.99945,CWE-918,Microsoft Exchange Server Elevation of Privilege Vulnerability,2022-10-03,CISA/EPSS/Metasploit,cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2022-41049,5.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L,0.02482,NVD-CWE-noinfo,Windows Mark of the Web Security Feature Bypass Vulnerability,2022-11-09,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2022-41073,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02389,CWE-787,Windows Print Spooler Elevation of Privilege Vulnerability,2022-11-09,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:rt:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2022-41080,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.77326,NVD-CWE-noinfo,Microsoft Exchange Server Elevation of Privilege Vulnerability,2022-11-09,CISA,cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2022-41082,8.0,CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.9997,CWE-502,Microsoft Exchange Server Remote Code Execution Vulnerability,2022-10-03,CISA/EPSS/Metasploit,cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2022-41091,5.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L,0.01986,NVD-CWE-noinfo,Windows Mark of the Web Security Feature Bypass Vulnerability,2022-11-09,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2022-41125,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03021,CWE-787,Windows CNG Key Isolation Service Elevation of Privilege Vulnerability,2022-11-09,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:rt:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2022-41128,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.24623,CWE-787,Windows Scripting Languages Remote Code Execution Vulnerability,2022-11-09,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_7:sp1:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:rt:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2022-4117,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04955,Missing_Data,"The IWS WordPress plugin through 1.0 does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection.",2022-12-26,Nuclei,cpe:2.3:a:iws-geo-form-fields_project:iws-geo-form-fields:*:*:*:*:*:wordpress:*:*,Iws-Geo-Form-Fields Project,Iws-Geo-Form-Fields
CVE-2022-41223,6.8,CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.10571,CWE-94,The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.,2022-11-22,CISA,cpe:2.3:a:mitel:mivoice_connect:*:*:*:*:*:*:*:*,Mitel,Mivoice Connect
CVE-2022-41328,6.7,CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.12316,CWE-22,"A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands.",2023-03-07,CISA,cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*,Fortinet,Fortios
CVE-2022-4135,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.31864,CWE-787,Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High),2022-11-25,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*,Google,Chrome
CVE-2022-41352,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.95478,CWE-22,"An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.",2022-09-26,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p10:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p11:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p12:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p13:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p14:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p15:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p16:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p17:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p18:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p19:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p20:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p21:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p22:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p23:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p24:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p25:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p26:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p27:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p28:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p29:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p30:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31.1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p32:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p33:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p6:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p7:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p8:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p9:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p12:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p15:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p21:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24.1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p26:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p5:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p6:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p8:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p9:*:*:*:*:*:*,Synacor,Zimbra Collaboration Suite
CVE-2022-4140,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02941,Missing_Data,"The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server",2023-01-02,Nuclei,cpe:2.3:a:welcart:welcart_e-commerce:*:*:*:*:*:wordpress:*:*,Welcart,Welcart E-Commerce
CVE-2022-41412,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.04088,CWE-918,An issue in the graphData.cgi component of perfSONAR v4.4.5 and prior allows attackers to access sensitive data and execute Server-Side Request Forgery (SSRF) attacks.,2022-11-30,Nuclei,cpe:2.3:a:perfsonar:perfsonar:*:*:*:*:*:*:*:*,Perfsonar,Perfsonar
CVE-2022-41441,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.05187,CWE-79,Multiple cross-site scripting (XSS) vulnerabilities in ReQlogic v11.3 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the POBatch and WaitDuration parameters.,2023-01-20,Nuclei,cpe:2.3:a:reqlogic:reqlogic:11.3:*:*:*:*:*:*:*,Reqlogic,Reqlogic
CVE-2022-41473,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01012,CWE-79,RPCMS v3.0.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Search function.,2022-10-13,Nuclei,cpe:2.3:a:rpcms:rpcms:3.0.2:*:*:*:*:*:*:*,Rpcms,Rpcms
CVE-2022-41622,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.87987,CWE-352,"In all versions, 

BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

",2022-12-07,Metasploit,cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_access_policy_manager:17.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:17.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:17.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:17.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:17.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_domain_name_system:17.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_fraud_protection_service:17.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:17.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:17.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:17.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:17.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_centralized_management:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-iq_centralized_management:7.1.0:*:*:*:*:*:*:*,F5,Big-Iq Centralized Management
CVE-2022-41678,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.8581,CWE-287,"Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. 

In details, in ActiveMQ configurations, jetty allows
org.jolokia.http.AgentServlet to handler request to /api/jolokia

org.jolokia.http.HttpRequestHandler#handlePostRequest is able to
create JmxRequest through JSONObject. And calls to
org.jolokia.http.HttpRequestHandler#executeRequest.

Into deeper calling stacks,
org.jolokia.handler.ExecHandler#doHandleRequest can be invoked
through refection. This could lead to RCE through via
various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.

1 Call newRecording.

2 Call setConfiguration. And a webshell data hides in it.

3 Call startRecording.

4 Call copyTo method. The webshell will be written to a .jsp file.

The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia.
A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.
",2023-11-28,Nuclei,cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*,Apache,Activemq
CVE-2022-41697,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.20196,CWE-204,A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send a series of HTTP requests to trigger this vulnerability.,2022-12-22,Nuclei,cpe:2.3:a:ghost:ghost:5.9.4:*:*:*:*:node.js:*:*,Ghost,Ghost
CVE-2022-41800,8.7,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N,0.62406,CWE-77,"
In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

",2022-12-07,Metasploit/Nuclei,cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_access_policy_manager:17.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:17.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:17.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:17.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_domain_name_system:17.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_fraud_protection_service:17.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:17.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:17.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:17.0.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:17.0.0:*:*:*:*:*:*:*,F5,Big-Ip Access Policy Manager
CVE-2022-41840,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.05116,CWE-22,Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin <= 2.7.7 on WordPress.,2022-11-18,Nuclei,cpe:2.3:a:welcart:welcart_e-commerce:*:*:*:*:*:wordpress:*:*,Welcart,Welcart E-Commerce
CVE-2022-42094,4.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N,0.02505,CWE-79,Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.,2022-11-22,Nuclei,cpe:2.3:a:backdropcms:backdrop:1.23.0:*:*:*:*:*:*:*,Backdropcms,Backdrop
CVE-2022-42095,4.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N,0.01947,CWE-79,Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page content.,2022-11-23,Nuclei,cpe:2.3:a:backdropcms:backdrop_cms:1.23.0:*:*:*:*:*:*:*,Backdropcms,Backdrop Cms
CVE-2022-42096,4.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N,0.0196,CWE-79,Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content.,2022-11-21,Nuclei,cpe:2.3:a:backdropcms:backdrop_cms:1.23.0:*:*:*:*:*:*:*,Backdropcms,Backdrop Cms
CVE-2022-42118,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00897,CWE-79,"A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.",2022-11-15,Nuclei,cpe:2.3:a:liferay:digital_experience_platform:7.1:-:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_10:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_11:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_12:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_13:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_14:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_15:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_16:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_17:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_18:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_19:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_1:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_20:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_21:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_22:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_23:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_24:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_25:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_2:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_3:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_4:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_5:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_6:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_7:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_8:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_9:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_10:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_11:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_12:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_13:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_14:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_8:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9:*:*:*:*:*:*;cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*;cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:*;cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:*;cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*,Liferay,Liferay Portal
CVE-2022-42149,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0219,CWE-918,kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\OnlinePreviewController.java.,2022-10-17,Nuclei,cpe:2.3:a:keking:kkfileview:4.0.0:*:*:*:*:*:*:*,Keking,Kkfileview
CVE-2022-4223,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.79933,CWE-94,"The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. The utility is executed by the server to determine what PostgreSQL version it is from. Versions of pgAdmin prior to 6.17 failed to properly secure this API, which could allow an unauthenticated user to call it with a path of their choosing, such as a UNC path to a server they control on a Windows machine. This would cause an appropriately named executable in the target path to be executed by the pgAdmin server.",2022-12-13,Nuclei,cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*;cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2022-42233,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.42704,CWE-287,Tenda 11N with firmware version V5.07.33_cn suffers from an Authentication Bypass vulnerability.,2022-10-20,Nuclei,cpe:2.3:h:tenda:11n:-:*:*:*:*:*:*:*;cpe:2.3:o:tenda:11n_firmware:5.07.33_cn:*:*:*:*:*:*:*,Tenda,11N Firmware
CVE-2022-42475,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99474,CWE-197,"A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier  and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.",2023-01-02,CISA/EPSS,cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*;cpe:2.3:h:fortinet:fim-7901e:-:*:*:*:*:*:*:*;cpe:2.3:h:fortinet:fim-7904e:-:*:*:*:*:*:*:*;cpe:2.3:h:fortinet:fim-7910e:-:*:*:*:*:*:*:*;cpe:2.3:h:fortinet:fim-7920e:-:*:*:*:*:*:*:*;cpe:2.3:h:fortinet:fim-7921f:-:*:*:*:*:*:*:*;cpe:2.3:h:fortinet:fim-7941f:-:*:*:*:*:*:*:*;cpe:2.3:h:fortinet:fortigate-6300f-dc:-:*:*:*:*:*:*:*;cpe:2.3:h:fortinet:fortigate-6300f:-:*:*:*:*:*:*:*;cpe:2.3:h:fortinet:fortigate-6500f-dc:-:*:*:*:*:*:*:*;cpe:2.3:h:fortinet:fortigate-6500f:-:*:*:*:*:*:*:*;cpe:2.3:h:fortinet:fortigate-6501f-dc:-:*:*:*:*:*:*:*;cpe:2.3:h:fortinet:fortigate-6501f:-:*:*:*:*:*:*:*;cpe:2.3:h:fortinet:fortigate-6601f-dc:-:*:*:*:*:*:*:*;cpe:2.3:h:fortinet:fortigate-6601f:-:*:*:*:*:*:*:*;cpe:2.3:h:fortinet:fortigate-7030e:-:*:*:*:*:*:*:*;cpe:2.3:h:fortinet:fortigate-7040e:-:*:*:*:*:*:*:*;cpe:2.3:h:fortinet:fortigate-7060e:-:*:*:*:*:*:*:*;cpe:2.3:h:fortinet:fortigate-7121f:-:*:*:*:*:*:*:*;cpe:2.3:h:fortinet:fpm-7620e:-:*:*:*:*:*:*:*;cpe:2.3:h:fortinet:fpm-7620f:-:*:*:*:*:*:*:*;cpe:2.3:h:fortinet:fpm-7630e:-:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*,Fortinet,Fortios
CVE-2022-4260,4.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N,0.00851,Missing_Data,"The WP-Ban WordPress plugin before 1.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",2023-01-02,Nuclei,cpe:2.3:a:wp-ban_project:wp-ban:*:*:*:*:*:wordpress:*:*,Wp-Ban Project,Wp-Ban
CVE-2022-4262,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.15983,CWE-843,Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High),2022-12-02,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*,Google,Chrome
CVE-2022-42746,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01117,CWE-79,"CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks.

",2022-11-03,Nuclei,cpe:2.3:a:auieo:candidats:3.0.0:-:*:*:*:*:*:*,Auieo,Candidats
CVE-2022-42747,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01071,CWE-79,"CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks.

",2022-11-03,Nuclei,cpe:2.3:a:auieo:candidats:3.0.0:-:*:*:*:*:*:*,Auieo,Candidats
CVE-2022-42748,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01071,CWE-79,"CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks.

",2022-11-03,Nuclei,cpe:2.3:a:auieo:candidats:3.0.0:-:*:*:*:*:*:*,Auieo,Candidats
CVE-2022-42749,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01071,CWE-79,"CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks.

",2022-11-03,Nuclei,cpe:2.3:a:auieo:candidats:3.0.0:-:*:*:*:*:*:*,Auieo,Candidats
CVE-2022-42827,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.01136,CWE-787,"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 16.1 and iPadOS 16. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..",2022-11-01,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2022-42856,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.08523,CWE-843,"A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1..",2022-12-15,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2022-42889,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99931,CWE-94,"Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is ""${prefix:name}"", where ""prefix"" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - ""script"" - execute expressions using the JVM script execution engine (javax.script) - ""dns"" - resolve dns records - ""url"" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.",2022-10-13,EPSS/Metasploit,cpe:2.3:a:apache:commons_text:*:*:*:*:*:*:*:*;cpe:2.3:a:juniper:security_threat_response_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:juniper:security_threat_response_manager:7.5.0:-:*:*:*:*:*:*;cpe:2.3:a:juniper:security_threat_response_manager:7.5.0:up1:*:*:*:*:*:*;cpe:2.3:a:juniper:security_threat_response_manager:7.5.0:up2:*:*:*:*:*:*;cpe:2.3:a:juniper:security_threat_response_manager:7.5.0:up3:*:*:*:*:*:*;cpe:2.3:a:netapp:bluexp:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:jsa1500:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:jsa3500:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:jsa3800:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:jsa5500:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:jsa5800:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:jsa7500:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:jsa7800:-:*:*:*:*:*:*:*,Juniper,Jsa1500
CVE-2022-42948,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02706,CWE-116,"Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.",2023-03-24,CISA,cpe:2.3:a:helpsystems:cobalt_strike:4.7.1:*:*:*:*:*:*:*,Helpsystems,Cobalt Strike
CVE-2022-4295,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00897,Missing_Data,"The Show All Comments WordPress plugin before 7.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin.",2023-01-16,Nuclei,cpe:2.3:a:appjetty:show_all_comments:*:*:*:*:*:wordpress:*:*,Appjetty,Show All Comments
CVE-2022-4301,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00902,Missing_Data,"The Sunshine Photo Cart WordPress plugin before 2.9.15 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.",2023-01-09,Nuclei,cpe:2.3:a:sunshinephotocart:sunshine_photo_cart:*:*:*:*:*:wordpress:*:*,Sunshinephotocart,Sunshine Photo Cart
CVE-2022-43014,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01278,CWE-79,OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parameter.,2022-10-19,Nuclei,cpe:2.3:a:opencats:opencats:0.9.6:*:*:*:*:*:*:*,Opencats,Opencats
CVE-2022-43015,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01278,CWE-79,OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the entriesPerPage parameter.,2022-10-19,Nuclei,cpe:2.3:a:opencats:opencats:0.9.6:*:*:*:*:*:*:*,Opencats,Opencats
CVE-2022-43016,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01333,CWE-79,OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback component.,2022-10-19,Nuclei,cpe:2.3:a:opencats:opencats:0.9.6:*:*:*:*:*:*:*,Opencats,Opencats
CVE-2022-43017,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01333,CWE-79,OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component.,2022-10-19,Nuclei,cpe:2.3:a:opencats:opencats:0.9.6:*:*:*:*:*:*:*,Opencats,Opencats
CVE-2022-43018,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01333,CWE-79,OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email function.,2022-10-19,Nuclei,cpe:2.3:a:opencats:opencats:0.9.6:*:*:*:*:*:*:*,Opencats,Opencats
CVE-2022-4305,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.38625,Missing_Data,"The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.",2023-01-23,Nuclei,cpe:2.3:a:wp-buy:login_as_user_or_customer_\(user_switching\):*:*:*:*:*:wordpress:*:*,Wp-Buy,Login As User Or Customer (User Switching)
CVE-2022-4306,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.00841,Missing_Data,"The Panda Pods Repeater Field WordPress plugin before 1.5.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a user having at least Contributor permission.",2023-01-30,Nuclei,cpe:2.3:a:panda_pods_repeater_field_project:panda_pods_repeater_field:*:*:*:*:*:wordpress:*:*,Panda Pods Repeater Field Project,Panda Pods Repeater Field
CVE-2022-43140,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N,0.01949,CWE-918,kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the url parameter.,2022-11-17,Nuclei,cpe:2.3:a:keking:kkfileview:4.1.0:*:*:*:*:*:*:*,Keking,Kkfileview
CVE-2022-43164,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.00874,CWE-79,"A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking ""Add"".",2022-10-28,Nuclei,cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*,Rukovoditel,Rukovoditel
CVE-2022-43165,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.00874,CWE-79,"A stored cross-site scripting (XSS) vulnerability in the Global Variables feature (/index.php?module=global_vars/vars) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Value parameter after clicking ""Create"".",2022-10-28,Nuclei,cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*,Rukovoditel,Rukovoditel
CVE-2022-43166,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.00874,CWE-79,"A stored cross-site scripting (XSS) vulnerability in the Global Entities feature (/index.php?module=entities/entities) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking ""Add New Entity"".",2022-10-28,Nuclei,cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*,Rukovoditel,Rukovoditel
CVE-2022-43167,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.00929,CWE-79,"A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_alerts) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking ""Add"".",2022-10-28,Nuclei,cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*,Rukovoditel,Rukovoditel
CVE-2022-43169,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.00874,CWE-79,"A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature (/index.php?module=users_groups/users_groups) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking ""Add New Group"".",2022-10-28,Nuclei,cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*,Rukovoditel,Rukovoditel
CVE-2022-43170,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.00874,CWE-79,"A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_configure/index) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking ""Add info block"".",2022-10-28,Nuclei,cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*,Rukovoditel,Rukovoditel
CVE-2022-43185,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.00961,CWE-79,A stored cross-site scripting (XSS) vulnerability in the Configuration/Holidays module of Rukovoditel v3.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter.,2022-10-19,Nuclei,cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*,Rukovoditel,Rukovoditel
CVE-2022-4320,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00891,Missing_Data,"The WordPress Events Calendar WordPress plugin before 1.4.5 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users (such as high-privilege ones like admin).",2023-01-16,Nuclei,cpe:2.3:a:mhsoftware:wordpress_events_calendar_plugin:*:*:*:*:*:wordpress:*:*,Mhsoftware,Wordpress Events Calendar Plugin
CVE-2022-4321,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01193,Missing_Data,The PDF Generator for WordPress plugin before 1.1.2 includes a vendored dompdf example file which is susceptible to Reflected Cross-Site Scripting and could be used against high privilege users such as admin,2023-02-06,Nuclei,cpe:2.3:a:wpswings:pdf_generator_for_wordpress:*:*:*:*:*:wordpress:*:*,Wpswings,Pdf Generator For Wordpress
CVE-2022-4325,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00902,Missing_Data,"The Post Status Notifier Lite WordPress plugin before 1.10.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high privilege users such as admin.",2023-01-09,Nuclei,cpe:2.3:a:ifeelweb:post_status_notifier_lite:*:*:*:*:*:wordpress:*:*,Ifeelweb,Post Status Notifier Lite
CVE-2022-4328,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04427,Missing_Data,"The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server",2023-03-06,Nuclei,cpe:2.3:a:najeebmedia:woocommerce_checkout_field_manager:*:*:*:*:*:wordpress:*:*,Najeebmedia,Woocommerce Checkout Field Manager
CVE-2022-43571,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.14314,CWE-94,"In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component.

",2022-11-03,Metasploit,cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*;cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*,Splunk,Splunk
CVE-2022-4375,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.0289,CWE-707,A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the argument sqlWhere leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.2.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215196.,2022-12-09,Nuclei,cpe:2.3:a:mingsoft:mcms:*:*:*:*:*:*:*:*,Mingsoft,Mcms
CVE-2022-43769,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.9767,CWE-74,"Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.",2023-04-03,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:hitachi:vantara_pentaho_business_analytics_server:*:*:*:*:*:*:*:*;cpe:2.3:a:hitachi:vantara_pentaho_business_analytics_server:9.4.0.0:*:*:*:*:*:*:*,Hitachi,Vantara Pentaho Business Analytics Server
CVE-2022-43781,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98076,CWE-77,There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.,2022-11-17,EPSS/Metasploit,cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*,Atlassian,Bitbucket
CVE-2022-43939,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H,0.92266,CWE-647,"Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.",2023-04-03,CISA/Metasploit/Nuclei,cpe:2.3:a:hitachi:vantara_pentaho_business_analytics_server:*:*:*:*:*:*:*:*;cpe:2.3:a:hitachi:vantara_pentaho_business_analytics_server:9.4.0.0:*:*:*:*:*:*:*,Hitachi,Vantara Pentaho Business Analytics Server
CVE-2022-44290,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03616,CWE-89,webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in deleteapprovalstages.php.,2022-12-02,Nuclei,cpe:2.3:a:webtareas_project:webtareas:2.4:p5:*:*:*:*:*:*,Webtareas Project,Webtareas
CVE-2022-44291,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03616,CWE-89,webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php.,2022-12-02,Nuclei,cpe:2.3:a:webtareas_project:webtareas:2.4:p5:*:*:*:*:*:*,Webtareas Project,Webtareas
CVE-2022-44356,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02756,CWE-552,WAVLINK Quantum D4G (WL-WN531G3) running firmware versions M31G3.V5030.201204 and M31G3.V5030.200325 has an access control issue which allows unauthenticated attackers to download configuration data and log files.,2022-11-29,Nuclei,cpe:2.3:h:wavlink:wl-wn531g3:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wl-wn531g3_firmware:m31g3.v5030.200325:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wl-wn531g3_firmware:m31g3.v5030.201204:*:*:*:*:*:*:*,Wavlink,Wl-Wn531G3 Firmware
CVE-2022-44384,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.05009,CWE-434,An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file.,2022-11-17,Metasploit,cpe:2.3:a:rconfig:rconfig:3.9.6:*:*:*:*:*:*:*,Rconfig,Rconfig
CVE-2022-4447,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04795,Missing_Data,"The Fontsy WordPress plugin through 1.8.6 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.",2023-01-16,Nuclei,cpe:2.3:a:fontsy_project:fontsy:*:*:*:*:*:wordpress:*:*,Fontsy Project,Fontsy
CVE-2022-44588,9.9,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L,0.02268,CWE-89,Unauth. SQL Injection vulnerability in Cryptocurrency Widgets Pack Plugin <=1.8.1 on WordPress.,2022-12-15,Nuclei,cpe:2.3:a:blocksera:cryptocurrency_widgets_pack:*:*:*:*:*:wordpress:*:*,Blocksera,Cryptocurrency Widgets Pack
CVE-2022-44698,5.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L,0.76106,NVD-CWE-noinfo,Windows SmartScreen Security Feature Bypass Vulnerability,2022-12-13,CISA,cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1607
CVE-2022-44727,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.02397,CWE-89,The EU Cookie Law GDPR (Banner + Blocker) module before 2.1.3 for PrestaShop allows SQL Injection via a cookie ( lgcookieslaw or __lglaw ).,2022-11-10,Nuclei,cpe:2.3:a:lineagrafica:eu_cookie_law_gdpr:*:*:*:*:*:prestashop:*:*,Lineagrafica,Eu Cookie Law Gdpr
CVE-2022-44877,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99995,CWE-78,login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.,2023-01-05,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:control-webpanel:webpanel:*:*:*:*:*:*:*:*,Control-Webpanel,Webpanel
CVE-2022-44944,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01046,CWE-79,Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Announcement function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field.,2022-12-02,Nuclei,cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*,Rukovoditel,Rukovoditel
CVE-2022-44946,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01046,CWE-79,Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field.,2022-12-02,Nuclei,cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*,Rukovoditel,Rukovoditel
CVE-2022-44947,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.00961,CWE-79,"Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature at /index.php?module=entities/listing_types&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Note field after clicking ""Add"".",2022-12-02,Nuclei,cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*,Rukovoditel,Rukovoditel
CVE-2022-44948,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.00903,CWE-79,"Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Entities Group feature at/index.php?module=entities/entities_groups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field after clicking ""Add"".",2022-12-02,Nuclei,cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*,Rukovoditel,Rukovoditel
CVE-2022-44949,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.00937,CWE-79,Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Short Name field.,2022-12-02,Nuclei,cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*,Rukovoditel,Rukovoditel
CVE-2022-44950,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.00937,CWE-79,Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.,2022-12-02,Nuclei,cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*,Rukovoditel,Rukovoditel
CVE-2022-44951,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.00937,CWE-79,Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/forms&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.,2022-12-02,Nuclei,cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*,Rukovoditel,Rukovoditel
CVE-2022-44952,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.00903,CWE-79,"Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=configuration/application. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Copyright Text field after clicking ""Add"".",2022-12-02,Nuclei,cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*,Rukovoditel,Rukovoditel
CVE-2022-44957,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01037,CWE-79,webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /clients/listclients.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.,2022-12-02,Nuclei,cpe:2.3:a:webtareas_project:webtareas:2.4:p5:*:*:*:*:*:*,Webtareas Project,Webtareas
CVE-2022-45037,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01024,CWE-79,A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name field.,2022-11-25,Nuclei,cpe:2.3:a:wbce:wbce_cms:1.5.4:*:*:*:*:*:*:*,Wbce,Wbce Cms
CVE-2022-45038,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01024,CWE-79,A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Footer field.,2022-11-25,Nuclei,cpe:2.3:a:wbce:wbce_cms:1.5.4:*:*:*:*:*:*:*,Wbce,Wbce Cms
CVE-2022-45269,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03092,CWE-22,A directory traversal vulnerability in the component SCS.Web.Server.SPI/1.0 of Linx Sphere LINX 7.35.ST15 allows attackers to read arbitrary files.,2022-12-12,Nuclei,cpe:2.3:a:gmaolinx:linx_sphere:7.35.st15:*:*:*:*:*:*:*,Gmaolinx,Linx Sphere
CVE-2022-45354,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.38083,CWE-200,Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.7.60.,2024-01-08,Nuclei,cpe:2.3:a:wpchill:download_monitor:*:*:*:*:*:wordpress:*:*,Wpchill,Download Monitor
CVE-2022-45362,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.40506,CWE-918,Server-Side Request Forgery (SSRF) vulnerability in Paytm Paytm Payment Gateway.This issue affects Paytm Payment Gateway: from n/a through 2.7.0.,2023-12-07,Nuclei,cpe:2.3:a:paytm:payment_gateway:*:*:*:*:*:wordpress:*:*,Paytm,Payment Gateway
CVE-2022-45365,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.49315,CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aleksandar Urošević Stock Ticker allows Reflected XSS.This issue affects Stock Ticker: from n/a through 3.23.2.,2023-12-14,Nuclei,cpe:2.3:a:urosevic:stock_ticker:*:*:*:*:*:wordpress:*:*,Urosevic,Stock Ticker
CVE-2022-45699,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.76604,CWE-78,Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter.,2023-02-10,Nuclei,cpe:2.3:h:apsystems:ecu-r:-:*:*:*:*:*:*:*;cpe:2.3:o:apsystems:ecu-r_firmware:5203:*:*:*:*:*:*:*,Apsystems,Ecu-R Firmware
CVE-2022-45805,8.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L,0.02327,CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paytm Paytm Payment Gateway paytm-payments allows SQL Injection.This issue affects Paytm Payment Gateway: from n/a through 2.7.3.,2023-11-03,Nuclei,cpe:2.3:a:paytm:payment_gateway:*:*:*:*:*:wordpress:*:*,Paytm,Payment Gateway
CVE-2022-45808,9.9,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L,0.04269,CWE-89,SQL Injection vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.,2023-01-26,Nuclei,cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:*,Thimpress,Learnpress
CVE-2022-45835,5.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N,0.37673,CWE-918,Server-Side Request Forgery (SSRF) vulnerability in PhonePe PhonePe Payment Solutions.This issue affects PhonePe Payment Solutions: from n/a through 1.0.15.,2023-11-13,Nuclei,cpe:2.3:a:phonepe:phonepe:*:*:*:*:*:wordpress:*:*,Phonepe,Phonepe
CVE-2022-45836,6.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L,0.0068,CWE-79,"Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in W3 Eden, Inc. Download Manager plugin <= 3.2.59 versions.",2023-04-18,Nuclei,cpe:2.3:a:w3eden:download_manager:*:*:*:*:free:wordpress:*:*,W3Eden,Download Manager
CVE-2022-45917,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0199,CWE-601,ILIAS before 7.16 has an Open Redirect.,2022-12-07,Nuclei,cpe:2.3:a:ilias:ilias:*:*:*:*:*:*:*:*,Ilias,Ilias
CVE-2022-45933,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.51696,CWE-306,"KubeView through 0.1.31 allows attackers to obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authentication, and retrieves certificate files that can be used for authentication as kube-admin. NOTE: the vendor's position is that KubeView was a ""fun side project and a learning exercise,"" and not ""very secure.""",2022-11-27,Nuclei,cpe:2.3:a:kubeview_project:kubeview:*:*:*:*:*:*:*:*,Kubeview Project,Kubeview
CVE-2022-46020,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.38953,CWE-434,WBCE CMS v1.5.4 can implement getshell by modifying the upload file type.,2022-12-20,Nuclei,cpe:2.3:a:wbce:wbce_cms:1.5.4:*:*:*:*:*:*:*,Wbce,Wbce Cms
CVE-2022-46071,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0431,CWE-89,There is SQL Injection vulnerability at Helmet Store Showroom v1.0 Login Page. This vulnerability can be exploited to bypass admin access.,2022-12-14,Nuclei,cpe:2.3:a:helmet_store_showroom_site_project:helmet_store_showroom_site:1.0:*:*:*:*:*:*:*,Helmet Store Showroom Site Project,Helmet Store Showroom Site
CVE-2022-46073,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01235,CWE-79,Helmet Store Showroom 1.0 is vulnerable to Cross Site Scripting (XSS).,2022-12-14,Nuclei,cpe:2.3:a:helmet_store_showroom_project:helmet_store_showroom:1.0:*:*:*:*:*:*:*,Helmet Store Showroom Project,Helmet Store Showroom
CVE-2022-46169,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99826,CWE-74,"Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for any monitored device. The vulnerability resides in the `remote_agent.php` file. This file can be accessed without authentication. This function retrieves the IP address of the client via `get_client_addr` and resolves this IP address to the corresponding hostname via `gethostbyaddr`. After this, it is verified that an entry within the `poller` table exists, where the hostname corresponds to the resolved hostname. If such an entry was found, the function returns `true` and the client is authorized. This authorization can be bypassed due to the implementation of the `get_client_addr` function. The function is defined in the file `lib/functions.php` and checks serval `$_SERVER` variables to determine the IP address of the client. The variables beginning with `HTTP_` can be arbitrarily set by an attacker. Since there is a default entry in the `poller` table with the hostname of the server running Cacti, an attacker can bypass the authentication e.g. by providing the header `Forwarded-For: <TARGETIP>`. This way the function `get_client_addr` returns the IP address of the server running Cacti. The following call to `gethostbyaddr` will resolve this IP address to the hostname of the server, which will pass the `poller` hostname check because of the default entry. After the authorization of the `remote_agent.php` file is bypassed, an attacker can trigger different actions. One of these actions is called `polldata`. The called function `poll_for_data` retrieves a few request parameters and loads the corresponding `poller_item` entries from the database. If the `action` of a `poller_item` equals `POLLER_ACTION_SCRIPT_PHP`, the function `proc_open` is used to execute a PHP script. The attacker-controlled parameter `$poller_id` is retrieved via the function `get_nfilter_request_var`, which allows arbitrary strings. This variable is later inserted into the string passed to `proc_open`, which leads to a command injection vulnerability. By e.g. providing the `poller_id=;id` the `id` command is executed. In order to reach the vulnerable call, the attacker must provide a `host_id` and `local_data_id`, where the `action` of the corresponding `poller_item` is set to `POLLER_ACTION_SCRIPT_PHP`. Both of these ids (`host_id` and `local_data_id`) can easily be bruteforced. The only requirement is that a `poller_item` with an `POLLER_ACTION_SCRIPT_PHP` action exists. This is very likely on a productive instance because this action is added by some predefined templates like `Device - Uptime` or `Device - Polling Time`.

This command injection vulnerability allows an unauthenticated user to execute arbitrary commands if a `poller_item` with the `action` type `POLLER_ACTION_SCRIPT_PHP` (`2`) is configured. The authorization bypass should be prevented by not allowing an attacker to make `get_client_addr` (file `lib/functions.php`) return an arbitrary IP address. This could be done by not honoring the `HTTP_...` `$_SERVER` variables. If these should be kept for compatibility reasons it should at least be prevented to fake the IP address of the server running Cacti. This vulnerability has been addressed in both the 1.2.x and 1.3.x release branches with `1.2.23` being the first release containing the patch.",2022-12-05,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*,Cacti,Cacti
CVE-2022-46381,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01739,CWE-79,"Certain Linear eMerge E3-Series devices are vulnerable to XSS via the type parameter (e.g., to the badging/badge_template_v0.php component). This affects 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e.",2022-12-13,Nuclei,cpe:2.3:h:niceforyou:linear_emerge_e3_access_control:-:*:*:*:*:*:*:*;cpe:2.3:o:niceforyou:linear_emerge_e3_access_control_firmware:0.32-07e:*:*:*:*:*:*:*;cpe:2.3:o:niceforyou:linear_emerge_e3_access_control_firmware:0.32-07p:*:*:*:*:*:*:*;cpe:2.3:o:niceforyou:linear_emerge_e3_access_control_firmware:0.32-08e:*:*:*:*:*:*:*;cpe:2.3:o:niceforyou:linear_emerge_e3_access_control_firmware:0.32-08f:*:*:*:*:*:*:*;cpe:2.3:o:niceforyou:linear_emerge_e3_access_control_firmware:0.32-09a:*:*:*:*:*:*:*;cpe:2.3:o:niceforyou:linear_emerge_e3_access_control_firmware:0.32-09b:*:*:*:*:*:*:*;cpe:2.3:o:niceforyou:linear_emerge_e3_access_control_firmware:0.32-09c:*:*:*:*:*:*:*,Niceforyou,Linear Emerge E3 Access Control Firmware
CVE-2022-46443,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.37729,CWE-89,mesinkasir Bangresto 1.0 is vulnberable to SQL Injection via the itemqty%5B%5D parameter.,2022-12-14,Nuclei,cpe:2.3:a:bangresto_project:bangresto:1.0:*:*:*:*:*:*:*,Bangresto Project,Bangresto
CVE-2022-46689,7.0,CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.44678,CWE-362,"A race condition was addressed with additional validation. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. An app may be able to execute arbitrary code with kernel privileges.",2022-12-15,Metasploit,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2022-46770,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.21478,CWE-835,qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of service (CPU consumption and loss of forwarding) via a crafted multicast UDP packet (IP address range of 224.0.0.0 through 239.255.255.255).,2022-12-07,Metasploit,cpe:2.3:a:linuxfoundation:mirage_firewall:*:*:*:*:*:qubesos:*:*,Linuxfoundation,Mirage Firewall
CVE-2022-46888,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01543,CWE-79,Multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inject arbitrary web script or HTML via the secret parameter in /login.php; q parameter in /user-ban-log.php; query parameter in /log.php; text parameter in /moresmiles.php; q parameter in myhr.php; or id parameter in /viewrequests.php.,2023-01-19,Nuclei,cpe:2.3:a:nexusphp:nexusphp:*:*:*:*:*:*:*:*,Nexusphp,Nexusphp
CVE-2022-46934,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01084,CWE-79,kkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java.,2023-02-01,Nuclei,cpe:2.3:a:keking:kkfileview:4.1.0:*:*:*:*:*:*:*,Keking,Kkfileview
CVE-2022-47002,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06253,CWE-863,"A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers to bypass authentication via a crafted web request.",2023-02-01,Nuclei,cpe:2.3:a:masacms:masacms:*:*:*:*:*:*:*:*;cpe:2.3:a:masacms:masacms:7.4.0:alpha1:*:*:*:*:*:*;cpe:2.3:a:masacms:masacms:7.4.0:alpha2:*:*:*:*:*:*;cpe:2.3:a:masacms:masacms:7.4.0:beta1:*:*:*:*:*:*;cpe:2.3:a:masacms:masacms:7.4.0:beta2:*:*:*:*:*:*,Masacms,Masacms
CVE-2022-47003,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03614,NVD-CWE-Other,A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a crafted web request.,2023-02-01,Nuclei,cpe:2.3:a:murasoftware:mura_cms:*:*:*:*:*:*:*:*,Murasoftware,Mura Cms
CVE-2022-47075,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.59407,NVD-CWE-noinfo,"An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to ExportReportingManager.aspx.",2023-02-28,Nuclei,cpe:2.3:a:smartofficepayroll:smartoffice:*:*:*:*:web:*:*:*,Smartofficepayroll,Smartoffice
CVE-2022-47501,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.1018,CWE-22,"Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a 
pre-authentication attack.
This issue affects Apache OFBiz: before 18.12.07.",2023-04-14,Nuclei,cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*,Apache,Ofbiz
CVE-2022-47615,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N,0.05063,CWE-434,Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.,2023-01-26,Nuclei,cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:*,Thimpress,Learnpress
CVE-2022-47945,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.16378,CWE-22,"ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php.",2022-12-23,Nuclei,cpe:2.3:a:thinkphp:thinkphp:*:*:*:*:*:*:*:*,Thinkphp,Thinkphp
CVE-2022-47966,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99753,NVD-CWE-noinfo,"Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).",2023-01-18,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:zohocorp:manageengine_access_manager_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4300:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4301:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4302:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4303:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4304:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4305:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4306:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4307:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_ad360:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_ad360:4.3:4300:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_ad360:4.3:4302:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_ad360:4.3:4303:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_ad360:4.3:4304:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_ad360:4.3:4305:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_ad360:4.3:4306:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_ad360:4.3:4308:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_ad360:4.3:4309:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7002:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7003:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7004:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7005:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7006:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7007:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7008:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7050:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7051:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7052:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7053:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7054:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7055:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7060:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7062:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7063:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7065:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7080:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7102:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7110:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7111:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7112:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7113:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7114:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7115:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7116:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7117:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7118:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7120:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7121:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7122:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7123:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7124:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7125:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7126:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7130:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7131:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7140:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7141:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7150:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7151:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7160:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7161:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.2:6200:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.2:6201:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.2:6202:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.2:6203:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.2:6204:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.2:6205:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.2:6206:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.2:6207:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.2:6208:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.2:6209:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.2:6210:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_analytics_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_analytics_plus:5.1:5100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_analytics_plus:5.1:5110:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_analytics_plus:5.1:5120:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_analytics_plus:5.1:5121:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_analytics_plus:5.1:5130:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_analytics_plus:5.1:5140:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_application_control_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6900:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6901:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6902:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6903:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6904:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6905:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6906:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6907:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6908:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6909:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6950:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6951:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6952:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6953:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6954:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6955:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6956:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6957:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6970:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6971:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6972:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6973:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6974:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6975:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6976:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6977:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6978:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6979:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6980:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6981:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6982:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_browser_security_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_device_control_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_endpoint_dlp_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_key_manager_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_key_manager_plus:6.4:6400:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_os_deployer:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.7:build5700:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.7:build5710:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.7:build5711:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_pam360:5.7:build5712:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12110:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12120:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12121:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12122:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12123:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_patch_manager_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_remote_access_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_remote_monitoring_and_management_central:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14001:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14002:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14003:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:13.0:13000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11017:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11018:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11019:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11020:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11021:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11022:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11024:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11025:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_vulnerability_manager_plus:*:*:*:*:*:*:*:*,Zohocorp,Manageengine Access Manager Plus
CVE-2022-47986,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99968,CWE-502,"IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.",2023-02-17,CISA/EPSS/Nuclei,cpe:2.3:a:ibm:aspera_faspex:*:*:*:*:*:*:*:*;cpe:2.3:a:ibm:aspera_faspex:4.4.2:-:*:*:*:*:*:*;cpe:2.3:a:ibm:aspera_faspex:4.4.2:patch_level_1:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2022-48012,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0137,CWE-79,Opencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /opencats/index.php?m=settings&a=ajax_tags_upd.,2023-01-27,Nuclei,cpe:2.3:a:opencats:opencats:0.9.7:*:*:*:*:*:*:*,Opencats,Opencats
CVE-2022-48164,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03096,NVD-CWE-Other,An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN533A8 M33A8.V5030.190716 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials.,2023-02-06,Nuclei,cpe:2.3:h:wavlink:wl-wn533a8:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wl-wn533a8_firmware:m33a8.v5030.190716:*:*:*:*:*:*:*,Wavlink,Wl-Wn533A8 Firmware
CVE-2022-48165,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03284,NVD-CWE-Other,An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN530H4 M30H4.V5030.210121 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials.,2023-02-03,Nuclei,cpe:2.3:h:wavlink:wl-wn530h4:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wl-wn530h4_firmware:m30h4.v5030.210121:*:*:*:*:*:*:*,Wavlink,Wl-Wn530H4 Firmware
CVE-2022-48166,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02823,CWE-862,An access control issue in Wavlink WL-WN530HG4 M30HG4.V5030.201217 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials.,2023-02-06,Nuclei,cpe:2.3:h:wavlink:wl-wn530hg4:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wl-wn530hg4_firmware:m30hg4.v5030.201217:*:*:*:*:*:*:*,Wavlink,Wl-Wn530Hg4 Firmware
CVE-2022-48197,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.06608,CWE-79,"Reflected cross-site scripting (XSS) exists in Sandbox examples in the YUI2 repository. The download distributions, TreeView component and the YUI Javascript library overall are not affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.",2023-01-02,Nuclei,cpe:2.3:a:yui_project:yui:*:*:*:*:*:*:*:*,Yui Project,Yui
CVE-2022-48323,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.56787,CWE-22,"Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue. A remote and unauthenticated attacker can execute arbitrary programs on the victim host by sending a crafted HTTP request, as demonstrated by /check?cmd=ping../ followed by the pathname of the powershell.exe program.",2023-02-13,Nuclei,cpe:2.3:a:sunlogin:sunflower:1.0.1.43315:*:*:*:simple:*:*:*,Sunlogin,Sunflower
CVE-2022-48503,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.03213,NVD-CWE-noinfo,"The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to arbitrary code execution.",2023-08-14,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2022-48618,7.0,CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.00487,CWE-367,"The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited against versions of iOS released before iOS 15.7.1.",2024-01-09,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2022-4897,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00858,Missing_Data,"The BackupBuddy WordPress plugin before 8.8.3 does not sanitise and escape some parameters before outputting them back in various places, leading to Reflected Cross-Site Scripting",2023-02-21,Nuclei,cpe:2.3:a:ithemes:backupbuddy:*:*:*:*:*:wordpress:*:*,Ithemes,Backupbuddy
CVE-2022-4940,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.01084,CWE-862,"The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying membership details, changing renewal information, controlling membership approvals, and more.",2023-04-05,Nuclei,cpe:2.3:a:wclovers:wcfm_membership:*:*:*:*:*:wordpress:*:*,Wclovers,Wcfm Membership
CVE-2022-4971,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.15837,CWE-79,"The Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'urls' parameter called via the 'heateor_sss_sharing_count' AJAX action in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",2024-10-16,Nuclei,cpe:2.3:a:heateor:sassy_social_share:*:*:*:*:*:wordpress:*:*,Heateor,Sassy Social Share
CVE-2022-4978,0.0,,0.01561,CWE-78,"Remote Control Server, maintained by Steppschuh, 3.1.1.12 allows unauthenticated remote code execution when authentication is disabled, which is the default configuration. The server exposes a custom UDP-based control protocol that accepts remote keyboard input events without verification. An attacker on the same network can issue a sequence of keystroke commands to launch a system shell and execute arbitrary commands, resulting in full system compromise.",2025-07-23,Metasploit,,,
CVE-2023-0037,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03911,Missing_Data,"The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection",2023-03-13,Nuclei,cpe:2.3:a:10web:map_builder_for_google_maps:*:*:*:*:*:wordpress:*:*,10Web,Map Builder For Google Maps
CVE-2023-0099,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01726,Missing_Data,"The Simple URLs WordPress plugin before 115 does not sanitise and escape some parameters before outputting them back in some pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2023-02-13,Nuclei,cpe:2.3:a:getlasso:simple_urls:*:*:*:*:*:wordpress:*:*,Getlasso,Simple Urls
CVE-2023-0126,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.72699,CWE-22,"Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbitrary files and directories stored outside the web root directory.",2023-01-19,Nuclei,cpe:2.3:h:sonicwall:sma1000:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma1000_firmware:12.4.2:*:*:*:*:*:*:*,Sonicwall,Sma1000 Firmware
CVE-2023-0159,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.55736,Missing_Data,"The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 does not validate a parameter passed to the php extract function when loading templates, allowing an unauthenticated attacker to override the template path to read arbitrary files from the hosts file system. This may be escalated to RCE using PHP filter chains.",2023-02-13,Nuclei,cpe:2.3:a:wprealize:extensive_vc_addons_for_wpbakery_page_builder:*:*:*:*:*:wordpress:*:*,Wprealize,Extensive Vc Addons For Wpbakery Page Builder
CVE-2023-0236,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01347,Missing_Data,"The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin",2023-02-06,Nuclei,cpe:2.3:a:themeum:tutor_lms:*:*:*:*:*:wordpress:*:*,Themeum,Tutor Lms
CVE-2023-0261,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.04356,Missing_Data,"The WP TripAdvisor Review Slider WordPress plugin before 10.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.",2023-02-13,Nuclei,cpe:2.3:a:ljapps:wp_tripadvisor_review_slider:*:*:*:*:*:wordpress:*:*,Ljapps,Wp Tripadvisor Review Slider
CVE-2023-0266,7.9,CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H,0.03702,CWE-416,A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e,2023-01-30,CISA,cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2023-0297,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.95845,CWE-94,Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.,2023-01-14,EPSS/Metasploit/Nuclei,cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:*,Pyload,Pyload
CVE-2023-0315,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.97653,CWE-77,Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8.,2023-01-16,EPSS/Metasploit,cpe:2.3:a:froxlor:froxlor:*:*:*:*:*:*:*:*,Froxlor,Froxlor
CVE-2023-0334,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00881,Missing_Data,"The ShortPixel Adaptive Images WordPress plugin before 3.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against any high privilege users such as admin",2023-02-27,Nuclei,cpe:2.3:a:shortpixel:shortpixel_adaptive_images:*:*:*:*:*:wordpress:*:*,Shortpixel,Shortpixel Adaptive Images
CVE-2023-0342,3.1,CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N,0.00891,CWE-497,MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12,2023-06-09,Metasploit,cpe:2.3:a:mongodb:ops_manager_server:*:*:*:*:*:*:*:*,Mongodb,Ops Manager Server
CVE-2023-0386,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.0788,CWE-282,"A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.",2023-03-22,CISA/Metasploit,cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:6.2:rc5:*:*:*:*:*:*;cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*,Netapp,H300S Firmware
CVE-2023-0448,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.44513,CWE-79,"The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability.",2023-01-26,Nuclei,cpe:2.3:a:matbao:wp_helper_premium:*:*:*:*:*:wordpress:*:*,Matbao,Wp Helper Premium
CVE-2023-0514,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0085,CWE-79,"The Membership Database WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",2023-05-08,Nuclei,cpe:2.3:a:membership_database_project:membership_database:*:*:*:*:*:wordpress:*:*,Membership Database Project,Membership Database
CVE-2023-0527,3.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N,0.06118,CWE-79,"A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file search-request.php. The manipulation of the argument searchdata with the input ""><script>alert(document.domain)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219596.",2023-01-27,Nuclei,cpe:2.3:a:online_security_guards_hiring_system_project:online_security_guards_hiring_system:1.0:*:*:*:*:*:*:*,Online Security Guards Hiring System Project,Online Security Guards Hiring System
CVE-2023-0552,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.24263,Missing_Data,"The Registration Forms WordPress plugin before 3.8.2.3 does not properly validate the redirection URL when logging in and login out, leading to an Open Redirect vulnerability",2023-02-27,Nuclei,cpe:2.3:a:genetechsolutions:pie_register:*:*:*:*:*:wordpress:*:*,Genetechsolutions,Pie Register
CVE-2023-0562,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.44268,CWE-89,A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php of the component Login. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219716.,2023-01-28,Nuclei,cpe:2.3:a:phpgurukul:bank_locker_management_system:1.0:*:*:*:*:*:*:*,Phpgurukul,Bank Locker Management System
CVE-2023-0563,3.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N,0.37608,CWE-79,A vulnerability classified as problematic has been found in PHPGurukul Bank Locker Management System 1.0. This affects an unknown part of the file add-locker-form.php of the component Assign Locker. The manipulation of the argument ahname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219717 was assigned to this vulnerability.,2023-01-28,Nuclei,cpe:2.3:a:phpgurukul:bank_locker_management_system:1.0:*:*:*:*:*:*:*,Phpgurukul,Bank Locker Management System
CVE-2023-0600,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04234,CWE-89,"The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.9 does not escape user input which is concatenated to an SQL query, allowing unauthenticated visitors to conduct SQL Injection attacks.",2023-05-15,Nuclei,cpe:2.3:a:codepress:visitor_statistics:*:*:*:*:-:wordpress:*:*,Codepress,Visitor Statistics
CVE-2023-0602,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00886,Missing_Data,"The Twittee Text Tweet WordPress plugin through 1.0.8 does not properly escape POST values which are printed back to the user inside one of the plugin's administrative page, which allows reflected XSS attacks targeting administrators to happen.",2023-07-31,Nuclei,cpe:2.3:a:johnniejodelljr:twittee_text_tweet:*:*:*:*:*:wordpress:*:*,Johnniejodelljr,Twittee Text Tweet
CVE-2023-0630,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.05141,CWE-89,The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL query.,2023-03-20,Nuclei,cpe:2.3:a:wp-slimstat:slimstat_analytics:*:*:*:*:*:wordpress:*:*,Wp-Slimstat,Slimstat Analytics
CVE-2023-0669,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.99999,CWE-502,"Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.",2023-02-06,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:*,Fortra,Goanywhere Managed File Transfer
CVE-2023-0676,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01532,CWE-79,Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1.,2023-02-04,Nuclei,cpe:2.3:a:phpipam:phpipam:*:*:*:*:*:*:*:*,Phpipam,Phpipam
CVE-2023-0678,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.37304,CWE-862,Missing Authorization in GitHub repository phpipam/phpipam prior to v1.5.1.,2023-02-04,Nuclei,cpe:2.3:a:phpipam:phpipam:*:*:*:*:*:*:*:*,Phpipam,Phpipam
CVE-2023-0777,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.15088,CWE-305,Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.,2023-02-10,Nuclei,cpe:2.3:a:modoboa:modoboa:*:*:*:*:*:*:*:*,Modoboa,Modoboa
CVE-2023-0872,8.2,CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L,0.02951,CWE-269,"The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

OpenNMS thanks Erik Wynter for reporting this issue.",2023-08-14,Metasploit,cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*;cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*,Opennms,Horizon
CVE-2023-0876,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00713,Missing_Data,"The WP Meta SEO WordPress plugin before 4.5.3 does not authorize several ajax actions, allowing low-privilege users to make updates to certain data and leading to an arbitrary redirect vulnerability.",2023-03-20,Nuclei,cpe:2.3:a:joomunited:wp_meta_seo:*:*:*:*:*:wordpress:*:*,Joomunited,Wp Meta Seo
CVE-2023-0900,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.03229,Missing_Data,"The Pricing Table Builder WordPress plugin through 1.1.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admins.",2023-06-05,Nuclei,cpe:2.3:a:wpdevart:pricing_table_builder:*:*:*:*:*:wordpress:*:*,Wpdevart,Pricing Table Builder
CVE-2023-0942,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01213,CWE-79,"The Japanized For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",2023-02-21,Nuclei,cpe:2.3:a:artisanworkshop:japanized_for_woocommerce:*:*:*:*:*:wordpress:*:*,Artisanworkshop,Japanized For Woocommerce
CVE-2023-0947,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03637,CWE-22,Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3.,2023-02-22,Nuclei,cpe:2.3:a:flatpress:flatpress:*:*:*:*:*:*:*:*,Flatpress,Flatpress
CVE-2023-0948,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0085,CWE-79,"The Japanized For WooCommerce WordPress plugin before 2.5.8 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting",2023-05-08,Nuclei,cpe:2.3:a:artisanworkshop:japanized_for_woocommerce:*:*:*:*:*:wordpress:*:*,Artisanworkshop,Japanized For Woocommerce
CVE-2023-0968,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01252,CWE-79,"The Watu Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘dn’, 'email', 'points', and 'date' parameters in versions up to, and including, 3.3.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",2023-03-03,Nuclei,cpe:2.3:a:kibokolabs:watu_quiz:*:*:*:*:*:wordpress:*:*,Kibokolabs,Watu Quiz
CVE-2023-1020,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0499,Missing_Data,"The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.",2023-04-24,Nuclei,cpe:2.3:a:wp_live_chat_shoutbox_project:wp_live_chat_shoutbox:*:*:*:*:*:wordpress:*:*,Wp Live Chat Shoutbox Project,Wp Live Chat Shoutbox
CVE-2023-1080,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0126,CWE-79,"The GN Publisher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",2023-02-28,Nuclei,cpe:2.3:a:gnpublisher:gn_publisher:*:*:*:*:*:wordpress:*:*,Gnpublisher,Gn Publisher
CVE-2023-1119,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01158,Missing_Data,"The WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin WordPress plugin before 2.4.1 use a third-party library that removes the escaping on some HTML characters, leading to a cross-site scripting vulnerability.",2023-07-10,Nuclei,cpe:2.3:a:srbtranslatin_project:srbtranslatin:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:updraftplus:wp-optimize:*:*:*:*:*:wordpress:*:*,Srbtranslatin Project,Srbtranslatin
CVE-2023-1133,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.5005,CWE-502,"Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on port 10100/ UDP by default. The service accepts the unverified UDP packets and deserializes the content, which could allow an unauthenticated attacker to remotely execute arbitrary code.",2023-03-27,Metasploit,cpe:2.3:a:deltaww:infrasuite_device_master:*:*:*:*:*:*:*:*,Deltaww,Infrasuite Device Master
CVE-2023-1177,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N,0.69468,CWE-29,"Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.

",2023-03-24,Nuclei,cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*,Lfprojects,Mlflow
CVE-2023-1263,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01414,CWE-200,"The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 4.1.6  via the cmp_get_post_detail function. This can allow unauthenticated individuals to obtain the contents of any non-password-protected, published post or page even when maintenance mode is enabled.",2023-03-07,Nuclei,cpe:2.3:a:niteothemes:coming_soon_\&_maintenance:*:*:*:*:*:wordpress:*:*,Niteothemes,Coming Soon & Maintenance
CVE-2023-1315,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01059,CWE-79,Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6.,2023-03-10,Nuclei,cpe:2.3:a:enhancesoft:osticket:*:*:*:*:*:*:*:*,Enhancesoft,Osticket
CVE-2023-1317,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01015,CWE-79,Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6.,2023-03-10,Nuclei,cpe:2.3:a:enhancesoft:osticket:*:*:*:*:*:*:*:*,Enhancesoft,Osticket
CVE-2023-1318,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01015,CWE-79,Cross-site Scripting (XSS) - Generic in GitHub repository osticket/osticket prior to v1.16.6.,2023-03-10,Nuclei,cpe:2.3:a:enhancesoft:osticket:*:*:*:*:*:*:*:*,Enhancesoft,Osticket
CVE-2023-1362,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01411,CWE-1021,Improper Restriction of Rendered UI Layers or Frames in GitHub repository unilogies/bumsys prior to v2.0.2.,2023-03-13,Nuclei,cpe:2.3:a:bumsys_project:bumsys:*:*:*:*:*:*:*:*,Bumsys Project,Bumsys
CVE-2023-1389,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99999,CWE-77,"TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.",2023-03-15,CISA/EPSS/Nuclei,cpe:2.3:h:tp-link:archer_ax21:-:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:archer_ax21_firmware:*:*:*:*:*:*:*:*,TP-Link,Archer Ax21 Firmware
CVE-2023-1408,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.03229,Missing_Data,"The Video List Manager WordPress plugin through 1.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin",2023-05-08,Nuclei,cpe:2.3:a:video_list_manager_project:video_list_manager:*:*:*:*:*:wordpress:*:*,Video List Manager Project,Video List Manager
CVE-2023-1454,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.35825,CWE-89,A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223299.,2023-03-17,Nuclei,cpe:2.3:a:jeecg:jeecg_boot:3.5.0:*:*:*:*:*:*:*,Jeecg,Jeecg Boot
CVE-2023-1496,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01585,CWE-79,Cross-site Scripting (XSS) - Reflected in GitHub repository imgproxy/imgproxy prior to 3.14.0.,2023-03-19,Nuclei,cpe:2.3:a:evilmartians:imgproxy:*:*:*:*:*:*:*:*,Evilmartians,Imgproxy
CVE-2023-1546,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0085,CWE-79,"The MyCryptoCheckout WordPress plugin before 2.124 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting",2023-05-02,Nuclei,cpe:2.3:a:plainviewplugins:mycryptocheckout:*:*:*:*:*:wordpress:*:*,Plainviewplugins,Mycryptocheckout
CVE-2023-1671,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99999,CWE-77,A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.,2023-04-04,CISA/EPSS/Nuclei,cpe:2.3:a:sophos:web_appliance:*:*:*:*:*:*:*:*,Sophos,Web Appliance
CVE-2023-1698,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.82037,CWE-78,"In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise.",2023-05-15,Nuclei,cpe:2.3:h:wago:compact_controller_100:-:*:*:*:*:*:*:*;cpe:2.3:h:wago:edge_controller:-:*:*:*:*:*:*:*;cpe:2.3:h:wago:pfc100:-:*:*:*:*:*:*:*;cpe:2.3:h:wago:pfc200:-:*:*:*:*:*:*:*;cpe:2.3:h:wago:touch_panel_600_advanced:-:*:*:*:*:*:*:*;cpe:2.3:h:wago:touch_panel_600_marine:-:*:*:*:*:*:*:*;cpe:2.3:h:wago:touch_panel_600_standard:-:*:*:*:*:*:*:*;cpe:2.3:o:wago:compact_controller_100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:wago:edge_controller_firmware:22:*:*:*:*:*:*:*;cpe:2.3:o:wago:pfc100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:wago:pfc200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:wago:touch_panel_600_advanced_firmware:22:-:*:*:*:*:*:*;cpe:2.3:o:wago:touch_panel_600_marine_firmware:22:-:*:*:*:*:*:*;cpe:2.3:o:wago:touch_panel_600_standard_firmware:22:-:*:*:*:*:*:*,Wago,Compact Controller 100 Firmware
CVE-2023-1719,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04973,CWE-665,"Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the server and (2) execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via overwriting uninitialised variables.",2023-11-01,Nuclei,cpe:2.3:a:bitrix24:bitrix24:22.0.300:*:*:*:*:*:*:*,Bitrix24,Bitrix24
CVE-2023-1730,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.40586,CWE-89,"The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks",2023-05-02,Nuclei,cpe:2.3:a:supportcandy:supportcandy:*:*:*:*:*:wordpress:*:*,Supportcandy,Supportcandy
CVE-2023-1780,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00998,CWE-79,"The Companion Sitemap Generator WordPress plugin before 4.5.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2023-07-10,Nuclei,cpe:2.3:a:codeermeneer:companion_sitemap_generator:*:*:*:*:*:wordpress:*:*,Codeermeneer,Companion Sitemap Generator
CVE-2023-1835,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00925,Missing_Data,"The Ninja Forms Contact Form WordPress plugin before 3.6.22 does not properly escape user input before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",2023-05-15,Nuclei,cpe:2.3:a:ninjaforms:ninja_forms:*:*:*:*:*:wordpress:*:*,Ninjaforms,Ninja Forms
CVE-2023-1880,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01644,CWE-79,Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12.,2023-04-05,Nuclei,cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*,Phpmyfaq,Phpmyfaq
CVE-2023-1890,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01067,Missing_Data,"The Tablesome WordPress plugin before 1.0.9 does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leading to Reflected Cross-Site Scripting",2023-05-15,Nuclei,cpe:2.3:a:pauple:tablesome:*:*:*:*:*:wordpress:*:*,Pauple,Tablesome
CVE-2023-1892,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.02742,CWE-79,Cross-site Scripting (XSS) - Reflected in GitHub repository sidekiq/sidekiq prior to 7.0.8.,2023-04-21,Nuclei,cpe:2.3:a:contribsys:sidekiq:*:*:*:*:*:*:*:*,Contribsys,Sidekiq
CVE-2023-1893,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00718,CWE-79,"The Login Configurator WordPress plugin through 2.1 does not properly escape a URL parameter before outputting it to the page, leading to a reflected cross-site scripting vulnerability targeting site administrators.",2023-07-17,Nuclei,cpe:2.3:a:login_configurator_project:login_configurator:*:*:*:*:*:wordpress:*:*,Login Configurator Project,Login Configurator
CVE-2023-20073,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.88874,CWE-434,"A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to insufficient authorization enforcement mechanisms in the context of file uploads. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to upload arbitrary files to the affected device.",2023-04-05,Nuclei,cpe:2.3:h:cisco:rv340:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv340w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv345:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv345p:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv340_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv340w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv345_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv345p_firmware:*:*:*:*:*:*:*:*,Cisco,Rv340 Firmware
CVE-2023-2009,4.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N,0.00824,CWE-79,"Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",2023-05-15,Nuclei,cpe:2.3:a:pretty_url_project:pretty_url:*:*:*:*:*:wordpress:*:*,Pretty Url Project,Pretty Url
CVE-2023-20109,6.6,CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H,0.02344,CWE-787,"A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash.

 This vulnerability is due to insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature. An attacker could exploit this vulnerability by either compromising an installed key server or modifying the configuration of a group member to point to a key server that is controlled by the attacker. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a denial of service (DoS) condition. For more information, see the Details [""#details""] section of this advisory.",2023-09-27,CISA,cpe:2.3:o:cisco:ios:12.4\(22\)md1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)md2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)md:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)mda1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)mda2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)mda3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)mda4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)mda5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)mda6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)mda:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)t5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)xr10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)xr11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)xr12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)xr1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)xr2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)xr3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)xr4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)xr5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)xr6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)xr7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)xr8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(22\)xr9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)md1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)md2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)md3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)md4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)md5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)md6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)md7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)md:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mda10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mda11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mda12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mda13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mda1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mda2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mda3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mda4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mda5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mda6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mda7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mda8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mda9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mdb10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mdb11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mdb12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mdb13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mdb14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mdb15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mdb16:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mdb17:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mdb18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mdb19:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mdb1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mdb3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mdb4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mdb5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mdb5a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mdb6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mdb7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mdb8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mdb9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)mdb:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)t3e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)t3f:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)t4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)t4b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)t4c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)t4d:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)t4e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)t4f:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)t4l:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)t5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)t6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)t7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)t8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)yg1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)yg2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)yg3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)yg4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.4\(24\)yg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)m10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)m1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)m2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)m3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)m4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)m5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)m6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)m7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)m8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)m9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)mr:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)s3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)s4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)s5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)s6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)xa1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)xa2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)xa3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)xa4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)xa5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)xa:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ea1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ea:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ej1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ej:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ek1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ek:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ex10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ex11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ex12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ex13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ex1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ex2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ex3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ex4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ex5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ex8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ex:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ey1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ey2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ey3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ey:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ez:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)mr:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se10a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2a\)ex5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)sg1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)sg2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)sg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)sy1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)sy2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)sy3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)sy4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)sy5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)sy6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)sy:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)t5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)xb:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)gc1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)gc2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)gc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy16:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)t0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)t2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)t5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)mra1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)mra2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)mra3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)mra4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)mra:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)s0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)s5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)s5a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)s6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)svb1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)svb2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)svd1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)svd2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)svd:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)sve:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)svf1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)svf:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)svg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)svj2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(3\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(4\)gc1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(4\)gc2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(4\)gc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(4\)m10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(4\)m1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(4\)m2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(4\)m3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(4\)m3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(4\)m4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(4\)m5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(4\)m6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(4\)m7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(4\)m8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(4\)m9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(4\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)e3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)ey:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)gc1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)gc2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)gc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e5a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e5b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e7b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)ea1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)ea2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)ea3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)ea:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)eb1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)eb2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)eb:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)gc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)s0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)s0c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)sy1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)sy2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)sy3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)sy:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2a\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2a\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)e3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)e4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)e5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)ea:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)gc1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)gc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3a\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e10a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e10d:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e5a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ea1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ea3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ea4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ea5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ea6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ea7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ea8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ea9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ea9a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ea:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ec1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ec2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)gc1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)gc2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)gc3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)gc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m6a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)s3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)s4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)s5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)s6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)s7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5\)e2b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5\)e2c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5\)ea:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5\)ex:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5a\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5a\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5b\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5c\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(6\)e0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(6\)e0c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(6\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(6\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(6\)e2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(6\)e2b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(6\)e3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(6\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(6\)eb:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e0b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e3k:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7a\)e0b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7b\)e0b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(8\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(8\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(8\)e3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(8\)e4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(8\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)sy1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)sy2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)sy:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(2\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(2\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(2\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(2\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(2\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(2\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(2\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(2\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m8a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s8a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)cg1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)cg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)sy1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)sy2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)sy3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)sy4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)sy:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)cg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m6a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s6a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(3\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m6a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s6a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s6b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s9a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)sn:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)t0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sn:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m6a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m6b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m4b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m0b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m3b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m3b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m6a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m6b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m7a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.1.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.1.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.1.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1d:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1f:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1g:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.11.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.11.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.11.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.11.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.11.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1w:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1x:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1y:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1z1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1z2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.5a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.5b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.6a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.2.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.2.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.5b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.4.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.4.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.4.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.5.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.5.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.5.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.5.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.5.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.5a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.7.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.7.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.7.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.7.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.7.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.7.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.1c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.1d:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.1e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.5f:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.1.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.1.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.1.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.1.1t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.1.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.10.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.10.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.10.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.11.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.11.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.11.99sw:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.2.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.2.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.2.1r:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.2.1v:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.2.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.2.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.1w:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.1x:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.1z:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.4b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.4c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.5a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.5b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.4.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.4.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.4.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.4.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.4.2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.5.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.5.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.5.1c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.1w:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.1x:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.1y:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.1z1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.1z:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.5a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.7.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.7.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.7.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.7.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.8.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.8.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.1w:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.1x1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.1x:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.1y1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.1y:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.0ce:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.0e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.10s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.1e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.1xbs:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.2e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.2ts:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.3e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.5s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.6s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.7s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.8as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.8s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.9s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.0e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.1ae:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.1e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.2e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.3ae:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.3e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.4e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.5e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.6e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.7e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.8e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.12.0as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.12.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.12.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.12.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.12.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.12.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.0as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.10s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.2as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.5as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.5s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.6as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.6s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.7as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.7s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.8s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.13.9s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.14.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.14.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.14.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.14.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.14.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.15.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.15.1cs:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.15.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.15.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.15.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.15.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.0cs:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.10s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.1as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.2as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.2bs:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.3as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.4as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.4bs:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.4ds:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.5s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.6bs:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.6s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.7as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.7bs:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.7s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.8s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.9s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.17.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.17.1as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.17.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.17.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.17.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.17.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.0as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.0sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.1asp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.1bsp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.1csp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.1sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.2asp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.2sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.3asp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.3bsp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.3sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.4sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.5sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.6sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.7sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.8asp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.9sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.3.0sg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.3.1sg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.3.2sg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.4.0sg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.4.1sg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.4.2sg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.4.3sg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.4.4sg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.4.5sg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.4.6sg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.4.7sg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.4.8sg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.5.0e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.5.1e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.5.2e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.5.3e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.0e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.10e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.1e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.2ae:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.2e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.3e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.4e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.5ae:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.5be:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.5e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.6e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.7be:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.7e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.8e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.9e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.7.0bs:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.7.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.7.1as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.7.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.7.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.7.2ts:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.7.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.7.4as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.7.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.7.5s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.7.6s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.7.7s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.0e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.10e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.1e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.2e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.3e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.4e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.5ae:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.5e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.6e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.7e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.8e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.9e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.9.0as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.9.0e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.9.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.9.1as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.9.1e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.9.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.9.2e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.9.2s:*:*:*:*:*:*:*,Cisco,Ios
CVE-2023-20118,6.5,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N,0.54107,CWE-77,"A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary commands on an affected device.

 This vulnerability is due to improper validation of user input within incoming HTTP packets. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface. A successful exploit could allow the attacker to gain root-level privileges and access unauthorized data. To exploit this vulnerability, an attacker would need to have valid administrative credentials on the affected device.

 Cisco has not and will not release software updates that address this vulnerability.   However, administrators may disable the affected feature as described in the Workarounds [""#workarounds""] section.

  {{value}} [""%7b%7bvalue%7d%7d""])}]]",2023-04-13,CISA,cpe:2.3:h:cisco:rv016:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv042:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv042g:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv082:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv320:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv325:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv016_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv042_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv042g_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv082_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv320_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv325_firmware:*:*:*:*:*:*:*:*,Cisco,Rv016 Firmware
CVE-2023-20198,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.99571,CWE-420,"Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.",2023-10-16,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:h:rockwellautomation:allen-bradley_stratix_5200:-:*:*:*:*:*:*:*;cpe:2.3:h:rockwellautomation:allen-bradley_stratix_5800:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*;cpe:2.3:o:rockwellautomation:allen-bradley_stratix_5200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:rockwellautomation:allen-bradley_stratix_5800_firmware:*:*:*:*:*:*:*:*,Rockwellautomation,Allen-Bradley Stratix 5200 Firmware
CVE-2023-2023,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0171,CWE-79,"The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.",2023-05-30,Nuclei,cpe:2.3:a:kunalnagar:custom_404_pro:*:*:*:*:*:wordpress:*:*,Kunalnagar,Custom 404 Pro
CVE-2023-20269,5.0,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N,0.21583,CWE-288,"A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user.

 This vulnerability is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. An attacker could exploit this vulnerability by specifying a default connection profile/tunnel group while conducting a brute force attack or while establishing a clientless SSL VPN session using valid credentials. A successful exploit could allow the attacker to achieve one or both of the following:

 
 Identify valid credentials that could then be used to establish an unauthorized remote access VPN session.
 Establish a clientless SSL VPN session (only when running Cisco ASA Software Release 9.16 or earlier).
 
 Notes:

 
 Establishing a client-based remote access VPN tunnel is not possible as these default connection profiles/tunnel groups do not and cannot have an IP address pool configured.
 This vulnerability does not allow an attacker to bypass authentication. To successfully establish a remote access VPN session, valid credentials are required, including a valid second factor if multi-factor authentication (MFA) is configured.
 
 Cisco will release software updates that address this vulnerability. There are workarounds that address this vulnerability.",2023-09-06,CISA,cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.10:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.11:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.12:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.13:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.14:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.15:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.16:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.17:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.18:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.7:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.8:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.9:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.10:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.11:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.12:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.13:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.14:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.15:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.16:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.7:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.8:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.9:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.5.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.5.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.7.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.7:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.7.0.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.7.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.2.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.4.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.3.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.3.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.4.0:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.1.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.1.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.2.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.2.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.2.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.2.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.3.12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.3.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.3.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.3.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.24:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.26:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.29:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.30:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.35:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.37:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.38:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.39:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.40:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.41:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.47:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.48:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.50:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.52:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.54:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.55:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.56:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.58:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.1.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.1.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.1.19:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.1.30:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.1.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.2.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.2.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.2.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.2.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3.11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.17:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.22:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.23:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.16:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.17:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.21:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.1.28:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.2.11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.2.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.2.14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.2.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.2.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.3.14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.3.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.3.19:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.3.23:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.3.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.19:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.27:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.38:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.20:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.30:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.1.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.2.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.2.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.2.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.3.39:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.3.46:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.3.53:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.3.55:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.1.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.1.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.17:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.20:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.24:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.26:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.28:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.33:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.35:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.38:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.16:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.21:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.26:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.29:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.17:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.20:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.22:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.25:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.26:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.29:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.32:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.33:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.34:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.35:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.39:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.40:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.41:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.43:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.44:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.45:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.46:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.48:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4:*:*:*:*:*:*:*,Cisco,Adaptive Security Appliance Software
CVE-2023-20273,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.89634,CWE-78,"A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.",2023-10-25,CISA/Metasploit,cpe:2.3:h:cisco:catalyst_3650-12x48fd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48fd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48fd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48ur-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48ur-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48ur-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48ur:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uz-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uz-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uz-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-12x48uz:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pd:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pdm-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pdm-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pdm-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24pdm:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ps-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ps-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24td-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24td-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24td-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ts-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-24ts-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fqm-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fqm-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fqm-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fqm:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fs-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48fs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48pq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ps-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ps-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ps-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48td-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48td-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48td-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48tq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48tq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48tq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ts-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ts-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-48ts-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24pd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24pd-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24pd-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24uq-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24uq-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24uq-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650-8x24uq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3650:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12s-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12x48u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-12xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-16xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-16xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24p-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24pw-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24s-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24s-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24t-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xs:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-24xu:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-32xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-32xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48f-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48f-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48f-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48p-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48p-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48pw-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48t-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48t-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u-l:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48u:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-f-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-f-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-48xs:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-nm-2-40g:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850-nm-8-10g:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:catalyst_3850:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.1.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.1.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.1.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1d:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1f:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1g:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.11.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.11.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.11.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.11.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.11.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1w:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1x:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1y:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1z1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1z2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.5a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.5b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.6a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.2.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.2.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.5b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.3.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.4.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.4.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.4.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.5.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.5.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.5.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.5.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.5.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.5a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.7.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.7.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.7.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.7.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.7.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.7.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.1c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.1d:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.1e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.5f:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.1.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.1.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.1.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.1.1t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.1.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.10.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.10.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.10.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.11.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.11.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.11.99sw:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.2.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.2.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.2.1r:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.2.1v:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.2.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.2.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.1w:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.1x:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.1z:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.4b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.4c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.5a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.5b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.4.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.4.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.4.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.4.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.4.2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.5.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.5.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.5.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.5.1c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.1w:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.1x:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.1y:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.1z1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.1z:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.7.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.7.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.7.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.7.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.8.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.8.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.1w:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.1x1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.1x:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.1y1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.1y:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.4:*:*:*:*:*:*:*,Cisco,Ios Xe
CVE-2023-2033,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.40798,CWE-843,Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High),2023-04-14,CISA,cpe:2.3:a:couchbase:couchbase_server:*:*:*:*:*:*:*:*;cpe:2.3:a:couchbase:couchbase_server:7.2.0:*:*:*:*:*:*:*;cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2023-2059,4.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L,0.02406,CWE-28,A vulnerability was found in DedeCMS 5.7.87. It has been rated as problematic. Affected by this issue is some unknown functionality of the file uploads/include/dialog/select_templets.php. The manipulation leads to path traversal: '..\filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225944.,2023-04-14,Nuclei,cpe:2.3:a:dedecms:dedecms:5.7.87:*:*:*:*:*:*:*,Dedecms,Dedecms
CVE-2023-2068,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.3962,Missing_Data,"The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to unauthenticated users.",2023-06-27,Metasploit,cpe:2.3:a:advancedfilemanager:file_manager_advanced_shortcode:*:*:*:*:*:wordpress:*:*,Advancedfilemanager,File Manager Advanced Shortcode
CVE-2023-20864,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.70423,CWE-502,"VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware Aria Operations for Logs may be able to execute arbitrary code as root.",2023-04-20,Nuclei,cpe:2.3:a:vmware:aria_operations_for_logs:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*,Vmware,Aria Operations For Logs
CVE-2023-20867,3.9,CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N,0.1353,CWE-287,"A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.",2023-06-13,CISA,cpe:2.3:a:vmware:tools:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2023-20887,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98281,CWE-77,Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.,2023-06-07,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:vmware:aria_operations_for_networks:*:*:*:*:*:*:*:*,Vmware,Aria Operations For Networks
CVE-2023-20888,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.82282,CWE-502,Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network access to VMware Aria Operations for Networks and valid 'member' role credentials may be able to perform a deserialization attack resulting in remote code execution.,2023-06-07,Nuclei,cpe:2.3:a:vmware:vrealize_network_insight:*:*:*:*:*:*:*:*,Vmware,Vrealize Network Insight
CVE-2023-20889,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.79258,CWE-77,Aria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in information disclosure.,2023-06-07,Nuclei,cpe:2.3:a:vmware:vrealize_network_insight:*:*:*:*:*:*:*:*,Vmware,Vrealize Network Insight
CVE-2023-20963,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01445,CWE-295,"In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-220302519",2023-03-24,CISA,cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:12.1:*:*:*:*:*:*:*;cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*,Google,Android
CVE-2023-2122,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0085,Missing_Data,"The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary javascript by clicking a link.",2023-08-16,Nuclei,cpe:2.3:a:10web:image_optimizer:*:*:*:*:*:wordpress:*:*,10Web,Image Optimizer
CVE-2023-21237,5.5,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.00264,NVD-CWE-noinfo,"In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251586912",2023-06-28,CISA,cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*,Google,Android
CVE-2023-2130,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.04122,CWE-89,A vulnerability classified as critical has been found in SourceCodester Purchase Order Management System 1.0. Affected is an unknown function of the file /admin/suppliers/view_details.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-226206 is the identifier assigned to this vulnerability.,2023-04-17,Nuclei,cpe:2.3:a:purchase_order_management_system_project:purchase_order_management_system:1.0:*:*:*:*:*:*:*,Purchase Order Management System Project,Purchase Order Management System
CVE-2023-2136,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.05786,CWE-190,Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High),2023-04-19,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2023-21492,4.4,CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N,0.02554,CWE-532,Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.,2023-05-04,CISA,cpe:2.3:o:samsung:android:11.0:-:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-apr-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-apr-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-apr-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-aug-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-aug-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-dec-2020-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-dec-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-dec-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-feb-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-feb-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-feb-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-jan-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-jan-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-jan-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-jul-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-jul-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-jun-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-jun-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-mar-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-mar-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-mar-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-may-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-may-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-nov-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-nov-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-oct-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-oct-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-sep-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:11.0:smr-sep-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:12.0:-:*:*:*:*:*:*;cpe:2.3:o:samsung:android:12.0:smr-apr-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:12.0:smr-apr-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:12.0:smr-aug-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:12.0:smr-dec-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:12.0:smr-dec-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:12.0:smr-feb-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:12.0:smr-feb-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:12.0:smr-jan-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:12.0:smr-jan-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:12.0:smr-jul-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:12.0:smr-jun-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:12.0:smr-mar-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:12.0:smr-mar-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:12.0:smr-may-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:12.0:smr-nov-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:12.0:smr-nov-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:12.0:smr-oct-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:12.0:smr-sep-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:-:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-apr-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-apr-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-aug-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-dec-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-dec-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-feb-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-feb-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jan-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jan-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jul-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jun-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-mar-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-mar-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-may-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-nov-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-nov-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-oct-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-sep-2022-r1:*:*:*:*:*:*,Samsung,Android
CVE-2023-21529,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.62104,CWE-502,Microsoft Exchange Server Remote Code Execution Vulnerability,2023-02-14,CISA,cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2023-21554,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.95454,CWE-20,Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability,2023-04-11,EPSS/Metasploit,cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1607
CVE-2023-21608,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.61475,CWE-416,"Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",2023-01-18,CISA,cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:*;cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*;cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:*;cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2023-21674,8.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.41806,CWE-416,Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability,2023-01-10,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2023-21715,7.3,CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H,0.12011,CWE-863,Microsoft Publisher Security Feature Bypass Vulnerability,2023-02-14,CISA,cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*,Microsoft,365 Apps
CVE-2023-21768,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.65417,CWE-822,Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability,2023-01-10,Metasploit,cpe:2.3:o:microsoft:windows_11:21h2:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11:21h2:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11:22h2:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11:22h2:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*,Microsoft,Windows 11
CVE-2023-2178,4.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N,0.00773,Missing_Data,"The Aajoda Testimonials WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",2023-06-27,Nuclei,cpe:2.3:a:aajoda:aajoda_testimonials:*:*:*:*:*:wordpress:*:*,Aajoda,Aajoda Testimonials
CVE-2023-21823,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.05563,CWE-190,Windows Graphics Component Remote Code Execution Vulnerability,2023-02-14,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2023-21839,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.99811,CWE-502,"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).",2023-01-18,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*,Oracle,Weblogic Server
CVE-2023-22047,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.7698,NVD-CWE-noinfo,Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).  Supported versions that are affected are 8.59 and  8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).,2023-07-18,Nuclei,cpe:2.3:a:oracle:peoplesoft_enterprise:8.59:*:*:*:*:*:*:*;cpe:2.3:a:oracle:peoplesoft_enterprise:8.60:*:*:*:*:*:*:*,Oracle,Peoplesoft Enterprise
CVE-2023-22232,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.81875,CWE-284,"Adobe Connect versions 11.4.5 (and earlier), 12.1.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the integrity of a minor feature. Exploitation of this issue does not require user interaction.",2023-02-17,Nuclei,cpe:2.3:a:adobe:connect:*:*:*:*:*:*:*:*,Adobe,Connect
CVE-2023-2224,4.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N,0.00909,CWE-79,"The SEO by 10Web WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",2023-06-05,Nuclei,cpe:2.3:a:10web:seo:*:*:*:*:*:wordpress:*:*,10Web,Seo
CVE-2023-2227,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.43756,CWE-285,Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0.,2023-04-21,Nuclei,cpe:2.3:a:modoboa:modoboa:*:*:*:*:*:*:*:*,Modoboa,Modoboa
CVE-2023-22432,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02382,CWE-601,"Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.",2023-03-06,Nuclei,cpe:2.3:a:web2py:web2py:*:*:*:*:*:*:*:*,Web2Py,Web2Py
CVE-2023-22463,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.69667,CWE-798,"KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. Furthermore, they may use the administrator to take over the k8s cluster of the target enterprise. `session.go`, the use of hard-coded JwtSigKey, allows an attacker to use this value to forge jwt tokens arbitrarily. The JwtSigKey is confidential and should not be hard-coded in the code. The vulnerability has been fixed in 1.6.3. In the patch, JWT key is specified in app.yml. If the user leaves it blank, a random key will be used. There are no workarounds aside from upgrading.",2023-01-04,Nuclei,cpe:2.3:a:fit2cloud:kubepi:*:*:*:*:*:*:*:*,Fit2Cloud,Kubepi
CVE-2023-22478,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.03573,CWE-862,KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.,2023-01-14,Nuclei,cpe:2.3:a:fit2cloud:kubepi:*:*:*:*:*:*:*:*,Fit2Cloud,Kubepi
CVE-2023-22480,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.66768,CWE-285,"KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used to take over the cluster under certain conditions. This issue has been patched in version 3.16.4.
",2023-01-14,Nuclei,cpe:2.3:a:fit2cloud:kubeoperator:*:*:*:*:*:*:*:*,Fit2Cloud,Kubeoperator
CVE-2023-22515,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99156,NVD-CWE-noinfo,"Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. 

Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.",2023-10-04,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*,Atlassian,Confluence Data Center
CVE-2023-22518,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99999,CWE-863,"All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability. 

Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.",2023-10-31,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:confluence_data_center:8.6.0:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:confluence_server:8.6.0:*:*:*:*:*:*:*,Atlassian,Confluence Data Center
CVE-2023-2252,2.7,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N,0.01342,CWE-22,The Directorist WordPress plugin before 7.5.4 is vulnerable to Local File Inclusion as it does not validate the file parameter when importing CSV files.,2024-01-16,Nuclei,cpe:2.3:a:wpwax:directorist:*:*:*:*:*:wordpress:*:*,Wpwax,Directorist
CVE-2023-22527,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99984,CWE-74,"A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.

Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.",2024-01-16,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:confluence_data_center:8.7.0:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*,Atlassian,Confluence Data Center
CVE-2023-2256,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00952,CWE-79,"The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.7 does not sanitize and escape some URL parameters, leading to Reflected Cross-Site Scripting.",2023-05-30,Nuclei,cpe:2.3:a:themeisle:product_addons_\&_fields_for_woocommerce:*:*:*:*:*:wordpress:*:*,Themeisle,Product Addons & Fields For Woocommerce
CVE-2023-22620,7.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.03888,CWE-863,An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows sessionid information disclosure via an invalid authentication attempt. This can afterwards be used to bypass the device's authentication and get access to the administrative interface.,2023-04-12,Nuclei,cpe:2.3:o:securepoint:unified_threat_management:*:*:*:*:*:*:*:*,Securepoint,Unified Threat Management
CVE-2023-22621,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.76825,CWE-74,Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses the validation checks that should prevent code execution.,2023-04-19,Nuclei,cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*,Strapi,Strapi
CVE-2023-22629,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.12322,CWE-22,An issue was discovered in TitanFTP through 1.94.1205. The move-file function has a path traversal vulnerability in the newPath parameter. An authenticated attacker can upload any file and then move it anywhere on the server's filesystem.,2023-02-14,Nuclei,cpe:2.3:a:southrivertech:titan_ftp_server:*:*:*:*:*:*:*:*,Southrivertech,Titan Ftp Server
CVE-2023-22649,8.4,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H,0.01908,CWE-532,"A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. [Rancher Audit Logging](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log) is an opt-in feature, only deployments that have it enabled and have [AUDIT_LEVEL](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#audit-log-levels) set to `1 or above` are impacted by this issue.",2024-10-16,Metasploit,cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*;cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:undefined,Suse,Rancher
CVE-2023-2272,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0085,Missing_Data,"The Tiempo.com WordPress plugin through 0.1.2 does not sanitise and escape the page parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",2023-08-16,Nuclei,cpe:2.3:a:tiempo:tiempo:*:*:*:*:*:wordpress:*:*,Tiempo,Tiempo
CVE-2023-22809,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.55367,CWE-269,"In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a ""--"" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.",2023-01-18,Metasploit,cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*;cpe:2.3:a:sudo_project:sudo:1.9.12:-:*:*:*:*:*:*;cpe:2.3:a:sudo_project:sudo:1.9.12:p1:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2023-22893,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04158,CWE-287,Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.,2023-04-19,Nuclei,cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*,Strapi,Strapi
CVE-2023-22897,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.04074,CWE-908,"An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows information disclosure of memory contents to be achieved by an authenticated user. Essentially, uninitialized data can be retrieved via an approach in which a sessionid is obtained but not used.",2023-04-12,Nuclei,cpe:2.3:o:securepoint:unified_threat_management:*:*:*:*:*:*:*:*,Securepoint,Unified Threat Management
CVE-2023-22952,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.80274,CWE-20,"In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.",2023-01-11,CISA/Metasploit/Nuclei,cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:*:*:*:*,Sugarcrm,Sugarcrm
CVE-2023-23063,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02431,CWE-22,Cellinx NVT v1.0.6.002b was discovered to contain a local file disclosure vulnerability via the component /cgi-bin/GetFileContent.cgi.,2023-02-22,Nuclei,cpe:2.3:a:cellinx:nvt_web_server:1.0.6.002b:*:*:*:*:*:*:*,Cellinx,Nvt Web Server
CVE-2023-2309,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00845,Missing_Data,"The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a Reflected Cross-Site Scripting vulnerability.",2023-07-24,Nuclei,cpe:2.3:a:gvectors:wpforo_forum:*:*:*:*:*:wordpress:*:*,Gvectors,Wpforo Forum
CVE-2023-23161,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0591,CWE-79,A reflected cross-site scripting (XSS) vulnerability in Art Gallery Management System Project v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the artname parameter under ART TYPE option in the navigation bar.,2023-02-10,Nuclei,cpe:2.3:a:phpgurukul:art_gallery_management_system:1.0:*:*:*:*:*:*:*,Phpgurukul,Art Gallery Management System
CVE-2023-23333,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99273,CWE-77,"There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php.",2023-02-06,EPSS/Metasploit/Nuclei,cpe:2.3:h:contec:solarview_compact:-:*:*:*:*:*:*:*;cpe:2.3:o:contec:solarview_compact_firmware:*:*:*:*:*:*:*:*,Contec,Solarview Compact Firmware
CVE-2023-23376,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.10853,CWE-122,Windows Common Log File System Driver Elevation of Privilege Vulnerability,2023-02-14,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2023-23397,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97408,CWE-20,Microsoft Outlook Elevation of Privilege Vulnerability,2023-03-14,CISA/EPSS,cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*;cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:-:*:*:*;cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:rt:*:*:*;cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:*:*,Microsoft,365 Apps
CVE-2023-23488,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9246,CWE-89,"The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpro/v1/order' REST route.",2023-01-20,Metasploit/Nuclei,cpe:2.3:a:strangerstudios:paid_memberships_pro:*:*:*:*:*:wordpress:*:*,Strangerstudios,Paid Memberships Pro
CVE-2023-23489,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.11172,CWE-89,"The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of its 'edd_download_search' action.",2023-01-20,Nuclei,cpe:2.3:a:sandhillsdev:easy_digital_downloads:*:*:*:*:*:wordpress:*:*,Sandhillsdev,Easy Digital Downloads
CVE-2023-23491,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01179,CWE-79,"The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' parameter of its 'qem_ajax_calendar' action.",2023-01-20,Nuclei,cpe:2.3:a:fullworksplugins:quick_event_manager:*:*:*:*:*:wordpress:*:*,Fullworksplugins,Quick Event Manager
CVE-2023-23492,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.57123,CWE-89,"The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwp_forgot_password' action.",2023-01-20,Nuclei,cpe:2.3:a:idehweb:login_with_phone_number:*:*:*:*:*:wordpress:*:*,Idehweb,Login With Phone Number
CVE-2023-23529,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.09502,CWE-843,"A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, Safari 16.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.",2023-02-27,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2023-2356,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04119,CWE-23,Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1.,2023-04-28,Nuclei,cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*,Lfprojects,Mlflow
CVE-2023-23752,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.99827,NVD-CWE-Other,An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.,2023-02-16,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*,Joomla,Joomla!
CVE-2023-23897,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N,0.0161,CWE-352,Cross-Site Request Forgery (CSRF) vulnerability in Ozette Plugins Simple Mobile URL Redirect plugin <= 1.7.2 versions.,2023-07-10,Nuclei,cpe:2.3:a:ozette:simple_mobile_url_redirect:*:*:*:*:*:wordpress:*:*,Ozette,Simple Mobile Url Redirect
CVE-2023-24000,8.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L,0.0257,CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GamiPress gamipress allows SQL Injection.This issue affects GamiPress: from n/a through 2.5.7.,2023-10-31,Nuclei,cpe:2.3:a:gamipress:gamipress:*:*:*:*:*:wordpress:*:*,Gamipress,Gamipress
CVE-2023-24243,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03995,CWE-918,CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery (SSRF).,2023-06-16,Nuclei,cpe:2.3:a:cdata:arc:*:*:*:*:*:*:*:*,Cdata,Arc
CVE-2023-24278,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02908,CWE-79,Squidex before 7.4.0 was discovered to contain a squid.svg cross-site scripting (XSS) vulnerability.,2023-03-18,Nuclei,cpe:2.3:a:squidex.io:squidex:*:*:*:*:*:*:*:*,Squidex.Io,Squidex
CVE-2023-24322,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.31714,CWE-79,A reflected cross-site scripting (XSS) vulnerability in the FileDialog.aspx component of mojoPortal v2.7.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ed and tbi parameters.,2023-02-09,Nuclei,cpe:2.3:a:mojoportal:mojoportal:2.7.0.0:*:*:*:*:*:*:*,Mojoportal,Mojoportal
CVE-2023-2437,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06801,CWE-288,"The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email. An attacker can leverage CVE-2023-2448 and CVE-2023-2446 to get the user's email address to successfully exploit this vulnerability.",2023-11-22,Nuclei,cpe:2.3:a:userproplugin:userpro:*:*:*:*:*:wordpress:*:*,Userproplugin,Userpro
CVE-2023-2442,8.7,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N,0.96058,CWE-79,"An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims.",2023-06-07,EPSS,cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*;cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*,Gitlab,Gitlab
CVE-2023-24488,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.80907,CWE-79,Cross site scripting vulnerability in Citrix ADC and Citrix Gateway  in allows and attacker to perform cross site scripting,2023-07-10,Nuclei,cpe:2.3:a:citrix:application_delivery_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:citrix:application_delivery_controller:*:*:*:*:-:*:*:*;cpe:2.3:a:citrix:application_delivery_controller:*:*:*:*:fips:*:*:*;cpe:2.3:a:citrix:application_delivery_controller:*:*:*:*:ndcpp:*:*:*;cpe:2.3:a:citrix:gateway:*:*:*:*:*:*:*:*,Citrix,Gateway
CVE-2023-24489,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.95076,CWE-284,"A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller.",2023-07-10,CISA/EPSS/Nuclei,cpe:2.3:a:citrix:sharefile_storage_zones_controller:*:*:*:*:*:*:*:*,Citrix,Sharefile Storage Zones Controller
CVE-2023-24657,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03904,CWE-79,phpipam v1.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the closeClass parameter at /subnet-masks/popup.php.,2023-03-08,Nuclei,cpe:2.3:a:phpipam:phpipam:1.6:*:*:*:*:*:*:*,Phpipam,Phpipam
CVE-2023-24733,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01169,CWE-79,PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /admin/convert/export_z3950_new.php.,2023-03-06,Nuclei,cpe:2.3:a:sigb:pmb:7.4.6:*:*:*:*:*:*:*,Sigb,Pmb
CVE-2023-24735,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0108,CWE-601,PMB v7.4.6 was discovered to contain an open redirect vulnerability via the component /opac_css/pmb.php. This vulnerability allows attackers to redirect victim users to an external domain via a crafted URL.,2023-03-06,Nuclei,cpe:2.3:a:sigb:pmb:7.4.6:*:*:*:*:*:*:*,Sigb,Pmb
CVE-2023-24737,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01169,CWE-79,PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /admin/convert/export_z3950.php.,2023-03-06,Nuclei,cpe:2.3:a:sigb:pmb:7.4.6:*:*:*:*:*:*:*,Sigb,Pmb
CVE-2023-2479,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.22014,CWE-78,OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4.,2023-05-02,Nuclei,cpe:2.3:a:appium:appium-desktop:*:*:*:*:*:*:*:*,Appium,Appium-Desktop
CVE-2023-24880,4.4,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L,0.78152,CWE-863,Windows SmartScreen Security Feature Bypass Vulnerability,2023-03-14,CISA,cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1607
CVE-2023-24955,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.85395,CWE-94,Microsoft SharePoint Server Remote Code Execution Vulnerability,2023-05-09,CISA/Metasploit,cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:-:*:*:*:subscription:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*,Microsoft,Sharepoint Enterprise Server
CVE-2023-25135,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.23926,CWE-502,"vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors. The fixed versions are 5.6.7 PL1, 5.6.8 PL1, and 5.6.9 PL1.",2023-02-03,Nuclei,cpe:2.3:a:vbulletin:vbulletin:5.6.7:-:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.6.8:-:*:*:*:*:*:*;cpe:2.3:a:vbulletin:vbulletin:5.6.9:-:*:*:*:*:*:*,Vbulletin,Vbulletin
CVE-2023-25157,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.85247,CWE-89,"GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols.  CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should disable the PostGIS Datastore *encode functions* setting to mitigate ``strEndsWith``, ``strStartsWith`` and ``PropertyIsLike `` misuse and enable the PostGIS DataStore *preparedStatements* setting to mitigate the ``FeatureId`` misuse.",2023-02-21,Nuclei,cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*,Osgeo,Geoserver
CVE-2023-2518,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01092,Missing_Data,"The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape a parameter before outputting it back in the page when the debug option is enabled, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2023-05-30,Nuclei,cpe:2.3:a:yikesinc:easy_forms_for_mailchimp:*:*:*:*:*:wordpress:*:*,Yikesinc,Easy Forms For Mailchimp
CVE-2023-25194,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.9581,CWE-502,"A possible security vulnerability has been identified in Apache Kafka Connect API.
This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config
and a SASL-based security protocol, which has been possible on Kafka Connect clusters since Apache Kafka Connect 2.3.0.
When configuring the connector via the Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config`
property for any of the connector's Kafka clients to ""com.sun.security.auth.module.JndiLoginModule"", which can be done via the
`producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties.
This will allow the server to connect to the attacker's LDAP server
and deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafka connect server.
Attacker can cause unrestricted deserialization of untrusted data (or) RCE vulnerability when there are gadgets in the classpath.

Since Apache Kafka 3.0.0, users are allowed to specify these properties in connector configurations for Kafka Connect clusters running with out-of-the-box
configurations. Before Apache Kafka 3.0.0, users may not specify these properties unless the Kafka Connect cluster has been reconfigured with a connector
client override policy that permits them.

Since Apache Kafka 3.4.0, we have added a system property (""-Dorg.apache.kafka.disallowed.login.modules"") to disable the problematic login modules usage
in SASL JAAS configuration. Also by default ""com.sun.security.auth.module.JndiLoginModule"" is disabled in Apache Kafka Connect 3.4.0. 

We advise the Kafka Connect users to validate connector configurations and only allow trusted JNDI configurations. Also examine connector dependencies for 
vulnerable versions and either upgrade their connectors, upgrading that specific dependency, or removing the connectors as options for remediation. Finally,
in addition to leveraging the ""org.apache.kafka.disallowed.login.modules"" system property, Kafka Connect users can also implement their own connector
client config override policy, which can be used to control which Kafka client properties can be overridden directly in a connector config and which cannot.
",2023-02-07,EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:kafka_connect:*:*:*:*:*:*:*:*,Apache,Kafka Connect
CVE-2023-25280,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97864,CWE-78,OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.,2023-03-16,CISA/EPSS/Nuclei,cpe:2.3:h:dlink:dir-820l:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-820l_firmware:1.05b03:*:*:*:*:*:*:*,D-Link,Dir-820L Firmware
CVE-2023-2533,8.4,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H,0.29246,CWE-352,"A Cross-Site Request Forgery (CSRF) vulnerability has been identified in
PaperCut NG/MF, which, under specific conditions, could potentially enable
an attacker to alter security settings or execute arbitrary code. This could
be exploited if the target is an admin with a current login session. Exploiting
this would typically involve the possibility of deceiving an admin into clicking
a specially crafted malicious link, potentially leading to unauthorized changes.",2023-06-20,CISA,cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*;cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*,Papercut,Papercut Mf
CVE-2023-25346,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01524,CWE-79,A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /churchcrm/v2/family/not-found.,2023-04-25,Nuclei,cpe:2.3:a:churchcrm:churchcrm:4.5.3:*:*:*:*:*:*:*,Churchcrm,Churchcrm
CVE-2023-25573,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.49851,CWE-862,"metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in `/api/jmeter/download/files`, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This issue has been addressed in version 1.20.20 lts and 2.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.",2023-03-09,Nuclei,cpe:2.3:a:metersphere:metersphere:*:*:*:*:*:*:*:*,Metersphere,Metersphere
CVE-2023-25717,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98069,CWE-94,"Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.",2023-02-13,CISA/EPSS/Nuclei,cpe:2.3:a:ruckuswireless:ruckus_wireless_admin:*:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:e510:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:h320:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:h350:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:h500:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:h510:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:h550:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:m510-jp:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:m510:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:p300:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:q410:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:q710:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:q910:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:r300:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:r310:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:r320:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:r350:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:r500:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:r510:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:r550:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:r560:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:r600:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:r610:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:r650:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:r700:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:r710:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:r720:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:r730:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:r750:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:r760:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:r850:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:sz-144-federal:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:sz-144:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:sz100:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:sz300-federal:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:sz300:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:t300:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:t301n:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:t301s:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:t310c:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:t310d:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:t310n:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:t310s:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:t350c:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:t350d:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:t350se:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:t504:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:t610:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:t710:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:t710s:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:t750:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:t750se:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:t811-cm:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:t811-cm\(non-spf\):-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:zd1000:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:zd1100:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:zd1200:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:zd3000:-:*:*:*:*:*:*:*;cpe:2.3:h:ruckuswireless:zd5000:-:*:*:*:*:*:*:*;cpe:2.3:o:commscope:ruckus_smartzone_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:commscope:ruckus_smartzone_firmware:6.1.0.0.935:*:*:*:*:*:*:*;cpe:2.3:o:ruckuswireless:smartzone_ap:*:*:*:*:*:*:*:*,Commscope,Ruckus Smartzone Firmware
CVE-2023-25826,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.35604,CWE-78,"Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that was made when this vulnerability was previously disclosed as CVE-2020-35476. Regex validation that was implemented to restrict allowed input to the query API does not work as intended, allowing crafted commands to bypass validation.",2023-05-03,Metasploit,cpe:2.3:a:opentsdb:opentsdb:*:*:*:*:*:*:*:*,Opentsdb,Opentsdb
CVE-2023-26035,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.80462,CWE-862,"ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. There are no permissions check on the snapshot action, which expects an id to fetch an existing monitor but can be passed an object to create a new one instead. TriggerOn ends up calling shell_exec using the supplied Id. This issue is fixed in This issue is fixed in versions 1.36.33 and 1.37.33.",2023-02-25,Metasploit/Nuclei,cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*,Zoneminder,Zoneminder
CVE-2023-26067,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.37835,CWE-20,Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4).,2023-04-10,Nuclei,cpe:2.3:h:lexmark:b2236:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:b2338:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:b2442:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:b2546:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:b2650:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:b2865:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:b3340:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:b3442:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:c2325:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:c2326:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:c2425:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:c2535:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:c3224:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:c3326:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:c3426:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:c4150:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:c6160:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:c923:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs331:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs421:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs431:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs439:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs521:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs720:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs725:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs727:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs728:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs820:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs827:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs921:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs923:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs927:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs943:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx421:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx431:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx522:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx622:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx625:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx725:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx727:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx730:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx735:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx820:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx825:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx827:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx86:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx920:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx921:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx922:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx923:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx924:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx930:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx931:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx942:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx943:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx944:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:m1242:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:m1246:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:m1342:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:m3250:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:m5255:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:m5270:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mb2236:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mb2338:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mb2442:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mb2546:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mb2650:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mb2770:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mb3442:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mc2325:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mc2425:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mc2535:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mc2640:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mc3224:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mc3326:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mc3426:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms321:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms331:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms421:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms431:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms439:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms521:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms621:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms622:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms725:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms821:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms822:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms823:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms825:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms826:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx321:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx331:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx421:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx431:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx432:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx521:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx522:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx622:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx721:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx722:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx725:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx822:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx826:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx931:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc2235:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc2326:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc4140:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc4143:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc4150:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc4153:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc4240:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc4342:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc4352:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc6152:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc6153:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc8155:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc8160:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc8163:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc9225:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc9235:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc9245:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc9255:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc9265:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc9325:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc9335:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc9445:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc9455:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc9465:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xm1242:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xm1246:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xm1342:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xm3142:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xm3250:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xm5365:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xm5370:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xm7355:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xm7370:-:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cslbl_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cslbn_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:csnzj_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cstat_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cstmh_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cstpc_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cxlbl_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cxlbn_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cxnzj_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cxtat_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cxtmm_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cxtpc_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cxtpp_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cxtzj_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:mslbd_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:mslsg_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:msngm_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:msngw_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:mstgw_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:mxlbd_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:mxlsg_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:mxngm_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:mxtct_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:mxtgm_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:mxtgw_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:mxtpm_firmware:*:*:*:*:*:*:*:*,Lexmark,Cxtpc Firmware
CVE-2023-26068,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.11634,CWE-20,Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4).,2023-04-10,Metasploit,cpe:2.3:h:lexmark:b2236:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:b2338:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:b2442:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:b2546:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:b2650:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:b2865:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:b3340:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:b3442:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:c2325:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:c2326:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:c2425:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:c2535:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:c3224:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:c3326:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:c3426:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:c4150:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:c6160:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs331:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs421:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs431:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs439:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs521:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs720:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs725:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs727:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs728:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs820:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs827:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs921:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs923:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs927:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cs943:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx421:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx431:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx522:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx622:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx625:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx725:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx727:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx730:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx735:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx820:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx825:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx827:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx86:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx930:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx931:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx942:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx943:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:cx944:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:m1242:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:m1246:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:m1342:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:m3250:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:m5255:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:m5270:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mb2236:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mb2338:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mb2442:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mb2546:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mb2650:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mb2770:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mb3442:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mc2325:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mc2425:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mc2535:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mc2640:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mc3224:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mc3326:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mc3426:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms321:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms331:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms421:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms431:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms439:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms521:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms621:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms622:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms725:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms821:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms822:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms823:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms825:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:ms826:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx321:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx331:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx421:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx431:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx432:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx521:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx522:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx622:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx721:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx722:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx725:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx822:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx826:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:mx931:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc2235:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc2326:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc4140:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc4143:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc4150:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc4153:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc4240:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc4342:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc4352:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc6152:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc6153:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc8155:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc8160:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc8163:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc9325:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc9335:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc9445:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc9455:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xc9465:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xm1242:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xm1246:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xm1342:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xm3142:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xm3250:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xm5365:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xm5370:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xm7355:-:*:*:*:*:*:*:*;cpe:2.3:h:lexmark:xm7370:-:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cslbl_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cslbn_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:csnzj_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cstat_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cstmh_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cstpc_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cxlbl_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cxlbn_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cxnzj_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cxtat_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cxtmm_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cxtpc_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cxtpp_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:cxtzj_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:mslbd_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:mslsg_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:msngm_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:msngw_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:mstgw_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:mxlbd_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:mxlsg_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:mxngm_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:mxtct_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:mxtgm_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:mxtgw_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:lexmark:mxtpm_firmware:*:*:*:*:*:*:*:*,Lexmark,Cxtpc Firmware
CVE-2023-26083,3.3,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N,0.01429,CWE-401,"Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from r0p0 - r42p0, Valhall GPU Kernel Driver all versions from r19p0 - r42p0, and Avalon GPU Kernel Driver all versions from r41p0 - r42p0 allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.",2023-04-06,CISA,cpe:2.3:a:arm:5th_gen_gpu_architecture_kernel_driver:*:*:*:*:*:*:*:*;cpe:2.3:a:arm:bifrost_gpu_kernel_driver:*:*:*:*:*:*:*:*;cpe:2.3:a:arm:midgard_gpu_kernel_driver:*:*:*:*:*:*:*:*;cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:*,Arm,5Th Gen Gpu Architecture Kernel Driver
CVE-2023-2624,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01156,Missing_Data,"The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrator",2023-06-27,Nuclei,cpe:2.3:a:iqonic:kivicare:*:*:*:*:*:wordpress:*:*,Iqonic,Kivicare
CVE-2023-26255,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.47199,CWE-22,"An unauthenticated path traversal vulnerability affects the ""STAGIL Navigation for Jira - Menu & Themes"" plugin before 2.0.52 for Jira. By modifying the fileName parameter to the snjCustomDesignConfig endpoint, it is possible to traverse and read the file system.",2023-02-28,Nuclei,cpe:2.3:a:stagil:stagil_navigation:*:*:*:*:*:jira:*:*,Stagil,Stagil Navigation
CVE-2023-26256,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.11615,CWE-22,"An unauthenticated path traversal vulnerability affects the ""STAGIL Navigation for Jira - Menu & Themes"" plugin before 2.0.52 for Jira. By modifying the fileName parameter to the snjFooterNavigationConfig endpoint, it is possible to traverse and read the file system.",2023-02-28,Nuclei,cpe:2.3:a:stagil:stagil_navigation:*:*:*:*:*:jira:*:*,Stagil,Stagil Navigation
CVE-2023-26258,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.37715,CWE-863,Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at WebServiceImpl/services/FlashServiceImpl leaks the AuthUUID token. This token can be used at /WebServiceImpl/services/VirtualStandbyServiceImpl to obtain a valid session. This session can be used to execute any task as administrator.,2023-07-03,Nuclei,cpe:2.3:a:arcserve:udp:*:*:*:*:*:*:*:*,Arcserve,Udp
CVE-2023-26347,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.10072,CWE-284,Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.,2023-11-17,Nuclei,cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update10:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update11:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update7:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update8:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update9:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*,Adobe,Coldfusion
CVE-2023-26359,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.17937,CWE-502,Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.,2023-03-23,CISA,cpe:2.3:a:adobe:coldfusion:2018:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update10:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update11:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update12:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update13:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update14:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update15:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update7:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update8:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update9:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*,Adobe,Coldfusion
CVE-2023-26360,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.97339,CWE-284,Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.,2023-03-23,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:adobe:coldfusion:2018:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update10:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update11:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update12:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update13:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update14:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update15:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update7:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update8:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update9:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*,Adobe,Coldfusion
CVE-2023-26369,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.07036,CWE-787,"Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",2023-09-13,CISA,cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:*;cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*;cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:*;cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Apple,Macos
CVE-2023-2640,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.15783,CWE-863,"On Ubuntu kernels carrying both c914c0e27eb0 and ""UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs"", an unprivileged user may set privileged extended attributes on the mounted files, leading them to be set on the upper files without the appropriate security checks.",2023-07-26,Metasploit,cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2023-26469,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.81918,CWE-22,"In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.",2023-08-17,Metasploit/Nuclei,cpe:2.3:a:jorani:jorani:1.0.0:*:*:*:*:*:*:*,Jorani,Jorani
CVE-2023-2648,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.28478,CWE-434,A vulnerability was found in Weaver E-Office 9.5. It has been classified as critical. This affects an unknown part of the file /inc/jquery/uploadify/uploadify.php. The manipulation of the argument Filedata leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-228777 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2023-05-11,Nuclei,cpe:2.3:a:weaver:e-office:9.5:*:*:*:*:*:*:*,Weaver,E-Office
CVE-2023-26482,9.0,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H,0.04176,CWE-78,"Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are designed to be only available for administrators. Some workflows are designed to be RCE by invoking defined scripts, in order to generate PDFs, invoking webhooks or running scripts on the server. Due to this combination depending on the available apps the issue can result in a RCE at the end. It is recommended that the Nextcloud Server is upgraded to 24.0.10 or 25.0.4. Users unable to upgrade should disable app `workflow_scripts` and `workflow_pdf_converter` as a mitigation.",2023-03-30,Metasploit,cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*;cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*,Nextcloud,Nextcloud Server
CVE-2023-26802,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.4871,CWE-22,An issue in the component /network_config/nsg_masq.cgi of DCN (Digital China Networks) DCBI-Netlog-LAB v1.0 allows attackers to bypass authentication and execute arbitrary commands via a crafted request.,2023-03-26,Nuclei,cpe:2.3:h:dcnglobal:dcbi-netlog-lab:-:*:*:*:*:*:*:*;cpe:2.3:o:dcnglobal:dcbi-netlog-lab_firmware:1.0:*:*:*:*:*:*:*,Dcnglobal,Dcbi-Netlog-Lab Firmware
CVE-2023-26842,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01409,CWE-79,A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the OptionManager.php.,2023-05-31,Nuclei,cpe:2.3:a:churchcrm:churchcrm:4.5.3:*:*:*:*:*:*:*,Churchcrm,Churchcrm
CVE-2023-26843,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.0142,CWE-79,A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php.,2023-04-25,Nuclei,cpe:2.3:a:churchcrm:churchcrm:4.5.3:*:*:*:*:*:*:*,Churchcrm,Churchcrm
CVE-2023-26876,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.09725,CWE-89,SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admin.php?page=history&filter_image_id=&filter_user_id endpoint.,2023-04-21,Metasploit,cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*,Piwigo,Piwigo
CVE-2023-27008,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01499,CWE-79,A Cross-site scripting (XSS) vulnerability in the function encrypt_password() in login.tmpl.php in ATutor 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter.,2023-03-28,Nuclei,cpe:2.3:a:atutor:atutor:2.2.1:*:*:*:*:*:*:*,Atutor,Atutor
CVE-2023-27032,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03015,CWE-89,Prestashop advancedpopupcreator v1.1.21 to v1.1.24 was discovered to contain a SQL injection vulnerability via the component AdvancedPopup::getPopups().,2023-04-12,Nuclei,"cpe:2.3:a:idnovate:popup_module_\(on_entering\,_exit_popup\,_add_product\)_and_newsletter:*:*:*:*:*:prestashop:*:*",Idnovate,"Popup Module (On Entering, Exit Popup, Add Product) And Newsletter"
CVE-2023-27034,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.58743,CWE-89,PrestaShop jmsblog 2.5.5 was discovered to contain a SQL injection vulnerability.,2023-03-23,Nuclei,cpe:2.3:a:joommasters:jms_blog:2.5.5:*:*:*:*:prestashop:*:*;cpe:2.3:a:joommasters:jms_blog:2.5.6:*:*:*:*:prestashop:*:*,Joommasters,Jms Blog
CVE-2023-27159,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.36171,CWE-918,Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.,2023-03-31,Nuclei,cpe:2.3:a:appwrite:appwrite:*:*:*:*:*:*:*:*,Appwrite,Appwrite
CVE-2023-27163,6.5,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N,0.06976,CWE-918,request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.,2023-03-31,Nuclei,cpe:2.3:a:rbaskets:request_baskets:*:*:*:*:*:*:*:*,Rbaskets,Request Baskets
CVE-2023-27179,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.60793,CWE-434,GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /_admin/imgdownload.php.,2023-04-11,Nuclei,cpe:2.3:a:gdidees:gdidees_cms:*:*:*:*:*:*:*:*,Gdidees,Gdidees Cms
CVE-2023-27253,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.89505,CWE-91,A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file supplied to the component config.xml.,2023-03-17,Metasploit,cpe:2.3:a:netgate:pfsense:2.7.0:*:*:*:*:*:*:*,Netgate,Pfsense
CVE-2023-27292,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01027,CWE-601,An open redirect vulnerability exposes OpenCATS to template injection due to improper validation of user-supplied GET parameters.,2023-02-28,Nuclei,cpe:2.3:a:opencats:opencats:0.9.6:*:*:*:*:*:*:*,Opencats,Opencats
CVE-2023-2732,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.67511,CWE-288,"The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.",2023-05-25,Nuclei,cpe:2.3:a:inspireui:mstore_api:*:*:*:*:*:wordpress:*:*,Inspireui,Mstore Api
CVE-2023-2734,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03805,CWE-288,"The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from mobile REST API request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.",2023-05-25,Nuclei,cpe:2.3:a:inspireui:mstore_api:*:*:*:*:*:wordpress:*:*,Inspireui,Mstore Api
CVE-2023-27350,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99999,CWE-284,This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.,2023-04-20,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*;cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*,Papercut,Papercut Mf
CVE-2023-27351,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.77388,CWE-287,This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.,2023-04-20,CISA/Nuclei,cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*;cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*,Papercut,Papercut Mf
CVE-2023-27372,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99637,NVD-CWE-noinfo,"SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.",2023-02-28,EPSS/Metasploit/Nuclei,cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*;cpe:2.3:a:spip:spip:4.2.0:-:*:*:*:*:*:*;cpe:2.3:a:spip:spip:4.2.0:alpha2:*:*:*:*:*:*;cpe:2.3:a:spip:spip:4.2.0:alpha:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2023-2745,5.4,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N,0.79527,CWE-22,"WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.",2023-05-17,Nuclei,cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*;cpe:2.3:a:wordpress:wordpress:6.2:*:*:*:*:*:*:*,Wordpress,Wordpress
CVE-2023-27482,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.70199,CWE-287,"homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Home Assistant has been discovered. This impacts all Home Assistant installation types that use the Supervisor 2023.01.1 or older. Installation types, like Home Assistant Container (for example Docker), or Home Assistant Core manually in a Python environment, are not affected. The issue has been mitigated and closed in Supervisor version 2023.03.1, which has been rolled out to all affected installations via the auto-update feature of the Supervisor. This rollout has been completed at the time of publication of this advisory. Home Assistant Core 2023.3.0 included mitigation for this vulnerability. Upgrading to at least that version is thus advised. In case one is not able to upgrade the Home Assistant Supervisor or the Home Assistant Core application at this time, it is advised to not expose your Home Assistant instance to the internet.",2023-03-08,Nuclei,cpe:2.3:a:home-assistant:home-assistant:*:*:*:*:*:*:*:*;cpe:2.3:a:home-assistant:supervisor:*:*:*:*:*:*:*:*,Home-Assistant,Home-Assistant
CVE-2023-27524,8.9,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L,0.97405,CWE-1188,"Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.

All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database.
Add a strong SECRET_KEY to your `superset_config.py` file like:

SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY>

Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.",2023-04-24,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*,Apache,Superset
CVE-2023-27532,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.7761,CWE-306,Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.,2023-03-10,CISA,cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:*;cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:-:*:*:*:*:*:*;cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20211123:*:*:*:*:*:*;cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20211211:*:*:*:*:*:*;cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20220302:*:*:*:*:*:*;cpe:2.3:a:veeam:veeam_backup_\&_replication:12.0.0.1420:-:*:*:*:*:*:*,Veeam,Veeam Backup & Replication
CVE-2023-27584,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.33618,CWE-321,"Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation (CNCF) as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, ""Secret Key"", is hard coded, which leads to authentication bypass. An attacker can perform any action as a user with admin privileges. This issue has been addressed in release version 2.0.9. All users are advised to upgrade. There are no known workarounds for this vulnerability.",2024-09-19,Nuclei,cpe:2.3:a:linuxfoundation:dragonfly:*:*:*:*:*:go:*:*,Linuxfoundation,Dragonfly
CVE-2023-27587,7.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N,0.03857,CWE-209,"ReadtoMyShoe, a web app that lets users upload articles and listen to them later, generates an error message containing sensitive information prior to commit 8533b01. If an error occurs when adding an article, the website shows the user an error message. If the error originates from the Google Cloud TTS request, then it will include the full URL of the request. The request URL contains the Google Cloud API key. This has been patched in commit 8533b01. Upgrading should be accompanied by deleting the current GCP API key and issuing a new one. There are no known workarounds.",2023-03-13,Nuclei,cpe:2.3:a:readtomyshoe_project:readtomyshoe:*:*:*:*:*:*:*:*,Readtomyshoe Project,Readtomyshoe
CVE-2023-27624,5.9,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L,0.00619,CWE-79,Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marcelotorres Redirect After Login plugin <= 0.1.9 versions.,2023-06-13,Nuclei,cpe:2.3:a:redirect_after_login_project:redirect_after_login:*:*:*:*:*:wordpress:*:*,Redirect After Login Project,Redirect After Login
CVE-2023-27637,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03299,CWE-89,"An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised product_id GET parameter in order to exploit an insecure parameter in the front controller file designer.php, which could lead to a SQL injection. This is exploited in the wild in March 2023.",2023-03-22,Nuclei,cpe:2.3:a:tshirtecommerce:custom_product_designer:2.1.4:*:*:*:*:prestashop:*:*,Tshirtecommerce,Custom Product Designer
CVE-2023-27638,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03299,CWE-89,"An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised tshirtecommerce_design_cart_id GET parameter in order to exploit an insecure parameter in the functions hookActionCartSave and updateCustomizationTable, which could lead to a SQL injection. This is exploited in the wild in March 2023.",2023-03-22,Nuclei,cpe:2.3:a:tshirtecommerce:custom_product_designer:2.1.4:*:*:*:*:prestashop:*:*,Tshirtecommerce,Custom Product Designer
CVE-2023-27639,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03551,CWE-22,"An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with the POST parameter file_name in the tshirtecommerce/ajax.php?type=svg endpoint, to allow a remote attacker to traverse directories on the system in order to open files (without restriction on the extension and path). Only files that can be parsed in XML can be opened. This is exploited in the wild in March 2023.",2023-06-01,Nuclei,cpe:2.3:a:tshirtecommerce:custom_product_designer:*:*:*:*:*:prestashop:*:*,Tshirtecommerce,Custom Product Designer
CVE-2023-27640,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03573,CWE-22,"An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with the POST parameter type in the /tshirtecommerce/fonts.php endpoint, to allow a remote attacker to traverse directories on the system in order to open files (without restriction on the extension and path). The content of the file is returned with base64 encoding. This is exploited in the wild in March 2023.",2023-06-01,Nuclei,cpe:2.3:a:tshirtecommerce:custom_product_designer:*:*:*:*:*:prestashop:*:*,Tshirtecommerce,Custom Product Designer
CVE-2023-27641,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01092,CWE-79,The REPORT (after z but before a) parameter in wa.exe in L-Soft LISTSERV 16.5 before 17 allows an attacker to conduct XSS attacks via a crafted URL.,2023-03-05,Nuclei,cpe:2.3:a:lsoft:listserv:*:*:*:*:*:*:*:*,Lsoft,Listserv
CVE-2023-2766,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.54232,CWE-552,A vulnerability was found in Weaver OA 9.5 and classified as problematic. This issue affects some unknown processing of the file /building/backmgr/urlpage/mobileurl/configfile/jx2_config.ini. The manipulation leads to files or directories accessible. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229271. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2023-05-17,Nuclei,cpe:2.3:a:weaver:e-office:9.5:*:*:*:*:*:*:*,Weaver,E-Office
CVE-2023-2779,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.05991,Missing_Data,"The Social Share, Social Login and Social Comments WordPress plugin before 7.13.52 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2023-06-19,Nuclei,"cpe:2.3:a:heator:social_share\,_social_login_and_social_comments:*:*:*:*:*:wordpress:*:*",Heator,"Social Share, Social Login And Social Comments"
CVE-2023-2780,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06311,CWE-29,Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1.,2023-05-17,Nuclei,cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*,Lfprojects,Mlflow
CVE-2023-27847,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04715,CWE-89,SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategoryclass and xippostsclass components.,2023-03-27,Nuclei,cpe:2.3:a:xipblog_project:xipblog:*:*:*:*:*:prestashop:*:*,Xipblog Project,Xipblog
CVE-2023-27855,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.13451,CWE-22,"
In affected versions, a path traversal exists when processing a message in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker could potentially exploit this vulnerability to upload arbitrary files to any directory on the disk drive where ThinServer.exe is installed. The attacker could overwrite existing executable files with attacker-controlled, malicious contents, potentially causing remote code execution. 

",2023-03-22,Metasploit,cpe:2.3:a:rockwellautomation:thinmanager:*:*:*:*:*:*:*:*;cpe:2.3:a:rockwellautomation:thinmanager:13.0.0:*:*:*:*:*:*:*;cpe:2.3:a:rockwellautomation:thinmanager:13.0.1:*:*:*:*:*:*:*,Rockwellautomation,Thinmanager
CVE-2023-27856,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.77225,CWE-22,"


In affected versions, path traversal exists when processing a message of type 8

 in Rockwell Automation's ThinManager ThinServer. 

An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.exe is installed.

 

",2023-03-22,Metasploit,cpe:2.3:a:rockwellautomation:thinmanager:*:*:*:*:*:*:*:*;cpe:2.3:a:rockwellautomation:thinmanager:13.0.0:*:*:*:*:*:*:*;cpe:2.3:a:rockwellautomation:thinmanager:13.0.1:*:*:*:*:*:*:*,Rockwellautomation,Thinmanager
CVE-2023-27922,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01198,CWE-79,Cross-site scripting vulnerability in Newsletter versions prior to 7.6.9 allows a remote unauthenticated attacker to inject an arbitrary script.,2023-05-23,Nuclei,cpe:2.3:a:thenewsletterplugin:newsletter:*:*:*:*:*:wordpress:*:*,Thenewsletterplugin,Newsletter
CVE-2023-2796,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.42674,CWE-862,"The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id.",2023-07-10,Nuclei,cpe:2.3:a:myeventon:eventon:*:*:*:*:*:wordpress:*:*,Myeventon,Eventon
CVE-2023-27992,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.84195,CWE-78,"The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.",2023-06-19,CISA,cpe:2.3:h:zyxel:nas326:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:nas540:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:nas542:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:nas326_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:nas540_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:nas542_firmware:*:*:*:*:*:*:*:*,Zyxel,Nas326 Firmware
CVE-2023-27997,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.85689,CWE-122,"A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.",2023-06-13,CISA,cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*;cpe:2.3:h:fortinet:fortigate_6000:-:*:*:*:*:*:*:*;cpe:2.3:h:fortinet:fortigate_7000:-:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:6.0.10:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:6.2.4:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:6.2.6:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:6.2.7:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*,Fortinet,Fortios
CVE-2023-28121,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.86919,CWE-287,"An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.",2023-04-12,Metasploit/Nuclei,cpe:2.3:a:automattic:woocommerce_payments:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:automattic:woopayments:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:automattic:woopayments:4.9.0:*:*:*:*:wordpress:*:*;cpe:2.3:a:automattic:woopayments:5.3.0:*:*:*:*:wordpress:*:*;cpe:2.3:a:automattic:woopayments:5.4.0:*:*:*:*:wordpress:*:*,Automattic,Woocommerce Payments
CVE-2023-28128,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.84697,CWE-434,An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution.,2023-05-09,Metasploit,cpe:2.3:a:ivanti:avalanche:*:*:*:*:*:*:*:*,Ivanti,Avalanche
CVE-2023-2813,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00972,Missing_Data,"All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPress theme before 1.1.13, Atlast Business WordPress theme through 1.5.8.5, Bazaar Lite WordPress theme before 1.8.6, Brain Power WordPress theme through 1.2, BunnyPressLite WordPress theme before 2.1, Cafe Bistro WordPress theme before 1.1.4, College WordPress theme before 1.5.1, Connections Reloaded WordPress theme through 3.1, Counterpoint WordPress theme through 1.8.1, Digitally WordPress theme through 1.0.8, Directory WordPress theme before 3.0.2, Drop WordPress theme before 1.22, Everse WordPress theme before 1.2.4, Fashionable Store WordPress theme through 1.3.4, Fullbase WordPress theme before 1.2.1, Ilex WordPress theme before 1.4.2, Js O3 Lite WordPress theme through 1.5.8.2, Js Paper WordPress theme through 2.5.7, Kata WordPress theme before 1.2.9, Kata App WordPress theme through 1.0.5, Kata Business WordPress theme through 1.0.2, Looki Lite WordPress theme before 1.3.0, moseter WordPress theme through 1.3.1, Nokke WordPress theme before 1.2.4, Nothing Personal WordPress theme through 1.0.7, Offset Writing WordPress theme through 1.2, Opor Ayam WordPress theme through 18, Pinzolo WordPress theme before 1.2.10, Plato WordPress theme before 1.1.9, Polka Dots WordPress theme through 1.2, Purity Of Soul WordPress theme through 1.9, Restaurant PT WordPress theme before 1.1.3, Saul WordPress theme before 1.1.0, Sean Lite WordPress theme before 1.4.6, Tantyyellow WordPress theme through 1.0.0.5, TIJAJI WordPress theme through 1.43, Tiki Time WordPress theme through 1.3, Tuaug4 WordPress theme through 1.4, Tydskrif WordPress theme through 1.1.3, UltraLight WordPress theme through 1.2, Venice Lite WordPress theme before 1.5.5, Viala WordPress theme through 1.3.1, viburno WordPress theme before 1.3.2, Wedding Bride WordPress theme before 1.0.2, Wlow WordPress theme before 1.2.7 suffer from the same issue about the search box reflecting the results causing XSS which allows an unauthenticated attacker to exploit against users if they click a malicious link.",2023-09-04,Nuclei,cpe:2.3:a:ajaydsouza:connections_reloaded:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:archimidismertzanos:atlast_business:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:archimidismertzanos:fashionable_store:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:archimidismertzanos:nothing_personal:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:arthousewebdesign:brain_power:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:asmedia:moseter:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:asmedia:tuaug4:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:ayecode:cafe_bistro:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:ayecode:college:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:ayecode:directory:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:ayecode:plato:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:ayecode:restaurant_pt:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:ayecode:wedding_bride:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:climaxthemes:kata:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:competethemes:drop:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:davidgarlitz:viala:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:deothemes:arendelle:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:deothemes:everse:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:deothemes:nokke:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:dotecsa:ilex:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:dotecsa:viburno:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:fredriksoerlie:ultralight:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:fyrewurks:polka_dots:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:fyrewurks:tiki_time:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:henleythemes:counterpoint:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:iznyn:opor_ayam:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:iznyn:purity_of_soul:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:jinwen:js_o3_lite:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:jinwen:js_paper:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:marchettidesign:fullbase:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:marchettidesign:wlow:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:omarfolgheraiter:digitally:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:saumendra:aapna:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:saumendra:anand:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:ta2g:tantyyellow:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themeinprogress:bazaar_lite:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themeinprogress:looki_lite:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themeinprogress:saul:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themeinprogress:saul_lite:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:themeinprogress:venice_lite:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thewebhunter:anfaust:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thewebhunter:offset_writing:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:thriveweb:pinzolo:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:tijaji:tijaji:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:wpmole:tydskrif:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:yws:bunnypress_lite:*:*:*:*:*:wordpress:*:*,Ajaydsouza,Connections Reloaded
CVE-2023-28204,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.14292,CWE-125,"An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been actively exploited.",2023-06-23,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:a:webkitgtk:webkitgtk\+:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2023-28205,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.27076,CWE-416,"A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.",2023-04-10,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2023-28206,8.6,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.24513,CWE-787,"An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1, iOS 15.7.5 and iPadOS 15.7.5, macOS Big Sur 11.7.6. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.",2023-04-10,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2023-2822,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N,0.03301,CWE-79,A vulnerability was found in Ellucian Ethos Identity up to 5.10.5. It has been classified as problematic. Affected is an unknown function of the file /cas/logout. The manipulation of the argument url leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.10.6 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-229596.,2023-05-20,Nuclei,cpe:2.3:a:ellucian:ethos_identity:*:*:*:*:*:*:*:*,Ellucian,Ethos Identity
CVE-2023-28229,7.0,CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01872,CWE-591,Windows CNG Key Isolation Service Elevation of Privilege Vulnerability,2023-04-11,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2023-2825,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N,0.71641,CWE-22,An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups.,2023-05-26,Metasploit/Nuclei,cpe:2.3:a:gitlab:gitlab:16.0.0:*:*:*:community:*:*:*;cpe:2.3:a:gitlab:gitlab:16.0.0:*:*:*:enterprise:*:*:*,Gitlab,Gitlab
CVE-2023-28252,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.48973,CWE-122,Windows Common Log File System Driver Elevation of Privilege Vulnerability,2023-04-11,CISA/Metasploit,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2023-28324,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.12904,CWE-20,A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege escalation or remote code execution.,2023-07-01,Metasploit,cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*,Ivanti,Endpoint Manager
CVE-2023-28341,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.9881,CWE-79,Stored Cross site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager through 16340 allows an unauthenticated user to inject malicious javascript on the incorrect login details page.,2023-04-11,EPSS,cpe:2.3:a:zohocorp:manageengine_applications_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_applications_manager:15.9:build15990:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_applications_manager:16.3:build16300:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_applications_manager:16.3:build16310:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_applications_manager:16.3:build16320:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_applications_manager:16.3:build16330:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_applications_manager:16.3:build16340:*:*:*:*:*:*,Zohocorp,Manageengine Applications Manager
CVE-2023-28343,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.85332,CWE-78,"OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php.",2023-03-14,Nuclei,cpe:2.3:h:apsystems:energy_communication_unit:-:*:*:*:*:*:*:*;cpe:2.3:o:apsystems:energy_communication_unit_firmware:c1.2.5:*:*:*:*:*:*:*,Apsystems,Energy Communication Unit Firmware
CVE-2023-28384,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.4481,CWE-78,mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.,2023-04-27,Metasploit,cpe:2.3:a:myscada:mypro:*:*:*:*:*:*:*:*,Myscada,Mypro
CVE-2023-28432,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.83957,CWE-200,"Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY`
and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.",2023-03-22,CISA/Metasploit/Nuclei,cpe:2.3:a:minio:minio:*:*:*:*:*:*:*:*,Minio,Minio
CVE-2023-28434,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.06736,CWE-269,"Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.",2023-03-22,CISA,cpe:2.3:a:minio:minio:*:*:*:*:*:*:*:*,Minio,Minio
CVE-2023-28458,4.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N,0.03429,CWE-22,pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Organizers can trigger the overwriting (with the standard pretalx 404 page content) of an arbitrary file.,2023-04-20,Metasploit,cpe:2.3:a:pretalx:pretalx:*:*:*:*:*:*:*:*,Pretalx,Pretalx
CVE-2023-28459,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.06648,CWE-22,pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Users were able to upload crafted HTML documents that trigger the reading of arbitrary files.,2023-04-20,Metasploit,cpe:2.3:a:pretalx:pretalx:*:*:*:*:*:*:*:*,Pretalx,Pretalx
CVE-2023-28461,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.67419,CWE-287,"Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated ""a new Array AG release with the fix will be available soon.""",2023-03-15,CISA,cpe:2.3:h:arraynetworks:ag1000:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:ag1000t:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:ag1000v5:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:ag1100v5:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:ag1150:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:ag1200:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:ag1200v5:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:ag1500:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:ag1500fips:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:ag1500v5:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:ag1600:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:ag1600v5:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:vxag:-:*:*:*:*:*:*:*;cpe:2.3:o:arraynetworks:arrayos_ag:*:*:*:*:*:*:*:*,Arraynetworks,Arrayos Ag
CVE-2023-28502,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.61102,CWE-120,"Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a stack-based buffer overflow in the ""udadmin"" service that can lead to remote code execution as the root user.",2023-03-29,Metasploit,cpe:2.3:a:rocketsoftware:unidata:*:*:*:*:*:*:*:*;cpe:2.3:a:rocketsoftware:universe:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2023-28503,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.62136,CWE-798,"Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from an authentication bypass vulnerability, where a special username with a deterministic password can be leveraged to bypass authentication checks and execute OS commands as the root user.",2023-03-29,Metasploit,cpe:2.3:a:rocketsoftware:unidata:*:*:*:*:*:*:*:*;cpe:2.3:a:rocketsoftware:universe:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2023-28528,8.4,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01457,CWE-78,"IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands.  IBM X-Force ID:  251207.",2023-04-28,Metasploit,cpe:2.3:a:ibm:vios:3.1:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:7.1:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:7.2:*:*:*:*:*:*:*;cpe:2.3:o:ibm:aix:7.3:*:*:*:*:*:*:*,Ibm,Aix
CVE-2023-28662,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.42186,CWE-89,"The Gift Cards (Gift Vouchers and Packages) WordPress Plugin, version <= 4.3.1, is affected by an unauthenticated SQL injection vulnerability in the template parameter in the wpgv_doajax_voucher_pdf_save_func action.",2023-03-22,Nuclei,cpe:2.3:a:codemenschen:gift_vouchers:*:*:*:*:*:wordpress:*:*,Codemenschen,Gift Vouchers
CVE-2023-28665,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.00887,CWE-79,"The Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'page' parameter to the techno_get_products action, which can only be triggered by an authenticated user.",2023-03-22,Nuclei,cpe:2.3:a:technocrackers:bulk_price_update_for_woocommerce:*:*:*:*:*:wordpress:*:*,Technocrackers,Bulk Price Update For Woocommerce
CVE-2023-2868,9.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L,0.86956,CWE-20,"A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.",2023-05-24,CISA/Metasploit,cpe:2.3:h:barracuda:email_security_gateway_300:-:*:*:*:*:*:*:*;cpe:2.3:h:barracuda:email_security_gateway_400:-:*:*:*:*:*:*:*;cpe:2.3:h:barracuda:email_security_gateway_600:-:*:*:*:*:*:*:*;cpe:2.3:h:barracuda:email_security_gateway_800:-:*:*:*:*:*:*:*;cpe:2.3:h:barracuda:email_security_gateway_900:-:*:*:*:*:*:*:*;cpe:2.3:o:barracuda:email_security_gateway_300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:barracuda:email_security_gateway_400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:barracuda:email_security_gateway_600_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:barracuda:email_security_gateway_800_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:barracuda:email_security_gateway_900_firmware:*:*:*:*:*:*:*:*,Barracuda,Email Security Gateway 300 Firmware
CVE-2023-28769,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0542,CWE-120,The buffer overflow vulnerability in the library “libclinkc.so” of the web server “zhttpd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could allow a remote unauthenticated attacker to execute some OS commands or to cause denial-of-service (DoS) conditions on a vulnerable device.,2023-04-27,Metasploit,cpe:2.3:h:zyxel:dx5401-b0:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:dx5401-b0_firmware:*:*:*:*:*:*:*:*,Zyxel,Dx5401-B0 Firmware
CVE-2023-28770,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.57778,CWE-200,The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could allow a remote unauthenticated attacker to read the system files and to retrieve the password of the supervisor from the encrypted file.,2023-04-27,Metasploit,cpe:2.3:h:zyxel:dx5401-b0:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:dx5401-b0_firmware:*:*:*:*:*:*:*:*,Zyxel,Dx5401-B0 Firmware
CVE-2023-28771,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99284,CWE-78,"Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.",2023-04-25,CISA/EPSS/Metasploit,cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_usg_100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_usg_310:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_usg_100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_usg_100_firmware:4.73:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_usg_310_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_usg_310_firmware:4.73:-:*:*:*:*:*:*,Zyxel,Atp100 Firmware
CVE-2023-28787,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L,0.0196,CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.4.,2024-03-26,Nuclei,,,
CVE-2023-29084,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.98388,CWE-77,Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings.,2023-04-13,EPSS/Metasploit/Nuclei,cpe:2.3:a:zohocorp:manageengine_admanager_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7102:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7110:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7111:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7112:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7113:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7114:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7115:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7116:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7117:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7118:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7120:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7121:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7122:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7123:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7124:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7125:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7126:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7130:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7131:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7140:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7141:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7150:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7151:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7160:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7161:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7162:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7163:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7170:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7171:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7180:*:*:*:*:*:*,Zohocorp,Manageengine Admanager Plus
CVE-2023-2915,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.78093,CWE-20,"The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability, Due to improper input validation, a path traversal vulnerability exists when the ThinManager software processes a certain function. If exploited, an unauthenticated remote threat actor can delete arbitrary files with system privileges.   A malicious user could exploit this vulnerability by sending a specifically crafted synchronization protocol message resulting in a denial-of-service condition.  ",2023-08-17,Metasploit,cpe:2.3:a:rockwellautomation:thinmanager_thinserver:*:*:*:*:*:*:*:*;cpe:2.3:a:rockwellautomation:thinmanager_thinserver:13.1.0:*:*:*:*:*:*:*,Rockwellautomation,Thinmanager Thinserver
CVE-2023-2917,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.69364,CWE-20,"The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability.  Due to an improper input validation, a path traversal vulnerability exists, via the filename field, when the ThinManager processes a certain function. If exploited, an unauthenticated remote attacker can upload arbitrary files to any directory on the disk drive where ThinServer.exe is installed.  A malicious user could exploit this vulnerability by sending a crafted synchronization protocol message and potentially gain remote code execution abilities.

  ",2023-08-17,Metasploit,cpe:2.3:a:rockwellautomation:thinmanager_thinserver:*:*:*:*:*:*:*:*;cpe:2.3:a:rockwellautomation:thinmanager_thinserver:13.1.0:*:*:*:*:*:*:*,Rockwellautomation,Thinmanager Thinserver
CVE-2023-29204,4.7,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N,0.01756,CWE-601,"XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as `//mydomain.com` (i.e. omitting the `http:`). It was also possible to bypass it when using URL such as `http:/mydomain.com`. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.
",2023-04-15,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:6.0:rc1:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2023-29298,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.99734,CWE-284,"Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.",2023-07-12,CISA/EPSS/Nuclei,cpe:2.3:a:adobe:coldfusion:2018:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update10:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update11:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update12:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update13:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update14:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update15:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update16:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update7:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update8:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update9:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*,Adobe,Coldfusion
CVE-2023-29300,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99987,CWE-502,"Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.",2023-07-12,CISA/EPSS/Nuclei,cpe:2.3:a:adobe:coldfusion:2018:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update10:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update11:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update12:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update13:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update14:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update15:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update16:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update7:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update8:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update9:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*,Adobe,Coldfusion
CVE-2023-29336,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.40919,CWE-416,Win32k Elevation of Privilege Vulnerability,2023-05-09,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2023-29357,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99649,CWE-303,Microsoft SharePoint Server Elevation of Privilege Vulnerability,2023-06-14,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*,Microsoft,Sharepoint Server
CVE-2023-29360,8.4,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.22133,CWE-822,Microsoft Streaming Service Elevation of Privilege Vulnerability,2023-06-14,CISA,cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1607
CVE-2023-29439,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.01747,CWE-79,Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FooPlugins FooGallery plugin <= 2.2.35 versions.,2023-05-16,Nuclei,cpe:2.3:a:fooplugins:foogallery:*:*:*:*:*:wordpress:*:*,Fooplugins,Foogallery
CVE-2023-2948,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.96731,CWE-79,Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.1.,2023-05-28,EPSS/Nuclei,cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*,Open-Emr,Openemr
CVE-2023-29489,5.3,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.65533,CWE-79,"An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31.",2023-04-27,Nuclei,cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*,Cpanel,Cpanel
CVE-2023-2949,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01472,CWE-79,Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.1.,2023-05-28,Nuclei,cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*,Open-Emr,Openemr
CVE-2023-29492,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0269,CWE-94,Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.,2023-04-11,CISA,cpe:2.3:a:3rdmill:novi_survey:*:*:*:*:*:*:*:*,3Rdmill,Novi Survey
CVE-2023-29506,5.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N,0.01721,CWE-79,"XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10.",2023-04-16,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:14.10:rc1:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:14.6:*:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2023-29552,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.65873,NVD-CWE-noinfo,"The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.",2023-04-25,CISA,cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:*;cpe:2.3:a:service_location_protocol_project:service_location_protocol:-:*:*:*:*:*:*:*;cpe:2.3:a:suse:manager_server:-:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:sap:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:sap:*:*;cpe:2.3:o:vmware:esxi:*:*:*:*:*:*:*:*,Suse,Linux Enterprise Server
CVE-2023-29623,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0125,CWE-79,Purchase Order Management v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the password parameter at /purchase_order/classes/login.php.,2023-04-14,Nuclei,cpe:2.3:a:purchase_order_management_project:purchase_order_management:1.0:*:*:*:*:*:*:*,Purchase Order Management Project,Purchase Order Management
CVE-2023-2982,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.46242,CWE-288,"The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.",2023-06-29,Nuclei,"cpe:2.3:a:miniorange:wordpress_social_login_and_register_\(discord\,_google\,_twitter\,_linkedin\):*:*:*:*:*:wordpress:*:*",Miniorange,"Wordpress Social Login And Register (Discord, Google, Twitter, Linkedin)"
CVE-2023-29827,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05552,CWE-74,"ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with untrusted input.",2023-05-04,Nuclei,cpe:2.3:a:ejs:ejs:*:*:*:*:*:node.js:*:*,Ejs,Ejs
CVE-2023-29887,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04736,CWE-22,A Local File inclusion vulnerability in test.php in spreadsheet-reader 0.5.11 allows remote attackers to include arbitrary files via the File parameter.,2023-04-18,Nuclei,cpe:2.3:a:nuovo:spreadsheet-reader:0.5.11:*:*:*:*:*:*:*,Nuovo,Spreadsheet-Reader
CVE-2023-29919,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.60221,CWE-276,SolarView Compact <= 6.0 is vulnerable to Insecure Permissions. Any file on the server can be read or modified because texteditor.php is not restricted.,2023-05-23,Nuclei,cpe:2.3:h:contec:solarview_compact:-:*:*:*:*:*:*:*;cpe:2.3:o:contec:solarview_compact_firmware:*:*:*:*:*:*:*:*,Contec,Solarview Compact Firmware
CVE-2023-29922,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.02998,NVD-CWE-Other,PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.,2023-04-19,Nuclei,cpe:2.3:a:powerjob:powerjob:4.3.1:*:*:*:*:*:*:*,Powerjob,Powerjob
CVE-2023-29923,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.09545,CWE-276,PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface.,2023-04-19,Nuclei,cpe:2.3:a:powerjob:powerjob:4.3.1:*:*:*:*:*:*:*,Powerjob,Powerjob
CVE-2023-30013,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.25889,CWE-78,"TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the ""command"" parameter.",2023-05-05,Metasploit/Nuclei,cpe:2.3:h:totolink:x5000r:-:*:*:*:*:*:*:*;cpe:2.3:o:totolink:x5000r_firmware:9.1.0u.6118_b20201102:*:*:*:*:*:*:*;cpe:2.3:o:totolink:x5000r_firmware:9.1.0u.6369_b20230113:*:*:*:*:*:*:*,Totolink,X5000R Firmware
CVE-2023-30019,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.02214,CWE-918,imgproxy <=3.14.0 is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of sanitization of the imageURL parameter.,2023-05-08,Nuclei,cpe:2.3:a:evilmartians:imgproxy:*:*:*:*:*:*:*:*,Evilmartians,Imgproxy
CVE-2023-30150,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03849,CWE-89,PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.,2023-06-14,Nuclei,cpe:2.3:a:leotheme:leocustomajax:1.0.0:*:*:*:*:prestashop:*:*,Leotheme,Leocustomajax
CVE-2023-30192,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02678,CWE-89,Prestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find().,2023-05-12,Nuclei,cpe:2.3:a:prestashop:possearchproducts:1.7:*:*:*:*:prestashop:*:*,Prestashop,Possearchproducts
CVE-2023-30194,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.32413,CWE-89,Prestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook().,2023-05-10,Nuclei,cpe:2.3:a:prestashop:poststaticfooter:*:*:*:*:*:wordpress:*:*,Prestashop,Poststaticfooter
CVE-2023-30210,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01173,CWE-79,OURPHP <= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via ourphp_tz.php.,2023-04-26,Nuclei,cpe:2.3:a:ourphp:ourphp:*:*:*:*:*:*:*:*,Ourphp,Ourphp
CVE-2023-30212,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.08115,CWE-79,OURPHP <= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php.,2023-04-26,Nuclei,cpe:2.3:a:ourphp:ourphp:*:*:*:*:*:*:*:*,Ourphp,Ourphp
CVE-2023-30253,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.79335,CWE-78,Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data.,2023-05-29,Metasploit,cpe:2.3:a:dolibarr:dolibarr_erp\/crm:*:*:*:*:*:*:*:*,Dolibarr,Dolibarr Erp/Crm
CVE-2023-30256,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.08731,CWE-79,Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and email_create parameters in the AuthController.php file.,2023-05-11,Nuclei,cpe:2.3:a:webkul:qloapps:1.5.2:*:*:*:*:*:*:*,Webkul,Qloapps
CVE-2023-30258,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9425,CWE-78,Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request.,2023-06-23,Metasploit/Nuclei,cpe:2.3:a:magnussolution:magnusbilling:*:*:*:*:*:*:*:*,Magnussolution,Magnusbilling
CVE-2023-30534,4.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N,0.02569,CWE-502,"Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24. While a viable gadget chain exists in Cacti’s vendor directory (phpseclib), the necessary gadgets are not included, making them inaccessible and the insecure deserializations not exploitable. Each instance of insecure deserialization is due to using the unserialize function without sanitizing the user input. Cacti has a “safe” deserialization that attempts to sanitize the content and check for specific values before calling unserialize, but it isn’t used in these instances. The vulnerable code lies in graphs_new.php, specifically within the host_new_graphs_save function. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.",2023-09-05,Nuclei,cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2023-30625,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.85825,CWE-89,"rudder-server is part of RudderStack, an open source Customer Data Platform (CDP). Versions of rudder-server prior to 1.3.0-rc.1 are vulnerable to SQL injection. This issue may lead to Remote Code Execution (RCE) due to the `rudder` role in PostgresSQL having superuser permissions by default. Version 1.3.0-rc.1 contains patches for this issue.",2023-06-16,Metasploit/Nuclei,cpe:2.3:a:rudderstack:rudder-server:*:*:*:*:*:*:*:*,Rudderstack,Rudder-Server
CVE-2023-3077,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05505,Missing_Data,"The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features, and uses the woocommerce-appointments plugin.",2023-07-10,Nuclei,cpe:2.3:a:inspireui:mstore_api:*:*:*:*:*:wordpress:*:*,Inspireui,Mstore Api
CVE-2023-30777,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.38768,CWE-79,"Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins <= 6.1.5 versions.",2023-05-10,Nuclei,cpe:2.3:a:advancedcustomfields:advanced_custom_fields:*:*:*:*:-:wordpress:*:*;cpe:2.3:a:advancedcustomfields:advanced_custom_fields:*:*:*:*:pro:wordpress:*:*,Advancedcustomfields,Advanced Custom Fields
CVE-2023-3079,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.32724,CWE-843,Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High),2023-06-05,CISA,cpe:2.3:a:couchbase:couchbase_server:*:*:*:*:*:*:*:*;cpe:2.3:a:couchbase:couchbase_server:7.2.0:*:*:*:*:*:*:*;cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2023-30868,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.03995,CWE-79,Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jon Christopher CMS Tree Page View plugin <= 1.6.7 versions.,2023-05-18,Nuclei,cpe:2.3:a:cms_tree_page_view_project:cms_tree_page_view:*:*:*:*:*:wordpress:*:*,Cms Tree Page View Project,Cms Tree Page View
CVE-2023-30869,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.031,CWE-287,Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue affects Easy Digital Downloads: from 3.1 through 3.1.1.4.1.,2023-05-02,Nuclei,cpe:2.3:a:awesomemotive:easy_digital_downloads:*:*:*:*:*:wordpress:*:*,Awesomemotive,Easy Digital Downloads
CVE-2023-30943,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N,0.06583,CWE-73,The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.,2023-05-02,Nuclei,cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2023-31059,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.05574,CWE-22,"Repetier Server through 1.4.10 allows ..%5c directory traversal for reading files that contain credentials, as demonstrated by connectionLost.php.",2023-04-24,Nuclei,cpe:2.3:a:repetier-server:repetier-server:*:*:*:*:*:*:*:*,Repetier-Server,Repetier-Server
CVE-2023-3139,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00734,CWE-601,"The Protect WP Admin WordPress plugin before 4.0 discloses the URL of the admin panel via a redirection of a crafted URL, bypassing the protection offered.",2023-07-04,Nuclei,cpe:2.3:a:wp-experts:protect_wp_admin:*:*:*:*:*:wordpress:*:*,Wp-Experts,Protect Wp Admin
CVE-2023-31446,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.61081,NVD-CWE-noinfo,"In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized. This leads to injecting Bash code and executing it with root privileges on device startup.",2024-01-10,Nuclei,cpe:2.3:h:cassianetworks:xc1000:-:*:*:*:*:*:*:*;cpe:2.3:h:cassianetworks:xc2000:-:*:*:*:*:*:*:*;cpe:2.3:o:cassianetworks:xc1000_firmware:2.1.1.2303082218:*:*:*:*:*:*:*;cpe:2.3:o:cassianetworks:xc2000_firmware:2.1.1.2303090947:*:*:*:*:*:*:*,Cassianetworks,Xc1000 Firmware
CVE-2023-31465,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.44455,NVD-CWE-noinfo,"An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28. By intercepting requests from various timekeeper streams, it is possible to find the getsamplebacklog call. Some query parameters are passed directly in the URL and named arg[x], with x an integer starting from 1; it is possible to modify arg[2] to insert Bash code that will be executed directly by the server.",2023-07-26,Nuclei,cpe:2.3:a:fsmlabs:timekeeper:*:*:*:*:*:*:*:*,Fsmlabs,Timekeeper
CVE-2023-31478,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.29699,NVD-CWE-noinfo,"An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key.",2023-05-09,Nuclei,cpe:2.3:h:gl-inet:gl-a1300:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-ap1300:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-ap1300lte:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-ar300m:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-ar750:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-ar750s:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-ax1800:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-axt1800:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-b1300:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-b2200:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-e750:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-mifi:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-mt1300:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-mt2500:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-mt2500a:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-mt3000:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-mt300n-v2:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-mv1000:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-mv1000w:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-s10:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-s1300:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-s200:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-s20:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-sf1200:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-sft1200:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-usb150:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-x1200:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-x3000:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-x300b:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-x750:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-xe300:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:microuter-n300:-:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-a1300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-ap1300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-ap1300lte_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-ar300m_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-ar750_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-ar750s_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-axt1800_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-b1300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-b2200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-e750_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-mifi_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-mt1300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-mt2500_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-mt2500a_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-mt3000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-mv1000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-mv1000w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-s10_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-s1300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-s200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-s20_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-sf1200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-sft1200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-usb150_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-x1200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-x3000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-x300b_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-x750_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-xe300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:microuter-n300_firmware:*:*:*:*:*:*:*:*,Gl-Inet,Gl-S20 Firmware
CVE-2023-31548,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01248,CWE-79,A stored Cross-site scripting (XSS) vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.,2023-05-31,Nuclei,cpe:2.3:a:churchcrm:churchcrm:4.5.3:*:*:*:*:*:*:*,Churchcrm,Churchcrm
CVE-2023-3169,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01582,Missing_Data,"The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST route and does not validate as well as escape some parameters when outputting them back, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks.",2023-09-11,Nuclei,cpe:2.3:a:tagdiv:tagdiv_composer:*:*:*:*:*:wordpress:*:*,Tagdiv,Tagdiv Composer
CVE-2023-31742,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.09075,CWE-77,"There is a command injection vulnerability in the Linksys WRT54GL router with firmware version 4.30.18.006. If an attacker gains web management privileges, they can inject commands into the post request parameters wl_ant, wl_rate, WL_atten_ctl, ttcp_num, ttcp_size in the httpd s Start_EPI() function, thereby gaining shell privileges.",2023-05-22,Metasploit,cpe:2.3:h:linksys:wrt54gl:-:*:*:*:*:*:*:*;cpe:2.3:o:linksys:wrt54gl_firmware:4.30.18.006:*:*:*:*:*:*:*,Linksys,Wrt54Gl Firmware
CVE-2023-3188,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.01356,CWE-918,Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0.,2023-06-10,Nuclei,cpe:2.3:a:owncast_project:owncast:*:*:*:*:*:*:*:*,Owncast Project,Owncast
CVE-2023-31902,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.08678,NVD-CWE-noinfo,RPA Technology Mobile Mouse 3.6.0.4 is vulnerable to Remote Code Execution (RCE).,2023-05-17,Metasploit,cpe:2.3:a:mobilemouse:mobile_mouse:3.6.0.4:*:*:*:*:*:*:*,Mobilemouse,Mobile Mouse
CVE-2023-3197,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03902,CWE-89,"The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2023-06-24,Nuclei,cpe:2.3:a:inspireui:mstore_api:*:*:*:*:*:wordpress:*:*,Inspireui,Mstore Api
CVE-2023-32046,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.10049,NVD-CWE-noinfo,Windows MSHTML Platform Elevation of Privilege Vulnerability,2023-07-11,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2023-32049,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.04401,NVD-CWE-noinfo,Windows SmartScreen Security Feature Bypass Vulnerability,2023-07-11,CISA,cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1607
CVE-2023-32068,4.7,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N,0.5507,CWE-601,"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 14.10.4 it's possible to exploit well known parameters in XWiki URLs to perform redirection to untrusted site. This vulnerability was partially fixed in the past for XWiki 12.10.7 and 13.3RC1 but there is still the possibility to force specific URLs to skip some checks, e.g. using URLs like `http:example.com` in the parameter would allow the redirect.  The issue has now been patched against all patterns that are known for performing redirects. This issue has been patched in XWiki 14.10.4 and 15.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.",2023-05-15,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:15.0:rc1:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2023-32077,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03147,CWE-321,"Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. The issue is patched in 0.17.1 and fixed in 0.18.6.  If users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone who is using version 0.17.1 can pull the latest docker image of the backend and restart the server.",2023-08-24,Nuclei,cpe:2.3:a:netmaker:netmaker:*:*:*:*:*:*:*:*,Netmaker,Netmaker
CVE-2023-32117,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07133,CWE-862,Missing Authorization vulnerability in SoftLab Integrate Google Drive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integrate Google Drive: from n/a through 1.1.99.,2024-12-09,Nuclei,,,
CVE-2023-3219,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.07521,CWE-639,"The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.",2023-07-10,Nuclei,cpe:2.3:a:myeventon:eventon:*:*:*:*:*:wordpress:*:*,Myeventon,Eventon
CVE-2023-32235,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.39078,CWE-22,Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.,2023-05-05,Nuclei,cpe:2.3:a:ghost:ghost:*:*:*:*:*:node.js:*:*,Ghost,Ghost
CVE-2023-32243,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.75531,CWE-287,Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1.,2023-05-12,Nuclei,cpe:2.3:a:wpdeveloper:essential_addons_for_elementor:*:*:*:*:*:wordpress:*:*,Wpdeveloper,Essential Addons For Elementor
CVE-2023-32315,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L,0.99999,CWE-22,"Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users. This vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0. The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0). Users are advised to upgrade. If an Openfire upgrade isn’t available for a specific release, or isn’t quickly actionable, users may see the linked github advisory (GHSA-gw42-f939-fhvm) for mitigation advice.",2023-05-26,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:igniterealtime:openfire:*:*:*:*:*:*:*:*,Igniterealtime,Openfire
CVE-2023-32373,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.12172,CWE-416,"A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.",2023-06-23,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:a:webkitgtk:webkitgtk\+:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*,Apple,Ipados
CVE-2023-32409,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N,0.1653,NVD-CWE-noinfo,"The issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.8 and iPadOS 15.7.8, Safari 16.5, iOS 16.5 and iPadOS 16.5. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited.",2023-06-23,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2023-32434,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.51517,CWE-190,"An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.5.2, macOS Big Sur 11.7.8, iOS 15.7.7 and iPadOS 15.7.7, macOS Monterey 12.6.7, watchOS 8.8.1, iOS 16.5.1 and iPadOS 16.5.1, macOS Ventura 13.4.1. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.",2023-06-23,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2023-32435,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.22951,CWE-787,"A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.",2023-06-23,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2023-32439,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.23788,CWE-843,"A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.",2023-06-23,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:a:webkitgtk:webkitgtk\+:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2023-32560,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98919,CWE-787,"An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution.

Thanks to a Researcher at Tenable for finding and reporting.

Fixed in version 6.4.1.",2023-08-10,EPSS/Metasploit,cpe:2.3:a:ivanti:avalanche:*:*:*:*:*:*:*:*,Ivanti,Avalanche
CVE-2023-32563,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.90166,CWE-22,An unauthenticated attacker could achieve the code execution through a RemoteControl server.,2023-08-10,Nuclei,cpe:2.3:a:ivanti:avalanche:*:*:*:*:*:*:*:*,Ivanti,Avalanche
CVE-2023-32590,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L,0.01646,CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Daniel Söderström / Sidney van de Stouwe Subscribe to Category.This issue affects Subscribe to Category: from n/a through 2.7.4.,2023-12-20,Nuclei,cpe:2.3:a:subscribe_to_category_project:subscribe_to_category:*:*:*:*:*:wordpress:*:*,Subscribe To Category Project,Subscribe To Category
CVE-2023-32629,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.08894,CWE-863,Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks when calling ovl_do_setxattr on Ubuntu kernels,2023-07-26,Metasploit,cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2023-32707,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.73537,CWE-285,"In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests.",2023-06-01,Metasploit,cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*;cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*,Splunk,Splunk
CVE-2023-3277,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02888,CWE-288,"The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to improper implementation of the Apple login feature. This allows unauthenticated attackers to log in as any user as long as they know the user's email address.",2023-11-03,Nuclei,cpe:2.3:a:inspireui:mstore_api:*:*:*:*:*:wordpress:*:*,Inspireui,Mstore Api
CVE-2023-32781,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.12342,CWE-77,A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier versions in the HL7 sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor. The severity of this vulnerability is high and received a score of 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,2023-08-09,Metasploit,cpe:2.3:a:paessler:prtg_network_monitor:*:*:*:*:*:*:*:*,Paessler,Prtg Network Monitor
CVE-2023-33009,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.28144,CWE-120,"A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.60 through 5.36 Patch 1, VPN series firmware versions 4.60 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.60 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.",2023-05-24,CISA,cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_20w-vpn:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_40:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_40w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_60:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_60w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp100_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp100_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp100w_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp100w_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp200_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp200_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp500_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp500_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp700_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp700_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp800_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp800_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg20-vpn_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg20-vpn_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_20w-vpn_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_20w-vpn_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_20w-vpn_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_40_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_40_firmware:4.73:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_40_firmware:4.73:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_40w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_40w_firmware:4.73:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_40w_firmware:4.73:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_60_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_60_firmware:4.73:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_60_firmware:4.73:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_60w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_60w_firmware:4.73:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_60w_firmware:4.73:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_100_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_100_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_100w_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_100w_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_200_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_200_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_500_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_500_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_50_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_50_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_50w_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_50w_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_700_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_700_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn1000_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn1000_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn100_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn100_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn300_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn300_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn50_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn50_firmware:5.36:patch1:*:*:*:*:*:*,Zyxel,Atp100 Firmware
CVE-2023-33010,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.28813,CWE-120,"A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.25 through 5.36 Patch 1, VPN series firmware versions 4.30 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.25 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.",2023-05-24,CISA,cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_20w-vpn:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_40:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_40w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_60:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_60w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp100_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp100_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp100w_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp100w_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp200_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp200_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp500_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp500_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp700_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp700_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp800_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:atp800_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg20-vpn_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg20-vpn_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_20w-vpn_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_20w-vpn_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_40_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_40_firmware:4.73:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_40_firmware:4.73:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_40w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_40w_firmware:4.73:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_40w_firmware:4.73:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_60_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_60_firmware:4.73:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_60_firmware:4.73:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_60w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_60w_firmware:4.73:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_60w_firmware:4.73:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_100_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_100_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_100w_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_100w_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_200_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_200_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_500_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_500_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_50_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_50_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_50w_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_50w_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_700_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_700_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn1000_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn1000_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn100_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn100_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn300_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn300_firmware:5.36:patch1:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn50_firmware:5.36:-:*:*:*:*:*:*;cpe:2.3:o:zyxel:vpn50_firmware:5.36:patch1:*:*:*:*:*:*,Zyxel,Atp100 Firmware
CVE-2023-33012,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09882,CWE-78,"A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2,  USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN series firmware versions 5.00 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted GRE configuration when the cloud management mode is enabled.",2023-07-17,Metasploit,cpe:2.3:h:zyxel:usg_20w-vpn:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_2200-vpn:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_atp100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_atp100w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_atp200:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_atp500:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_atp700:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_atp800:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_vpn100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_vpn2s:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_vpn300:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_vpn50:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_vpn_100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_vpn_300:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:zywall_vpn_50:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_20w-vpn_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_2200-vpn_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_atp100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_atp100w_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_atp200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_atp500_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_atp700_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_atp800_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_vpn100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_vpn2s_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_vpn300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_vpn50_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_vpn_100_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_vpn_300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zywall_vpn_50_firmware:*:*:*:*:*:*:*:*,Zyxel,Usg 20W-Vpn Firmware
CVE-2023-33063,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.007,CWE-416,Memory corruption in DSP Services during a remote call from HLOS to DSP.,2023-12-05,CISA,cpe:2.3:h:qualcomm:315_5g_iot_modem:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:8098:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:8953pro:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:8998:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:apq5053-aa:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:apq8009:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:apq8017:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:apq8053-aa:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:apq8053-ac:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:aqt1000:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ar8031:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ar8035:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ar9380:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:c-v2x_9150:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:csr8811:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:csra6620:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:csra6640:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:csrb31024:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:flight_rb5_5g_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:immersive_home_214_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:immersive_home_216_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:immersive_home_316_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:immersive_home_318_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ipq4018:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ipq4019:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ipq4028:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ipq4029:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ipq5010:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ipq6010:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ipq6018:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ipq6028:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ipq8064:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ipq8065:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ipq8068:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ipq8070:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ipq8070a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ipq8071a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ipq8072a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ipq8074a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ipq8076:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ipq8076a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ipq8078:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ipq8078a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ipq8173:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ipq8174:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:mdm9650:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:msm8905:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qam8255p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qam8295p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qam8650p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qam8775p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca4024:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6174a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6310:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6320:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6335:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6390:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6420:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6421:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6426:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6430:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6431:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6436:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6564:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6564au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6595:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6595au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6696:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6698aq:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6797aq:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca7500:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca8075:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca8081:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca8337:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca9377:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca9880:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca9886:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca9888:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca9889:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca9898:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca9980:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca9984:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca9985:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca9990:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca9992:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca9994:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm2290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm4290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm4325:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm4490:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm5430:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm6125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm6490:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn5022:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn5024:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn5052:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn5122:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn5124:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn5152:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn5154:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn5164:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn6023:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn6024:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn9000:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn9011:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn9012:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn9022:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn9024:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn9070:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn9072:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn9074:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn9100:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs2290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs410:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs4290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs4490:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs5430:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs610:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs6125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs6490:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs7230:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs8155:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs8250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs8550:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qm215:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qrb5165:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qrb5165m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qrb5165n:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qsm8250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:s820a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa4150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa4155p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6145p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6155:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6155p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8145p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8155:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8155p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8195p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8255p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8295p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8770p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8775p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa9000p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd626:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd660:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd670:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd675:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd730:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd835:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd855:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd865_5g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd888:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd_675:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sda845:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdm429w:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdm660:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdm845:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx55:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sg4150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sg8275p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm4125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm4250-aa:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm4350-ac:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm4350:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm4375:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6150-ac:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6225-ad:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6225:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6350:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6375:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7150-aa:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7150-ab:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7150-ac:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7225:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7250-aa:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7250-ab:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7250-ac:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7250p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7315:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7325-ae:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7325-af:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7325:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7325p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7350-ab:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8150-ac:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8150:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8250-ab:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8250-ac:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8350-ac:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8350:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8450:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8475:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8550p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_210_processor:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_212_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_425_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_429_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_439_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_4_gen_2_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_625_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_632_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_662_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_675_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_7c\+_gen_3_compute:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8\+_gen_2_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8_gen_2_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_ar2_gen_1_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_auto_4g_modem:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_auto_5g_modem-rf:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_w5\+_gen_1_wearable_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_wear_4100\+_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_x12_lte_modem:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_x24_lte_modem:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_x50_5g_modem-rf_system:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_x55_5g_modem-rf_system:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_x65_5g_modem-rf_system:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_xr1_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_xr2\+_gen_1_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_xr2_5g_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ssg2115p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ssg2125p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sw5100:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sw5100p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sxr1120:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sxr1230p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sxr2130:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sxr2230p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:video_collaboration_vc1_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:video_collaboration_vc3_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:video_collaboration_vc5_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:vision_intelligence_300_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:vision_intelligence_400_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9326:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9335:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9340:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9341:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9360:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9371:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9390:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9395:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3610:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3615:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3620:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3660b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3680:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3680b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3910:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3980:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3988:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3990:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3991:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3998:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6740:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6750:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn685x-1:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn685x-5:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn785x-1:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn785x-5:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8832:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8840:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8845:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8845h:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:315_5g_iot_modem_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:8098_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:8953pro_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:8998_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq5053-aa_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8009_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8017_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8053-aa_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8053-ac_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:aqt1000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ar8031_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ar8035_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ar9380_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:c-v2x_9150_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:csr8811_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:csra6620_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:csra6640_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:csrb31024_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:flight_rb5_5g_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:immersive_home_214_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:immersive_home_216_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:immersive_home_316_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:immersive_home_318_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ipq4018_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ipq4019_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ipq4028_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ipq4029_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ipq5010_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ipq6010_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ipq6018_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ipq6028_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ipq8064_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ipq8065_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ipq8068_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ipq8070_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ipq8070a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ipq8071a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ipq8072a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ipq8074a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ipq8076_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ipq8076a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ipq8078_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ipq8078a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ipq8173_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ipq8174_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:mdm9650_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:msm8905_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qam8255p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qam8295p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qam8650p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qam8775p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca4024_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6174a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6310_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6320_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6335_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6390_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6420_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6421_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6426_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6430_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6431_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6436_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6564_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6564au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6595_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6595au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6696_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6698aq_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6797aq_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca7500_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca8075_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca8081_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca8337_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca9377_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca9880_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca9886_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca9888_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca9889_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca9898_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca9980_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca9984_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca9985_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca9990_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca9992_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca9994_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm2290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm4290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm4325_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm4490_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm5430_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm6125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm6490_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn5022_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn5024_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn5052_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn5122_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn5124_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn5152_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn5154_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn5164_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn6023_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn6024_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn9000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn9011_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn9012_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn9022_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn9024_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn9070_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn9072_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn9074_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn9100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs2290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs410_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs4290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs4490_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs5430_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs610_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs6125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs6490_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs7230_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs8155_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs8250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs8550_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qm215_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qrb5165_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qrb5165m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qrb5165n_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qsm8250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:s820a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa4150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa4155p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6145p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6155_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6155p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8145p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8155_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8155p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8195p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8255p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8295p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8770p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8775p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa9000p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd626_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd660_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd670_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd675_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd730_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd835_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd855_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd865_5g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd888_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd_675_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sda845_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdm429w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdm660_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdm845_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx55_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sg4150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sg8275p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm4125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm4250-aa_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm4350-ac_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm4350_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm4375_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6150-ac_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6225-ad_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6225_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6350_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6375_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7150-aa_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7150-ab_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7150-ac_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7225_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7250-aa_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7250-ab_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7250-ac_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7250p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7315_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7325-ae_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7325-af_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7325_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7325p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7350-ab_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8150-ac_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8150_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8250-ab_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8250-ac_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8350-ac_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8350_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8450_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8475_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8550p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_210_processor_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_212_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_425_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_429_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_439_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_4_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_625_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_632_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_662_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_675_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_7c\+_gen_3_compute_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8\+_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_ar2_gen_1_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_auto_4g_modem_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_auto_5g_modem-rf_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_w5\+_gen_1_wearable_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_wear_4100\+_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_x12_lte_modem_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_x24_lte_modem_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_x50_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_x55_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_x65_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_xr1_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_xr2\+_gen_1_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_xr2_5g_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ssg2115p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ssg2125p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sw5100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sw5100p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sxr1120_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sxr1230p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sxr2130_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sxr2230p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:video_collaboration_vc1_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:video_collaboration_vc3_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:video_collaboration_vc5_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:vision_intelligence_300_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:vision_intelligence_400_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9326_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9335_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9340_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9341_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9360_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9371_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9390_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9395_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3610_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3615_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3620_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3660b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3680_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3680b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3910_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3980_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3990_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3991_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3998_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6740_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6750_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn685x-1_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn685x-5_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn785x-1_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn785x-5_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8832_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8840_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8845_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8845h_firmware:-:*:*:*:*:*:*:*,Qualcomm,315 5G Iot Modem Firmware
CVE-2023-33106,8.4,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.00854,CWE-823,Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.,2023-12-05,CISA,cpe:2.3:h:qualcomm:ar8035:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:csra6620:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:csra6640:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_6200:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_6700:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_6800:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_6900:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:flight_rb5_5g_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qam8255p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qam8295p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qam8650p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qam8775p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6174a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6426:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6436:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6595:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6595au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6696:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6698aq:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6797aq:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca8081:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca8337:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca9377:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm2290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm4290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm4325:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm4490:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm5430:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm6490:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm8550:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn6024:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn9011:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn9012:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn9024:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs2290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs410:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs4290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs4490:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs5430:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs610:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs6490:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs7230:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs8250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs8550:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qrb5165m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qrb5165n:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qualcomm_215_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:robotics_rb5_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa4150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa4155p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6145p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6155p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8145p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8155p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8195p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8255p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8295p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8770p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8775p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa9000p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd660:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd865_5g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd888:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd_8_gen1_5g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sg4150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sg8275p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm4125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7250p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7315:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7325p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8550p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smart_audio_400_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_439_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_460_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_480\+_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_480_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_4_gen_1_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_4_gen_2_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_660_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_662_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_680_4g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_685_4g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_690_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_695_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_750g_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_765_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_765g_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_768g_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_778g\+_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_778g_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_780g_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_782g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_7c\+_gen_3_compute:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_865\+_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_865_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_870_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_888\+_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_888_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8\+_gen_1_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8\+_gen_2_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8_gen_1_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8_gen_2_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_ar2_gen_1_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_auto_5g_modem-rf:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_w5\+_gen_1_wearable_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_x12_lte_modem:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_x55_5g_modem-rf_system:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_x65_5g_modem-rf_system:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_xr2\+_gen_1_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_xr2_5g_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ssg2115p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ssg2125p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sw5100:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sw5100p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sxr1230p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sxr2130:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sxr2230p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:video_collaboration_vc1_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:video_collaboration_vc3_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:video_collaboration_vc5_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9326:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9335:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9341:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9390:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9395:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3615:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3660b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3680b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3910:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3980:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3988:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3990:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6740:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8832:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8840:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8845:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8845h:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ar8035_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:csra6620_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:csra6640_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_6200_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_6700_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_6800_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:flight_rb5_5g_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qam8255p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qam8295p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qam8650p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qam8775p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6174a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6426_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6436_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6595_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6595au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6696_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6698aq_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6797aq_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca8081_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca8337_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca9377_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm2290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm4290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm4325_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm4490_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm5430_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm6490_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm8550_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn6024_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn9011_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn9012_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn9024_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs2290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs410_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs4290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs4490_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs5430_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs610_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs6490_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs7230_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs8250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs8550_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qrb5165m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qrb5165n_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qualcomm_215_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:robotics_rb5_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa4150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa4155p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6145p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6155p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8145p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8155p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8195p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8255p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8295p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8770p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8775p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa9000p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd660_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd865_5g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd888_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd_8_gen1_5g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sg4150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sg8275p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm4125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7250p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7315_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7325p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8550p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smart_audio_400_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_439_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_460_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_480\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_480_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_4_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_4_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_660_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_662_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_680_4g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_685_4g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_690_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_695_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_750g_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_765_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_765g_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_768g_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_778g\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_778g_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_780g_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_782g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_7c\+_gen_3_compute_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_865\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_865_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_870_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_888\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_888_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8\+_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8\+_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_ar2_gen_1_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_auto_5g_modem-rf_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_w5\+_gen_1_wearable_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_x12_lte_modem_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_x55_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_x65_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_xr2\+_gen_1_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_xr2_5g_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ssg2115p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ssg2125p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sw5100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sw5100p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sxr1230p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sxr2130_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sxr2230p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:video_collaboration_vc1_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:video_collaboration_vc3_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:video_collaboration_vc5_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9326_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9335_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9341_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9390_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9395_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3615_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3660b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3680b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3910_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3980_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3990_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6740_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8832_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8840_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8845_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8845h_firmware:-:*:*:*:*:*:*:*,Qualcomm,Ar8035 Firmware
CVE-2023-33107,8.4,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.00892,CWE-190,Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.,2023-12-05,CISA,cpe:2.3:h:qualcomm:315_5g_iot_modem:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:apq8017:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:apq8064au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:aqt1000:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ar8031:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ar8035:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:c-v2x_9150:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:csra6620:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:csra6640:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:csrb31024:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_6200:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_6700:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_6800:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_6900:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:flight_rb5_5g_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:mdm9250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:mdm9650:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:msm8108:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:msm8209:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:msm8608:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:msm8909w:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:msm8996au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qam8255p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qam8295p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qam8650p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qam8775p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6174a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6310:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6320:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6335:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6420:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6421:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6426:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6430:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6431:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6436:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6564:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6564a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6564au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6595:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6595au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6696:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6698aq:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6797aq:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca8081:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca8337:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca9377:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm2290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm4290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm4325:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm4490:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm5430:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm6125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm6490:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm8550:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn6024:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn9011:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn9012:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn9024:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn9074:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs2290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs410:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs4290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs4490:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs5430:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs610:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs6125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs6490:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs7230:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs8155:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs8250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs8550:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qrb5165m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qrb5165n:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qsm8250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qualcomm_205_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qualcomm_215_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:robotics_rb3_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:robotics_rb5_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa4150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa4155p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6145p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6155:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6155p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8145p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8155:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8155p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8195p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8255p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8295p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8770p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8775p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa9000p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd626:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd660:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd670:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd675:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd730:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd835:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd855:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd865_5g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd888:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd_675:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd_8_gen1_5g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdm429w:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx20m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx55:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sg4150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sg8275p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm4125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7250p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7315:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7325p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8550p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smart_audio_200_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smart_audio_400_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smart_display_200_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_208_processor:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_210_processor:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_212_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_425_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_429_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_439_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_460_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_480\+_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_480_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_4_gen_1_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_4_gen_2_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_625_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_626_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_630_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_632_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_636_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_660_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_662_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_665_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_670_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_675_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_678_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_680_4g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_685_4g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_690_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_695_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_710_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_720g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_730_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_730g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_732g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_750g_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_765_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_765g_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_768g_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_778g\+_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_778g_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_780g_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_782g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_7c\+_gen_3_compute:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_820_automotive_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_835_mobile_pc_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_845_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_855\+\/860_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_855_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_865\+_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_865_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_870_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_888\+_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_888_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8\+_gen_1_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8\+_gen_2_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8_gen_1_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8_gen_2_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_ar2_gen_1_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_auto_4g_modem:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_auto_5g_modem-rf:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_w5\+_gen_1_wearable_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_wear_2100_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_wear_2500_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_wear_3100_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_wear_4100\+_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_x12_lte_modem:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_x20_lte_modem:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_x24_lte_modem:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_x50_5g_modem-rf_system:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_x55_5g_modem-rf_system:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_x65_5g_modem-rf_system:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_xr1_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_xr2\+_gen_1_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_xr2_5g_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ssg2115p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ssg2125p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sw5100:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sw5100p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sxr1120:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sxr1230p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sxr2130:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sxr2230p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:video_collaboration_vc1_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:video_collaboration_vc3_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:video_collaboration_vc5_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:vision_intelligence_100_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:vision_intelligence_200_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:vision_intelligence_300_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:vision_intelligence_400_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9326:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9335:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9340:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9341:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9371:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9390:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9395:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3610:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3615:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3620:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3660b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3680:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3680b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3910:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3980:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3988:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3990:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6740:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8832:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8840:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8845:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8845h:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:315_5g_iot_modem_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8017_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8064au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:aqt1000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ar8031_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ar8035_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:c-v2x_9150_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:csra6620_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:csra6640_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:csrb31024_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_6200_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_6700_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_6800_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:flight_rb5_5g_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:mdm9250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:mdm9650_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:msm8108_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:msm8209_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:msm8608_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:msm8909w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:msm8996au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qam8255p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qam8295p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qam8650p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qam8775p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6174a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6310_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6320_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6335_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6420_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6421_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6426_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6430_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6431_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6436_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6564_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6564a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6564au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6595_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6595au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6696_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6698aq_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6797aq_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca8081_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca8337_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca9377_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm2290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm4290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm4325_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm4490_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm5430_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm6125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm6490_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm8550_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn6024_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn9011_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn9012_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn9024_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn9074_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs2290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs410_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs4290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs4490_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs5430_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs610_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs6125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs6490_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs7230_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs8155_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs8250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs8550_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qrb5165m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qrb5165n_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qsm8250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qualcomm_205_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qualcomm_215_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:robotics_rb3_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:robotics_rb5_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa4150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa4155p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6145p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6155_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6155p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8145p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8155_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8155p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8195p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8255p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8295p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8770p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8775p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa9000p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd626_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd660_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd670_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd675_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd730_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd835_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd855_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd865_5g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd888_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd_675_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd_8_gen1_5g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdm429w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx20m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx55_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sg4150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sg8275p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm4125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7250p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7315_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7325p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8550p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smart_audio_200_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smart_audio_400_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smart_display_200_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_208_processor_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_210_processor_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_212_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_425_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_429_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_439_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_460_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_480\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_480_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_4_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_4_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_625_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_626_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_630_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_632_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_636_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_660_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_662_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_665_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_670_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_675_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_678_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_680_4g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_685_4g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_690_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_695_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_710_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_720g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_730_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_730g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_732g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_750g_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_765_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_765g_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_768g_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_778g\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_778g_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_780g_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_782g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_7c\+_gen_3_compute_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_820_automotive_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_835_mobile_pc_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_845_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_855\+\/860_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_855_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_865\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_865_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_870_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_888\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_888_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8\+_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8\+_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_ar2_gen_1_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_auto_4g_modem_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_auto_5g_modem-rf_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_w5\+_gen_1_wearable_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_wear_2100_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_wear_2500_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_wear_3100_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_wear_4100\+_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_x12_lte_modem_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_x20_lte_modem_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_x24_lte_modem_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_x50_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_x55_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_x65_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_xr1_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_xr2\+_gen_1_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_xr2_5g_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ssg2115p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ssg2125p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sw5100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sw5100p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sxr1120_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sxr1230p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sxr2130_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sxr2230p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:video_collaboration_vc1_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:video_collaboration_vc3_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:video_collaboration_vc5_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:vision_intelligence_100_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:vision_intelligence_200_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:vision_intelligence_300_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:vision_intelligence_400_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9326_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9335_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9340_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9341_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9371_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9390_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9395_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3610_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3615_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3620_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3660b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3680_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3680b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3910_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3980_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3990_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6740_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8832_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8840_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8845_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8845h_firmware:-:*:*:*:*:*:*:*,Qualcomm,315 5G Iot Modem Firmware
CVE-2023-33193,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.01699,CWE-444,"Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewing at home and abroad on a broad range of client devices. This vulnerability may allow administrative access to an Emby Server system, depending on certain user account settings. By spoofing certain headers which are intended for interoperation with reverse proxy servers, it may be possible to affect the local/non-local network determination to allow logging in without password or to view a list of user accounts which may have no password configured. Impacted are all Emby Server system which are publicly accessible and where the administrator hasn't tightened the account login configuration for administrative users. This issue has been patched in Emby Server Beta version 4.8.31 and Emby Server version 4.7.12.

",2023-05-30,Nuclei,cpe:2.3:a:emby:emby.releases:*:*:*:*:*:*:*:*,Emby,Emby.Releases
CVE-2023-33246,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96604,CWE-94,"For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. 

Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. 

To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .",2023-05-24,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:rocketmq:*:*:*:*:*:*:*:*,Apache,Rocketmq
CVE-2023-33338,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03632,CWE-89,Old Age Home Management 1.0 is vulnerable to SQL Injection via the username parameter.,2023-05-23,Nuclei,cpe:2.3:a:phpgurukul:old_age_home_management_system:1.0:*:*:*:*:*:*:*,Phpgurukul,Old Age Home Management System
CVE-2023-33405,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.31265,CWE-601,Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect.,2023-06-21,Nuclei,cpe:2.3:a:blogengine:blogengine.net:*:*:*:*:*:*:*:*,Blogengine,Blogengine.Net
CVE-2023-33439,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.03307,CWE-89,Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_task.php?id=.,2023-05-26,Nuclei,cpe:2.3:a:faculty_evaluation_system_project:faculty_evaluation_system:1.0:*:*:*:*:*:*:*,Faculty Evaluation System Project,Faculty Evaluation System
CVE-2023-33440,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.14507,NVD-CWE-noinfo,Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_user.,2023-05-26,Nuclei,cpe:2.3:a:faculty_evaluation_system_project:faculty_evaluation_system:1.0:*:*:*:*:*:*:*,Faculty Evaluation System Project,Faculty Evaluation System
CVE-2023-3345,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.0197,Missing_Data,"The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoints, making it possible for any students to retrieve email addresses of other students",2023-07-31,Nuclei,cpe:2.3:a:themegrill:masteriyo:*:*:*:*:*:wordpress:*:*,Themegrill,Masteriyo
CVE-2023-33510,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04042,CWE-668,Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.,2023-06-07,Nuclei,cpe:2.3:a:jeecg_p3_biz_chat_project:jeecg_p3_biz_chat:1.0.5:*:*:*:*:wordpress:*:*,Jeecg P3 Biz Chat Project,Jeecg P3 Biz Chat
CVE-2023-33538,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.41874,CWE-77,"TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .",2023-06-07,CISA,cpe:2.3:h:tp-link:tl-wr740n:1.0:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:tl-wr740n:2.0:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:tl-wr841n:10.0:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:tl-wr841n:8.0:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:tl-wr940n:2.0:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:tl-wr940n:4.0:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:tl-wr740n_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:tl-wr841n_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:tl-wr940n_firmware:-:*:*:*:*:*:*:*,TP-Link,Tl-Wr940N Firmware
CVE-2023-33568,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.1494,CWE-552,"An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.",2023-06-13,Metasploit/Nuclei,cpe:2.3:a:dolibarr:dolibarr_erp\/crm:*:*:*:*:*:*:*:*,Dolibarr,Dolibarr Erp/Crm
CVE-2023-33625,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.33154,CWE-77,"D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a command injection vulnerability via the ST parameter in the lxmldbc_system() function.",2023-06-12,Metasploit,cpe:2.3:h:dlink:dir-600:b5:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-600_firmware:2.18:*:*:*:*:*:*:*,D-Link,Dir-600 Firmware
CVE-2023-33629,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.04353,CWE-787,H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DeltriggerList interface at /goform/aspForm.,2023-05-31,Nuclei,cpe:2.3:h:h3c:magic_r300-2100m:-:*:*:*:*:*:*:*;cpe:2.3:o:h3c:magic_r300-2100m_firmware:r300-2100mv100r004:*:*:*:*:*:*:*,H3C,Magic R300-2100M Firmware
CVE-2023-3368,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.68897,CWE-78,Command injection in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters. This is a bypass of CVE-2023-34960.,2023-11-28,Nuclei,cpe:2.3:a:chamilo:chamilo:*:*:*:*:*:*:*:*,Chamilo,Chamilo
CVE-2023-3380,4.7,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L,0.0388,CWE-74,A vulnerability classified as critical has been found in Wavlink WN579X3 up to 20230615. Affected is an unknown function of the file /cgi-bin/adm.cgi of the component Ping Test. The manipulation of the argument pingIp leads to injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-232236. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2023-06-23,Nuclei,cpe:2.3:h:wavlink:wn579x3:-:*:*:*:*:*:*:*;cpe:2.3:o:wavlink:wn579x3_firmware:*:*:*:*:*:*:*:*,Wavlink,Wn579X3 Firmware
CVE-2023-33831,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.13746,CWE-77,A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.,2023-09-18,Nuclei,cpe:2.3:a:frangoteam:fuxa:1.1.13:*:*:*:*:*:*:*,Frangoteam,Fuxa
CVE-2023-3388,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.84461,CWE-79,"The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nsc_bar_content_href' parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A partial patch was made available in 2.10.1 and the issue was fully patched in 2.10.2.",2023-06-24,Nuclei,cpe:2.3:a:beautiful-cookie-banner:beautiful_cookie_consent_banner:*:*:*:*:*:wordpress:*:*,Beautiful-Cookie-Banner,Beautiful Cookie Consent Banner
CVE-2023-33960,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01268,CWE-200,"OpenProject is web-based project management software. For any OpenProject installation, a `robots.txt` file is generated through the server to denote which routes shall or shall not be accessed by crawlers. These routes contain project identifiers of all public projects in the instance. Prior to version 12.5.6, even if the entire instance is marked as `Login required` and prevents all truly anonymous access, the `/robots.txt` route remains publicly available.

Version 12.5.6 has a fix for this issue. Alternatively, users can download a patchfile to apply the patch to any OpenProject version greater than 10.0 As a workaround, one may mark any public project as non-public and give anyone in need of access to the project a membership.",2023-06-01,Nuclei,cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*,Openproject,Openproject
CVE-2023-34020,4.7,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N,0.00963,CWE-601,URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.6.4.3.,2024-03-27,Nuclei,cpe:2.3:a:uncannyowl:uncanny_toolkit_for_learndash:*:*:*:*:*:wordpress:*:*,Uncannyowl,Uncanny Toolkit For Learndash
CVE-2023-34039,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.64194,CWE-327,Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with network access to Aria Operations for Networks could bypass SSH authentication to gain access to the Aria Operations for Networks CLI.,2023-08-29,Metasploit/Nuclei,cpe:2.3:a:vmware:aria_operations_for_networks:*:*:*:*:*:*:*:*,Vmware,Aria Operations For Networks
CVE-2023-34048,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99428,CWE-787,vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.,2023-10-25,CISA/EPSS/Nuclei,cpe:2.3:a:vmware:vcenter_server:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3e:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3f:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3g:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3h:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3i:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3j:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3k:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3l:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3m:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3n:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:*,Vmware,Vcenter Server
CVE-2023-34092,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03152,CWE-50,"Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options (`server.fs.deny`) can be bypassed using double forward-slash (//) allows any unauthenticated user to read file from the Vite root-path of the application including the default `fs.deny` settings (`['.env', '.env.*', '*.{crt,pem}']`). Only users explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected, and only files in the immediate Vite project root folder could be exposed. This issue is fixed in vite@4.3.9, vite@4.2.3, vite@4.1.5, vite@4.0.5, vite@3.2.7, and vite@2.9.16.",2023-06-01,Nuclei,cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*;cpe:2.3:a:vitejs:vite:2.9.15:*:*:*:*:node.js:*:*,Vitejs,Vite
CVE-2023-34105,7.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.0876,CWE-78,"SRS is a real-time video server supporting RTMP, WebRTC, HLS, HTTP-FLV, SRT, MPEG-DASH, and GB28181. Prior to versions 5.0.157, 5.0-b1, and 6.0.48, SRS's `api-server` server is vulnerable to a drive-by command injection. An attacker may send a request to the `/api/v1/snapshots` endpoint containing any commands to be executed as part of the body of the POST request. This issue may lead to Remote Code Execution (RCE). Versions 5.0.157, 5.0-b1, and 6.0.48 contain a fix.",2023-06-12,Nuclei,cpe:2.3:a:ossrs:simple_realtime_server:*:*:*:*:*:*:*:*,Ossrs,Simple Realtime Server
CVE-2023-34124,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.44715,CWE-305,"The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.",2023-07-13,Metasploit/Nuclei,cpe:2.3:a:sonicwall:analytics:*:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:global_management_system:*:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:global_management_system:9.3.2:-:*:*:*:*:*:*;cpe:2.3:a:sonicwall:global_management_system:9.3.2:sp1:*:*:*:*:*:*,Sonicwall,Analytics
CVE-2023-34127,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.86469,CWE-78,"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall GMS, SonicWall Analytics enables an authenticated attacker to execute arbitrary code with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.",2023-07-13,Metasploit,cpe:2.3:a:sonicwall:analytics:*:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:global_management_system:*:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:global_management_system:9.3.2:-:*:*:*:*:*:*;cpe:2.3:a:sonicwall:global_management_system:9.3.2:sp1:*:*:*:*:*:*,Sonicwall,Analytics
CVE-2023-34132,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0768,CWE-836,Use of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows Pass-the-Hash attacks. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.,2023-07-13,Metasploit,cpe:2.3:a:sonicwall:analytics:*:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:global_management_system:*:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:global_management_system:9.3.2:-:*:*:*:*:*:*;cpe:2.3:a:sonicwall:global_management_system:9.3.2:sp1:*:*:*:*:*:*,Sonicwall,Analytics
CVE-2023-34133,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.72203,CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and Analytics allows an unauthenticated attacker to extract sensitive information from the application database. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.,2023-07-13,Metasploit/Nuclei,cpe:2.3:a:sonicwall:analytics:*:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:global_management_system:*:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:global_management_system:9.3.2:-:*:*:*:*:*:*;cpe:2.3:a:sonicwall:global_management_system:9.3.2:sp1:*:*:*:*:*:*,Sonicwall,Analytics
CVE-2023-34192,9.0,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H,0.77266,CWE-79,Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.,2023-07-06,CISA/Nuclei,cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p10:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p11:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p12:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p13:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p14:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p15:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p16:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p17:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p18:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p19:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p20:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p21:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p22:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p23:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p24:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p25:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p26:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p27:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p28:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p29:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p30:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31.1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p32:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p33:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p34:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p35:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p36:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p37:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p38:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p39:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p6:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p7:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p8:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p9:*:*:*:*:*:*,Synacor,Zimbra Collaboration Suite
CVE-2023-34259,4.9,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N,0.60745,CWE-22,"Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow /wlmdeu%2f%2e%2e%2f%2e%2e directory traversal to read arbitrary files on the filesystem, even files that require root privileges. NOTE: this issue exists because of an incomplete fix for CVE-2020-23575.",2023-11-03,Nuclei,cpe:2.3:h:kyocera:d-copia253mf_plus:-:*:*:*:*:*:*:*;cpe:2.3:o:kyocera:d-copia253mf_plus_firmware:*:*:*:*:*:*:*:*,Kyocera,D-Copia253Mf Plus Firmware
CVE-2023-34362,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99934,CWE-89,"In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.",2023-06-02,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:progress:moveit_cloud:*:*:*:*:*:*:*:*;cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*,Progress,Moveit Cloud
CVE-2023-34468,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.63633,CWE-94,"The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution.

The resolution validates the Database URL and rejects H2 JDBC locations.

You are recommended to upgrade to version 1.22.0 or later which fixes this issue.",2023-06-12,Metasploit,cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*,Apache,Nifi
CVE-2023-3452,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0562,CWE-98,"The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit less useful because it requires that the attacker be able to upload a malicious php file via FTP or some other means into a directory readable by the web server.",2023-08-12,Nuclei,cpe:2.3:a:canto:canto:*:*:*:*:*:wordpress:*:*,Canto,Canto
CVE-2023-34537,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.0145,CWE-79,"A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data.",2023-06-13,Nuclei,cpe:2.3:a:digitaldruid:hoteldruid:3.0.5:*:*:*:*:*:*:*,Digitaldruid,Hoteldruid
CVE-2023-34598,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.47238,CWE-22,Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in the server's response.,2023-06-29,Nuclei,cpe:2.3:a:gibbonedu:gibbon:25.0.00:*:*:*:*:*:*:*,Gibbonedu,Gibbon
CVE-2023-34599,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01868,CWE-79,"Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code.",2023-06-29,Nuclei,cpe:2.3:a:gibbonedu:gibbon:25.0.00:*:*:*:*:*:*:*,Gibbonedu,Gibbon
CVE-2023-3460,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.72306,Missing_Data,"The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.",2023-07-04,Nuclei,cpe:2.3:a:ultimatemember:ultimate_member:*:*:*:*:*:wordpress:*:*,Ultimatemember,Ultimate Member
CVE-2023-34634,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.07685,NVD-CWE-noinfo,Greenshot 1.2.10 and below allows arbitrary code execution because .NET content is insecurely deserialized when a .greenshot file is opened.,2023-08-01,Metasploit,cpe:2.3:a:getgreenshot:greenshot:*:*:*:*:*:*:*:*,Getgreenshot,Greenshot
CVE-2023-34659,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.1248,CWE-89,jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interface.,2023-06-16,Nuclei,cpe:2.3:a:jeecg:jeecg_boot:3.5.0:*:*:*:*:*:*:*;cpe:2.3:a:jeecg:jeecg_boot:3.5.1:*:*:*:*:*:*:*,Jeecg,Jeecg Boot
CVE-2023-34751,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04228,CWE-89,bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the gid parameter at admin/index.php?mode=user&page=groups&action=edit.,2023-06-14,Nuclei,cpe:2.3:a:bloofox:bloofoxcms:0.5.2.1:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*,Apple,Macos
CVE-2023-34752,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04383,CWE-89,bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/index.php?mode=settings&page=lang&action=edit.,2023-06-14,Nuclei,cpe:2.3:a:bloofox:bloofoxcms:0.5.2.1:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*,Apple,Macos
CVE-2023-34753,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04228,CWE-89,bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the tid parameter at admin/index.php?mode=settings&page=tmpl&action=edit.,2023-06-14,Nuclei,cpe:2.3:a:bloofox:bloofoxcms:0.5.2.1:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*,Apple,Macos
CVE-2023-34754,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03449,CWE-89,bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the pid parameter at admin/index.php?mode=settings&page=plugins&action=edit.,2023-06-14,Nuclei,cpe:2.3:a:bloofox:bloofoxcms:0.5.2.1:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*,Apple,Macos
CVE-2023-34755,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04228,CWE-89,bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the userid parameter at admin/index.php?mode=user&action=edit.,2023-06-14,Nuclei,cpe:2.3:a:bloofox:bloofoxcms:0.5.2.1:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*,Apple,Macos
CVE-2023-34756,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04228,CWE-89,bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the cid parameter at admin/index.php?mode=settings&page=charset&action=edit.,2023-06-14,Nuclei,cpe:2.3:a:bloofox:bloofoxcms:0.5.2.1:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*,Apple,Macos
CVE-2023-3479,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01293,CWE-79,Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.7.8.,2023-06-30,Nuclei,cpe:2.3:a:hestiacp:control_panel:*:*:*:*:*:*:*:*,Hestiacp,Control Panel
CVE-2023-34843,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.07176,CWE-22,Traggo Server 0.3.0 is vulnerable to directory traversal via a crafted GET request.,2023-06-29,Nuclei,cpe:2.3:a:traggo:traggo:0.3.0:*:*:*:*:*:*:*,Traggo,Traggo
CVE-2023-34960,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99192,CWE-77,A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.,2023-08-01,EPSS/Metasploit/Nuclei,cpe:2.3:a:chamilo:chamilo:*:*:*:*:*:*:*:*,Chamilo,Chamilo
CVE-2023-34990,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.24901,CWE-23,A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specially crafted web requests.,2024-12-18,Nuclei,cpe:2.3:a:fortinet:fortiwlm:*:*:*:*:*:*:*:*,Fortinet,Fortiwlm
CVE-2023-34992,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.65509,CWE-78,A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet  allows attacker to execute unauthorized code or commands via crafted API requests.,2023-10-10,Nuclei,cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortisiem:6.4.0:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortisiem:6.4.1:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortisiem:6.4.2:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortisiem:6.5.0:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortisiem:6.5.1:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortisiem:7.0.0:*:*:*:*:*:*:*,Fortinet,Fortisiem
CVE-2023-34993,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.18148,CWE-78,A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.,2023-10-10,Nuclei,cpe:2.3:a:fortinet:fortiwlm:*:*:*:*:*:*:*:*,Fortinet,Fortiwlm
CVE-2023-35078,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99999,CWE-287,An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.,2023-07-25,CISA/EPSS/Nuclei,cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:*,Ivanti,Endpoint Manager Mobile
CVE-2023-35081,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.63316,CWE-22,"A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3,  11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the appliance.",2023-08-03,CISA,cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:*,Ivanti,Endpoint Manager Mobile
CVE-2023-35082,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99999,CWE-287,"An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.",2023-08-15,CISA/EPSS/Nuclei,cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:*,Ivanti,Endpoint Manager Mobile
CVE-2023-35155,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L,0.01496,CWE-79,"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). For instance, the following URL execute an `alter` on the browser: `<xwiki-host>/xwiki/bin/view/Main/?viewer=share&send=1&target=&target=%3Cimg+src+onerror%3Dalert%28document.domain%29%3E+%3Cimg+src+onerror%3Dalert%28document.domain%29%3E+%3Crenniepak%40intigriti.me%3E&includeDocument=inline&message=I+wanted+to+share+this+page+with+you.`, where `<xwiki-host>` is the URL of your XWiki installation. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8.
",2023-06-23,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2023-35156,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.02081,CWE-87,"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the delete template to perform a XSS, e.g. by using URL such as: > xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.0-rc-1. The vulnerability has been patched in XWiki 14.10.6 and 15.1. Note that a partial patch has been provided in 14.10.5 but wasn't enough to entirely fix the vulnerability. 
",2023-06-23,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:15.0:*:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:6.0:milestone1:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:6.0:milestone2:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2023-35158,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.02048,CWE-87,"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the restore template to perform a XSS, e.g. by using URL such as: > /xwiki/bin/view/XWiki/Main?xpage=restore&showBatch=true&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 9.4-rc-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1. ",2023-06-23,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:15.0:-:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:9.4:-:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:9.4:rc-1:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2023-35159,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.02182,CWE-87,"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the deletespace template to perform a XSS, e.g. by using URL such as: > xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 3.4-milestone-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.",2023-06-23,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:15.0:*:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:3.4:milestone-1:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:3.5:rc-1:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2023-35160,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.02268,CWE-87,"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the resubmit template to perform a XSS, e.g. by using URL such as: > xwiki/bin/view/XWiki/Main xpage=resubmit&resubmit=javascript:alert(document.domain)&xback=javascript:alert(document.domain). This vulnerability exists since XWiki 2.5-milestone-2. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.",2023-06-23,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:15.0:*:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:2.5:milestone2:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2023-35161,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.02377,CWE-87,"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the DeleteApplication page to perform a XSS, e.g. by using URL such as: > xwiki/bin/view/AppWithinMinutes/DeleteApplication?appName=Menu&resolve=true&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.2-milestone-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.
",2023-06-23,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:6.2:milestone1:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:6.2:milestone2:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2023-35162,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.02377,CWE-79,"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the previewactions template to perform a XSS, e.g. by using URL such as: > <hostname>/xwiki/bin/get/FlamingoThemes/Cerulean xpage=xpart&vm=previewactions.vm&xcontinue=javascript:alert(document.domain). This vulnerability exists since XWiki 6.1-rc-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.",2023-06-23,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:6.1:-:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:6.1:milestone1:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:6.1:milestone2:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:6.1:rc1:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2023-3519,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99715,CWE-94,Unauthenticated remote code execution,2023-07-19,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*;cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*;cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*;cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*,Citrix,Netscaler Application Delivery Controller
CVE-2023-3521,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00919,CWE-79,Cross-site Scripting (XSS) - Reflected in GitHub repository fossbilling/fossbilling prior to 0.5.4.,2023-07-06,Nuclei,cpe:2.3:a:fossbilling:fossbilling:*:*:*:*:*:*:*:*,Fossbilling,Fossbilling
CVE-2023-35311,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.15522,CWE-367,Microsoft Outlook Security Feature Bypass Vulnerability,2023-07-11,CISA,cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*;cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:outlook:2013:-:-:*:-:-:*:*;cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:rt:*:*:*;cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:*:*,Microsoft,365 Apps
CVE-2023-35674,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02203,NVD-CWE-noinfo,"In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",2023-09-11,CISA,cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:12.1:*:*:*:*:*:*:*;cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*,Google,Android
CVE-2023-35708,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96682,CWE-89,"In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content. These are fixed versions of the DLL drop-in: 2020.1.10 (12.1.10), 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3).",2023-06-16,EPSS/Nuclei,cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*,Progress,Moveit Transfer
CVE-2023-3578,5.5,CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.0357,CWE-918,A vulnerability classified as critical was found in DedeCMS 5.7.109. Affected by this vulnerability is an unknown functionality of the file co_do.php. The manipulation of the argument rssurl leads to server-side request forgery. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233371.,2023-07-10,Nuclei,cpe:2.3:a:dedecms:dedecms:5.7.109:*:*:*:*:*:*:*,Dedecms,Dedecms
CVE-2023-35813,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.86685,NVD-CWE-noinfo,"Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.",2023-06-17,Nuclei,cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:*;cpe:2.3:a:sitecore:managed_cloud:*:*:*:*:*:*:*:*,Sitecore,Experience Commerce
CVE-2023-35843,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.08875,CWE-22,"NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route. This vulnerability could allow an attacker to access sensitive files and data on the server, including configuration files, source code, and other sensitive information.",2023-06-19,Nuclei,cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*,Nocodb,Nocodb
CVE-2023-35844,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.06344,CWE-22,"packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension (.csv or .png) is used.",2023-06-19,Nuclei,cpe:2.3:a:lightdash:lightdash:*:*:*:*:*:*:*:*,Lightdash,Lightdash
CVE-2023-35885,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.74888,CWE-565,CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.,2023-06-20,Nuclei,cpe:2.3:a:mgt-commerce:cloudpanel:*:*:*:*:*:*:*:*,Mgt-Commerce,Cloudpanel
CVE-2023-36025,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.88196,NVD-CWE-noinfo,Windows SmartScreen Security Feature Bypass Vulnerability,2023-11-14,CISA,cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_11_21h2:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_21h2:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2023-36033,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.11977,CWE-822,Windows DWM Core Library Elevation of Privilege Vulnerability,2023-11-14,CISA,cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1809
CVE-2023-36036,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.1667,CWE-122,Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability,2023-11-14,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2023-36144,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.36507,CWE-862,"An authentication bypass in Intelbras Switch SG 2404 MR in firmware 1.00.54 allows an unauthenticated attacker to download the backup file of the device, exposing critical information about the device configuration.",2023-06-30,Nuclei,cpe:2.3:h:intelbras:sg_2404_mr:-:*:*:*:*:*:*:*;cpe:2.3:o:intelbras:sg_2404_mr_firmware:1.00.54:*:*:*:*:*:*:*,Intelbras,Sg 2404 Mr Firmware
CVE-2023-36255,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.57359,CWE-94,An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the URL.,2023-08-03,Metasploit,cpe:2.3:a:eramba:eramba:3.19.1:*:*:*:*:*:*:*,Eramba,Eramba
CVE-2023-36284,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03157,CWE-89,"An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remote attacker to bypass a web application's authentication and authorization mechanisms and retrieve the contents of an entire database.",2023-06-23,Nuclei,cpe:2.3:a:webkul:qloapps:1.6.0:*:*:*:*:*:*:*,Webkul,Qloapps
CVE-2023-36287,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01199,CWE-79,An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter.,2023-06-23,Nuclei,cpe:2.3:a:webkul:qloapps:1.6.0:*:*:*:*:*:*:*,Webkul,Qloapps
CVE-2023-36289,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01169,CWE-79,An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST email_create and back parameter.,2023-06-23,Nuclei,cpe:2.3:a:webkul:qloapps:1.6.0:*:*:*:*:*:*:*,Webkul,Qloapps
CVE-2023-36306,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03771,CWE-79,"A Cross Site Scripting (XSS) vulnerability in Adiscon Aiscon LogAnalyzer through 4.1.13 allows a remote attacker to execute arbitrary code via the asktheoracle.php, details.php, index.php, search.php, export.php, reports.php, and statistics.php components.",2023-08-08,Nuclei,cpe:2.3:a:adiscon:loganalyzer:*:*:*:*:*:*:*:*,Adiscon,Loganalyzer
CVE-2023-36346,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.05295,CWE-79,POS Codekop v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the nm_member parameter at print.php.,2023-06-23,Nuclei,cpe:2.3:a:codekop:codekop:2.0:*:*:*:*:*:*:*,Codekop,Codekop
CVE-2023-36347,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.34293,CWE-306,A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data.,2023-06-30,Nuclei,cpe:2.3:a:codekop:codekop:2.0:*:*:*:*:*:*:*,Codekop,Codekop
CVE-2023-36424,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.12184,CWE-125,Windows Common Log File System Driver Elevation of Privilege Vulnerability,2023-11-14,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2023-3643,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.75387,CWE-73,A vulnerability was found in Boss Mini 1.4.0 Build 6221. It has been classified as critical. This affects an unknown part of the file boss/servlet/document. The manipulation of the argument path leads to file inclusion. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-233889 was assigned to this vulnerability.,2023-07-12,Nuclei,cpe:2.3:h:carel:boss_mini:-:*:*:*:*:*:*:*;cpe:2.3:o:carel:boss_mini_firmware:1.4.0:build_6221:*:*:*:*:*:*,Carel,Boss Mini Firmware
CVE-2023-36563,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.20719,CWE-20,Microsoft WordPad Information Disclosure Vulnerability,2023-10-10,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2023-36584,5.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L,0.03055,NVD-CWE-noinfo,Windows Mark of the Web Security Feature Bypass Vulnerability,2023-10-10,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2023-36661,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.03055,CWE-918,"Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. (This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows.)",2023-06-25,Metasploit,cpe:2.3:a:shibboleth:xmltooling:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2023-36761,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.18959,CWE-20,Microsoft Word Information Disclosure Vulnerability,2023-09-12,CISA,cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*;cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*;cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:*;cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x86:*;cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:x64:*;cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:x86:*;cpe:2.3:a:microsoft:word:2013:sp1:*:*:*:*:x64:*;cpe:2.3:a:microsoft:word:2013:sp1:*:*:*:*:x86:*;cpe:2.3:a:microsoft:word:2013:sp1:*:*:rt:*:*:*;cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:x64:*;cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:x86:*,Microsoft,365 Apps
CVE-2023-36802,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.261,CWE-416,Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability,2023-09-12,CISA,cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1809
CVE-2023-36812,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.16501,CWE-74,"OpenTSDB is a open source, distributed, scalable Time Series Database (TSDB). OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. This issue has been patched in  commit `07c4641471c` and further refined in commit `fa88d3e4b`. These patches are available in the `2.4.2` release. Users are advised to upgrade. User unable to upgrade may disable Gunuplot via the config option`tsd.core.enable_ui = true` and remove the shell files `mygnuplot.bat` and `mygnuplot.sh`.",2023-06-30,Metasploit,cpe:2.3:a:opentsdb:opentsdb:*:*:*:*:*:*:*:*,Opentsdb,Opentsdb
CVE-2023-36844,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.91357,CWE-473,"A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables.

Using a crafted request an attacker is able to modify 

certain PHP environment variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities.
This issue affects Juniper Networks Junos OS on EX Series:



  *  All versions prior to 20.4R3-S9;
  *  21.1 versions 21.1R1 and later;
  *  21.2 versions prior to 21.2R3-S7;
  *  21.3 versions 

prior to 

 21.3R3-S5;
  *  21.4 versions 

prior to 

21.4R3-S5;
  *  22.1 versions 

prior to 

22.1R3-S4;
  *  22.2 versions 

prior to 

22.2R3-S2;
  *  22.3 versions 

prior to 22.3R3-S1;
  *  22.4 versions 

prior to 

22.4R2-S2, 22.4R3;
  *  23.2 versions prior to 

23.2R1-S1, 23.2R2.",2023-08-17,CISA/Nuclei,cpe:2.3:h:juniper:ex2200-c:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2200-vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2200:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300-24mp:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300-24p:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300-24t:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300-48mp:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300-48p:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300-48t:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300m:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex3200:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex3300-vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex3300:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4200-vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4200:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-24p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-24p:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-24t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-24t:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-32f-dc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-32f-s:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-32f:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48mp-s:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48mp:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48p:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48t-afi:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48t-dc-afi:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48t-dc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48t:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48tafi:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48tdc-afi:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48tdc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-mp:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300m:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4400:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4500-vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4500:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4550-vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4550:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4550\/vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4600-vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex6200:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex6210:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex8200-vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex8200:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex8208:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex8216:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex9200:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex9204:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex9208:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex9214:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex9250:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex9251:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex9253:-:*:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s7:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s8:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:23.2:r1:*:*:*:*:*:*,Juniper,Junos
CVE-2023-36845,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9415,CWE-473,"A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series 

and SRX Series 

allows an unauthenticated, network-based attacker to remotely execute code.

Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code.


This issue affects Juniper Networks Junos OS on EX Series


and 


SRX Series:



  *  All versions prior to 

20.4R3-S9;
  *  21.1 versions 21.1R1 and later;
  *  21.2 versions prior to 21.2R3-S7;
  *  21.3 versions prior to 21.3R3-S5;
  *  21.4 versions prior to 21.4R3-S5;
  *  22.1 versions 

prior to 

22.1R3-S4;
  *  22.2 versions 

prior to 

22.2R3-S2;
  *  22.3 versions 

prior to 

22.3R2-S2, 22.3R3-S1;
  *  22.4 versions 

prior to 

22.4R2-S1, 22.4R3;
  *  23.2 versions prior to 23.2R1-S1, 23.2R2.",2023-08-17,CISA/Metasploit/Nuclei,cpe:2.3:h:juniper:srx100:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx110:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx1400:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx1500:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx210:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx220:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx240:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx240h2:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx240m:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx300:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx320:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx3400:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx340:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx345:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx3600:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx380:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx4000:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx4100:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx4200:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx4600:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx5000:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx5400:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx550:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx550_hm:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx550m:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx5600:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx5800:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx650:-:*:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s7:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s8:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:23.2:r1:*:*:*:*:*:*,Juniper,Junos
CVE-2023-36846,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.94205,CWE-306,"A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.



With a specific request to user.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of 

integrity

for a certain 

part of the file system, which may allow chaining to other vulnerabilities.


This issue affects Juniper Networks Junos OS on SRX Series:



  *  All versions prior to 20.4R3-S8;
  *  21.1 versions 21.1R1 and later;
  *  21.2 versions prior to 21.2R3-S6;
  *  21.3 versions 

prior to 

 21.3R3-S5;
  *  21.4 versions 

prior to 

21.4R3-S5;
  *  22.1 versions 

prior to 

22.1R3-S3;
  *  22.2 versions 

prior to 

22.2R3-S2;
  *  22.3 versions 

prior to 

22.3R2-S2, 22.3R3;
  *  22.4 versions 

prior to 

22.4R2-S1, 22.4R3.",2023-08-17,CISA,cpe:2.3:h:juniper:srx100:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx110:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx1400:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx1500:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx210:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx220:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx240:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx240h2:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx240m:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx300:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx320:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx3400:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx340:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx345:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx3600:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx380:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx4000:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx4100:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx4200:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx4600:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx5000:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx5400:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx550:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx550_hm:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx550m:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx5600:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx5800:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx650:-:*:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s7:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r2:*:*:*:*:*:*,Juniper,Junos
CVE-2023-36847,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.84692,CWE-306,"A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.





With a specific request to installAppPackage.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of 

integrity

for a certain 

part of the file system, which may allow chaining to other vulnerabilities.


This issue affects Juniper Networks Junos OS on EX Series:



  *  All versions prior to 20.4R3-S8;
  *  21.1 versions 21.1R1 and later;
  *  21.2 versions prior to 21.2R3-S6;
  *  21.3 versions 

prior to 

 21.3R3-S5;
  *  21.4 versions 

prior to 

21.4R3-S4;
  *  22.1 versions 

prior to 

22.1R3-S3;
  *  22.2 versions 

prior to 

22.2R3-S1;
  *  22.3 versions 

prior to 

22.3R2-S2, 22.3R3;
  *  22.4 versions 

prior to 

22.4R2-S1, 22.4R3.",2023-08-17,CISA,cpe:2.3:h:juniper:ex2200-c:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2200-vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2200:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300-24mp:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300-24p:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300-24t:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300-48mp:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300-48p:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300-48t:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300m:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex3200:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex3300-vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex3300:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4200-vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4200:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-24p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-24p:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-24t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-24t:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-32f-dc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-32f-s:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-32f:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48mp-s:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48mp:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48p:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48t-afi:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48t-dc-afi:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48t-dc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48t:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48tafi:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48tdc-afi:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48tdc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-mp:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300m:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4400:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4500-vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4500:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4550-vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4550:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4550\/vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4600-vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex6200:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex6210:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex8200-vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex8200:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex8208:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex8216:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex9200:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex9204:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex9208:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex9214:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex9250:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex9251:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex9253:-:*:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3-s7:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:20.4:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.1:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.3:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r2:*:*:*:*:*:*,Juniper,Junos
CVE-2023-36851,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.01091,CWE-306,"A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.



With a specific request to 

webauth_operation.php

that doesn't require authentication, an attacker is able to upload and download arbitrary files via J-Web, leading to a loss of 

integrity or confidentiality, which may allow chaining to other vulnerabilities.


This issue affects Juniper Networks Junos OS on SRX Series:



  *  

21.2 versions prior to 21.2R3-S8;
  *  21.4 

versions prior to 

21.4R3-S6;
  *  22.1 

versions prior to 

22.1R3-S5;
  *  22.2 

versions prior to 

22.2R3-S3;
  *  22.3 

versions prior to 

22.3R3-S2;
  *  22.4 versions prior to 22,4R2-S2, 22.4R3;
  *  23.2 versions prior to 

23.2R1-S2, 23.2R2.",2023-09-27,CISA,cpe:2.3:h:juniper:ex2200-c:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2200-vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2200:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300-24mp:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300-24p:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300-24t:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300-48mp:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300-48p:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300-48t:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex2300m:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex3200:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex3300-vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex3300:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4200-vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4200:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-24p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-24p:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-24t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-24t:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-32f-dc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-32f-s:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-32f:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48mp-s:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48mp:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48p-s:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48p:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48t-afi:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48t-dc-afi:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48t-dc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48t-s:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48t:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48tafi:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48tdc-afi:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-48tdc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-mp:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300-vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4300m:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4400:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4500-vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4500:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4550-vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4550:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4550\/vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4600-vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex6200:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex6210:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex8200-vc:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex8200:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex8208:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex8216:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex9200:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex9204:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex9208:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex9214:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex9250:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex9251:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:ex9253:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx100:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx110:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx1400:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx1500:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx210:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx220:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx240:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx240h2:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx240m:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx300:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx320:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx3400:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx340:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx345:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx3600:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx380:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx4000:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx4100:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx4200:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx4600:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx5000:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx5400:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx550:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx550_hm:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx550m:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx5600:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx5800:-:*:*:*:*:*:*:*;cpe:2.3:h:juniper:srx650:-:*:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s7:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.1:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.3:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:23.2:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:23.2:r1:*:*:*:*:*:*,Juniper,Junos
CVE-2023-36874,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.42602,CWE-59,Windows Error Reporting Service Elevation of Privilege Vulnerability,2023-07-11,CISA/Metasploit,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2023-36884,7.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.98998,CWE-362,Windows Search Remote Code Execution Vulnerability,2023-07-11,CISA/EPSS,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2023-36934,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.94716,CWE-89,"In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.",2023-07-05,Nuclei,cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*,Progress,Moveit Transfer
CVE-2023-36969,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.49317,CWE-434,CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function.,2023-07-06,Metasploit,cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.17:*:*:*:*:*:*:*,Cmsmadesimple,Cms Made Simple
CVE-2023-3710,9.9,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H,0.33094,CWE-20,"Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).",2023-09-12,Nuclei,cpe:2.3:h:honeywell:pm43:-:*:*:*:*:*:x86:*;cpe:2.3:o:honeywell:pm43_firmware:*:*:*:*:*:*:*:*,Honeywell,Pm43 Firmware
CVE-2023-3722,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H,0.0386,CWE-434,An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier.,2023-07-19,Nuclei,cpe:2.3:a:avaya:aura_device_services:*:*:*:*:*:*:*:*,Avaya,Aura Device Services
CVE-2023-37265,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07356,CWE-306,"CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances. The problem was addressed by improving the detection of client IP addresses in `391dd7f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.",2023-07-17,Nuclei,cpe:2.3:a:icewhale:casaos-gateway:*:*:*:*:*:*:*:*;cpe:2.3:a:icewhale:casaos-gateway:0.4.4:alpha1:*:*:*:*:*:*;cpe:2.3:o:icewhale:casaos:*:*:*:*:*:*:*:*;cpe:2.3:o:icewhale:casaos:0.4.4:alpha1:*:*:*:*:*:*;cpe:2.3:o:icewhale:casaos:0.4.4:alpha2:*:*:*:*:*:*;cpe:2.3:o:icewhale:casaos:0.4.4:alpha3:*:*:*:*:*:*;cpe:2.3:o:icewhale:casaos:0.4.4:alpha4:*:*:*:*:*:*;cpe:2.3:o:icewhale:casaos:0.4.4:alpha5:*:*:*:*:*:*,Icewhale,Casaos
CVE-2023-37266,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06789,CWE-287,"CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit `705bf1f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.",2023-07-17,Nuclei,cpe:2.3:o:icewhale:casaos:*:*:*:*:*:*:*:*,Icewhale,Casaos
CVE-2023-37270,7.6,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L,0.045,CWE-89,"Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header `User-Agent` is vulnerable at the endpoint that records user information when logging in to the administrator screen. It is possible to execute arbitrary SQL statements. Someone who wants to exploit the vulnerability must be log in to the administrator screen, even with low privileges. Any SQL statement can be executed. Doing so may leak information from the database. Version 13.8.0 contains a fix for this issue. As another mitigation, those who want to execute a SQL statement verbatim with user-enterable parameters should be sure to escape the parameter contents appropriately.",2023-07-07,Nuclei,cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*,Piwigo,Piwigo
CVE-2023-37450,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.1895,NVD-CWE-noinfo,"The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.",2023-07-27,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:a:webkitgtk:webkitgtk\+:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2023-37462,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.91492,CWE-74,"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document `SkinsCode.XWikiSkinsSheet` leads to an injection vector from view right on that document to programming rights, or in other words, it is possible to execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to contain a dangerous payload. It is possible to check if an existing installation is vulnerable. See the linked GHSA for instructions on testing an installation. This issue has been patched in XWiki 14.4.8, 14.10.4 and 15.0-rc-1. Users are advised to upgrade. The fix commit `d9c88ddc` can also be applied manually to the impacted document `SkinsCode.XWikiSkinsSheet` and users unable to upgrade are advised to manually patch their installations.",2023-07-14,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2023-37474,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.4492,CWE-22,"Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root directory. This issue has been addressed in commit `043e3c7d` which has been included in release 1.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.",2023-07-14,Nuclei,cpe:2.3:a:9001:copyparty:*:*:*:*:*:*:*:*,9001,Copyparty
CVE-2023-37580,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.60034,CWE-79,Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.,2023-07-31,CISA/Nuclei,cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p11:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p26:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p30:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p32:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p33:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p34:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p35:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p37:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p38:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p40:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:*,Synacor,Zimbra Collaboration Suite
CVE-2023-37582,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.90427,CWE-94,"The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. 

When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function on the NameServer component to execute commands as the system users that RocketMQ is running as. 

It is recommended for users to upgrade their NameServer version to 5.1.2 or above for RocketMQ 5.x or 4.9.7 or above for RocketMQ 4.x to prevent these attacks.",2023-07-12,Nuclei,cpe:2.3:a:apache:rocketmq:*:*:*:*:*:*:*:*,Apache,Rocketmq
CVE-2023-37599,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03632,CWE-668,An issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via the modules directory,2023-07-13,Nuclei,cpe:2.3:a:issabel:pbx:4.0.0-6:*:*:*:*:*:*:*,Issabel,Pbx
CVE-2023-37629,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.23311,CWE-434,"Online Piggery Management System 1.0 is vulnerable to File Upload. An unauthenticated user can upload a php file by sending a POST request to ""add-pig.php.""",2023-07-12,Nuclei,cpe:2.3:a:simple_online_piggery_management_system_project:simple_online_piggery_management_system:1.0:*:*:*:*:*:*:*,Simple Online Piggery Management System Project,Simple Online Piggery Management System
CVE-2023-37645,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.24931,CWE-668,eyoucms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt.,2023-07-20,Nuclei,cpe:2.3:a:eyoucms:eyoucms:1.6.3:*:*:*:*:*:*:*,Eyoucms,Eyoucms
CVE-2023-3765,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.67324,CWE-36,Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.,2023-07-19,Nuclei,cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2023-37679,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96129,CWE-77,A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server.,2023-08-03,EPSS/Metasploit/Nuclei,cpe:2.3:a:nextgen:mirth_connect:4.3.0:*:*:*:*:*:*:*,Nextgen,Mirth Connect
CVE-2023-37728,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01164,CWE-79,IceWarp v10.2.1 was discovered to contain cross-site scripting (XSS) vulnerability via the color parameter.,2023-07-20,Nuclei,cpe:2.3:a:icewarp:icewarp:10.2.1:*:*:*:*:*:*:*,Icewarp,Icewarp
CVE-2023-37941,6.6,CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H,0.29226,CWE-502,"If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend.

The Superset metadata db is an 'internal' component that is typically 
only accessible directly by the system administrator and the superset 
process itself. Gaining access to that database should
 be difficult and require significant privileges.

This vulnerability impacts Apache Superset versions 1.5.0 up to and including 2.1.0. Users are recommended to upgrade to version 2.1.1 or later.",2023-09-06,Metasploit,cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*,Apache,Superset
CVE-2023-37979,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.0601,CWE-79,Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Saturday Drive Ninja Forms Contact Form plugin <= 3.6.25 versions.,2023-07-27,Nuclei,cpe:2.3:a:ninjaforms:ninja_forms:*:*:*:*:*:wordpress:*:*,Ninjaforms,Ninja Forms
CVE-2023-37988,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.01306,CWE-79,Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Creative Solutions Contact Form Generator plugin <= 2.5.5 versions.,2023-08-10,Nuclei,cpe:2.3:a:creative-solutions:contact_form_generator:*:*:*:*:*:wordpress:*:*,Creative-Solutions,Contact Form Generator
CVE-2023-37999,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03183,CWE-269,Improper Privilege Management vulnerability in HasThemes HT Mega allows Privilege Escalation.This issue affects HT Mega: from n/a through 2.2.0.,2024-05-17,Nuclei,cpe:2.3:a:hasthemes:ht_mega:*:*:*:*:free:wordpress:*:*,Hasthemes,Ht Mega
CVE-2023-38035,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99949,CWE-863,"A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.",2023-08-21,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:ivanti:mobileiron_sentry:*:*:*:*:*:*:*:*,Ivanti,Mobileiron Sentry
CVE-2023-38040,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01983,CWE-79,A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions..,2023-09-17,Nuclei,cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*,Revive-Adserver,Revive Adserver
CVE-2023-38096,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.81545,CWE-287,"NETGEAR ProSAFE Network Management System MyHandlerInterceptor Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of NETGEAR ProSAFE Network Management System. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the MyHandlerInterceptor class. The issue results from improper implementation of the authentication mechanism. An attacker can leverage this vulnerability to bypass authentication on the system.
. Was ZDI-CAN-19718.",2024-05-03,Metasploit,cpe:2.3:a:netgear:prosafe_network_management_system:*:*:*:*:*:*:*:*,Netgear,Prosafe Network Management System
CVE-2023-38098,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.12496,CWE-434,"NETGEAR ProSAFE Network Management System UpLoadServlet Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the UpLoadServlet class. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-19720.",2024-05-03,Metasploit,cpe:2.3:a:netgear:prosafe_network_management_system:*:*:*:*:*:*:*:*,Netgear,Prosafe Network Management System
CVE-2023-38146,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.39491,CWE-367,Windows Themes Remote Code Execution Vulnerability,2023-09-12,Metasploit,cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*,Microsoft,Windows 11 21H2
CVE-2023-38180,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.14688,NVD-CWE-noinfo,.NET and Visual Studio Denial of Service Vulnerability,2023-08-08,CISA,cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2023-38192,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01116,CWE-79,An issue was discovered in SuperWebMailer 9.00.0.01710. It allows superadmincreate.php XSS via crafted incorrect passwords.,2023-10-21,Nuclei,cpe:2.3:a:superwebmailer:superwebmailer:9.00.0.01710:*:*:*:*:*:*:*,Superwebmailer,Superwebmailer
CVE-2023-38194,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0114,CWE-79,An issue was discovered in SuperWebMailer 9.00.0.01710. It allows keepalive.php XSS via a GET parameter.,2023-10-21,Nuclei,cpe:2.3:a:superwebmailer:superwebmailer:9.00.0.01710:*:*:*:*:*:*:*,Superwebmailer,Superwebmailer
CVE-2023-38203,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96534,CWE-502,"Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.",2023-07-20,CISA/EPSS/Nuclei,cpe:2.3:a:adobe:coldfusion:2018:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update10:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update11:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update12:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update13:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update14:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update15:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update16:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update17:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update7:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update8:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update9:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update7:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*,Adobe,Coldfusion
CVE-2023-38205,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.99768,CWE-284,"Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.",2023-09-14,CISA/EPSS/Nuclei,cpe:2.3:a:adobe:coldfusion:2018:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update10:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update11:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update12:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update13:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update14:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update15:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update16:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update18:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update7:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update8:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2018:update9:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update7:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update8:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*,Adobe,Coldfusion
CVE-2023-3836,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.73024,CWE-434,A vulnerability classified as critical was found in Dahua Smart Park Management up to 20230713. This vulnerability affects unknown code of the file /emap/devicePoint_addImgIco?hasSubsystem=true. The manipulation of the argument upload leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-235162 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2023-07-22,Nuclei,cpe:2.3:a:dahuasecurity:smart_parking_management:*:*:*:*:*:*:*:*,Dahuasecurity,Smart Parking Management
CVE-2023-3843,3.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N,0.04852,CWE-79,A vulnerability was found in mooSocial mooDating 1.2. It has been classified as problematic. Affected is an unknown function of the file /matchmakings/question of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. VDB-235194 is the identifier assigned to this vulnerability. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.,2023-07-23,Nuclei,cpe:2.3:a:moosocial:moodating:1.2:*:*:*:*:*:*:*,Moosocial,Moodating
CVE-2023-38433,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.0299,CWE-798,"Fujitsu Real-time Video Transmission Gear ""IP series"" use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the products, and as a result, terminate the video transmission. Affected products and versions are as follows: IP-HE950E firmware versions V01L001 to V01L053, IP-HE950D firmware versions V01L001 to V01L053, IP-HE900E firmware versions V01L001 to V01L010, IP-HE900D firmware versions V01L001 to V01L004, IP-900E / IP-920E firmware versions V01L001 to V02L061, IP-900D / IP-900ⅡD / IP-920D firmware versions V01L001 to V02L061, IP-90 firmware versions V01L001 to V01L013, and IP-9610 firmware versions V01L001 to V02L007.",2023-07-26,Nuclei,cpe:2.3:h:fujitsu:ip-900d:-:*:*:*:*:*:*:*;cpe:2.3:h:fujitsu:ip-900e:-:*:*:*:*:*:*:*;cpe:2.3:h:fujitsu:ip-900iid:-:*:*:*:*:*:*:*;cpe:2.3:h:fujitsu:ip-90:-:*:*:*:*:*:*:*;cpe:2.3:h:fujitsu:ip-920d:-:*:*:*:*:*:*:*;cpe:2.3:h:fujitsu:ip-920e:-:*:*:*:*:*:*:*;cpe:2.3:h:fujitsu:ip-9610:-:*:*:*:*:*:*:*;cpe:2.3:h:fujitsu:ip-he900d:-:*:*:*:*:*:*:*;cpe:2.3:h:fujitsu:ip-he900e:-:*:*:*:*:*:*:*;cpe:2.3:h:fujitsu:ip-he950d:-:*:*:*:*:*:*:*;cpe:2.3:h:fujitsu:ip-he950e:-:*:*:*:*:*:*:*;cpe:2.3:o:fujitsu:ip-900d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:fujitsu:ip-900e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:fujitsu:ip-900iid_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:fujitsu:ip-90_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:fujitsu:ip-920d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:fujitsu:ip-920e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:fujitsu:ip-9610_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:fujitsu:ip-he900d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:fujitsu:ip-he900e_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:fujitsu:ip-he950d_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:fujitsu:ip-he950e_firmware:*:*:*:*:*:*:*:*,Fujitsu,Ip-He950E Firmware
CVE-2023-3844,3.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N,0.04852,CWE-79,A vulnerability was found in mooSocial mooDating 1.2. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /friends of the component URL Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-235195. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.,2023-07-23,Nuclei,cpe:2.3:a:moosocial:moodating:1.2:*:*:*:*:*:*:*,Moosocial,Moodating
CVE-2023-3845,3.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N,0.04852,CWE-79,A vulnerability was found in mooSocial mooDating 1.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /friends/ajax_invite of the component URL Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-235196. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.,2023-07-23,Nuclei,cpe:2.3:a:moosocial:moodating:1.2:*:*:*:*:*:*:*,Moosocial,Moodating
CVE-2023-3846,3.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N,0.04852,CWE-79,A vulnerability classified as problematic has been found in mooSocial mooDating 1.2. This affects an unknown part of the file /pages of the component URL Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-235197 was assigned to this vulnerability. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.,2023-07-23,Nuclei,cpe:2.3:a:moosocial:moodating:1.2:*:*:*:*:*:*:*,Moosocial,Moodating
CVE-2023-3847,3.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N,0.04852,CWE-79,A vulnerability classified as problematic was found in mooSocial mooDating 1.2. This vulnerability affects unknown code of the file /users of the component URL Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. VDB-235198 is the identifier assigned to this vulnerability. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.,2023-07-23,Nuclei,cpe:2.3:a:moosocial:moodating:1.2:*:*:*:*:*:*:*,Moosocial,Moodating
CVE-2023-3848,3.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N,0.04892,CWE-79,"A vulnerability, which was classified as problematic, has been found in mooSocial mooDating 1.2. This issue affects some unknown processing of the file /users/view of the component URL Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-235199. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.",2023-07-23,Nuclei,cpe:2.3:a:moosocial:moodating:1.2:*:*:*:*:*:*:*,Moosocial,Moodating
CVE-2023-3849,3.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N,0.04892,CWE-79,"A vulnerability, which was classified as problematic, was found in mooSocial mooDating 1.2. Affected is an unknown function of the file /find-a-match of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-235200. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.",2023-07-23,Nuclei,cpe:2.3:a:moosocial:moodating:1.2:*:*:*:*:*:*:*,Moosocial,Moodating
CVE-2023-38501,6.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L,0.06195,CWE-79,"copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cross-site scripting via URL-parameter `?k304=...` and `?setck=...`. The worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, using the account of the person who clicks the malicious link. It is recommended to change the passwords of one's copyparty accounts, unless one have inspected one's logs and found no trace of attacks. Version 1.8.7 contains a patch for the issue.",2023-07-25,Nuclei,cpe:2.3:a:9001:copyparty:*:*:*:*:*:*:*:*,9001,Copyparty
CVE-2023-38606,5.5,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N,0.01002,NVD-CWE-noinfo,"This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1.",2023-07-27,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2023-38646,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98677,NVD-CWE-noinfo,"Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.",2023-07-21,EPSS/Metasploit/Nuclei,cpe:2.3:a:metabase:metabase:*:*:*:*:-:*:*:*;cpe:2.3:a:metabase:metabase:*:*:*:*:enterprise:*:*:*,Metabase,Metabase
CVE-2023-38831,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.97798,CWE-345,"RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.",2023-08-23,CISA/EPSS/Metasploit,cpe:2.3:a:rarlab:winrar:*:*:*:*:*:*:*:*,Rarlab,Winrar
CVE-2023-38836,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.69003,CWE-434,File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks.,2023-08-21,Metasploit,cpe:2.3:a:boidcms:boidcms:2.0.0:*:*:*:*:*:*:*,Boidcms,Boidcms
CVE-2023-38875,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00824,CWE-79,"A reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'validator' parameter in '/reset-password'.",2023-09-20,Nuclei,cpe:2.3:a:msaad1999:php-login-system:2.0.1:*:*:*:*:*:*:*,Msaad1999,Php-Login-System
CVE-2023-38879,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03663,CWE-22,The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulnerability in the 'filename' parameter of 'DownloadWindow.php'.,2023-11-20,Nuclei,cpe:2.3:a:os4ed:opensis:9.0:*:*:*:community:*:*:*,Os4Ed,Opensis
CVE-2023-38950,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.8488,CWE-22,A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version 9.0.120240617.19506 of ZKBioTime.,2023-08-03,CISA/Nuclei,cpe:2.3:a:zkteco:biotime:*:*:*:*:*:*:*:*,Zkteco,Biotime
CVE-2023-38952,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02438,CWE-552,Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and admin users are not enforced and any authenticated user can leverage admin functions without restriction by making direct requests to administrative endpoints.,2023-08-03,Nuclei,cpe:2.3:a:zkteco:biotime:8.5.5:*:*:*:*:*:*:*,Zkteco,Biotime
CVE-2023-38964,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01056,CWE-79,Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability.,2023-08-04,Nuclei,cpe:2.3:a:creativeitem:academy_lms:6.0:*:*:*:*:*:*:*,Creativeitem,Academy Lms
CVE-2023-38992,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.72043,CWE-89,jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.,2023-07-28,Nuclei,cpe:2.3:a:jeecg:jeecg_boot:3.5.1:*:*:*:*:*:*:*,Jeecg,Jeecg Boot
CVE-2023-39002,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01162,CWE-79,A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.,2023-08-09,Nuclei,cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*,Opnsense,Opnsense
CVE-2023-39007,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.02315,CWE-79,/ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in app/controllers/OPNsense/Cron/ItemController.php.,2023-08-09,Nuclei,cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*,Opnsense,Opnsense
CVE-2023-39026,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.10562,CWE-22,Directory Traversal vulnerability in FileMage Gateway Windows Deployments v.1.10.8 and before allows a remote attacker to obtain sensitive information via a crafted request to the /mgmt/ component.,2023-08-22,Nuclei,cpe:2.3:a:filemage:filemage:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2023-39108,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02965,CWE-918,rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.,2023-08-01,Nuclei,cpe:2.3:a:rconfig:rconfig:3.9.4:*:*:*:*:*:*:*,Rconfig,Rconfig
CVE-2023-39109,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02965,CWE-918,rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.,2023-08-01,Nuclei,cpe:2.3:a:rconfig:rconfig:3.9.4:*:*:*:*:*:*:*,Rconfig,Rconfig
CVE-2023-39110,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02746,CWE-918,rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.,2023-08-01,Nuclei,cpe:2.3:a:rconfig:rconfig:3.9.4:*:*:*:*:*:*:*,Rconfig,Rconfig
CVE-2023-39121,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.02258,CWE-89,emlog v2.1.9 was discovered to contain a SQL injection vulnerability via the component /admin/user.php.,2023-08-03,Nuclei,cpe:2.3:a:emlog:emlog:2.1.9:-:*:*:*:*:*:*,Emlog,Emlog
CVE-2023-39141,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03051,CWE-22,webui-aria2 commit 4fe2e was discovered to contain a path traversal vulnerability.,2023-08-22,Nuclei,cpe:2.3:a:ziahamza:webui-aria2:-:*:*:*:*:*:*:*,Ziahamza,Webui-Aria2
CVE-2023-39143,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.78696,CWE-22,"PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code execution when external device integration is enabled (a very common configuration).",2023-08-04,Nuclei,cpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*;cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2023-39265,3.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N,0.83716,CWE-20,"Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is using a SQLite database for its metadata (not advised for production use) it could result in more severe vulnerabilities related to confidentiality and integrity. This vulnerability exists in Apache Superset versions up to and including 2.1.0.",2023-09-06,Metasploit,cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*,Apache,Superset
CVE-2023-3936,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0093,Missing_Data,"The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",2023-08-21,Nuclei,cpe:2.3:a:adenion:blog2social:*:*:*:*:*:wordpress:*:*,Adenion,Blog2Social
CVE-2023-39361,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.87688,CWE-89,"Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are being utilized in an enabled state, there could be the potential for significant damage. Attackers may exploit this vulnerability, and there may be possibilities for actions such as the usurpation of administrative privileges or remote code execution. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.",2023-09-05,Nuclei,cpe:2.3:a:cacti:cacti:1.2.24:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2023-39560,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04109,CWE-89,ECTouch v2 was discovered to contain a SQL injection vulnerability via the $arr['id'] parameter at \default\helpers\insert.php.,2023-08-28,Nuclei,cpe:2.3:a:ectouch:ectouch:2.0:*:*:*:*:*:*:*,Ectouch,Ectouch
CVE-2023-39598,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0139,CWE-79,Cross Site Scripting vulnerability in IceWarp Corporation WebClient v.10.2.1 allows a remote attacker to execute arbitrary code via a crafted payload to the mid parameter.,2023-09-05,Nuclei,cpe:2.3:a:icewarp:webclient:10.2.1:*:*:*:*:*:*:*,Icewarp,Webclient
CVE-2023-39600,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01165,CWE-79,IceWarp 11.4.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the color parameter.,2023-08-25,Nuclei,cpe:2.3:a:icewarp:icewarp:11.4.6.0:*:*:*:*:*:*:*,Icewarp,Icewarp
CVE-2023-39650,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03631,CWE-89,Theme Volty CMS Blog up to version v4.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /tvcmsblog/single.,2023-08-28,Nuclei,cpe:2.3:a:themevolty:theme_volty_cms_blog:*:*:*:*:*:prestashop:*:*,Themevolty,Theme Volty Cms Blog
CVE-2023-39676,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01343,CWE-79,FieldPopupNewsletter Prestashop Module v1.0.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback parameter at ajax.php.,2023-09-08,Nuclei,cpe:2.3:a:fieldthemes:fieldpopupnewsletter:1.0.0:*:*:*:*:prestashop:*:*,Fieldthemes,Fieldpopupnewsletter
CVE-2023-39677,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.30806,NVD-CWE-noinfo,MyPrestaModules Prestashop Module v6.2.9 and UpdateProducts Prestashop Module v3.6.9 were discovered to contain a PHPInfo information disclosure vulnerability via send.php.,2023-09-20,Nuclei,"cpe:2.3:a:myprestamodules:product_catalog_\(csv\,_excel\)_import:6.2.9:*:*:*:*:prestashop:*:*;cpe:2.3:a:updateproducts_project:updateproducts:3.6.9:*:*:*:*:prestashop:*:*",Myprestamodules,"Product Catalog (Csv, Excel) Import"
CVE-2023-39700,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01376,CWE-79,IceWarp Mail Server v10.4.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the color parameter.,2023-08-25,Nuclei,cpe:2.3:a:icewarp:mail_server:10.4.5:*:*:*:*:*:*:*,Icewarp,Mail Server
CVE-2023-39780,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.33641,CWE-78,"On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: for the similar ""token-generated module"" issue, see CVE-2023-41345; for the similar ""token-refresh module"" issue, see CVE-2023-41346; for the similar ""check token module"" issue, see CVE-2023-41347; and for the similar ""code-authentication module"" issue, see CVE-2023-41348.",2023-09-11,CISA,cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:*;cpe:2.3:o:asus:rt-ax55_firmware:3.0.0.4.386.51598:*:*:*:*:*:*:*,Asus,Rt-Ax55 Firmware
CVE-2023-39796,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06096,CWE-89,SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via the DB_RECORD_TABLE parameter.,2023-11-10,Nuclei,cpe:2.3:a:wbce:wbce_cms:1.6.0:*:*:*:*:*:*:*,Wbce,Wbce Cms
CVE-2023-3990,3.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N,0.01365,CWE-79,A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-235611.,2023-07-28,Nuclei,cpe:2.3:a:mingsoft:mcms:*:*:*:*:*:*:*:*,Mingsoft,Mcms
CVE-2023-40000,8.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L,0.54872,CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through 5.7.,2024-04-16,Nuclei,cpe:2.3:a:litespeedtech:litespeed_cache:*:*:*:*:*:wordpress:*:*,Litespeedtech,Litespeed Cache
CVE-2023-40044,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.9015,CWE-502,"In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.",2023-09-27,CISA/Metasploit/Nuclei,cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:*,Progress,Ws Ftp Server
CVE-2023-40208,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.0068,CWE-79,Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Aleksandar Urošević Stock Ticker plugin <= 3.23.3 versions.,2023-09-04,Nuclei,cpe:2.3:a:urosevic:stock_ticker:*:*:*:*:*:wordpress:*:*,Urosevic,Stock Ticker
CVE-2023-40211,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02025,CWE-200,Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid Combo – 36+ Gutenberg Blocks.This issue affects Post Grid Combo – 36+ Gutenberg Blocks: from n/a through 2.2.50.,2023-11-30,Nuclei,cpe:2.3:a:pickplugins:post_grid_combo:*:*:*:*:*:wordpress:*:*,Pickplugins,Post Grid Combo
CVE-2023-40315,5.3,CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L,0.02538,NVD-CWE-noinfo,"In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 and related Meridian versions, any user that has the ROLE_FILESYSTEM_EDITOR can easily escalate their privileges to ROLE_ADMIN or any other role. The solution is to upgrade to Meridian 2023.1.5 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue.",2023-08-17,Metasploit,cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*;cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*,Opennms,Horizon
CVE-2023-40355,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01081,CWE-79,"Cross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allows authenticated attackers to execute arbitrary code and obtain sensitive information via the logic for switching between the Standard and Ajax versions.",2024-02-07,Nuclei,cpe:2.3:a:axigen:axigen_mobile_webmail:*:*:*:*:*:*:*:*,Axigen,Axigen Mobile Webmail
CVE-2023-40498,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.82964,CWE-22,"LG Simple Editor cp Command Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the cp command implemented in the makeDetailContent method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
. Was ZDI-CAN-19925.",2024-05-03,Metasploit,cpe:2.3:a:lg:simple_editor:3.21.0:*:*:*:*:*:*:*,Lg,Simple Editor
CVE-2023-40504,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.87649,CWE-78,"LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the readVideoInfo method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
. Was ZDI-CAN-19953.",2024-05-03,Metasploit/Nuclei,cpe:2.3:a:lg:simple_editor:3.21.0:*:*:*:*:*:*:*,Lg,Simple Editor
CVE-2023-40600,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.02036,CWE-200,Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Exactly WWW EWWW Image Optimizer. It works only when debug.log is turned on.This issue affects EWWW Image Optimizer: from n/a through 7.2.0.,2023-11-30,Nuclei,cpe:2.3:a:ewww:image_optimizer:*:*:*:*:*:wordpress:*:*,Ewww,Image Optimizer
CVE-2023-40748,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02881,CWE-89,"PHPJabbers Food Delivery Script 3.0 has a SQL injection (SQLi) vulnerability in the ""q"" parameter of index.php.",2023-08-28,Nuclei,cpe:2.3:a:phpjabbers:food_delivery_script:3.0:*:*:*:*:*:*:*,Phpjabbers,Food Delivery Script
CVE-2023-40749,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03279,CWE-89,"PHPJabbers Food Delivery Script v3.0 is vulnerable to SQL Injection in the ""column"" parameter of index.php.",2023-08-28,Nuclei,cpe:2.3:a:phpjabbers:food_delivery_script:3.0:*:*:*:*:*:*:*,Phpjabbers,Food Delivery Script
CVE-2023-40750,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00966,CWE-79,"There is a Cross Site Scripting (XSS) vulnerability in the ""action"" parameter of index.php in PHPJabbers Yacht Listing Script v1.0.",2023-08-28,Nuclei,cpe:2.3:a:phpjabbers:yacht_listing_script:1.0:*:*:*:*:*:*:*,Phpjabbers,Yacht Listing Script
CVE-2023-40751,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01044,CWE-79,"PHPJabbers Fundraising Script v1.0 is vulnerable to Cross Site Scripting (XSS) via the ""action"" parameter of index.php.",2023-08-28,Nuclei,cpe:2.3:a:phpjabbers:fundraising_script:1.0:*:*:*:*:*:*:*,Phpjabbers,Fundraising Script
CVE-2023-40752,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00974,CWE-79,"There is a Cross Site Scripting (XSS) vulnerability in the ""action"" parameter of index.php in PHPJabbers Make an Offer Widget v1.0.",2023-08-28,Nuclei,cpe:2.3:a:phpjabbers:make_an_offer_widget:1.0:*:*:*:*:*:*:*,Phpjabbers,Make An Offer Widget
CVE-2023-40753,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01053,CWE-79,There is a Cross Site Scripting (XSS) vulnerability in the message parameter of index.php in PHPJabbers Ticket Support Script v3.2.,2023-08-28,Nuclei,cpe:2.3:a:phpjabbers:ticket_support_script:3.2:*:*:*:*:*:*:*,Phpjabbers,Ticket Support Script
CVE-2023-40755,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01202,CWE-79,"There is a Cross Site Scripting (XSS) vulnerability in the ""theme"" parameter of preview.php in PHPJabbers Callback Widget v1.0.",2023-08-28,Nuclei,cpe:2.3:a:phpjabbers:callback_widget:1.0:*:*:*:*:*:*:*,Phpjabbers,Callback Widget
CVE-2023-40779,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01355,CWE-601,An issue in IceWarp Mail Server Deep Castle 2 v.13.0.1.2 allows a remote attacker to execute arbitrary code via a crafted request to the URL.,2023-09-14,Nuclei,cpe:2.3:a:icewarp:deep_castle_g2:13.0.1.2:*:*:*:*:*:*:*,Icewarp,Deep Castle G2
CVE-2023-40924,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02885,CWE-22,SolarView Compact < 6.00 is vulnerable to Directory Traversal.,2023-09-08,Nuclei,cpe:2.3:h:contec:solarview_compact:-:*:*:*:*:*:*:*;cpe:2.3:o:contec:solarview_compact_firmware:*:*:*:*:*:*:*:*,Contec,Solarview Compact Firmware
CVE-2023-40931,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.11278,CWE-89,A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/banner_message-ajaxhelper.php,2023-09-19,Nuclei,cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*,Nagios,Nagios Xi
CVE-2023-41061,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.03151,NVD-CWE-noinfo,"A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.",2023-09-07,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2023-41064,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.15263,CWE-120,"A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.",2023-09-07,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2023-4110,3.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N,0.01766,CWE-79,A vulnerability has been found in PHP Jabbers Availability Booking Calendar 5.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument session_id leads to cross site scripting. The attack can be launched remotely. The identifier VDB-235957 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2023-08-03,Nuclei,cpe:2.3:a:phpjabbers:availability_booking_calendar:5.0:*:*:*:*:*:*:*,Phpjabbers,Availability Booking Calendar
CVE-2023-41109,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.64113,CWE-78,SmartNode SN200 (aka SN200) 3.21.2-23021 allows unauthenticated OS Command Injection.,2023-08-28,Nuclei,cpe:2.3:h:patton:smartnode_sn200:-:*:*:*:*:*:*:*;cpe:2.3:o:patton:smartnode_sn200_firmware:*:*:*:*:*:*:*:*,Patton,Smartnode Sn200 Firmware
CVE-2023-4111,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N,0.02499,CWE-79,A vulnerability was found in PHP Jabbers Bus Reservation System 1.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument index/pickup_id leads to cross site scripting. The attack may be launched remotely. VDB-235958 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2023-08-03,Nuclei,cpe:2.3:a:phpjabbers:bus_reservation_system:1.1:*:*:*:*:*:*:*,Phpjabbers,Bus Reservation System
CVE-2023-4112,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N,0.05177,CWE-79,A vulnerability was found in PHP Jabbers Shuttle Booking Software 1.0. It has been classified as problematic. This affects an unknown part of the file /index.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-235959. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2023-08-03,Nuclei,cpe:2.3:a:phpjabbers:shuttle_booking_software:1.0:*:*:*:*:*:*:*,Phpjabbers,Shuttle Booking Software
CVE-2023-4113,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N,0.05177,CWE-79,A vulnerability was found in PHP Jabbers Service Booking Script 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-235960. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2023-08-03,Nuclei,cpe:2.3:a:phpjabbers:service_booking_script:1.0:*:*:*:*:*:*:*,Phpjabbers,Service Booking Script
CVE-2023-4114,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N,0.05109,CWE-79,A vulnerability was found in PHP Jabbers Night Club Booking Software 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-235961 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2023-08-03,Nuclei,cpe:2.3:a:phpjabbers:night_club_booking_software:1.0:*:*:*:*:*:*:*,Phpjabbers,Night Club Booking Software
CVE-2023-4115,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N,0.05177,CWE-79,A vulnerability classified as problematic has been found in PHP Jabbers Cleaning Business 1.0. Affected is an unknown function of the file /index.php. The manipulation of the argument index leads to cross site scripting. It is possible to launch the attack remotely. VDB-235962 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2023-08-03,Nuclei,cpe:2.3:a:phpjabbers:cleaning_business_software:1.0:*:*:*:*:*:*:*,Phpjabbers,Cleaning Business Software
CVE-2023-4116,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N,0.0522,CWE-79,A vulnerability classified as problematic was found in PHP Jabbers Taxi Booking 2.0. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-235963. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2023-08-03,Nuclei,cpe:2.3:a:phpjabbers:taxi_booking_script:2.0:*:*:*:*:*:*:*,Phpjabbers,Taxi Booking Script
CVE-2023-41179,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.04739,CWE-94,"A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation.

Note that an attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.",2023-09-19,CISA,cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:-:*:*:*;cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:saas:*:*:*;cpe:2.3:a:trendmicro:worry-free_business_security:10.0:sp1:*:*:*:*:*:*;cpe:2.3:a:trendmicro:worry-free_business_security_services:-:*:*:*:saas:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2023-41265,9.6,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N,0.84967,CWE-444,"An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.",2023-08-29,CISA/Nuclei,cpe:2.3:a:qlik:qlik_sense:august_2022:-:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_10:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_11:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_1:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_2:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_3:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_4:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_5:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_6:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_7:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_8:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_9:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:-:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:patch_1:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:patch_2:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:patch_3:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:patch_4:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:patch_5:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:patch_6:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:patch_7:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2023:-:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2023:patch3:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2023:patch_1:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2023:patch_2:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:-:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_10:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_1:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_2:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_3:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_4:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_5:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_6:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_7:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_8:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_9:*:*:enterprise:windows:*:*,Qlik,Qlik Sense
CVE-2023-41266,8.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N,0.82646,CWE-22,"A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.",2023-08-29,CISA/Nuclei,cpe:2.3:a:qlik:qlik_sense:august_2022:-:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_10:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_11:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_1:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_2:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_3:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_4:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_5:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_6:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_7:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_8:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_9:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:-:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:patch_1:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:patch_2:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:patch_3:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:patch_4:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:patch_5:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:patch_6:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:patch_7:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2023:-:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2023:patch3:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2023:patch_1:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2023:patch_2:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:-:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_10:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_1:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_2:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_3:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_4:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_5:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_6:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_7:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_8:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_9:*:*:enterprise:windows:*:*,Qlik,Qlik Sense
CVE-2023-4136,7.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N,0.01304,CWE-79,"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.",2023-08-03,Nuclei,cpe:2.3:a:craftercms:craftercms:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:arm:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:x64:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:x86:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:arm:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:x64:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:arm:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:x86:*,Apple,Macos
CVE-2023-41425,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.54305,CWE-79,Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component.,2023-11-07,Metasploit,cpe:2.3:a:wondercms:wondercms:*:*:*:*:*:*:*:*,Wondercms,Wondercms
CVE-2023-4148,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00812,CWE-79,"The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2023-09-25,Nuclei,cpe:2.3:a:metaphorcreations:ditty:*:*:*:*:*:wordpress:*:*,Metaphorcreations,Ditty
CVE-2023-4151,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00645,Missing_Data,"The Store Locator WordPress plugin before 1.4.13 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",2023-09-04,Nuclei,cpe:2.3:a:agilelogix:store_locator:*:*:*:*:*:wordpress:*:*,Agilelogix,Store Locator
CVE-2023-41538,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01093,CWE-79,phpjabbers PHP Forum Script 3.0 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter.,2023-08-30,Nuclei,cpe:2.3:a:phpjabbers:php_forum_script:3.0:*:*:*:*:*:*:*,Phpjabbers,Php Forum Script
CVE-2023-41597,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01224,CWE-79,EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /admin/twitter.php?active_t.,2023-11-15,Nuclei,cpe:2.3:a:eyoucms:eyoucms:1.6.2:*:*:*:*:*:*:*,Eyoucms,Eyoucms
CVE-2023-41599,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.11215,CWE-22,An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal.,2023-09-19,Nuclei,cpe:2.3:a:jfinalcms_project:jfinalcms:5.0.0:*:*:*:*:*:*:*,Jfinalcms Project,Jfinalcms
CVE-2023-41621,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01146,CWE-79,A Cross Site Scripting (XSS) vulnerability was discovered in Emlog Pro v2.1.14 via the component /admin/store.php.,2023-12-13,Nuclei,cpe:2.3:a:emlog:emlog:2.1.14:*:*:*:pro:*:*:*,Emlog,Emlog
CVE-2023-41642,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01071,CWE-79,Multiple reflected cross-site scripting (XSS) vulnerabilities in the ErroreNonGestito.aspx component of GruppoSCAI RealGimm 1.1.37p38 allow attackers to execute arbitrary Javascript in the context of a victim user's browser via a crafted payload injected into the VIEWSTATE parameter.,2023-08-31,Nuclei,cpe:2.3:a:grupposcai:realgimm:1.1.37:p38:*:*:*:*:*:*,Grupposcai,Realgimm
CVE-2023-4168,4.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N,0.36205,CWE-200,A vulnerability was found in Templatecookie Adlisting 2.14.0. It has been classified as problematic. Affected is an unknown function of the file /ad-list of the component Redirect Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-236184. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2023-08-05,Nuclei,cpe:2.3:a:templatecookie:adlisting:2.14.0:*:*:*:*:*:*:*,Templatecookie,Adlisting
CVE-2023-4169,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.47109,CWE-284,A vulnerability was found in Ruijie RG-EW1200G 1.0(1)B1P5. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /api/sys/set_passwd of the component Administrator Password Handler. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-236185 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2023-08-05,Nuclei,cpe:2.3:h:ruijie:rg-ew1200g:-:*:*:*:*:*:*:*;cpe:2.3:o:ruijie:rg-ew1200g_firmware:1.0\(1\)b1p5:*:*:*:*:*:*:*,Ruijie,Rg-Ew1200G Firmware
CVE-2023-4173,3.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N,0.03336,CWE-79,"A vulnerability, which was classified as problematic, was found in mooSocial mooStore 3.1.6. Affected is an unknown function of the file /search/index. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-236208.",2023-08-06,Nuclei,cpe:2.3:a:moosocial:moostore:3.1.6:*:*:*:*:*:*:*,Moosocial,Moostore
CVE-2023-4174,3.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N,0.05271,CWE-79,A vulnerability has been found in mooSocial mooStore 3.1.6 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. The identifier VDB-236209 was assigned to this vulnerability.,2023-08-06,Nuclei,cpe:2.3:a:moosocial:moostore:3.1.6:*:*:*:*:*:*:*,Moosocial,Moostore
CVE-2023-41763,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.90353,CWE-918,Skype for Business Elevation of Privilege Vulnerability,2023-10-10,CISA/Nuclei,cpe:2.3:a:microsoft:skype_for_business_server:2015:cumulative_update_13:*:*:*:*:*:*;cpe:2.3:a:microsoft:skype_for_business_server:2019:cumulative_update_7:*:*:*:*:*:*,Microsoft,Skype For Business Server
CVE-2023-41892,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L,0.92918,CWE-94,"Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in Craft CMS 4.4.15.",2023-09-13,Metasploit/Nuclei,cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*,Craftcms,Craft Cms
CVE-2023-41954,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L,0.01397,CWE-269,Improper Privilege Management vulnerability in ProfilePress Membership Team ProfilePress allows Privilege Escalation.This issue affects ProfilePress: from n/a through 4.13.1.,2024-05-17,Nuclei,cpe:2.3:a:properfraction:profilepress:*:*:*:*:*:wordpress:*:*,Properfraction,Profilepress
CVE-2023-41974,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.0141,CWE-416,"A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, iOS 15.8.7 and iPadOS 15.8.7. An app may be able to execute arbitrary code with kernel privileges.",2024-01-10,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2023-41990,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.01145,NVD-CWE-noinfo,"The issue was addressed with improved handling of caches. This issue is fixed in tvOS 16.3, iOS 16.3 and iPadOS 16.3, macOS Monterey 12.6.8, macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Ventura 13.2, watchOS 9.3. Processing a font file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1.",2023-09-12,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2023-41991,5.5,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N,0.04547,CWE-295,"A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.",2023-09-21,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:17.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:17.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2023-41992,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02918,CWE-754,"The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.",2023-09-21,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:17.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:17.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2023-41993,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.29179,CWE-754,The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.,2023-09-21,CISA,cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*;cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:cloud_insights_storage_workload_security_agent:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*;cpe:2.3:a:oracle:graalvm:20.3.13:*:*:*:enterprise:*:*:*;cpe:2.3:a:oracle:graalvm:21.3.9:*:*:*:enterprise:*:*:*;cpe:2.3:a:oracle:jdk:1.8.0:update401:*:*:*:*:*:*;cpe:2.3:a:oracle:jre:1.8.0:update401:*:*:*:*:*:*;cpe:2.3:a:webkitgtk:webkitgtk\+:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*,Apple,Ipados
CVE-2023-4211,5.5,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.01361,CWE-416,A local non-privileged user can make improper GPU memory processing operations  to gain access to already freed memory.,2023-10-01,CISA,cpe:2.3:a:arm:5th_gen_gpu_architecture_kernel_driver:*:*:*:*:*:*:*:*;cpe:2.3:a:arm:bifrost_gpu_kernel_driver:*:*:*:*:*:*:*:*;cpe:2.3:a:arm:midgard_gpu_kernel_driver:*:*:*:*:*:*:*:*;cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:*,Arm,5Th Gen Gpu Architecture Kernel Driver
CVE-2023-4220,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.76084,CWE-434,Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.,2023-11-28,Metasploit/Nuclei,cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*,Chamilo,Chamilo Lms
CVE-2023-42343,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0059,CWE-79,A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.,2026-05-08,Nuclei,,,
CVE-2023-42344,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.02231,CWE-611,Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet.,2026-05-08,Nuclei,,,
CVE-2023-42442,8.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H,0.55861,CWE-287,"JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api `/api/v1/terminal/sessions/` permission control is broken and can be accessed anonymously. SessionViewSet permission classes set to `[RBACPermission | IsSessionAssignee]`, relation is or, so any permission matched will be allowed. Versions 3.5.5 and 3.6.4 have a fix. After upgrading, visit the api `$HOST/api/v1/terminal/sessions/?limit=1`. The expected http response code is 401 (`not_authenticated`).
",2023-09-15,Nuclei,cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:*,Fit2Cloud,Jumpserver
CVE-2023-42793,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99979,CWE-288,In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible,2023-09-19,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*,Jetbrains,Teamcity
CVE-2023-42824,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.00943,NVD-CWE-noinfo,The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.,2023-10-04,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2023-4284,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00709,Missing_Data,"The Post Timeline WordPress plugin before 2.2.6 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",2023-09-04,Nuclei,cpe:2.3:a:agilelogix:post_timeline:*:*:*:*:*:wordpress:*:*,Agilelogix,Post Timeline
CVE-2023-42916,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.17823,CWE-125,"An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.",2023-11-30,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:a:webkitgtk:webkitgtk\+:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*,Apple,Ipados
CVE-2023-42917,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.0937,CWE-787,"A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.",2023-11-30,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:a:webkitgtk:webkitgtk\+:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*,Apple,Ipados
CVE-2023-43000,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.03955,CWE-416,"A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.",2025-11-05,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2023-43177,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.81801,CWE-913,CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.,2023-11-18,Metasploit/Nuclei,cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*,Crushftp,Crushftp
CVE-2023-43187,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.45401,CWE-91,A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests.,2023-09-27,Nuclei,cpe:2.3:a:nodebb:nodebb:*:*:*:*:*:*:*:*,Nodebb,Nodebb
CVE-2023-43208,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.82708,CWE-78,NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.,2023-10-26,CISA/Metasploit/Nuclei,cpe:2.3:a:nextgen:mirth_connect:*:*:*:*:*:*:*:*,Nextgen,Mirth Connect
CVE-2023-43261,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.59342,CWE-532,"An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components.",2023-10-04,Nuclei,cpe:2.3:h:milesight:ur32:-:*:*:*:*:*:*:*;cpe:2.3:h:milesight:ur32l:-:*:*:*:*:*:*:*;cpe:2.3:h:milesight:ur35:-:*:*:*:*:*:*:*;cpe:2.3:h:milesight:ur41:-:*:*:*:*:*:*:*;cpe:2.3:h:milesight:ur51:-:*:*:*:*:*:*:*;cpe:2.3:h:milesight:ur52:-:*:*:*:*:*:*:*;cpe:2.3:h:milesight:ur55:-:*:*:*:*:*:*:*;cpe:2.3:o:milesight:ur32_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:milesight:ur32l_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:milesight:ur35_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:milesight:ur41_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:milesight:ur5x_firmware:*:*:*:*:*:*:*:*,Milesight,Ur5X Firmware
CVE-2023-43323,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.0186,NVD-CWE-noinfo,"mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP and DNS request to external server. The Parameters effected are multiple - messageText, data[wall_photo], data[userShareVideo] and data[userShareLink].",2023-09-28,Nuclei,cpe:2.3:a:moosocial:moosocial:3.1.8:*:*:*:*:*:*:*,Moosocial,Moosocial
CVE-2023-43325,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01857,CWE-79,A reflected cross-site scripting (XSS) vulnerability in the data[redirect_url] parameter of mooSocial v3.1.8 allows attackers to steal user's session cookies and impersonate their account via a crafted URL.,2023-09-26,Nuclei,cpe:2.3:a:moosocial:moosocial:3.1.8:*:*:*:*:*:*:*,Moosocial,Moosocial
CVE-2023-43326,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01615,CWE-79,A reflected cross-site scripting (XSS) vulnerability exisits in multiple url of mooSocial v3.1.8 allows attackers to steal user's session cookies and impersonate their account via a crafted URL.,2023-09-25,Nuclei,cpe:2.3:a:moosocial:moosocial:3.1.8:*:*:*:*:*:*:*,Moosocial,Moosocial
CVE-2023-43373,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03753,CWE-89,Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the n_utente_agg parameter at /hoteldruid/interconnessioni.php.,2023-09-20,Nuclei,cpe:2.3:a:digitaldruid:hoteldruid:3.0.5:*:*:*:*:*:*:*,Digitaldruid,Hoteldruid
CVE-2023-43374,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03272,CWE-89,Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the id_utente_log parameter at /hoteldruid/personalizza.php.,2023-09-20,Nuclei,cpe:2.3:a:digitaldruid:hoteldruid:3.0.5:*:*:*:*:*:*:*,Digitaldruid,Hoteldruid
CVE-2023-4346,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.00855,CWE-645,"
KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way. 

",2023-08-29,CISA,cpe:2.3:a:knx:connection_authorization:-:*:*:*:*:*:*:*,Knx,Connection Authorization
CVE-2023-43472,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.36582,NVD-CWE-noinfo,An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API.,2023-12-05,Nuclei,cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*,Lfprojects,Mlflow
CVE-2023-43654,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.35256,CWE-918,"TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and sensitive data. This issue is present in versions 0.1.0 to 0.8.1. A user is able to load the model of their choice from any URL that they would like to use. The user of TorchServe is responsible for configuring both the allowed_urls and specifying the model URL to be used. A pull request to warn the user when the default value for allowed_urls is used has been merged in PR #2534. TorchServe release 0.8.2 includes this change. Users are advised to upgrade. There are no known workarounds for this issue.",2023-09-28,Metasploit/Nuclei,cpe:2.3:a:pytorch:torchserve:*:*:*:*:*:*:*:*,Pytorch,Torchserve
CVE-2023-43662,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.08147,CWE-22,"ShokoServer is a media server which specializes in organizing anime. In affected versions the `/api/Image/WithPath` endpoint is accessible without authentication and is supposed to return default server images. The endpoint accepts the parameter `serverImagePath`, which is not sanitized in any way before being passed to `System.IO.File.OpenRead`, which results in an arbitrary file read. This issue may lead to an arbitrary file read which is exacerbated in the windows installer which installs the ShokoServer as administrator. Any unauthenticated attacker may be able to access sensitive information and read files stored on the server. The `/api/Image/WithPath` endpoint has been removed in commit `6c57ba0f0` which will be included in subsequent releases. Users should limit access to the `/api/Image/WithPath` endpoint or manually patch their installations until a patched release is made. This issue was discovered by the GitHub Security lab and is also indexed as GHSL-2023-191.",2023-09-28,Nuclei,cpe:2.3:a:shokoanime:shokoserver:*:*:*:*:*:*:*:*,Shokoanime,Shokoserver
CVE-2023-43770,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.58483,CWE-79,"Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.",2023-09-22,CISA,cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2023-43795,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L,0.67715,CWE-918,GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The OGC Web Processing Service (WPS) specification is designed to process information from any server using GET and POST requests. This presents the opportunity for Server Side Request Forgery. This vulnerability has been patched in version 2.22.5 and 2.23.2.,2023-10-25,Nuclei,cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*,Osgeo,Geoserver
CVE-2023-44012,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01258,CWE-79,Cross Site Scripting vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the helpkey parameter in the Help.aspx component.,2023-10-02,Nuclei,cpe:2.3:a:mojoportal:mojoportal:2.7.0.0:*:*:*:*:*:*:*,Mojoportal,Mojoportal
CVE-2023-4415,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.56147,CWE-287,A vulnerability was found in Ruijie RG-EW1200G 07161417 r483. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/sys/login. The manipulation leads to improper authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-237518 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2023-08-18,Nuclei,cpe:2.3:h:ruijienetworks:rg-ew1200g:-:*:*:*:*:*:*:*;cpe:2.3:o:ruijienetworks:rg-ew1200g_firmware:07161417_r483:*:*:*:*:*:*:*,Ruijienetworks,Rg-Ew1200G Firmware
CVE-2023-44221,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.74933,CWE-78,"Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.",2023-12-05,CISA,cpe:2.3:h:sonicwall:sma_200:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_210:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_400:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_410:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_500v:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_210_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_410_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_500v_firmware:*:*:*:*:*:*:*:*,Sonicwall,Sma 200 Firmware
CVE-2023-44352,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.84811,CWE-79,"Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.",2023-11-17,Nuclei,cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update10:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update11:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update7:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update8:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update9:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*,Adobe,Coldfusion
CVE-2023-44353,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.80178,CWE-502,Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.,2023-11-17,Nuclei,cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update10:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update11:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update7:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update8:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update9:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*,Adobe,Coldfusion
CVE-2023-44393,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N,0.01277,CWE-79,"Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting (XSS) vulnerability is in the` /admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]` page. This vulnerability can be exploited by an attacker to inject malicious HTML and JS code into the HTML page, which could then be executed by admin users when they visit the URL with the payload. The vulnerability is caused by the insecure injection of the `plugin_id` value from the URL into the HTML page. An attacker can exploit this vulnerability by crafting a malicious URL that contains a specially crafted `plugin_id` value. When a victim who is logged in as an administrator visits this URL, the malicious code will be injected into the HTML page and executed. This vulnerability can be exploited by any attacker who has access to a malicious URL. However, only users who are logged in as administrators are affected. This is because the vulnerability is only present on the `/admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]` page, which is only accessible to administrators. Version 14.0.0.beta4 contains a patch for this issue.",2023-10-09,Nuclei,cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*;cpe:2.3:a:piwigo:piwigo:14.0.0:beta1:*:*:*:*:*:*;cpe:2.3:a:piwigo:piwigo:14.0.0:beta2:*:*:*:*:*:*;cpe:2.3:a:piwigo:piwigo:14.0.0:beta3:*:*:*:*:*:*,Piwigo,Piwigo
CVE-2023-44487,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.99999,NVD-CWE-noinfo,"The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.",2023-10-10,CISA/EPSS,cpe:2.3:a:akka:http_server:*:*:*:*:*:*:*:*;cpe:2.3:a:amazon:opensearch_data_prepper:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone11:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:*;cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*;cpe:2.3:a:apple:swiftnio_http\/2:*:*:*:*:*:swift:*:*;cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:business_process_automation:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:connected_mobile_experiences:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:crosswork_data_gateway:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:crosswork_situation_manager:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:crosswork_zero_touch_provisioning:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:data_center_network_manager:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:enterprise_chat_and_email:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:expressway:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:iot_field_network_director:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_access_registrar:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_cable_provisioning:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_infrastructure:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:prime_network_registrar:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_dynamic_attributes_connector:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_malware_analytics:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:telepresence_video_communication_server:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ultra_cloud_core_-_policy_control_function:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ultra_cloud_core_-_policy_control_function:2024.01.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ultra_cloud_core_-_serving_gateway_function:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ultra_cloud_core_-_session_management_function:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_attendant_console_advanced:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_contact_center_domain_manager:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_contact_center_enterprise:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_contact_center_enterprise_-_live_data_server:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unified_contact_center_management_portal:-:*:*:*:*:*:*:*;cpe:2.3:a:dena:h2o:*:*:*:*:*:*:*:*;cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*;cpe:2.3:a:envoyproxy:envoy:1.24.10:*:*:*:*:*:*:*;cpe:2.3:a:envoyproxy:envoy:1.25.9:*:*:*:*:*:*:*;cpe:2.3:a:envoyproxy:envoy:1.26.4:*:*:*:*:*:*:*;cpe:2.3:a:envoyproxy:envoy:1.27.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_access_policy_manager:17.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:17.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:17.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:17.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:17.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:17.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:17.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_carrier-grade_nat:17.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:17.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_domain_name_system:17.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_fraud_protection_service:17.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:17.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:17.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:17.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_next:20.0.1:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_next_service_proxy_for_kubernetes:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:17.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_ssl_orchestrator:17.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:17.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_websafe:17.1.0:*:*:*:*:*:*:*;cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:nginx_plus:r29:-:*:*:*:*:*:*;cpe:2.3:a:f5:nginx_plus:r30:-:*:*:*:*:*:*;cpe:2.3:a:facebook:proxygen:*:*:*:*:*:*:*:*;cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*;cpe:2.3:a:golang:http2:*:*:*:*:*:go:*:*;cpe:2.3:a:golang:networking:*:*:*:*:*:go:*:*;cpe:2.3:a:grpc:grpc:*:*:*:*:*:-:*:*;cpe:2.3:a:grpc:grpc:*:*:*:*:*:go:*:*;cpe:2.3:a:grpc:grpc:1.57.0:-:*:*:*:go:*:*;cpe:2.3:a:ietf:http:2.0:*:*:*:*:*:*:*;cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*;cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*;cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*;cpe:2.3:a:kazu-yamamoto:http2:*:*:*:*:*:*:*:*;cpe:2.3:a:konghq:kong_gateway:*:*:*:*:enterprise:*:*:*;cpe:2.3:a:linecorp:armeria:*:*:*:*:*:*:*:*;cpe:2.3:a:linkerd:linkerd:*:*:*:*:stable:kubernetes:*:*;cpe:2.3:a:linkerd:linkerd:2.13.0:*:*:*:stable:kubernetes:*:*;cpe:2.3:a:linkerd:linkerd:2.13.1:*:*:*:stable:kubernetes:*:*;cpe:2.3:a:linkerd:linkerd:2.14.0:*:*:*:stable:kubernetes:*:*;cpe:2.3:a:linkerd:linkerd:2.14.1:*:*:*:stable:kubernetes:*:*;cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:azure_kubernetes_service:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:cbl-mariner:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:astra_control_center:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*;cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*;cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:*;cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*;cpe:2.3:a:openresty:openresty:*:*:*:*:*:*:*:*;cpe:2.3:a:projectcontour:contour:*:*:*:*:*:kubernetes:*:*;cpe:2.3:a:redhat:3scale_api_management_platform:2.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:advanced_cluster_security:3.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:advanced_cluster_security:4.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:build_of_optaplanner:8.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:ceph_storage:5.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:cert-manager_operator_for_red_hat_openshift:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:certification_for_red_hat_enterprise_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:certification_for_red_hat_enterprise_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:cost_management:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:cryostat:2.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:fence_agents_remediation_operator:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:integration_camel_for_spring_boot:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_a-mq:7:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_a-mq_streams:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:logging_subsystem_for_red_hat_openshift:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:machine_deletion_remediation_operator:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:migration_toolkit_for_applications:6.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:migration_toolkit_for_containers:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:migration_toolkit_for_virtualization:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:network_observability_operator:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:node_healthcheck_operator:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:node_maintenance_operator:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift:-:*:*:*:*:aws:*:*;cpe:2.3:a:redhat:openshift_api_for_data_protection:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_container_platform_assisted_installer:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_data_science:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_dev_spaces:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_developer_tools_and_services:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_distributed_tracing:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_gitops:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_pipelines:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_sandboxed_containers:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_secondary_scheduler_operator:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_serverless:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_service_mesh:2.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_virtualization:4:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openstack_platform:16.1:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openstack_platform:16.2:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openstack_platform:17.1:*:*:*:*:*:*:*;cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:run_once_duration_override_operator:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:self_node_remediation_operator:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:service_interconnect:1.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:service_telemetry_framework:1.5:*:*:*:*:*:*:*;cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:support_for_spring_boot:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:web_terminal:-:*:*:*:*:*:*:*;cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:*;cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*;cpe:2.3:a:siemens:sinec_ins:1.0:sp2:*:*:*:*:*:*;cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_1:*:*:*:*:*:*;cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_2:*:*:*:*:*:*;cpe:2.3:a:siemens:sinec_nms:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:st7_scadaconnect:*:*:*:*:*:*:*:*;cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*;cpe:2.3:a:traefik:traefik:3.0.0:beta1:*:*:*:*:*:*;cpe:2.3:a:traefik:traefik:3.0.0:beta2:*:*:*:*:*:*;cpe:2.3:a:traefik:traefik:3.0.0:beta3:*:*:*:*:*:*;cpe:2.3:a:varnish_cache_project:varnish_cache:*:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3016:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3016q:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3048:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3064-32t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3064-t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3064-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3064:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3064t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3064x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3100-v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3100-z:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3100:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3100v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_31108pc-v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_31108pv-v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_31108tc-v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_31128pq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3132c-z:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3132q-v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3132q-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3132q-x\/3132q-xl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3132q-xl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3132q:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3164q:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3172:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3172pq-xl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3172pq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3172pq\/pq-xl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3172tq-32t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3172tq-xl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3172tq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3200:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3232:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3232c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3232c_:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3264c-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3264q:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3400:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3408-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_34180yc:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_34200yc-sm:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3432d-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3464c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3500:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3524-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3524-x\/xl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3524-xl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3524:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3548-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3548-x\/xl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3548-xl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3548:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3600:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_36180yc-r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3636c-r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9000v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9200:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9200yc:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_92160yc-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_92160yc_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9221c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_92300yc:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_92300yc_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_92304qc:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_92304qc_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9232e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_92348gc-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9236c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9236c_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9272q:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9272q_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9300:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93108tc-ex-24:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93108tc-ex:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93108tc-ex_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93108tc-fx-24:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93108tc-fx3h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93108tc-fx3p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93108tc-fx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93120tx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93120tx_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93128:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93128tx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93128tx_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9316d-gx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93180lc-ex:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93180lc-ex_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93180tc-ex:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93180yc-ex-24:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93180yc-ex:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93180yc-ex_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93180yc-fx-24:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93180yc-fx3:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93180yc-fx3h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93180yc-fx3s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93180yc-fx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93216tc-fx2:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93240tc-fx2:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93240yc-fx2:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9332c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9332d-gx2b:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9332d-h2r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9332pq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9332pq_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93360yc-fx2:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9336c-fx2-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9336c-fx2:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9336pq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9336pq_aci:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9336pq_aci_spine:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9336pq_aci_spine_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9348d-gx2a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9348gc-fx3:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9348gc-fxp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93600cd-gx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9364c-gx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9364c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9364d-gx2a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9372px-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9372px-e_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9372px:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9372px_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9372tx-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9372tx-e_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9372tx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9372tx_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9396px:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9396px_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9396tx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9396tx_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9408:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9432pq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9500:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9500_16-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9500_4-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9500_8-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9500_supervisor_a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9500_supervisor_a\+:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9500_supervisor_b:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9500_supervisor_b\+:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9500r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9504:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9504_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9508:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9508_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9516:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9516_switch:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9536pq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9636pq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9716d-gx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9736pq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9800:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9804:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9808:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:secure_web_appliance:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:ruggedcom_ape1808:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518-4_pn\/dp:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:siplus_s7-1500_cpu_1518-4_pn\/dp_mfp:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:fog_director:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:secure_web_appliance_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:siplus_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:*,Siemens,Simatic S7-1500 Cpu 1518F-4 Pn/Dp Mfp Firmware
CVE-2023-4450,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.11407,CWE-74,A vulnerability was found in jeecgboot JimuReport up to 1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Template Handler. The manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.6.1 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-237571.,2023-08-21,Nuclei,cpe:2.3:a:jeecg:jimureport:*:*:*:*:*:*:*:*,Jeecg,Jimureport
CVE-2023-4451,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02287,CWE-79,Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.,2023-08-20,Nuclei,cpe:2.3:a:agentejo:cockpit:*:*:*:*:*:*:*:*,Agentejo,Cockpit
CVE-2023-44812,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01897,CWE-79,Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the admin_redirect_url parameter of the user login function.,2023-10-09,Nuclei,cpe:2.3:a:moosocial:moosocial:3.1.8:*:*:*:*:*:*:*,Moosocial,Moosocial
CVE-2023-44813,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01754,CWE-79,Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of the invite friend login function.,2023-10-09,Nuclei,cpe:2.3:a:moosocial:moosocial:3.1.8:*:*:*:*:*:*:*,Moosocial,Moosocial
CVE-2023-4490,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03096,Missing_Data,"The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users",2023-09-25,Nuclei,cpe:2.3:a:wpjobportal:wp_job_portal:*:*:*:*:*:wordpress:*:*,Wpjobportal,Wp Job Portal
CVE-2023-44982,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01425,CWE-200,"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina).This issue affects Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina): from n/a through 6.4.5.",2023-12-19,Nuclei,cpe:2.3:a:meowapps:perfect_images:*:*:*:*:*:wordpress:*:*,Meowapps,Perfect Images
CVE-2023-45038,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N,0.01173,CWE-287,"An improper authentication vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to compromise the security of the system via a network.

We have already fixed the vulnerability in the following version:
Music Station 5.4.0 and later",2024-09-06,Nuclei,cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*,Qnap,Music Station
CVE-2023-45136,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.05124,CWE-79,"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When document names are validated according to a name strategy (disabled by default), XWiki starting in version 12.0-rc-1 and prior to versions 12.10.12 and 15.5-rc-1 is vulnerable to a reflected cross-site scripting attack in the page creation form. This allows an attacker to execute arbitrary actions with the rights of the user opening the malicious link. Depending on the rights of the user, this may allow remote code execution and full read and write access to the whole XWiki installation. This has been patched in XWiki 14.10.12 and 15.5-rc-1 by adding appropriate escaping. The vulnerable template file `createinline.vm` is part of XWiki's WAR and can be patched by manually applying the changes from the fix.",2023-10-25,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:15.5:rc1:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2023-4521,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.39294,Missing_Data,"The Import XML and RSS Feeds WordPress plugin before 2.1.5 contains a web shell, allowing unauthenticated attackers to perform RCE. The plugin/vendor was not compromised and the files are the result of running a PoC for a previously reported issue (https://wpscan.com/vulnerability/d4220025-2272-4d5f-9703-4b2ac4a51c42) and not deleting the created files when releasing the new version.",2023-09-25,Nuclei,cpe:2.3:a:mooveagency:import_xml_and_rss_feeds:*:*:*:*:*:wordpress:*:*,Mooveagency,Import Xml And Rss Feeds
CVE-2023-45249,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.53255,CWE-1393,"Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before build 5.1.1-71, Acronis Cyber Infrastructure (ACI) before build 5.2.1-69, Acronis Cyber Infrastructure (ACI) before build 5.3.1-53, Acronis Cyber Infrastructure (ACI) before build 5.4.4-132.",2024-07-24,CISA/Metasploit/Nuclei,cpe:2.3:a:acronis:cyber_infrastructure:*:*:*:*:*:*:*:*,Acronis,Cyber Infrastructure
CVE-2023-45375,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.38457,CWE-89,"In the module ""PireosPay"" (pireospay) before version 1.7.10 from 01generator.com for PrestaShop, a guest can perform SQL injection via `PireosPayValidationModuleFrontController::postProcess().`",2023-10-17,Nuclei,cpe:2.3:a:01generator:pireospay:*:*:*:*:*:prestashop:*:*,01Generator,Pireospay
CVE-2023-4542,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.86533,CWE-78,A vulnerability was found in D-Link DAR-8000-10 up to 20230809. It has been classified as critical. This affects an unknown part of the file /app/sys1.php. The manipulation of the argument cmd with the input id leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238047. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2023-08-25,Nuclei,cpe:2.3:h:dlink:dar-8000-10:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dar-8000-10_firmware:*:*:*:*:*:*:*:*,D-Link,Dar-8000-10 Firmware
CVE-2023-4547,3.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N,0.48533,CWE-79,A vulnerability was found in SPA-Cart eCommerce CMS 1.9.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /search. The manipulation of the argument filter[brandid]/filter[price] leads to cross site scripting. The attack may be launched remotely. VDB-238058 is the identifier assigned to this vulnerability.,2023-08-26,Nuclei,cpe:2.3:a:spa-cart:ecommerce_cms:1.9.0.3:*:*:*:*:*:*:*,Spa-Cart,Ecommerce Cms
CVE-2023-45498,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.20477,CWE-77,"VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability.",2023-10-27,Metasploit,cpe:2.3:a:vinchin:vinchin_backup_and_recovery:*:*:*:*:*:*:*:*,Vinchin,Vinchin Backup And Recovery
CVE-2023-45499,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07887,CWE-798,"VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain hardcoded credentials.",2023-10-27,Metasploit,cpe:2.3:a:vinchin:vinchin_backup_and_recovery:*:*:*:*:*:*:*:*,Vinchin,Vinchin Backup And Recovery
CVE-2023-45542,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01635,CWE-79,Cross Site Scripting vulnerability in mooSocial 3.1.8 allows a remote attacker to obtain sensitive information via a crafted script to the q parameter in the Search function.,2023-10-16,Nuclei,cpe:2.3:a:moosocial:moosocial:3.1.8:*:*:*:*:*:*:*,Moosocial,Moosocial
CVE-2023-45648,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.05848,CWE-20,"Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially 
crafted, invalid trailer header could cause Tomcat to treat a single 
request as multiple requests leading to the possibility of request 
smuggling when behind a reverse proxy.

Older, EOL versions may also be affected.


Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.",2023-10-10,Nuclei,cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone17:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone18:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone19:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone20:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone11:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2023-45671,4.7,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01425,CWE-79,"Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the `/<camera_name>` base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both know very specific information about a user's Frigate server and requires an authenticated user to be tricked into clicking a specially crafted link to their Frigate instance. This vulnerability could exploited by an attacker under the following circumstances: Frigate publicly exposed to the internet (even with authentication); attacker knows the address of a user's Frigate instance; attacker crafts a specialized page which links to the user's Frigate instance; attacker finds a way to get an authenticated user to visit their specialized page and click the button/link. As the reflected values included in the URL are not sanitized or escaped, this permits execution arbitrary Javascript payloads. Version 0.13.0 Beta 3 contains a patch for this issue.",2023-10-30,Nuclei,cpe:2.3:a:frigate:frigate:*:*:*:*:*:*:*:*;cpe:2.3:a:frigate:frigate:0.13.0:beta1:*:*:*:*:*:*;cpe:2.3:a:frigate:frigate:0.13.0:beta2:*:*:*:*:*:*,Frigate,Frigate
CVE-2023-4568,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.03568,CWE-287,"PaperCut NG allows for unauthenticated XMLRPC commands to be run by default. Versions 22.0.12 and below are confirmed to be affected, but later versions may also be affected due to lack of a vendor supplied patch.",2023-09-13,Nuclei,cpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*,Papercut,Papercut Ng
CVE-2023-45727,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03542,CWE-611,"Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.",2023-10-18,CISA,cpe:2.3:a:northgrid:proself:*:*:*:*:enterprise:*:*:*;cpe:2.3:a:northgrid:proself:*:*:*:*:gateway:*:*:*;cpe:2.3:a:northgrid:proself:*:*:*:*:mail_sanitize:*:*:*;cpe:2.3:a:northgrid:proself:*:*:*:*:standard:*:*:*,Northgrid,Proself
CVE-2023-45826,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.01872,CWE-89,Leantime is an open source project management system. A 'userId' variable in `app/domain/files/repositories/class.files.php` is not parameterized. An authenticated attacker can send a carefully crafted POST request to `/api/jsonrpc` to exploit an SQL injection vulnerability. Confidentiality is impacted as it allows for dumping information from the database. This issue has been addressed in version 2.4-beta-4. Users are advised to upgrade. There are no known workarounds for this vulnerability.,2023-10-19,Nuclei,cpe:2.3:a:leantime:leantime:*:*:*:*:*:*:*:*;cpe:2.3:a:leantime:leantime:2.4:-:*:*:*:*:*:*;cpe:2.3:a:leantime:leantime:2.4:beta2:*:*:*:*:*:*;cpe:2.3:a:leantime:leantime:2.4:beta3:*:*:*:*:*:*;cpe:2.3:a:leantime:leantime:2.4:beta:*:*:*:*:*:*,Leantime,Leantime
CVE-2023-45852,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.14003,CWE-77,"In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharacters in the ipaddr params JSON data for the put method.",2023-10-14,Nuclei,cpe:2.3:h:viessmann:vitogate_300:-:*:*:*:*:*:*:*;cpe:2.3:o:viessmann:vitogate_300_firmware:*:*:*:*:*:*:*:*,Viessmann,Vitogate 300 Firmware
CVE-2023-45855,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.0333,CWE-22,qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI.,2023-10-14,Nuclei,cpe:2.3:a:qdpm:qdpm:9.2:*:*:*:*:*:*:*,Qdpm,Qdpm
CVE-2023-45878,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.63113,NVD-CWE-noinfo,"GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication. The endpoint accepts the img, path, and gibbonPersonID parameters. The img parameter is expected to be a base64 encoded image. If the path parameter is set, the defined path is used as the destination folder, concatenated with the absolute path of the installation directory. The content of the img parameter is base64 decoded and written to the defined file path. This allows creation of PHP files that permit Remote Code Execution (unauthenticated).",2023-11-14,Nuclei,cpe:2.3:a:gibbonedu:gibbon:*:*:*:*:*:*:*:*,Gibbonedu,Gibbon
CVE-2023-4596,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.12749,CWE-434,"The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.",2023-08-30,Nuclei,cpe:2.3:a:incsub:forminator:*:*:*:*:*:wordpress:*:*,Incsub,Forminator
CVE-2023-46214,8.0,CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H,0.89066,CWE-91,"In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.",2023-11-16,Metasploit,cpe:2.3:a:splunk:cloud:*:*:*:*:*:*:*:*;cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*,Splunk,Cloud
CVE-2023-4634,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.82585,CWE-73,"The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from the ~/includes/mla-stream-image.php file, where images are processed via Imagick(). This makes it possible for unauthenticated attackers to supply files via FTP that will make directory lists, local file inclusion, and remote code execution possible.",2023-09-06,Nuclei,cpe:2.3:a:davidlingren:media_library_assistant:*:*:*:*:*:wordpress:*:*,Davidlingren,Media Library Assistant
CVE-2023-46347,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.49885,CWE-89,"In the module ""Step by Step products Pack"" (ndk_steppingpack) version 1.5.6 and before from NDK Design for PrestaShop, a guest can perform SQL injection. The method `NdkSpack::getPacks()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.",2023-10-25,Nuclei,cpe:2.3:a:ndkdesign:ndk_steppingpack:*:*:*:*:*:prestashop:*:*,Ndkdesign,Ndk Steppingpack
CVE-2023-46359,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.78368,CWE-78,"An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attacker to execute arbitrary commands on the system via a specifically crafted arguments passed to the connectivity check feature.",2024-02-06,Nuclei,cpe:2.3:h:hardy-barth:cph2_echarge:-:*:*:*:*:*:*:*;cpe:2.3:o:hardy-barth:cph2_echarge_firmware:*:*:*:*:*:*:*:*,Hardy-Barth,Cph2 Echarge Firmware
CVE-2023-46455,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N,0.46966,CWE-22,In GL.iNET GL-AR300M routers with firmware v4.3.7 it is possible to write arbitrary files through a path traversal attack in the OpenVPN client file upload functionality.,2023-12-12,Nuclei,cpe:2.3:h:gl-inet:gl-ar300m:-:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-ar300m_firmware:4.3.7:*:*:*:*:*:*:*,Gl-Inet,Gl-Ar300M Firmware
CVE-2023-46574,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.65412,CWE-77,An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile function.,2023-10-25,Nuclei,cpe:2.3:h:totolink:a3700r:-:*:*:*:*:*:*:*;cpe:2.3:o:totolink:a3700r_firmware:9.1.2u.6165_20211012:*:*:*:*:*:*:*,Totolink,A3700R Firmware
CVE-2023-46604,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H,0.99654,CWE-502,"The Java OpenWire protocol marshaller is vulnerable to Remote Code 
Execution. This vulnerability may allow a remote attacker with network 
access to either a Java-based OpenWire broker or client to run arbitrary
 shell commands by manipulating serialized class types in the OpenWire 
protocol to cause either the client or the broker (respectively) to 
instantiate any class on the classpath.

Users are recommended to upgrade
 both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 
which fixes this issue.",2023-10-27,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:e-series_santricity_unified_manager:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:e-series_santricity_web_services_proxy:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:santricity_storage_plugin:-:*:*:*:*:vcenter:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2023-4666,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03283,Missing_Data,"The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE",2023-10-16,Nuclei,cpe:2.3:a:10web:form_maker:*:*:*:*:*:wordpress:*:*,10Web,Form Maker
CVE-2023-46732,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.02191,CWE-79,"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to reflected cross-site scripting (RXSS) via the `rev` parameter that is used in the content of the content menu without escaping. If an attacker can convince a user to visit a link with a crafted parameter, this allows the attacker to execute arbitrary actions in the name of the user, including remote code (Groovy) execution in the case of a user with programming right, compromising the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.6 RC1, 15.5.1 and 14.10.14. The patch in commit `04e325d57` can be manually applied without upgrading (or restarting) the instance. Users are advised to upgrade or to manually apply the patch. There are no known workarounds for this vulnerability.",2023-11-06,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2023-46747,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96515,CWE-288,"Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated",2023-10-26,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_fraud_protection_services:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*,F5,Big-Ip Access Policy Manager
CVE-2023-46748,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.04468,CWE-89,"An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which 

may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated",2023-10-26,CISA,cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_fraud_protection_services:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*;cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*,F5,Big-Ip Access Policy Manager
CVE-2023-46805,8.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N,0.99986,CWE-287,"An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.",2024-01-12,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:ivanti:connect_secure:22.1:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.1:r6:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.2:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.2:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.3:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.4:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.4:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.5:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.6:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.6:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.6:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r10:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r12.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r12:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r13.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r13:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r14:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r15.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r15:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r16.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r16:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r17.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r17:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r18:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.1:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.1:r6:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.2:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.2:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.3:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.3:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.4:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.4:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.4:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.5:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.5:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.6:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.0:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r10:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r11:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r12:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r13.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r13:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r14:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r15:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r16:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r17:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r18:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r3.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r4.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r4.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r5:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r6:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r7:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r8.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r8.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r8:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r9:*:*:*:*:*:*,Ivanti,Connect Secure
CVE-2023-46818,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.13894,CWE-94,An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is enabled.,2023-10-27,Metasploit/Nuclei,cpe:2.3:a:ispconfig:ispconfig:*:*:*:*:*:*:*:*;cpe:2.3:a:ispconfig:ispconfig:3.2.11:-:*:*:*:*:*:*,Ispconfig,Ispconfig
CVE-2023-46944,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.01322,NVD-CWE-noinfo,An issue in GitKraken GitLens before v.14.0.0 allows an attacker to execute arbitrary code via a crafted file to the Visual Studio Codes workspace trust component.,2023-11-28,Metasploit,cpe:2.3:a:gitkraken:gitlens:*:*:*:*:*:visual_studio_code:*:*,Gitkraken,Gitlens
CVE-2023-47105,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L,0.01669,CWE-78,"exec.CommandContext in Chaosblade 0.3 through 1.7.3, when server mode is used, allows OS command execution via the cmd parameter without authentication.",2024-09-18,Nuclei,,,
CVE-2023-47115,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.01448,CWE-79,"Label Studio is an a popular open source data labeling tool. Versions prior to 1.9.2 have a cross-site scripting (XSS) vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. Executing arbitrary JavaScript could result in an attacker performing malicious actions on Label Studio users if they visit the crafted avatar image. For an example, an attacker can craft a JavaScript payload that adds a new Django Super Administrator user if a Django administrator visits the image.

The file `users/functions.py` lines 18-49 show that the only verification check is that the file is an image by extracting the dimensions from the file. Label Studio serves avatar images using Django's built-in `serve` view, which is not secure for production use according to Django's documentation. The issue with the Django `serve` view is that it determines the `Content-Type` of the response by the file extension in the URL path. Therefore, an attacker can upload an image that contains malicious HTML code and name the file with a `.html` extension to be rendered as a HTML page. The only file extension validation is performed on the client-side, which can be easily bypassed.

Version 1.9.2 fixes this issue. Other remediation strategies include validating the file extension on the server side, not in client-side code; removing the use of Django's `serve` view and implement a secure controller for viewing uploaded avatar images; saving file content in the database rather than on the filesystem to mitigate against other file related vulnerabilities; and avoiding trusting user controlled inputs.",2024-01-23,Nuclei,cpe:2.3:a:humansignal:label_studio:*:*:*:*:*:*:*:*,Humansignal,Label Studio
CVE-2023-47117,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04055,CWE-200,"Label Studio is an open source data labeling tool. In all current versions of Label Studio prior to 1.9.2post0, the application allows users to insecurely set filters for filtering tasks. An attacker can construct a filter chain to filter tasks based on sensitive fields for all user accounts on the platform by exploiting Django's Object Relational Mapper (ORM). Since the results of query can be manipulated by the ORM filter, an attacker can leak these sensitive fields character by character. In addition, Label Studio had a hard coded secret key that an attacker can use to forge a session token of any user by exploiting this ORM Leak vulnerability to leak account password hashes. This vulnerability has been addressed in commit `f931d9d129` which is included in the 1.9.2post0 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.",2023-11-13,Nuclei,cpe:2.3:a:humansignal:label_studio:*:*:*:*:*:*:*:*;cpe:2.3:a:humansignal:label_studio:1.9.2:-:*:*:*:*:*:*,Humansignal,Label Studio
CVE-2023-4714,4.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N,0.0521,CWE-200,A vulnerability was found in PlayTube 3.0.1 and classified as problematic. This issue affects some unknown processing of the component Redirect Handler. The manipulation leads to information disclosure. The attack may be initiated remotely. The identifier VDB-238577 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2023-09-01,Nuclei,cpe:2.3:a:playtube:playtube:3.0.1:*:*:*:*:*:*:*,Playtube,Playtube
CVE-2023-47211,9.1,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L,0.47024,CWE-22,A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send a malicious MiB file to trigger this vulnerability.,2024-01-08,Nuclei,cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.7:build127000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.7:build127101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.7:build127130:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.7:build127131:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.7:build127187:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.7:build127244:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.7:build127257:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.7:build127259:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.7:build127000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.7:build127003:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.7:build127101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.7:build127130:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.7:build127131:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.7:build127187:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.7:build127244:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.7:build127255:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.7:build127257:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:12.7:build127259:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.7:build127000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.7:build127102:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.7:build127105:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.7:build127132:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.7:build127243:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.7:build127257:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:12.7:build127259:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127000:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127001:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127002:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127003:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127004:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127100:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127102:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127103:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127104:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127109:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127116:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127117:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127118:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127119:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127120:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127122:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127123:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127131:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127133:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127134:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127136:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127138:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127140:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127141:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127185:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127186:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127187:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127188:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127189:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127191:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127240:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127241:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127242:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127243:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127255:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127256:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127257:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127258:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager:12.7:build127259:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_msp:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.7:build127109:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.7:build127122:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.7:build127123:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.7:build127138:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.7:build127139:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.7:build127140:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.7:build127141:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.7:build127142:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_msp:12.7:build127259:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.7:build127109:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.7:build127122:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.7:build127123:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.7:build127138:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.7:build127139:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.7:build127140:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.7:build127141:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.7:build127142:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_opmanager_plus:12.7:build127259:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:*:*:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.7:build127101:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.7:build127117:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.7:build127134:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.7:build127241:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.7:build127242:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.7:build127258:*:*:*:*:*:*;cpe:2.3:a:zohocorp:manageengine_oputils:12.7:build127259:*:*:*:*:*:*,Zohocorp,Manageengine Firewall Analyzer
CVE-2023-47218,5.8,CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L,0.8992,CWE-77,"An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.5.2645 build 20240116 and later
QuTS hero h5.1.5.2647 build 20240118 and later
QuTScloud c5.1.5.2651 and later",2024-02-13,Metasploit/Nuclei,cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*;cpe:2.3:o:qnap:qts:5.1.5.2645:-:*:*:*:*:*:*;cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*;cpe:2.3:o:qnap:quts_hero:h5.1.5.2647:-:*:*:*:*:*:*;cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*,Qnap,Qts
CVE-2023-47246,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98851,CWE-22,"In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.",2023-11-10,CISA/EPSS/Nuclei,cpe:2.3:a:sysaid:sysaid:*:*:*:*:on-premises:*:*:*,Sysaid,Sysaid
CVE-2023-47248,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.14414,CWE-502,"Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).

This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.

It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.

If it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See  https://pypi.org/project/pyarrow-hotfix/  for instructions.",2023-11-09,Nuclei,cpe:2.3:a:apache:pyarrow:*:*:*:*:*:*:*:*,Apache,Pyarrow
CVE-2023-47253,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.14422,CWE-77,Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.php gridValoresPopHidden parameter.,2023-11-06,Nuclei,cpe:2.3:a:qualitor:qualitor:*:*:*:*:*:*:*:*,Qualitor,Qualitor
CVE-2023-47565,8.0,CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.73277,CWE-78,"An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network.

We have already fixed the vulnerability in the following versions:

QVR Firmware 5.0.0 and later",2023-12-08,CISA,cpe:2.3:o:qnap:qvr_firmware:*:*:*:*:*:*:*:*,Qnap,Qvr Firmware
CVE-2023-4762,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.37987,CWE-843,Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High),2023-09-05,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2023-47643,3.1,CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N,0.03002,CWE-200,"SuiteCRM is a Customer Relationship Management (CRM) software application. Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. An attacker can obtain the GraphQL schema and understand the entire attack surface of the API, including sensitive fields such as UserHash. This issue is patched in version 8.4.2. There are no known workarounds.",2023-11-21,Nuclei,cpe:2.3:a:salesagility:suitecrm:8.4.1:*:*:*:*:*:*:*,Salesagility,Suitecrm
CVE-2023-47684,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.00838,CWE-79,Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ThemePunch OHG Essential Grid plugin <= 3.1.0 versions.,2023-11-14,Nuclei,cpe:2.3:a:themepunch:essential_grid:*:*:*:*:*:wordpress:*:*,Themepunch,Essential Grid
CVE-2023-47873,9.1,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H,0.02276,CWE-434,Unrestricted Upload of File with Dangerous Type vulnerability in WEN Solutions WP Child Theme Generator.This issue affects WP Child Theme Generator: from n/a through 1.0.9.,2024-03-26,Nuclei,cpe:2.3:a:wensolutions:wp_child_theme_generator:*:*:*:*:*:wordpress:*:*,Wensolutions,Wp Child Theme Generator
CVE-2023-48022,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.81512,CWE-918,"Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment. (Also, within that environment, customers at version 2.52.0 and later can choose to use token authentication.)",2023-11-28,Metasploit/Nuclei,cpe:2.3:a:anyscale:ray:2.6.3:*:*:*:*:*:*:*;cpe:2.3:a:anyscale:ray:2.8.0:*:*:*:*:*:*:*,Anyscale,Ray
CVE-2023-48023,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.35052,CWE-918,"Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment",2023-11-28,Nuclei,cpe:2.3:a:anyscale:ray:2.6.3:*:*:*:*:*:*:*;cpe:2.3:a:anyscale:ray:2.8.0:*:*:*:*:*:*:*,Anyscale,Ray
CVE-2023-48084,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.3374,CWE-89,Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool.,2023-12-14,Nuclei,cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*,Nagios,Nagios Xi
CVE-2023-48241,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.7282,CWE-285,"XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 14.10.15, 15.5.1, and 15.6RC1, the Solr-based search suggestion provider that also duplicates as generic JavaScript API for search results in XWiki exposes the content of all documents of all wikis to anybody who has access to it, by default it is public. This exposes all information stored in the wiki (but not some protected information like password hashes). While there is a right check normally, the right check can be circumvented by explicitly requesting fields from Solr that don't include the data for the right check. This has been fixed in XWiki 15.6RC1, 15.5.1 and 14.10.15 by not listing documents whose rights cannot be checked. No known workarounds are available.",2023-11-20,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:6.3:milestone2:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:6.3:rc1:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2023-48365,9.6,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N,0.24676,CWE-444,"Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.",2023-11-15,CISA,cpe:2.3:a:qlik:qlik_sense:august_2022:-:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_10:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_11:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_12:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_13:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_1:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_2:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_3:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_4:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_5:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_6:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_7:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_8:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2022:patch_9:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2023:-:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:august_2023:patch_1:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2022:-:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2022:patch_10:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2022:patch_11:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2022:patch_12:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2022:patch_13:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2022:patch_14:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2022:patch_1:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2022:patch_2:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2022:patch_3:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2022:patch_4:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2022:patch_5:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2022:patch_6:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2022:patch_7:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2022:patch_8:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2022:patch_9:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:-:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:patch_1:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:patch_2:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:patch_3:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:patch_4:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:patch_5:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:patch_6:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:patch_7:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:patch_8:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:february_2023:patch_9:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2022:-:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2022:patch_10:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2022:patch_11:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2022:patch_12:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2022:patch_13:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2022:patch_14:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2022:patch_15:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2022:patch_1:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2022:patch_2:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2022:patch_3:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2022:patch_4:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2022:patch_5:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2022:patch_6:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2022:patch_7:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2022:patch_8:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2022:patch_9:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2023:-:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2023:patch_1:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2023:patch_2:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2023:patch_3:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2023:patch_4:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:may_2023:patch_5:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2021:-:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2021:patch_10:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2021:patch_11:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2021:patch_12:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2021:patch_13:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2021:patch_14:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2021:patch_15:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2021:patch_16:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2021:patch_1:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2021:patch_2:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2021:patch_3:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2021:patch_4:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2021:patch_5:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2021:patch_6:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2021:patch_7:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2021:patch_8:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2021:patch_9:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:-:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_10:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_11:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_1:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_2:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_3:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_4:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_5:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_6:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_7:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_8:*:*:enterprise:windows:*:*;cpe:2.3:a:qlik:qlik_sense:november_2022:patch_9:*:*:enterprise:windows:*:*,Qlik,Qlik Sense
CVE-2023-4863,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.99735,CWE-787,Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical),2023-09-12,CISA/EPSS,cpe:2.3:a:bandisoft:honeyview:*:*:*:*:*:*:*:*;cpe:2.3:a:bentley:seequent_leapfrog:*:*:*:*:*:*:*:*;cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:teams:*:*:*:*:*:macos:*:*;cpe:2.3:a:microsoft:teams:*:*:*:*:desktop:*:*:*;cpe:2.3:a:microsoft:webp_image_extension:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*;cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*;cpe:2.3:a:webmproject:libwebp:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2023-48728,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.02268,CWE-79,A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.,2024-01-10,Nuclei,cpe:2.3:a:wwbn:avideo:11.6:*:*:*:*:*:*:*;cpe:2.3:a:wwbn:avideo:3c6bb3ff:*:*:*:*:*:*:*,Wwbn,Avideo
CVE-2023-48777,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.041,CWE-434,Unrestricted Upload of File with Dangerous Type vulnerability in Elementor.Com Elementor Website Builder.This issue affects Elementor Website Builder: from 3.3.0 through 3.18.1.,2024-03-26,Nuclei,cpe:2.3:a:elementor:website_builder:*:*:*:*:free:wordpress:*:*,Elementor,Website Builder
CVE-2023-48788,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97591,CWE-89,"A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.",2024-03-12,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:fortinet:forticlient_enterprise_management_server:*:*:*:*:*:*:*:*,Fortinet,Forticlient Enterprise Management Server
CVE-2023-48795,5.9,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N,0.93305,CWE-354,"The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.",2023-12-18,Nuclei,cpe:2.3:a:9bis:kitty:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:sshd:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:sshj:*:*:*:*:*:*:*:*;cpe:2.3:a:asyncssh_project:asyncssh:*:*:*:*:*:*:*:*;cpe:2.3:a:bitvise:ssh_client:*:*:*:*:*:*:*:*;cpe:2.3:a:bitvise:ssh_server:*:*:*:*:*:*:*:*;cpe:2.3:a:connectbot:sshlib:*:*:*:*:*:*:*:*;cpe:2.3:a:crates:thrussh:*:*:*:*:*:*:*:*;cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*;cpe:2.3:a:dropbear_ssh_project:dropbear_ssh:*:*:*:*:*:*:*:*;cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*;cpe:2.3:a:filezilla-project:filezilla_client:*:*:*:*:*:*:*:*;cpe:2.3:a:gentoo:security:-:*:*:*:*:*:*:*;cpe:2.3:a:golang:crypto:*:*:*:*:*:*:*:*;cpe:2.3:a:jadaptive:maverick_synergy_java_ssh_api:*:*:*:*:*:*:*:*;cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:*;cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*;cpe:2.3:a:matez:jsch:*:*:*:*:*:*:*:*;cpe:2.3:a:net-ssh:net-ssh:7.2.0:*:*:*:*:ruby:*:*;cpe:2.3:a:netgate:pfsense_ce:*:*:*:*:*:*:*:*;cpe:2.3:a:netgate:pfsense_plus:*:*:*:*:*:*:*:*;cpe:2.3:a:netsarang:xshell_7:*:*:*:*:*:*:*:*;cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*;cpe:2.3:a:oryx-embedded:cyclone_ssh:*:*:*:*:*:*:*:*;cpe:2.3:a:panic:nova:*:*:*:*:*:*:*:*;cpe:2.3:a:panic:transmit_5:*:*:*:*:*:*:*:*;cpe:2.3:a:paramiko:paramiko:*:*:*:*:*:*:*:*;cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*;cpe:2.3:a:putty:putty:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:advanced_cluster_security:3.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:advanced_cluster_security:4.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:ceph_storage:6.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:cert-manager_operator_for_red_hat_openshift:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:discovery:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:keycloak:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_api_for_data_protection:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_data_foundation:4.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_dev_spaces:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_developer_tools_and_services:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_gitops:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_pipelines:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_serverless:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_virtualization:4:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openstack_platform:16.1:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openstack_platform:16.2:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openstack_platform:17.1:*:*:*:*:*:*:*;cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:storage:3.0:*:*:*:*:*:*:*;cpe:2.3:a:roumenpetrov:pkixssh:*:*:*:*:*:*:*:*;cpe:2.3:a:russh_project:russh:*:*:*:*:*:rust:*:*;cpe:2.3:a:sftpgo_project:sftpgo:*:*:*:*:*:*:*:*;cpe:2.3:a:ssh2_project:ssh2:*:*:*:*:*:node.js:*:*;cpe:2.3:a:ssh:ssh:*:*:*:*:*:*:*:*;cpe:2.3:a:tera_term_project:tera_term:*:*:*:*:*:*:*:*;cpe:2.3:a:tinyssh:tinyssh:*:*:*:*:*:*:*:*;cpe:2.3:a:trilead:ssh2:6401:*:*:*:*:*:*:*;cpe:2.3:a:vandyke:securecrt:*:*:*:*:*:*:*:*;cpe:2.3:a:winscp:winscp:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:-:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*;cpe:2.3:o:lancom-systems:lanconfig:-:*:*:*:*:*:*:*;cpe:2.3:o:lancom-systems:lcos:*:*:*:*:*:*:*:*;cpe:2.3:o:lancom-systems:lcos_fx:-:*:*:*:*:*:*:*;cpe:2.3:o:lancom-systems:lcos_lx:-:*:*:*:*:*:*:*;cpe:2.3:o:lancom-systems:lcos_sx:4.20:*:*:*:*:*:*:*;cpe:2.3:o:lancom-systems:lcos_sx:5.20:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:thorntech:sftp_gateway_firmware:*:*:*:*:*:*:*:*,Thorntech,Sftp Gateway Firmware
CVE-2023-49070,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.95442,CWE-94,"Pre-auth RCE in Apache Ofbiz 18.12.09.

It's due to XML-RPC no longer maintained still present.
This issue affects Apache OFBiz: before 18.12.10. 
Users are recommended to upgrade to version 18.12.10",2023-12-05,EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*,Apache,Ofbiz
CVE-2023-49084,8.0,CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H,0.63774,CWE-98,"Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `link.php`. Impact of the vulnerability execution of arbitrary code on the server.",2023-12-21,Metasploit,cpe:2.3:a:cacti:cacti:1.2.25:*:*:*:*:*:*:*,Cacti,Cacti
CVE-2023-49085,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.84628,CWE-89,"Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the `pollers.php`. Impact of the vulnerability - arbitrary SQL code execution. As of time of publication, a patch does not appear to exist.",2023-12-22,Metasploit,cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*,Cacti,Cacti
CVE-2023-49103,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.78428,NVD-CWE-noinfo,"An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system. Therefore, even if ownCloud is not running in a containerized environment, this vulnerability should still be a cause for concern. Note that Docker containers from before February 2023 are not vulnerable to the credential disclosure.",2023-11-21,CISA/Metasploit/Nuclei,cpe:2.3:a:owncloud:graph_api:0.2.0:*:*:*:*:*:*:*;cpe:2.3:a:owncloud:graph_api:0.3.0:*:*:*:*:*:*:*,Owncloud,Graph Api
CVE-2023-4911,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.81422,CWE-122,A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.,2023-10-03,CISA/Metasploit,cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder:9.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_eus:8.6:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_eus:9.2:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_eus:9.4:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_eus:9.6:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:9.0_aarch64:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:8.6:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.2_aarch64:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.4_aarch64:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.6_aarch64:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:8.6:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*;cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:*;cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*;cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518-4_pn\/dp_mfp:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_s7-1500_tm_mfp:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:siplus_s7-1500_cpu_1518-4_pn\/dp_mfp:-:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*;cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.6_aarch64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.2_aarch64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.6_aarch64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus_s390x:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:8.6_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:9.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.2_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.4_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.6_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.6:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_s7-1500_tm_mfp_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:siplus_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:*,Siemens,Simatic S7-1500 Cpu 1518-4 Pn/Dp Mfp Firmware
CVE-2023-49230,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.0205,CWE-862,An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in captive portals allows attackers to modify the portals' configurations without prior authentication.,2023-12-28,Nuclei,cpe:2.3:h:peplink:balance_two:-:*:*:*:*:*:*:*;cpe:2.3:o:peplink:balance_two_firmware:*:*:*:*:*:*:*:*,Peplink,Balance Two Firmware
CVE-2023-49293,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00997,CWE-79,"Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via `server.transformIndexHtml`, the original request URL is passed in unmodified, and the `html` being transformed contains inline module scripts (`<script type=""module"">...</script>`), it is possible to inject arbitrary HTML into the transformed output by supplying a malicious URL query string to `server.transformIndexHtml`. Only apps using `appType: 'custom'` and using the default Vite HTML middleware are affected. The HTML entry must also contain an inline script. The attack requires a user to click on a malicious URL while running the dev server. Restricted files aren't exposed to the attacker. This issue has been addressed in vite@5.0.5, vite@4.5.1, and vite@4.4.12. There are no known workarounds for this vulnerability.",2023-12-04,Nuclei,cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*;cpe:2.3:a:vitejs:vite:5.0.0:-:*:*:*:node.js:*:*;cpe:2.3:a:vitejs:vite:5.0.0:beta0:*:*:*:node.js:*:*;cpe:2.3:a:vitejs:vite:5.0.0:beta10:*:*:*:node.js:*:*;cpe:2.3:a:vitejs:vite:5.0.0:beta11:*:*:*:node.js:*:*;cpe:2.3:a:vitejs:vite:5.0.0:beta12:*:*:*:node.js:*:*;cpe:2.3:a:vitejs:vite:5.0.0:beta13:*:*:*:node.js:*:*;cpe:2.3:a:vitejs:vite:5.0.0:beta14:*:*:*:node.js:*:*;cpe:2.3:a:vitejs:vite:5.0.0:beta15:*:*:*:node.js:*:*;cpe:2.3:a:vitejs:vite:5.0.0:beta16:*:*:*:node.js:*:*;cpe:2.3:a:vitejs:vite:5.0.0:beta17:*:*:*:node.js:*:*;cpe:2.3:a:vitejs:vite:5.0.0:beta18:*:*:*:node.js:*:*;cpe:2.3:a:vitejs:vite:5.0.0:beta19:*:*:*:node.js:*:*;cpe:2.3:a:vitejs:vite:5.0.0:beta1:*:*:*:node.js:*:*;cpe:2.3:a:vitejs:vite:5.0.0:beta20:*:*:*:node.js:*:*;cpe:2.3:a:vitejs:vite:5.0.0:beta2:*:*:*:node.js:*:*;cpe:2.3:a:vitejs:vite:5.0.0:beta3:*:*:*:node.js:*:*;cpe:2.3:a:vitejs:vite:5.0.0:beta4:*:*:*:node.js:*:*;cpe:2.3:a:vitejs:vite:5.0.0:beta5:*:*:*:node.js:*:*;cpe:2.3:a:vitejs:vite:5.0.0:beta6:*:*:*:node.js:*:*;cpe:2.3:a:vitejs:vite:5.0.0:beta7:*:*:*:node.js:*:*;cpe:2.3:a:vitejs:vite:5.0.0:beta8:*:*:*:node.js:*:*;cpe:2.3:a:vitejs:vite:5.0.0:beta9:*:*:*:node.js:*:*,Vitejs,Vite
CVE-2023-49438,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01079,CWE-601,An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.,2023-12-26,Nuclei,cpe:2.3:a:flask-security-too_project:flask-security-too:*:*:*:*:*:*:*:*,Flask-Security-Too Project,Flask-Security-Too
CVE-2023-49489,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00726,CWE-79,"Reflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via the APP_HOST parameter at config/i18n/en/main.php.",2023-12-19,Nuclei,cpe:2.3:a:kodcloud:kodexplorer:4.51:*:*:*:*:*:*:*,Kodcloud,Kodexplorer
CVE-2023-49494,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01157,CWE-79,DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component select_media_post_wangEditor.php.,2023-12-11,Nuclei,cpe:2.3:a:dedecms:dedecms:5.7.111:*:*:*:*:*:*:*,Dedecms,Dedecms
CVE-2023-4966,9.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L,0.99999,CWE-119,"Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.",2023-10-10,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*;cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*;cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*;cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*,Citrix,Netscaler Application Delivery Controller
CVE-2023-4973,3.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N,0.01835,CWE-79,A vulnerability was found in Academy LMS 6.2 on Windows. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument searched_word/searched_tution_class_type[]/searched_price_type[]/searched_duration[] leads to cross site scripting. The attack can be launched remotely. The identifier VDB-239749 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2023-09-15,Nuclei,cpe:2.3:a:creativeitem:academy_lms:6.2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2023-4974,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.04886,CWE-89,A vulnerability was found in Academy LMS 6.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument price_min/price_max leads to sql injection. The attack may be launched remotely. VDB-239750 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2023-09-15,Nuclei,cpe:2.3:a:creativeitem:academy_lms:6.2:*:*:*:*:*:*:*,Creativeitem,Academy Lms
CVE-2023-49785,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.83163,CWE-79,"NextChat, also known as ChatGPT-Next-Web, is a cross-platform chat user interface for use with ChatGPT. Versions 2.11.2 and prior are vulnerable to server-side request forgery and cross-site scripting. This vulnerability enables read access to internal HTTP endpoints but also write access using HTTP POST, PUT, and other methods. Attackers can also use this vulnerability to mask their source IP by forwarding malicious traffic intended for other Internet targets through these open proxies. As of time of publication, no patch is available, but other mitigation strategies are available. Users may avoid exposing the application to the public internet or, if exposing the application to the internet, ensure it is an isolated network with no access to any other internal resources.
",2024-03-12,Nuclei,cpe:2.3:a:nextchat:nextchat:*:*:*:*:*:*:*:*,Nextchat,Nextchat
CVE-2023-49897,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.50729,CWE-78,"An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.",2023-12-06,CISA,cpe:2.3:h:fxc:ae1021:-:*:*:*:*:*:*:*;cpe:2.3:h:fxc:ae1021pe:-:*:*:*:*:*:*:*;cpe:2.3:o:fxc:ae1021_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:fxc:ae1021pe_firmware:*:*:*:*:*:*:*:*,Fxc,Ae1021 Firmware
CVE-2023-5003,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.25855,Missing_Data,"The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. Unfortunately, this log file is never removed, and remains accessible to any users knowing the URL to do so.",2023-10-16,Nuclei,cpe:2.3:a:miniorange:active_directory_integration_\/_ldap_integration:*:*:*:*:*:wordpress:*:*,Miniorange,Active Directory Integration / Ldap Integration
CVE-2023-50094,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.1354,CWE-78,reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.,2024-01-01,Nuclei,cpe:2.3:a:yogeshojha:rengine:*:*:*:*:*:*:*:*,Yogeshojha,Rengine
CVE-2023-50224,0.0,,0.1745,CWE-290,"TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.
. Was ZDI-CAN-19899.",2024-05-03,CISA,cpe:2.3:h:tp-link:tl-wr841n:12:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:tl-wr841n_firmware:3.16.9:build_200409:*:*:*:*:*:*,TP-Link,Tl-Wr841N Firmware
CVE-2023-50290,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.68665,CWE-200,"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.
The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host, unlike Java system properties which are set per-Java-proccess.

The Solr Metrics API is protected by the ""metrics-read"" permission.
Therefore, Solr Clouds with Authorization setup will only be vulnerable via users with the ""metrics-read"" permission.
This issue affects Apache Solr: from 9.0.0 before 9.3.0.

Users are recommended to upgrade to version 9.3.0 or later, in which environment variables are not published via the Metrics API.

",2024-01-15,Nuclei,cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*,Apache,Solr
CVE-2023-50386,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.8384,CWE-434,"Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1.

In the affected versions, Solr ConfigSets accepted Java jar and class files to be uploaded through the ConfigSets API.
When backing up Solr Collections, these configSet files would be saved to disk when using the LocalFileSystemRepository (the default for backups).
If the backup was saved to a directory that Solr uses in its ClassPath/ClassLoaders, then the jar and class files would be available to use with any ConfigSet, trusted or untrusted.

When Solr is run in a secure way (Authorization enabled), as is strongly suggested, this vulnerability is limited to extending the Backup permissions with the ability to add libraries.
Users are recommended to upgrade to version 8.11.3 or 9.4.1, which fix the issue.
In these versions, the following protections have been added:

  *  Users are no longer able to upload files to a configSet that could be executed via a Java ClassLoader.
  *  The Backup API restricts saving backups to directories that are used in the ClassLoader.",2024-02-09,Metasploit,cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*,Apache,Solr
CVE-2023-50387,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.99995,CWE-770,"Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the ""KeyTrap"" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.",2024-02-14,EPSS,cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*;cpe:2.3:a:nic:knot_resolver:*:*:*:*:*:*:*:*;cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*;cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:*;cpe:2.3:a:thekelleys:dnsmasq:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:-:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*,Redhat,Enterprise Linux
CVE-2023-50445,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.09123,CWE-78,"Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7, AR750 v4.3.7, AR300M v4.3.7, and B1300 v4.3.7., allows local attackers to execute arbitrary code via the get_system_log and get_crash_log functions of the logread module, as well as the upgrade_online function of the upgrade module.",2023-12-28,Metasploit,cpe:2.3:h:gl-inet:gl-a1300:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-ar300m:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-ar750:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-ar750s:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-ax1800:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-axt1800:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-b1300:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-mt1300:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-mt2500:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-mt3000:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-mt300n-v2:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-mt6000:-:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-a1300_firmware:4.4.6:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-ar300m_firmware:4.3.7:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-ar750_firmware:4.3.7:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-ar750s_firmware:4.3.7:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-ax1800_firmware:4.4.6:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-axt1800_firmware:4.4.6:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-b1300_firmware:4.3.7:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-mt1300_firmware:4.3.7:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-mt2500_firmware:4.4.6:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-mt3000_firmware:4.4.6:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:4.3.7:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-mt6000_firmware:4.5.0:*:*:*:*:*:*:*,Gl-Inet,Gl-Mt1300 Firmware
CVE-2023-50578,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02222,CWE-89,Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.,2023-12-30,Nuclei,cpe:2.3:a:mingsoft:mcms:5.2.9:*:*:*:*:*:*:*,Mingsoft,Mcms
CVE-2023-50719,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.83548,CWE-200,"XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are public. This vulnerability also affects any configurations used by extensions that contain passwords like API keys that are viewable for the attacker. Normally, such passwords aren't accessible but this vulnerability would disclose them as plain text.  This has been patched in XWiki 14.10.15, 15.5.2 and 15.7RC1. There are no known workarounds for this vulnerability.
",2023-12-15,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:15.6:-:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:15.6:rc1:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:15.7:rc1:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:7.2:milestone2:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:7.2:milestone3:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2023-50720,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.59119,CWE-200,"XWiki Platform is a generic wiki platform. Prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the email addresses of users even when obfuscation of email addresses is enabled. To demonstrate the vulnerability, search for `objcontent:email*` using XWiki's regular search interface. This has been fixed in XWiki 14.10.15, 15.5.2 and 15.7RC1 by not indexing email address properties when obfuscation is enabled. There are no known workarounds for this vulnerability.
",2023-12-15,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:15.6:-:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:15.6:rc1:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:15.7:rc1:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2023-5074,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.67914,CWE-798,Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28,2023-09-20,Nuclei,cpe:2.3:a:dlink:d-view_8:2.0.1.28:*:*:*:*:*:*:*,D-Link,D-View 8
CVE-2023-50839,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L,0.02041,CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.1.,2023-12-28,Nuclei,cpe:2.3:a:wiselyhub:js_help_desk:*:*:*:*:*:wordpress:*:*,Wiselyhub,Js Help Desk
CVE-2023-5089,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.02235,Missing_Data,"The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.",2023-10-16,Nuclei,cpe:2.3:a:wpmudev:defender_security:*:*:*:*:*:wordpress:*:*,Wpmudev,Defender Security
CVE-2023-50917,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.38263,CWE-77,MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager.,2023-12-15,Metasploit/Nuclei,cpe:2.3:a:mjdm:majordomo:*:*:*:*:*:*:*:*,Mjdm,Majordomo
CVE-2023-50919,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.47804,CWE-287,"An issue was discovered on GL.iNet devices before version 4.5.0. There is an NGINX authentication bypass via Lua string pattern matching. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7.",2024-01-12,Metasploit,cpe:2.3:h:gl-inet:gl-a1300:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-ar300m:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-ar750:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-ar750s:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-ax1800:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-axt1800:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-b1300:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-mt1300:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-mt2500:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-mt3000:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-mt300n-v2:-:*:*:*:*:*:*:*;cpe:2.3:h:gl-inet:gl-mt6000:-:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-a1300_firmware:4.3.7:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-a1300_firmware:4.4.6:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-ar300m_firmware:4.3.7:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-ar300m_firmware:4.4.6:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-ar750_firmware:4.3.7:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-ar750_firmware:4.4.6:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-ar750s_firmware:4.3.7:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-ar750s_firmware:4.4.6:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-ax1800_firmware:4.3.7:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-ax1800_firmware:4.4.6:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-axt1800_firmware:4.3.7:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-axt1800_firmware:4.4.6:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-b1300_firmware:4.3.7:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-b1300_firmware:4.4.6:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-mt1300_firmware:4.3.7:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-mt1300_firmware:4.4.6:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-mt2500_firmware:4.3.7:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-mt2500_firmware:4.4.6:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-mt3000_firmware:4.3.7:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-mt3000_firmware:4.4.6:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:4.3.7:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:4.4.6:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-mt6000_firmware:4.3.7:*:*:*:*:*:*:*;cpe:2.3:o:gl-inet:gl-mt6000_firmware:4.4.6:*:*:*:*:*:*:*,Gl-Inet,Gl-Ax1800 Firmware
CVE-2023-50968,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.63373,CWE-200,"Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations.

The same uri can be operated to realize a SSRF attack also  without  authorizations.

Users are recommended to upgrade to version 18.12.11, which fixes this issue.",2023-12-26,Nuclei,cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*,Apache,Ofbiz
CVE-2023-51409,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.63329,CWE-434,Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 1.9.98.,2024-04-12,Nuclei,cpe:2.3:a:meowapps:ai_engine:*:*:*:*:*:wordpress:*:*,Meowapps,Ai Engine
CVE-2023-51449,5.6,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L,0.0228,CWE-22,"Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file` route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with `share=True`, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.",2023-12-22,Nuclei,cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*,Gradio Project,Gradio
CVE-2023-51467,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96001,CWE-918,"The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code

",2023-12-26,EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*,Apache,Ofbiz
CVE-2023-51713,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.04249,CWE-125,"make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds read, and daemon crash, because of mishandling of quote/backslash semantics.",2023-12-22,Nuclei,cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*,Proftpd,Proftpd
CVE-2023-5203,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02221,CWE-89,"The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in some cases an error/union based technique.",2023-12-26,Nuclei,cpe:2.3:a:swit:wp_sessions_time_monitoring_full_automatic:*:*:*:*:*:wordpress:*:*,Swit,Wp Sessions Time Monitoring Full Automatic
CVE-2023-5204,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06888,CWE-89,"The ChatBot plugin for WordPress is vulnerable to SQL Injection via the $strid parameter in versions up to, and including, 4.8.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2023-10-19,Nuclei,cpe:2.3:a:quantumcloud:wpbot:*:*:*:*:*:wordpress:*:*,Quantumcloud,Wpbot
CVE-2023-52085,3.3,CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N,0.30166,CWE-22,"Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. This issue has been patched in v1.2.4.",2023-12-29,Nuclei,cpe:2.3:a:wintercms:winter:*:*:*:*:*:*:*:*,Wintercms,Winter
CVE-2023-52163,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.96979,CWE-862,Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.,2025-02-03,CISA/EPSS/Nuclei,cpe:2.3:h:digiever:ds-2105_pro:-:*:*:*:*:*:*:*;cpe:2.3:h:digiever:ds-2105_pro\+:-:*:*:*:*:*:*:*;cpe:2.3:o:digiever:ds-2105_pro\+_firmware:3.1.0.71-11:*:*:*:*:*:*:*;cpe:2.3:o:digiever:ds-2105_pro_firmware:3.1.0.71-11:*:*:*:*:*:*:*,Digiever,Ds-2105 Pro Firmware
CVE-2023-5217,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.49013,CWE-787,Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High),2023-09-28,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:edge:116.0.1938.98:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:edge:117.0.2045.47:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:edge_chromium:116.0.5845.229:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:edge_chromium:117.0.5938.132:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:firefox:*:*:*:*:*:android:*:*;cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*;cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*;cpe:2.3:a:webmproject:libvpx:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:16.7:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:16.7:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2023-5222,6.3,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.74525,CWE-259,A vulnerability classified as critical was found in Viessmann Vitogate 300 up to 2.1.3.0. This vulnerability affects the function isValidUser of the file /cgi-bin/vitogate.cgi of the component Web Management Interface. The manipulation leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240364. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2023-09-27,Nuclei,cpe:2.3:h:viessmann:vitogate_300:-:*:*:*:*:*:*:*;cpe:2.3:o:viessmann:vitogate_300_firmware:*:*:*:*:*:*:*:*,Viessmann,Vitogate 300 Firmware
CVE-2023-52251,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.85025,CWE-94,An issue discovered in provectus kafka-ui 0.4.0 through 0.7.1 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topics/{topic}/messages.,2024-01-25,Metasploit/Nuclei,cpe:2.3:a:provectus:ui:*:*:*:*:*:kafka:*:*,Provectus,Ui
CVE-2023-5244,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01061,CWE-79,Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 2.0.,2023-09-28,Nuclei,cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*,Microweber,Microweber
CVE-2023-5350,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.0191,CWE-89, SQL Injection in GitHub repository salesagility/suitecrm prior to 7.14.1.,2023-10-03,Metasploit,cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*,Salesagility,Suitecrm
CVE-2023-5360,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.81695,CWE-434,"The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE.",2023-10-31,Metasploit/Nuclei,cpe:2.3:a:royal-elementor-addons:royal_elementor_addons:*:*:*:*:*:wordpress:*:*,Royal-Elementor-Addons,Royal Elementor Addons
CVE-2023-5375,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.33629,CWE-601,Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2.,2023-10-04,Nuclei,cpe:2.3:a:mosparo:mosparo:*:*:*:*:*:*:*:*,Mosparo,Mosparo
CVE-2023-5556,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01222,CWE-79,Cross-site Scripting (XSS) - Reflected in GitHub repository structurizr/onpremises prior to 3194.,2023-10-12,Nuclei,cpe:2.3:a:structurizr:on-premises_installation:*:*:*:*:*:*:*:*,Structurizr,On-Premises Installation
CVE-2023-5558,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00916,CWE-79,"The LearnPress WordPress plugin before 4.2.5.5 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2024-01-16,Nuclei,cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:*,Thimpress,Learnpress
CVE-2023-5559,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H,0.02811,NVD-CWE-noinfo,"The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading to denial of service.",2023-11-27,Nuclei,cpe:2.3:a:10web:10web_booster:*:*:*:*:*:wordpress:*:*,10Web,10Web Booster
CVE-2023-5561,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.03862,NVD-CWE-noinfo,"WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack",2023-10-16,Nuclei,cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*,Wordpress,Wordpress
CVE-2023-5612,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.04392,CWE-862,"An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled.",2024-01-26,Metasploit,cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*;cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*;cpe:2.3:a:gitlab:gitlab:16.8.0:*:*:*:community:*:*:*;cpe:2.3:a:gitlab:gitlab:16.8.0:*:*:*:enterprise:*:*:*,Gitlab,Gitlab
CVE-2023-5631,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.75873,CWE-79,"Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker

to load arbitrary JavaScript code.",2023-10-18,CISA,cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2023-5652,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.63711,CWE-89,"The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before using it in a SQL statement of a function hooked to admin_init, allowing unauthenticated users to perform SQL injections",2023-11-20,Nuclei,cpe:2.3:a:thimpress:wp_hotel_booking:*:*:*:*:*:wordpress:*:*,Thimpress,Wp Hotel Booking
CVE-2023-5815,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04262,CWE-98,"The News & Blog Designer Pack – WordPress Blog Plugin — (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry) plugin for WordPress is vulnerable to Remote Code Execution via Local File Inclusion in all versions up to, and including, 3.4.1 via the bdp_get_more_post function hooked via a nopriv AJAX. This is due to function utilizing an unsafe extract() method to extract values from the POST variable and passing that input to the include() function. This makes it possible for unauthenticated attackers to include arbitrary PHP files and achieve remote code execution. On vulnerable Docker configurations it may be possible for an attacker to create a PHP file and then subsequently include it to achieve RCE.",2023-11-22,Nuclei,cpe:2.3:a:infornweb:news_\&_blog_designer_pack:*:*:*:*:*:wordpress:*:*,Infornweb,News & Blog Designer Pack
CVE-2023-5830,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.61043,CWE-287,A vulnerability classified as critical has been found in ColumbiaSoft Document Locator. This affects an unknown part of the file /api/authentication/login of the component WebTools. The manipulation of the argument Server leads to improper authentication. It is possible to initiate the attack remotely. Upgrading to version 7.2 SP4 and 2021.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-243729 was assigned to this vulnerability.,2023-10-27,Nuclei,cpe:2.3:a:documentlocator:document_locator:*:*:*:*:*:*:*:*;cpe:2.3:a:documentlocator:document_locator:21:*:*:*:*:*:*:*;cpe:2.3:a:documentlocator:document_locator:7.2:-:*:*:*:*:*:*;cpe:2.3:a:documentlocator:document_locator:7.2:sp3:*:*:*:*:*:*,Documentlocator,Document Locator
CVE-2023-5863,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01105,CWE-79,Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2.,2023-10-31,Nuclei,cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*,Phpmyfaq,Phpmyfaq
CVE-2023-5914,5.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N,0.73142,CWE-79,  Cross-site scripting (XSS),2024-01-17,Nuclei,cpe:2.3:a:cloud:citrix_storefront:*:*:*:*:*:*:*:*;cpe:2.3:a:cloud:citrix_storefront:*:*:*:*:ltsr:*:*:*;cpe:2.3:a:cloud:citrix_storefront:1912:-:*:*:ltsr:*:*:*,Cloud,Citrix Storefront
CVE-2023-5974,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0315,CWE-918,The WPB Show Core WordPress plugin through 2.2 is vulnerable to server-side request forgery (SSRF) via the `path` parameter.,2023-11-27,Nuclei,cpe:2.3:a:wpb_show_core_project:wpb_show_core:*:*:*:*:*:wordpress:*:*,Wpb Show Core Project,Wpb Show Core
CVE-2023-5991,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03313,CWE-22,"The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server",2023-12-26,Nuclei,cpe:2.3:a:motopress:hotel_booking_lite:*:*:*:*:*:wordpress:*:*,Motopress,Hotel Booking Lite
CVE-2023-6000,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01999,CWE-79,"The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which could lead to Stored XSS attacks.",2024-01-01,Nuclei,cpe:2.3:a:sygnoos:popup_builder:*:*:*:*:*:wordpress:*:*,Sygnoos,Popup Builder
CVE-2023-6018,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.47874,CWE-78,An attacker can overwrite any file on the server hosting MLflow without any authentication.,2023-11-16,Nuclei,cpe:2.3:a:lfprojects:mlflow:-:*:*:*:*:*:*:*,Lfprojects,Mlflow
CVE-2023-6019,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.7463,CWE-78,A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023,2023-11-16,Metasploit,cpe:2.3:a:ray_project:ray:-:*:*:*:*:*:*:*,Ray Project,Ray
CVE-2023-6020,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.14652,CWE-862,LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication.,2023-11-16,Metasploit/Nuclei,cpe:2.3:a:ray_project:ray:-:*:*:*:*:*:*:*,Ray Project,Ray
CVE-2023-6021,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.37076,CWE-29,LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023,2023-11-16,Nuclei,cpe:2.3:a:ray_project:ray:-:*:*:*:*:*:*:*,Ray Project,Ray
CVE-2023-6023,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02999,CWE-29,An attacker can read any file on the filesystem on the server hosting ModelDB through an LFI in the artifact_path URL parameter.,2023-11-16,Nuclei,cpe:2.3:a:vertaai:modeldb:-:*:*:*:*:*:*:*,Vertaai,Modeldb
CVE-2023-6030,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N,0.00748,CWE-89,The LogDash Activity Log WordPress plugin before 1.1.4 hooks the wp_login_failed function (from src/Hooks/Users.php) in order to log failed login attempts to the database but it doesn't escape the username when it perform some SQL request leading to a SQL injection vulnerability which can be exploited using time-based technique by unauthenticated attacker,2025-05-15,Nuclei,cpe:2.3:a:deryckoe:logdash_activity_log:*:*:*:*:*:wordpress:*:*,Deryckoe,Logdash Activity Log
CVE-2023-6038,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.0434,CWE-862,"A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3.",2023-11-16,Nuclei,cpe:2.3:a:h2o:h2o:-:*:*:*:*:*:*:*,H2O,H2O
CVE-2023-6063,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.73708,CWE-89,"The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.",2023-12-04,Metasploit/Nuclei,cpe:2.3:a:wpfastestcache:wp_fastest_cache:*:*:*:*:*:wordpress:*:*,Wpfastestcache,Wp Fastest Cache
CVE-2023-6065,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.18697,NVD-CWE-noinfo,"The Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 doesn't restrict access to detailed scan logs, which allows a malicious actor to discover local paths and portions of the site's code",2023-12-18,Nuclei,cpe:2.3:a:quttera:quttera_web_malware_scanner:*:*:*:*:*:wordpress:*:*,Quttera,Quttera Web Malware Scanner
CVE-2023-6114,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.30894,CWE-552,"The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version), which temporarily stores files containing sensitive data. When directory listing is enabled in the web server, this allows unauthenticated attackers to discover and access these sensitive files, which include a full database dump and a zip archive of the site.",2023-12-26,Nuclei,cpe:2.3:a:awesomemotive:duplicator:*:*:*:*:-:wordpress:*:*;cpe:2.3:a:awesomemotive:duplicator:*:*:*:*:pro:wordpress:*:*,Awesomemotive,Duplicator
CVE-2023-6266,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02072,CWE-200,"The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the BMI_BACKUP case of the handle_downloading function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to download back-up files which can contain sensitive information such as user passwords, PII,  database credentials, and much more.",2024-01-11,Nuclei,cpe:2.3:a:backupbliss:backup_migration:*:*:*:*:*:wordpress:*:*,Backupbliss,Backup Migration
CVE-2023-6275,3.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N,0.02379,CWE-79,"A vulnerability was found in TOTVS Fluig Platform 1.6.x/1.7.x/1.8.0/1.8.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /mobileredir/openApp.jsp of the component mobileredir. The manipulation of the argument redirectUrl/user with the input ""><script>alert(document.domain)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.7.1-231128, 1.8.0-231127 and 1.8.1-231127 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-246104.",2023-11-24,Nuclei,cpe:2.3:a:totvs:fluig:*:*:*:*:*:*:*:*,Totvs,Fluig
CVE-2023-6329,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.65237,CWE-287,"An authentication bypass vulnerability exists in Control iD iDSecure v4.7.32.0. The login routine used by iDS-Core.dll contains a ""passwordCustom"" option that allows an unauthenticated attacker to compute valid credentials that can be used to bypass authentication and act as an administrative user.",2023-11-27,Metasploit/Nuclei,cpe:2.3:a:controlid:idsecure:4.7.32.0:*:*:*:*:*:*:*,Controlid,Idsecure
CVE-2023-6345,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.1963,CWE-190,Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High),2023-11-29,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2023-6360,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.63141,CWE-89,"The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/my-calendar/v1/events' rest route.",2023-11-30,Nuclei,cpe:2.3:a:joedolson:my_calendar:*:*:*:*:*:wordpress:*:*,Joedolson,My Calendar
CVE-2023-6379,5.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N,0.01752,CWE-79,"Cross-site scripting (XSS) vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the 'Mercury' template. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to a victim and partially take control of their browsing session.",2023-12-13,Nuclei,cpe:2.3:a:alkacon:opencms:*:*:*:*:*:*:*:*,Alkacon,Opencms
CVE-2023-6380,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01594,CWE-601,Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker could create a specially crafted URL and send it to a specific user to redirect them to a malicious site and compromise them. Exploitation of this vulnerability is possible due to the fact that there is no proper sanitization of the 'URI' parameter.,2023-12-13,Nuclei,cpe:2.3:a:alkacon:opencms:*:*:*:*:*:*:*:*,Alkacon,Opencms
CVE-2023-6389,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.25679,CWE-601,"The WordPress Toolbar WordPress plugin through 2.2.6 redirects to any URL via the ""wptbto"" parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.",2024-01-29,Nuclei,cpe:2.3:a:abhinavsingh:wordpress_toolbar:*:*:*:*:*:*:wordpress:*,Abhinavsingh,Wordpress Toolbar
CVE-2023-6421,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02437,CWE-522,"The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receiving an invalid one.",2024-01-01,Nuclei,cpe:2.3:a:w3eden:download_manager:*:*:*:*:free:wordpress:*:*,W3Eden,Download Manager
CVE-2023-6444,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.02463,NVD-CWE-noinfo,The Seriously Simple Podcasting WordPress plugin before 3.0.0 discloses the Podcast owner's email address (which by default is the admin email address) via an unauthenticated crafted request.,2024-03-11,Nuclei,cpe:2.3:a:castos:seriously_simple_podcasting:*:*:*:*:*:wordpress:*:*,Castos,Seriously Simple Podcasting
CVE-2023-6448,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02089,CWE-1188,"Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.",2023-12-05,CISA,cpe:2.3:a:unitronics:visilogic:*:*:*:*:*:*:*:*;cpe:2.3:h:unitronics:samba_3.5:-:*:*:*:*:*:*:*;cpe:2.3:h:unitronics:samba_4.3:-:*:*:*:*:*:*:*;cpe:2.3:h:unitronics:samba_7:-:*:*:*:*:*:*:*;cpe:2.3:h:unitronics:vision1040:-:*:*:*:*:*:*:*;cpe:2.3:h:unitronics:vision120:-:*:*:*:*:*:*:*;cpe:2.3:h:unitronics:vision1210:-:*:*:*:*:*:*:*;cpe:2.3:h:unitronics:vision130:-:*:*:*:*:*:*:*;cpe:2.3:h:unitronics:vision230:-:*:*:*:*:*:*:*;cpe:2.3:h:unitronics:vision280:-:*:*:*:*:*:*:*;cpe:2.3:h:unitronics:vision290:-:*:*:*:*:*:*:*;cpe:2.3:h:unitronics:vision350:-:*:*:*:*:*:*:*;cpe:2.3:h:unitronics:vision430:-:*:*:*:*:*:*:*;cpe:2.3:h:unitronics:vision530:-:*:*:*:*:*:*:*;cpe:2.3:h:unitronics:vision560:-:*:*:*:*:*:*:*;cpe:2.3:h:unitronics:vision570:-:*:*:*:*:*:*:*;cpe:2.3:h:unitronics:vision700:-:*:*:*:*:*:*:*;cpe:2.3:o:unitronics:samba_3.5_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:unitronics:samba_4.3_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:unitronics:samba_7_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:unitronics:vision1040_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:unitronics:vision120_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:unitronics:vision1210_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:unitronics:vision130_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:unitronics:vision230_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:unitronics:vision280_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:unitronics:vision290_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:unitronics:vision350_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:unitronics:vision430_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:unitronics:vision530_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:unitronics:vision560_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:unitronics:vision570_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:unitronics:vision700_firmware:*:*:*:*:*:*:*:*,Unitronics,Vision1210 Firmware
CVE-2023-6505,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.39867,NVD-CWE-noinfo,The Migrate WordPress Website & Backups WordPress plugin before 1.9.3 does not prevent directory listing in sensitive directories containing export files.,2024-01-08,Nuclei,cpe:2.3:a:codexonics:prime_mover:*:*:*:*:*:wordpress:*:*,Codexonics,Prime Mover
CVE-2023-6548,5.5,CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.03191,CWE-94,"Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.",2024-01-17,CISA,cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*;cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*;cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*;cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*,Citrix,Netscaler Application Delivery Controller
CVE-2023-6549,8.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H,0.57633,CWE-119,Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and Out-Of-Bounds Memory Read,2024-01-17,CISA/Nuclei,cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*;cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*;cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*;cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*,Citrix,Netscaler Application Delivery Controller
CVE-2023-6553,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97846,CWE-94,"The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated attackers to easily execute code on the server.",2023-12-15,EPSS/Metasploit/Nuclei,cpe:2.3:a:backupbliss:backup_migration:*:*:*:*:*:wordpress:*:*,Backupbliss,Backup Migration
CVE-2023-6567,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.51394,CWE-89,"The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2024-01-11,Nuclei,cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:*,Thimpress,Learnpress
CVE-2023-6568,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01649,CWE-79,"A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the user without adequate sanitization or escaping, leading to arbitrary JavaScript execution in the context of the victim's browser. The vulnerability is present in the mlflow/server/auth/__init__.py file, where the user-supplied Content-Type header is directly injected into a Python formatted string and returned to the user, facilitating the XSS attack.",2023-12-07,Nuclei,cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*,Lfprojects,Mlflow
CVE-2023-6592,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00913,NVD-CWE-noinfo,The FastDup WordPress plugin before 2.2 does not prevent directory listing in sensitive directories containing export files.,2024-01-16,Nuclei,cpe:2.3:a:ninjateam:fastdup:*:*:*:*:*:wordpress:*:*,Ninjateam,Fastdup
CVE-2023-6623,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.50673,CWE-22,"The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when rendering templates over the REST API, which may lead to Local File Inclusion attacks.",2024-01-15,Nuclei,cpe:2.3:a:wpdeveloper:essential_blocks:*:*:*:*:*:wordpress:*:*,Wpdeveloper,Essential Blocks
CVE-2023-6634,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.08544,CWE-88,"The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function. This is due to the plugin making use of the call_user_func function with user input. This makes it possible for unauthenticated attackers to execute any public function with one parameter, which could result in remote code execution.",2024-01-11,Nuclei,cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:*,Thimpress,Learnpress
CVE-2023-6655,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.03766,CWE-89,"A vulnerability, which was classified as critical, has been found in Hongjing e-HR 2020. Affected by this issue is some unknown functionality of the file /w_selfservice/oauthservlet/%2e./.%2e/general/inform/org/loadhistroyorgtree of the component Login Interface. The manipulation of the argument parentid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-247358 is the identifier assigned to this vulnerability.",2023-12-10,Nuclei,cpe:2.3:a:hrp2000:e-hr:2020:*:*:*:*:*:*:*,Hrp2000,E-Hr
CVE-2023-6697,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0104,CWE-79,"The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the map id parameter in all versions up to, and including, 9.0.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",2024-01-24,Nuclei,cpe:2.3:a:wpgmaps:wp_go_maps:*:*:*:*:*:wordpress:*:*,Wpgmaps,Wp Go Maps
CVE-2023-6750,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01961,NVD-CWE-noinfo,"The Clone WordPress plugin before 2.4.3 uses buffer files to store in-progress backup informations, which is stored at a publicly accessible, statically defined file path.",2024-01-08,Nuclei,cpe:2.3:a:backupbliss:clone:*:*:*:*:*:wordpress:*:*,Backupbliss,Clone
CVE-2023-6786,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00464,CWE-601,"The Payment Gateway for Telcell WordPress plugin through 2.0.1 does not validate the api_url parameter before redirecting the user to its value, leading to an Open Redirect issue",2025-05-15,Nuclei,cpe:2.3:a:hkdigit:payment_gateway_for_telcell:*:*:*:*:*:wordpress:*:*,Hkdigit,Payment Gateway For Telcell
CVE-2023-6825,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.06009,CWE-23,"The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7.2.1 (free version) and 8.3.4 (Pro version) via the target parameter in the  mk_file_folder_manager_action_callback_shortcode function. This makes it possible for attackers to read the contents of arbitrary files on the server, which can contain sensitive information and to upload files into directories other than the intended directory for file uploads. The free version requires Administrator access for this vulnerability to be exploitable. The Pro version allows a file manager to be embedded via a shortcode and also allows admins to grant file handling privileges to other user levels, which could lead to this vulnerability being exploited by lower-level users.",2024-03-13,Nuclei,cpe:2.3:a:mndpsingh287:file_manager:*:*:*:*:free:wordpress:*:*;cpe:2.3:a:mndpsingh287:file_manager:*:*:*:*:pro:wordpress:*:*,Mndpsingh287,File Manager
CVE-2023-6831,8.1,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H,0.0329,CWE-29,Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.,2023-12-15,Nuclei,cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*,Lfprojects,Mlflow
CVE-2023-6875,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.90339,CWE-639,"The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to reset the API key used to authenticate to the mailer and view logs, including password reset emails, allowing site takeover. CVE-2023-52233 appears to be a duplicate of this issue.",2024-01-11,Metasploit/Nuclei,cpe:2.3:a:wpexperts:post_smtp:*:*:*:*:*:wordpress:*:*,Wpexperts,Post Smtp
CVE-2023-6895,6.3,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.89138,CWE-78,A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been declared as critical. This vulnerability affects unknown code of the file /php/ping.php. The manipulation of the argument jsondata[ip] with the input netstat -ano leads to os command injection. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issue. It is recommended to upgrade the affected component. VDB-248254 is the identifier assigned to this vulnerability.,2023-12-17,Nuclei,cpe:2.3:h:hikvision:ds-kd-bk:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kd-dis:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kd-e:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kd-in:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kd-info:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kd-kk:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kd-kk\/s:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kd-kp:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kd-kp\/s:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kd-m:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kd3003-e6:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kd8003ime1\(b\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kd8003ime1\(b\)\/flush:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kd8003ime1\(b\)\/ns:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kd8003ime1\(b\)\/s:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kd8003ime1\(b\)\/surface:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kh6220-le1:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kh6320-le1:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kh6320-tde1:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kh6320-te1:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kh6320-wtde1:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kh6320-wte1:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kh6350-wte1:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kh6351-te1:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kh6351-wte1:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kh63le1\(b\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kh8520-wte1:-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kh9310-wte1\(b\):-:*:*:*:*:*:*:*;cpe:2.3:h:hikvision:ds-kh9510-wte1\(b\):-:*:*:*:*:*:*:*;cpe:2.3:o:hikvision:intercom_broadcast_system:*:*:*:*:*:*:*:*,Hikvision,Intercom Broadcast System
CVE-2023-6909,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.89716,CWE-29,Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.,2023-12-18,Nuclei,cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*,Lfprojects,Mlflow
CVE-2023-6933,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.68047,CWE-502,"The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.",2024-02-05,Nuclei,cpe:2.3:a:wpengine:better_search_replace:*:*:*:*:*:wordpress:*:*,Wpengine,Better Search Replace
CVE-2023-6970,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00673,CWE-79,"The WP Recipe Maker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘Referer' header in all versions up to, and including, 9.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",2024-01-18,Nuclei,cpe:2.3:a:bootstrapped:wp_recipe_maker:*:*:*:*:*:wordpress:*:*,Bootstrapped,Wp Recipe Maker
CVE-2023-6977,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03924,CWE-29,This vulnerability enables malicious users to read sensitive files on the server.,2023-12-20,Nuclei,cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*,Lfprojects,Mlflow
CVE-2023-6989,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.56567,CWE-98,"The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the render_action_template parameter. This makes it possible for unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files.",2024-02-05,Nuclei,cpe:2.3:a:getshieldsecurity:shield_security:*:*:*:*:*:wordpress:*:*,Getshieldsecurity,Shield Security
CVE-2023-7024,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.07356,CWE-787,Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High),2023-12-21,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2023-7028,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N,0.94955,CWE-640,"An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.",2024-01-12,CISA/Metasploit/Nuclei,cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*;cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*,Gitlab,Gitlab
CVE-2023-7101,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.16832,CWE-95,"Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.",2023-12-24,CISA/Metasploit,cpe:2.3:a:jmcnamara:spreadsheet\:\:parseexcel:*:*:*:*:*:perl:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2023-7102,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.43596,CWE-1104,"Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.

",2023-12-24,Metasploit,cpe:2.3:h:barracuda:email_security_gateway_300:-:*:*:*:*:*:*:*;cpe:2.3:h:barracuda:email_security_gateway_400:-:*:*:*:*:*:*:*;cpe:2.3:h:barracuda:email_security_gateway_600:-:*:*:*:*:*:*:*;cpe:2.3:h:barracuda:email_security_gateway_800:-:*:*:*:*:*:*:*;cpe:2.3:h:barracuda:email_security_gateway_900:-:*:*:*:*:*:*:*;cpe:2.3:o:barracuda:email_security_gateway_300_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:barracuda:email_security_gateway_400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:barracuda:email_security_gateway_600_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:barracuda:email_security_gateway_800_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:barracuda:email_security_gateway_900_firmware:*:*:*:*:*:*:*:*,Barracuda,Email Security Gateway 300 Firmware
CVE-2023-7116,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.09901,CWE-78,"A vulnerability, which was classified as critical, has been found in WeiYe-Jing datax-web 2.1.2. Affected by this issue is some unknown functionality of the file /api/log/killJob of the component HTTP POST Request Handler. The manipulation of the argument processId leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249086 is the identifier assigned to this vulnerability.",2023-12-27,Nuclei,cpe:2.3:a:datax-web_project:datax-web:2.1.2:*:*:*:*:*:*:*,Datax-Web Project,Datax-Web
CVE-2023-7164,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02261,NVD-CWE-noinfo,"The BackWPup WordPress plugin before 4.0.4 does not prevent Directory Listing in its temporary backup folder, allowing unauthenticated attackers to download backups of a site's database.",2024-04-08,Nuclei,cpe:2.3:a:inpsyde:backwpup:*:*:*:*:*:wordpress:*:*,Inpsyde,Backwpup
CVE-2023-7165,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01915,NVD-CWE-noinfo,"The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files.",2024-02-27,Nuclei,cpe:2.3:a:jetbackup:jetbackup:*:*:*:*:*:wordpress:*:*,Jetbackup,Jetbackup
CVE-2023-7246,5.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N,0.00813,CWE-79,"The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks",2024-03-20,Nuclei,cpe:2.3:a:bowo:system_dashboard:*:*:*:*:*:wordpress:*:*,Bowo,System Dashboard
CVE-2023-7327,0.0,,0.02142,CWE-22,"Ozeki SMS Gateway versions up to and including 10.3.208 contain a path traversal vulnerability. Successful exploitation allows an unauthenticated attacker to use URL-encoded traversal sequences to read arbitrary files from the underlying filesystem with the privileges of the gateway service, leading to disclosure of sensitive information.",2025-11-12,Nuclei,,,
CVE-2023-7337,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01317,CWE-89,The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the 'js-support-ticket-token-tkstatus' cookie in version 2.8.2 due to an incomplete fix for CVE-2023-50839 where a second sink was left with insufficient escaping on the user supplied values and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.,2026-03-04,Nuclei,,,
CVE-2024-0012,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99698,CWE-306,"An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like  CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 .

The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software.

Cloud NGFW and Prisma Access are not impacted by this vulnerability.",2024-11-18,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h7:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.1:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.1:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.1:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h11:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h12:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h13:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h9:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h16:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.5:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.5:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.5:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.5:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.6:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.6:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.6:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h12:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h16:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h8:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h13:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h11:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h14:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h9:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:h12:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.4:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.4:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.4:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.4:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.5:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.5:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.6:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.0:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.0:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.0:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.0:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.1:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.1:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h12:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h14:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h9:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.5:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.0:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.1:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.2:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.2:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.3:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:-:*:*:*:*:*:*,Paloaltonetworks,Pan-Os
CVE-2024-0195,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.19403,CWE-94,"A vulnerability, which was classified as critical, was found in spider-flow 0.4.3. Affected is the function FunctionService.saveFunction of the file src/main/java/org/spiderflow/controller/FunctionController.java. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249510 is the identifier assigned to this vulnerability.",2024-01-02,Nuclei,cpe:2.3:a:ssssssss:spider-flow:0.4.3:*:*:*:*:*:*:*,Ssssssss,Spider-Flow
CVE-2024-0200,7.2,CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L,0.71725,CWE-470,"An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the organization owner role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.13, 3.9.8, 3.10.5, and 3.11.3. This vulnerability was reported via the GitHub Bug Bounty program.

",2024-01-16,Nuclei,cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*,Github,Enterprise Server
CVE-2024-0204,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.95086,CWE-425,Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.,2024-01-22,EPSS/Metasploit/Nuclei,cpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:*;cpe:2.3:a:fortra:goanywhere_managed_file_transfer:6.0.0:*:*:*:*:*:*:*,Fortra,Goanywhere Managed File Transfer
CVE-2024-0235,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.37957,CWE-862,"The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog",2024-01-16,Nuclei,cpe:2.3:a:myeventon:eventon:*:*:*:*:*:wordpress:*:*,Myeventon,Eventon
CVE-2024-0250,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01254,CWE-601,The Analytics Insights for Google Analytics 4 (AIWP) WordPress plugin before 6.3 is vulnerable to Open Redirect due to insufficient validation on the redirect oauth2callback.php file. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.,2024-02-12,Nuclei,cpe:2.3:a:deconf:analytics_insights:*:*:*:*:*:wordpress:*:*,Deconf,Analytics Insights
CVE-2024-0305,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.66932,CWE-200,A vulnerability was found in Guangzhou Yingke Electronic Technology Ncast up to 2017 and classified as problematic. Affected by this issue is some unknown functionality of the file /manage/IPSetup.php of the component Guest Login. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249872.,2024-01-08,Nuclei,cpe:2.3:a:ncast_project:ncast:*:*:*:*:*:*:*:*,Ncast Project,Ncast
CVE-2024-0337,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00891,CWE-601,The Travelpayouts: All Travel Brands in One Place WordPress plugin through 1.1.15 is vulnerable to Open Redirect due to insufficient validation on the travelpayouts_redirect variable. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.,2024-03-20,Nuclei,cpe:2.3:a:travelpayouts:travelpayouts:*:*:*:*:*:wordpress:*:*,Travelpayouts,Travelpayouts
CVE-2024-0352,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.70688,CWE-434,A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/api/controller/File.php of the component HTTP POST Request Handler. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250120.,2024-01-09,Nuclei,cpe:2.3:a:likeshop:likeshop:*:*:*:*:*:*:*:*,Likeshop,Likeshop
CVE-2024-0519,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.03769,CWE-787,Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High),2024-01-16,CISA,cpe:2.3:a:couchbase:couchbase_server:*:*:*:*:*:*:*:*;cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2024-0546,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L,0.06822,CWE-404,"A vulnerability, which was classified as problematic, has been found in EasyFTP 1.7.0. This issue affects some unknown processing of the component LIST Command Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250715.",2024-01-15,Metasploit,cpe:2.3:a:easyftp:easyftp:1.7.0:*:*:*:*:*:*:*,Easyftp,Easyftp
CVE-2024-0593,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00909,CWE-862,"The Simple Job Board plugin for WordPress is vulnerable to unauthorized access of data| due to insufficient authorization checking on the fetch_quick_job() function in all versions up to, and including, 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be password protected or private and contain sensitive information.",2024-02-21,Nuclei,cpe:2.3:a:presstigers:simple_job_board:*:*:*:*:*:wordpress:*:*,Presstigers,Simple Job Board
CVE-2024-0692,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.92245,CWE-502,"The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse SolarWinds’ service, resulting in remote code execution.",2024-03-01,Nuclei,cpe:2.3:a:solarwinds:security_event_manager:*:*:*:*:*:*:*:*,Solarwinds,Security Event Manager
CVE-2024-0705,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02635,CWE-89,"The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 3.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2024-01-19,Nuclei,cpe:2.3:a:webtoffee:stripe_payment_plugin_for_woocommerce:*:*:*:*:*:wordpress:*:*,Webtoffee,Stripe Payment Plugin For Woocommerce
CVE-2024-0769,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.82714,CWE-22,** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.,2024-01-21,CISA,cpe:2.3:h:dlink:dir-859:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-859_firmware:1.06:beta1:*:*:*:*:*:*,D-Link,Dir-859 Firmware
CVE-2024-0799,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04342,CWE-287,An authentication bypass vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in the edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.EdgeLoginServiceImpl.doLogin() function within wizardLogin.,2024-03-13,Nuclei,cpe:2.3:a:arcserve:udp:8.1:*:*:*:*:*:*:*;cpe:2.3:a:arcserve:udp:9.2:*:*:*:*:*:*:*,Arcserve,Udp
CVE-2024-0801,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.41843,CWE-75,A denial of service vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in ASNative.dll.,2024-03-13,Nuclei,cpe:2.3:a:arcserve:udp:8.1:*:*:*:*:*:*:*;cpe:2.3:a:arcserve:udp:9.2:*:*:*:*:*:*:*,Arcserve,Udp
CVE-2024-0881,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N,0.16906,NVD-CWE-noinfo,"The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel  WordPress plugin before 2.2.76 does not have proper authorization, resulting in password protected posts to be displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts",2024-04-11,Nuclei,cpe:2.3:a:pickplugins:post_grid:*:*:*:*:*:wordpress:*:*,Pickplugins,Post Grid
CVE-2024-0939,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.43777,CWE-434,A vulnerability has been found in Byzoro Smart S210 Management Platform up to 20240117 and classified as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252184. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2024-01-26,Nuclei,cpe:2.3:h:byzoro:smart_s210:-:*:*:*:*:*:*:*;cpe:2.3:o:byzoro:smart_s210_firmware:*:*:*:*:*:*:*:*,Byzoro,Smart S210 Firmware
CVE-2024-0986,4.7,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L,0.58153,CWE-78,A vulnerability was found in Issabel PBX 4.0.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php?menu=asterisk_cli of the component Asterisk-Cli. The manipulation of the argument Command leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252251. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2024-01-29,Nuclei,cpe:2.3:a:issabel:pbx:4.0.0:*:*:*:*:*:*:*,Issabel,Pbx
CVE-2024-10081,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N,0.38961,CWE-288,"CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. 
Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. All endpoints, apart from the /Authentication is affected by the vulnerability.

This issue affects CodeChecker: through 6.24.1.",2024-11-06,Nuclei,cpe:2.3:a:ericsson:codechecker:*:*:*:*:*:*:*:*,Ericsson,Codechecker
CVE-2024-10146,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.0057,CWE-79,"The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against admins.",2024-11-14,Nuclei,cpe:2.3:a:simplefilelist:simple_file_list:*:*:*:*:*:wordpress:*:*,Simplefilelist,Simple File List
CVE-2024-10152,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.006,CWE-79,"The Simple Certain Time to Show Content WordPress plugin before 1.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-02-26,Nuclei,cpe:2.3:a:elementengage:simple_certain_time_to_show_content:*:*:*:*:*:wordpress:*:*,Elementengage,Simple Certain Time To Show Content
CVE-2024-1021,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.34713,CWE-918,"A vulnerability, which was classified as critical, has been found in Rebuild up to 3.5.5. Affected by this issue is the function readRawText of the component HTTP Request Handler. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252290 is the identifier assigned to this vulnerability.",2024-01-29,Nuclei,cpe:2.3:a:ruifang-tech:rebuild:*:*:*:*:*:*:*:*,Ruifang-Tech,Rebuild
CVE-2024-10400,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.82464,CWE-89,"The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2024-11-21,Nuclei,cpe:2.3:a:themeum:tutor_lms:*:*:*:*:*:wordpress:*:*,Themeum,Tutor Lms
CVE-2024-10486,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00879,CWE-862,"The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly accessible print_php_information.php file. This makes it possible for unauthenticated attackers to retrieve information about Webserver and PHP configuration, which can be used to aid other attacks.",2024-11-18,Nuclei,,,
CVE-2024-10516,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06479,CWE-22,"The Swift Performance Lite plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 2.3.7.1 via the 'ajaxify' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.",2024-12-06,Nuclei,,,
CVE-2024-10571,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04841,CWE-98,"The Chartify – WordPress Chart Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.5 via the 'source' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.",2024-11-14,Nuclei,cpe:2.3:a:ays-pro:chartify:*:*:*:*:free:wordpress:*:*,Ays-Pro,Chartify
CVE-2024-1061,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.11215,CWE-89,"The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the  'get_view' function.
",2024-01-30,Nuclei,cpe:2.3:a:bplugins:html5_video_player:*:*:*:*:*:wordpress:*:*,Bplugins,Html5 Video Player
CVE-2024-10708,4.9,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N,0.0203,CWE-22,"The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such as admin to perform path traversal attacks an read arbitrary files on the server",2024-12-10,Nuclei,cpe:2.3:a:bowo:system_dashboard:*:*:*:*:*:wordpress:*:*,Bowo,System Dashboard
CVE-2024-1071,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.89431,CWE-89,"The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2024-03-13,Metasploit/Nuclei,cpe:2.3:a:ultimatemember:ultimate_member:*:*:*:*:*:wordpress:*:*,Ultimatemember,Ultimate Member
CVE-2024-10763,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03593,CWE-22,"The Campress theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.35 via the 'campress_woocommerce_get_ajax_products' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.",2025-02-13,Nuclei,cpe:2.3:a:apuswp:campress:*:*:*:*:*:wordpress:*:*,Apuswp,Campress
CVE-2024-10783,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02369,CWE-862,"The MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to privilege escalation due to a missing authorization checks on the register_site function in all versions up to, and including, 5.2 when a site is left in an unconfigured state. This makes it possible for unauthenticated attackers to log in as an administrator on instances where MainWP Child is not yet connected to the MainWP Dashboard. IMPORTANT: this only affects sites who have MainWP Child installed and have not yet connected to the MainWP Dashboard, and do not have the unique security ID feature enabled. Sites already connected to the MainWP Dashboard plugin and do not have the unique security ID feature enabled, are NOT affected and not required to upgrade. Please note versions up to 5.3.3 contained a patch, though a bypass was discovered and not addressed until version 5.3.4.",2024-12-13,Nuclei,,,
CVE-2024-10812,0.0,,0.00574,CWE-601,"An open redirect vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability occurs when a user is redirected to a URL specified by user-controlled input in the 'file' parameter without proper validation or sanitization. This can be exploited by attackers to conduct phishing attacks, distribute malware, and steal user credentials.",2025-03-20,Nuclei,cpe:2.3:a:binary-husky:gpt_academic:3.83:*:*:*:*:*:*:*,Binary-Husky,Gpt Academic
CVE-2024-1086,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.28058,CWE-416,"A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT.

We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.",2024-01-31,CISA,cpe:2.3:h:netapp:500f:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:a250:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:c250:-:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*;cpe:2.3:o:netapp:500f_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:c250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*,Netapp,A250 Firmware
CVE-2024-10908,0.0,,0.0077,CWE-601,"An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft.",2025-03-20,Nuclei,cpe:2.3:a:lm-sys:fastchat:0.2.36:*:*:*:*:*:*:*,Lm-Sys,Fastchat
CVE-2024-10914,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97432,CWE-74,"A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability is the function cgi_user_add of the file /cgi-bin/account_mgr.cgi?cmd=cgi_user_add. The manipulation of the argument name leads to os command injection. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.",2024-11-06,EPSS/Nuclei,cpe:2.3:h:dlink:dns-320:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-320lw:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-325:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-340l:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-320_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-320lw_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-325_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-340l_firmware:*:*:*:*:*:*:*:*,D-Link,Dns-320 Firmware
CVE-2024-10915,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.79135,CWE-74,"A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been rated as critical. Affected by this issue is the function cgi_user_add of the file /cgi-bin/account_mgr.cgi?cmd=cgi_user_add. The manipulation of the argument group leads to os command injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.",2024-11-06,Nuclei,cpe:2.3:h:dlink:dns-320:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-320lw:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-325:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-340l:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-320_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-320lw_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-325_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-340l_firmware:*:*:*:*:*:*:*:*,D-Link,Dns-320 Firmware
CVE-2024-10924,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.81722,CWE-288,"The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the ""Two-Factor Authentication"" setting is enabled (disabled by default).",2024-11-15,Metasploit/Nuclei,cpe:2.3:a:really-simple-plugins:really_simple_security:*:*:*:*:-:wordpress:*:*;cpe:2.3:a:really-simple-plugins:really_simple_security:*:*:*:*:pro:wordpress:*:*;cpe:2.3:a:really-simple-plugins:really_simple_security:*:*:*:*:pro_multisite:wordpress:*:*,Really-Simple-Plugins,Really Simple Security
CVE-2024-11044,0.0,,0.00816,CWE-601,"An open redirect vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This vulnerability can be exploited to conduct phishing attacks, distribute malware, and steal user credentials.",2025-03-20,Nuclei,cpe:2.3:a:automatic1111:stable-diffusion-webui:1.10.0:*:*:*:*:*:*:*,Automatic1111,Stable-Diffusion-Webui
CVE-2024-11120,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.28554,CWE-78,"Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports.",2024-11-15,CISA,cpe:2.3:h:geovision:gv-dsp_lpr:3.0:*:*:*:*:*:*:*;cpe:2.3:h:geovision:gv-vs11:-:*:*:*:*:*:*:*;cpe:2.3:h:geovision:gv-vs12:-:*:*:*:*:*:*:*;cpe:2.3:h:geovision:gvlx_4:2.0:*:*:*:*:*:*:*;cpe:2.3:h:geovision:gvlx_4:3.0:*:*:*:*:*:*:*;cpe:2.3:o:geovision:gv-dsp_lpr_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:geovision:gv-vs11_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:geovision:gv-vs12_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:geovision:gvlx_4_firmware:-:*:*:*:*:*:*:*,Geovision,Gv-Vs12 Firmware
CVE-2024-11182,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.17105,CWE-79,"An XSS issue was discovered in 

MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message 
with 
JavaScript in an img tag. This could
 allow a remote attacker

to load arbitrary JavaScript code in the context of a webmail user's browser window.",2024-11-15,CISA,cpe:2.3:a:mdaemon:mdaemon:*:*:*:*:*:*:*:*,Mdaemon,Mdaemon
CVE-2024-11238,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L,0.05597,CWE-22,"A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0. This affects the function delPreviewFile of the file /sys/ui/sys_ui_component/sysUiComponent.do?method=delPreviewFile. The manipulation of the argument directoryPath leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",2024-11-15,Nuclei,cpe:2.3:a:landray:landray_ekp:*:*:*:*:*:*:*:*,Landray,Landray Ekp
CVE-2024-11303,0.0,,0.01795,CWE-22,The pathname of the root directory to a Restricted Directory ('Path Traversal') vulnerability in Korenix JetPort 5601 allows Path Traversal.This issue affects JetPort 5601: through 1.2.,2024-11-18,Nuclei,,,
CVE-2024-11305,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.03695,CWE-74,A vulnerability classified as critical was found in Altenergy Power Control Software up to 20241108. This vulnerability affects the function get_status_zigbee of the file /index.php/display/status_zigbee. The manipulation of the argument date leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.,2024-11-18,Nuclei,,,
CVE-2024-11320,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.91128,CWE-77,Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. This issue affects Pandora FMS: from 700 through <=777.4,2024-11-21,Metasploit/Nuclei,cpe:2.3:a:pandorafms:pandora_fms:*:*:*:*:*:*:*:*,Pandorafms,Pandora Fms
CVE-2024-11396,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01975,CWE-359,"The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Export file. During the export, a CSV file is created in the wp-content folder with a hardcoded filename that is publicly accessible. This makes it possible for unauthenticated attackers to extract data about event visitors, that includes first and last names, email, and phone number.",2025-01-14,Nuclei,cpe:2.3:a:awplife:event_monster:*:*:*:*:*:wordpress:*:*,Awplife,Event Monster
CVE-2024-11587,3.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N,0.00886,CWE-79,A vulnerability was found in idcCMS 1.60. It has been classified as problematic. This affects the function GetCityOptionJs of the file /inc/classProvCity.php. The manipulation of the argument idName leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.,2024-11-21,Nuclei,cpe:2.3:a:idccms:idccms:1.60:*:*:*:*:*:*:*,Idccms,Idccms
CVE-2024-11667,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03017,CWE-22,"A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.",2024-11-27,CISA,cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:atp:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_20w-vpn:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_100ax:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*,Zyxel,Zld
CVE-2024-11680,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.91559,CWE-306,"ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.",2024-11-26,CISA/Metasploit/Nuclei,cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:*,Projectsend,Projectsend
CVE-2024-11728,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.13515,CWE-89,"The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'visit_type[service_id]' parameter of the tax_calculated_data AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2024-12-06,Nuclei,cpe:2.3:a:iqonic:kivicare:*:*:*:*:*:wordpress:*:*,Iqonic,Kivicare
CVE-2024-11740,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.01888,CWE-94,"The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.",2024-12-19,Nuclei,cpe:2.3:a:w3eden:download_manager:*:*:*:*:free:wordpress:*:*,W3Eden,Download Manager
CVE-2024-1183,0.0,,0.01784,CWE-601,"An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response.",2024-04-16,Nuclei,cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*,Gradio Project,Gradio
CVE-2024-11868,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01131,CWE-284,"The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.3 via class-lp-rest-material-controller.php. This makes it possible for unauthenticated attackers to extract potentially sensitive paid course material.",2024-12-10,Nuclei,cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:*,Thimpress,Learnpress
CVE-2024-11921,4.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N,0.0081,CWE-79,"The GiveWP  WordPress plugin before 3.19.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2024-12-27,Nuclei,cpe:2.3:a:givewp:givewp:*:*:*:*:*:wordpress:*:*,Givewp,Givewp
CVE-2024-11972,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.54754,NVD-CWE-noinfo,"The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed.",2024-12-31,Nuclei,cpe:2.3:a:themehunk:hunk_companion:*:*:*:*:*:wordpress:*:*,Themehunk,Hunk Companion
CVE-2024-12008,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.02206,CWE-200,"The W3 Total Cache plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For example, the log file may contain nonce values that can be used in further CSRF attacks.
Note: the debug feature must be enabled for this to be a concern, and it is disabled by default.",2025-01-14,Nuclei,cpe:2.3:a:boldgrid:w3_total_cache:*:*:*:*:*:wordpress:*:*,Boldgrid,W3 Total Cache
CVE-2024-12025,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02593,CWE-89,"The Collapsing Categories plugin for WordPress is vulnerable to SQL Injection via the 'taxonomy' parameter of the /wp-json/collapsing-categories/v1/get REST API in all versions up to, and including, 3.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2024-12-18,Nuclei,,,
CVE-2024-12029,0.0,,0.05342,CWE-502,"A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can exploit this by embedding malicious code in model files, which is executed upon loading. This issue is fixed in version 5.4.3.",2025-03-20,Metasploit,,,
CVE-2024-1208,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.05285,CWE-200,"The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it possible for unauthenticated attackers to obtain access to quiz questions.",2024-02-05,Nuclei,cpe:2.3:a:learndash:learndash:*:*:*:*:*:wordpress:*:*,Learndash,Learndash
CVE-2024-1209,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.02419,CWE-200,"The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via direct file access due to insufficient protection of uploaded assignments. This makes it possible for unauthenticated attackers to obtain those uploads.",2024-02-05,Nuclei,cpe:2.3:a:learndash:learndash:*:*:*:*:*:wordpress:*:*,Learndash,Learndash
CVE-2024-1210,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.02027,CWE-200,"The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via API. This makes it possible for unauthenticated attackers to obtain access to quizzes.",2024-02-05,Nuclei,cpe:2.3:a:learndash:learndash:*:*:*:*:*:wordpress:*:*,Learndash,Learndash
CVE-2024-1212,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.95388,CWE-78,"Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.",2024-02-21,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:o:progress:loadmaster:*:*:*:*:*:*:*:*,Progress,Loadmaster
CVE-2024-12209,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.15043,CWE-98,"The WP Umbrella: Update Backup Restore & Monitoring plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.17.0 via the 'filename' parameter of the 'umbrella-restore' action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.",2024-12-08,Nuclei,,,
CVE-2024-12356,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.87991,CWE-77,A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.,2024-12-17,CISA/Metasploit,cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*;cpe:2.3:a:beyondtrust:remote_support:*:*:*:*:*:*:*:*,Beyondtrust,Privileged Remote Access
CVE-2024-12585,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00604,CWE-79,"The Property Hive WordPress plugin before 2.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-01-08,Nuclei,cpe:2.3:a:wp-property-hive:propertyhive:*:*:*:*:*:wordpress:*:*,Wp-Property-Hive,Propertyhive
CVE-2024-12638,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.00528,CWE-79,"The Bulk Me Now! WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-01-30,Nuclei,cpe:2.3:a:ombu:bulk_me_now\!:*:*:*:*:*:wordpress:*:*,Ombu,Bulk Me Now!
CVE-2024-12686,6.6,CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H,0.13788,CWE-78,A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.,2024-12-18,CISA,cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*;cpe:2.3:a:beyondtrust:remote_support:*:*:*:*:*:*:*:*,Beyondtrust,Privileged Remote Access
CVE-2024-12724,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00517,CWE-79,"The WP DeskLite  WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-05-15,Nuclei,cpe:2.3:a:codeflock:wp_desklite:1.0.0:*:*:*:*:wordpress:*:*,Codeflock,Wp Desklite
CVE-2024-12732,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00517,CWE-79,"The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-05-15,Nuclei,cpe:2.3:a:cr1000:affiliateimportereb:*:*:*:*:*:wordpress:*:*,Cr1000,Affiliateimportereb
CVE-2024-12734,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00517,CWE-79,"The Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-05-15,Nuclei,cpe:2.3:a:niceit:advance_post_prefix:*:*:*:*:*:wordpress:*:*,Niceit,Advance Post Prefix
CVE-2024-12737,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00573,CWE-79,"The WP BASE Booking of Appointments, Services and Events WordPress plugin before 5.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-02-26,Nuclei,"cpe:2.3:a:wp-base:wp_base_booking_of_appointments\,_services_and_events:*:*:*:*:*:wordpress:*:*",Wp-Base,"Wp Base Booking Of Appointments, Services And Events"
CVE-2024-12749,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.00561,CWE-79,"The Competition Form WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-01-29,Nuclei,cpe:2.3:a:raiserweb:competition_form:*:*:*:*:*:wordpress:*:*,Raiserweb,Competition Form
CVE-2024-12824,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02145,CWE-620,"The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.2. This is due to the plugin not properly checking for an empty token value prior updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user's password, including administrators, and leverage that to gain access to their account.",2025-03-01,Nuclei,,,
CVE-2024-12847,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.29427,CWE-78,NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can execute arbitrary operating system commands as root by sending crafted HTTP requests to the setup.cgi endpoint. This vulnerability has been observed to be exploited in the wild since at least 2017 and specifically by the Shadowserver Foundation on 2025-02-06 UTC.,2025-01-10,Metasploit,cpe:2.3:h:netgear:dgn1000:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:dgn1000_firmware:*:*:*:*:*:*:*:*,Netgear,Dgn1000 Firmware
CVE-2024-12849,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.46858,CWE-22,"The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wp_ajax_nopriv_elvwp_log_download AJAX action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.",2025-01-07,Nuclei,,,
CVE-2024-12873,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00526,CWE-79,"The Custom Field Manager WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-05-15,Nuclei,cpe:2.3:a:f1logic:custom_field_manager:*:*:*:*:*:wordpress:*:*,F1Logic,Custom Field Manager
CVE-2024-12878,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.00588,CWE-79,"The Custom Block Builder  WordPress plugin before 3.8.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-02-26,Nuclei,cpe:2.3:a:thedevoice:lazy_blocks:*:*:*:*:*:wordpress:*:*,Thedevoice,Lazy Blocks
CVE-2024-12971,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.60194,CWE-77,Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6,2025-03-17,Metasploit,cpe:2.3:a:artica:pandora_fms:*:*:*:*:*:*:*:*,Artica,Pandora Fms
CVE-2024-12987,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.98084,CWE-77,"A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of the argument session leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.5 is able to address this issue. It is recommended to upgrade the affected component.",2024-12-27,CISA/EPSS/Nuclei,cpe:2.3:h:draytek:vigor2960:-:*:*:*:*:*:*:*;cpe:2.3:h:draytek:vigor300b:-:*:*:*:*:*:*:*;cpe:2.3:o:draytek:vigor2960_firmware:1.5.1.4:*:*:*:*:*:*:*;cpe:2.3:o:draytek:vigor300b_firmware:1.5.1.4:*:*:*:*:*:*:*,Draytek,Vigor300B Firmware
CVE-2024-13055,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.00517,CWE-79,"The Dyn Business Panel WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-01-27,Nuclei,cpe:2.3:a:phycticio:dyn_business_panel:1.0.0:*:*:*:*:*:*:*,Phycticio,Dyn Business Panel
CVE-2024-13094,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.0055,CWE-79,"The WP Triggers Lite WordPress plugin through 2.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-01-27,Nuclei,cpe:2.3:a:wptriggers:wp_triggers_lite:*:*:*:*:*:wordpress:*:*,Wptriggers,Wp Triggers Lite
CVE-2024-13097,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N,0.00668,CWE-79,"The WP Finance WordPress plugin through 1.3.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-02-01,Nuclei,cpe:2.3:a:mch0lic:wp_finance:*:*:*:*:*:wordpress:*:*,Mch0Lic,Wp Finance
CVE-2024-13098,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N,0.00682,CWE-79,"The WordPress Email Newsletter WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-02-01,Nuclei,cpe:2.3:a:megamindstechnologies:wordpress_email_newsletter:*:*:*:*:*:wordpress:*:*,Megamindstechnologies,Wordpress Email Newsletter
CVE-2024-13099,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N,0.00668,CWE-79,"The Widget4Call WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-02-01,Nuclei,cpe:2.3:a:apidaze:widget4call:*:*:*:*:*:wordpress:*:*,Apidaze,Widget4Call
CVE-2024-13112,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00572,CWE-79,"The WP MediaTagger WordPress plugin through 4.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-01-31,Nuclei,cpe:2.3:a:phd38:wp_mediatagger:*:*:*:*:*:wordpress:*:*,Phd38,Wp Mediatagger
CVE-2024-13114,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00562,CWE-79,"The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-02-04,Nuclei,cpe:2.3:a:phptechie:wp_projects_portfolio_with_client_testimonials:*:*:*:*:*:wordpress:*:*,Phptechie,Wp Projects Portfolio With Client Testimonials
CVE-2024-13126,4.6,CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L,0.0046,CWE-552,"The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unauthorized access of files.",2025-03-16,Nuclei,cpe:2.3:a:w3eden:download_manager:*:*:*:*:free:wordpress:*:*,W3Eden,Download Manager
CVE-2024-13159,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99835,CWE-36,Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.,2025-01-14,CISA/EPSS/Nuclei,cpe:2.3:a:ivanti:endpoint_manager:*:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su1:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su2:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su3:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su4:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su5:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su6:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2024:-:*:*:*:*:*:*,Ivanti,Endpoint Manager
CVE-2024-13160,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.91004,CWE-36,Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.,2025-01-14,CISA/Nuclei,cpe:2.3:a:ivanti:endpoint_manager:*:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su1:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su2:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su3:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su4:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su5:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su6:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2024:-:*:*:*:*:*:*,Ivanti,Endpoint Manager
CVE-2024-13161,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.89829,CWE-36,Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.,2025-01-14,CISA/Nuclei,cpe:2.3:a:ivanti:endpoint_manager:*:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su1:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su2:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su3:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su4:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su5:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su6:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2024:-:*:*:*:*:*:*,Ivanti,Endpoint Manager
CVE-2024-13219,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0056,CWE-79,"The Privacy Policy Genius WordPress plugin through 2.0.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-01-31,Nuclei,cpe:2.3:a:waelhassan:privacy_policy_genius:*:*:*:*:*:wordpress:*:*,Waelhassan,Privacy Policy Genius
CVE-2024-13220,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0056,CWE-79,"The WordPress Google Map Professional (Map In Your Language) WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-01-31,Nuclei,cpe:2.3:a:pragmasoftwares:google_map_professional:*:*:*:*:*:wordpress:*:*,Pragmasoftwares,Google Map Professional
CVE-2024-13221,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00572,CWE-79,"The Fantastic ElasticSearch WordPress plugin through 4.1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-01-31,Nuclei,cpe:2.3:a:parisholley:fantastic_elasticsearch:*:*:*:*:*:wordpress:*:*,Parisholley,Fantastic Elasticsearch
CVE-2024-13222,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00562,CWE-79,"The User Messages WordPress plugin through 1.2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-01-31,Nuclei,cpe:2.3:a:marvinlabs:user_messages:*:*:*:*:*:wordpress:*:*,Marvinlabs,User Messages
CVE-2024-13224,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00572,CWE-79,"The SlideDeck 1 Lite Content Slider WordPress plugin through 1.4.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-01-31,Nuclei,cpe:2.3:a:dtelepathy:slidedeck_1_lite_content_slider:*:*:*:*:*:wordpress:*:*,Dtelepathy,Slidedeck 1 Lite Content Slider
CVE-2024-13225,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00572,CWE-79,"The ECT Home Page Products WordPress plugin through 1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-01-31,Nuclei,cpe:2.3:a:etemplates:ect_home_page_products:*:*:*:*:*:wordpress:*:*,Etemplates,Ect Home Page Products
CVE-2024-13226,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00572,CWE-79,"The A5 Custom Login Page WordPress plugin through 2.8.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-01-31,Nuclei,cpe:2.3:a:tepelstreel:a5_custom_login_page:*:*:*:*:*:wordpress:*:*,Tepelstreel,A5 Custom Login Page
CVE-2024-13322,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01662,CWE-89,"The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the 'a_id' parameter in all versions up to, and including, 4.88 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2025-05-02,Nuclei,cpe:2.3:a:scripteo:ads_pro:*:*:*:*:*:wordpress:*:*,Scripteo,Ads Pro
CVE-2024-13325,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00562,CWE-79,"The Glossy WordPress plugin through 2.3.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",2025-02-04,Nuclei,cpe:2.3:a:croberts:glossy:*:*:*:*:*:wordpress:*:*,Croberts,Glossy
CVE-2024-13326,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00562,CWE-79,"The iBuildApp WordPress plugin through 0.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",2025-02-04,Nuclei,cpe:2.3:a:ibuildapp:ibuildapp:*:*:*:*:*:wordpress:*:*,Ibuildapp,Ibuildapp
CVE-2024-13327,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00562,CWE-79,"The Musicbox WordPress plugin through 2.0.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",2025-02-04,Nuclei,cpe:2.3:a:webdesignby:musicbox:*:*:*:*:*:wordpress:*:*,Webdesignby,Musicbox
CVE-2024-13328,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00562,CWE-79,"The Giga Messenger  WordPress plugin through 2.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",2025-02-04,Nuclei,cpe:2.3:a:tanng:giga_messenger:*:*:*:*:*:wordpress:*:*,Tanng,Giga Messenger
CVE-2024-13330,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.00552,CWE-79,"The JustRows free WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",2025-02-04,Nuclei,cpe:2.3:a:canaveralstudio:justrows_free:*:*:*:*:*:wordpress:*:*,Canaveralstudio,Justrows Free
CVE-2024-13331,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00562,CWE-79,"The WP Dream Carousel WordPress plugin through 1.0.1b does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",2025-02-04,Nuclei,cpe:2.3:a:neoloki:wp_dream_carousel:*:*:*:*:wordpress:*:*:*,Neoloki,Wp Dream Carousel
CVE-2024-13352,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.00541,CWE-79,"The Legull WordPress plugin through 1.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-02-07,Nuclei,cpe:2.3:a:alwayscurious:legull:*:*:*:*:*:wordpress:*:*,Alwayscurious,Legull
CVE-2024-13492,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00563,CWE-79,"The Guten Free Options WordPress plugin through 0.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-02-07,Nuclei,cpe:2.3:a:wordquest:guten_free_options:*:*:*:*:*:wordpress:*:*,Wordquest,Guten Free Options
CVE-2024-13496,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.0215,CWE-89,"The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. NOTE: This vulnerability was previously published as being fixed in version 7.2.2 which was incorrect. The correct fixed version is 7.3.2.",2025-01-22,Nuclei,cpe:2.3:a:gamipress:gamipress:*:*:*:*:*:wordpress:*:*,Gamipress,Gamipress
CVE-2024-13543,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00566,CWE-79,"The Zarinpal Paid Download WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-02-11,Nuclei,cpe:2.3:a:amini7:zarinpal_paid_download:*:*:*:*:*:wordpress:*:*,Amini7,Zarinpal Paid Download
CVE-2024-13569,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.00511,CWE-79,"The Front End Users WordPress plugin through 3.2.32 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-04-22,Nuclei,cpe:2.3:a:etoilewebdesign:front_end_users:*:*:*:*:*:wordpress:*:*,Etoilewebdesign,Front End Users
CVE-2024-13570,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00566,CWE-79,"The Stray Random Quotes WordPress plugin through 1.9.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-02-11,Nuclei,cpe:2.3:a:unalignedcode:stray_random_quotes:*:*:*:*:*:wordpress:*:*,Unalignedcode,Stray Random Quotes
CVE-2024-13609,5.9,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01593,CWE-200,"The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via the class-ocm-backup.php. This makes it possible for unauthenticated attackers to extract sensitive data including usernames and their respective password hashes during a short window of time in which the backup is in process.",2025-02-18,Nuclei,cpe:2.3:a:1clickmigration:1_click_migration:*:*:*:*:*:wordpress:*:*,1Clickmigration,1 Click Migration
CVE-2024-13619,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00517,CWE-79,"The LifterLMS  WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-05-15,Nuclei,cpe:2.3:a:lifterlms:lifterlms:*:*:*:*:*:wordpress:*:*,Lifterlms,Lifterlms
CVE-2024-13624,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.00649,CWE-79,"The WPMovieLibrary WordPress plugin through 2.1.4.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-02-26,Nuclei,cpe:2.3:a:caercam:wpmovielibrary:*:*:*:*:*:wordpress:*:*,Caercam,Wpmovielibrary
CVE-2024-13625,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.00552,CWE-79,"The Tube Video Ads Lite WordPress plugin through 1.5.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-02-17,Nuclei,cpe:2.3:a:gualdoni:tube_video_ads_lite:*:*:*:*:*:wordpress:*:*,Gualdoni,Tube Video Ads Lite
CVE-2024-13627,4.7,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L,0.00807,CWE-79,"The OWL Carousel Slider WordPress plugin through 2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-02-17,Nuclei,cpe:2.3:a:wp-buy:owl_carousel_slider:*:*:*:*:*:wordpress:*:*,Wp-Buy,Owl Carousel Slider
CVE-2024-13628,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00636,CWE-79,"The WP Pricing Table WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-02-26,Nuclei,cpe:2.3:a:codecabin:wp_pricing_table:*:*:*:*:*:wordpress:*:*,Codecabin,Wp Pricing Table
CVE-2024-13630,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00585,CWE-79,"The NewsTicker WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-02-26,Nuclei,cpe:2.3:a:mahinsha:newsticker:1.0:*:*:*:*:wordpress:*:*,Mahinsha,Newsticker
CVE-2024-13634,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00605,CWE-79,"The Post Sync WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-02-26,Nuclei,cpe:2.3:a:wphobby:post_sync:*:*:*:*:*:wordpress:*:*,Wphobby,Post Sync
CVE-2024-13726,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.01931,CWE-89,"The  Coder  WordPress plugin through 1.3.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection",2025-02-17,Nuclei,cpe:2.3:a:themescoder:themes_coder:*:*:*:*:*:wordpress:*:*,Themescoder,Themes Coder
CVE-2024-13727,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00559,CWE-79,"The MemberSpace  WordPress plugin before 2.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.",2025-05-15,Nuclei,cpe:2.3:a:memberspace:memberspace:*:*:*:*:*:wordpress:*:*,Memberspace,Memberspace
CVE-2024-1380,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.50192,CWE-862,"The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relevanssi_export_log_check() function in all versions up to, and including, 4.22.0 (Free) and 2.25.0 (Premium). This makes it possible for unauthenticated attackers to export the query log data. The vendor has indicated that they may look into adding a capability check for proper authorization control, however, this vulnerability is theoretically patched as is.",2024-03-13,Nuclei,cpe:2.3:a:relevanssi:relevanssi:*:*:*:*:*:wordpress:*:*,Relevanssi,Relevanssi
CVE-2024-13853,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00594,CWE-79,"The SEO Tools WordPress plugin through 4.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",2025-03-11,Nuclei,cpe:2.3:a:zynit:seo_tools:*:*:*:*:*:wordpress:*:*,Zynit,Seo Tools
CVE-2024-13888,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.00732,CWE-601,"The WPMobile.App plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 11.56. This is due to insufficient validation on the redirect URL supplied via the 'redirect' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.",2025-02-20,Nuclei,cpe:2.3:a:amauri:wpmobile.app:*:*:*:*:*:wordpress:*:*,Amauri,Wpmobile.App
CVE-2024-13979,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02899,CWE-89,"A SQL injection vulnerability exists in the St. Joe ERP system (""圣乔ERP系统"") that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries, enabling direct manipulation of the backend database. Successful exploitation may result in unauthorized data access, modification of records, or limited disruption of service. An affected version range is undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-04-14 UTC.",2025-08-27,Nuclei,cpe:2.3:a:st._joe_erp_system_project:st._joe_erp_system:-:*:*:*:*:*:*:*,St. Joe Erp System Project,St. Joe Erp System
CVE-2024-14015,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.00409,Missing_Data,"The WordPress eCommerce Plugin  WordPress plugin through 2.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",2025-11-24,Nuclei,,,
CVE-2024-1483,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02718,CWE-22,"A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP POST requests with specially crafted 'artifact_location' and 'source' parameters, using a local URI with '#' instead of '?', an attacker can traverse the server's directory structure. The issue occurs due to insufficient validation of user-supplied input in the server's handlers.",2024-04-16,Nuclei,cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*,Lfprojects,Mlflow
CVE-2024-1512,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.77729,CWE-89,"The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2024-02-17,Nuclei,cpe:2.3:a:stylemixthemes:masterstudy_lms:*:*:*:*:*:wordpress:*:*,Stylemixthemes,Masterstudy Lms
CVE-2024-1561,0.0,,0.09239,CWE-29,"An issue was discovered in gradio-app/gradio, where the `/component_server` endpoint improperly allows the invocation of any method on a `Component` class with attacker-controlled arguments. Specifically, by exploiting the `move_resource_to_block_cache()` method of the `Block` class, an attacker can copy any file on the filesystem to a temporary directory and subsequently retrieve it. This vulnerability enables unauthorized local file read access, posing a significant risk especially when the application is exposed to the internet via `launch(share=True)`, thereby allowing remote attackers to read files on the host machine. Furthermore, gradio apps hosted on `huggingface.co` are also affected, potentially leading to the exposure of sensitive information such as API keys and credentials stored in environment variables.",2024-04-16,Nuclei,cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*,Gradio Project,Gradio
CVE-2024-1698,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.77434,CWE-89,"The NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 2.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2024-02-27,Nuclei,cpe:2.3:a:wpdeveloper:notificationx:*:*:*:*:*:wordpress:*:*,Wpdeveloper,Notificationx
CVE-2024-1708,8.4,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H,0.87624,CWE-22,"ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker 

the ability to execute remote code or directly impact confidential data or critical systems.

",2024-02-21,CISA/Metasploit,cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*,Connectwise,Screenconnect
CVE-2024-1709,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.99959,CWE-288,"ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel

 vulnerability, which may allow an attacker direct access to confidential information or 

critical systems.",2024-02-21,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*,Connectwise,Screenconnect
CVE-2024-1728,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.85393,CWE-22,"gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component. Attackers can exploit this vulnerability to read arbitrary files on the filesystem, such as private SSH keys, by manipulating the file path in the request to the `/queue/join` endpoint. This issue could potentially lead to remote code execution. The vulnerability is present in the handling of file upload paths, allowing attackers to redirect file uploads to unintended locations on the server.",2024-04-10,Nuclei,cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*,Gradio Project,Gradio
CVE-2024-1751,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03109,CWE-89,"The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the question_id parameter in all versions up to, and including, 2.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with subscriber/student access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2024-03-13,Nuclei,cpe:2.3:a:themeum:tutor_lms:*:*:*:*:*:wordpress:*:*,Themeum,Tutor Lms
CVE-2024-1800,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.40375,CWE-502,"
In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability.",2024-03-20,Metasploit,cpe:2.3:a:progress:telerik_report_server:*:*:*:*:*:*:*:*,Progress,Telerik Report Server
CVE-2024-20353,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H,0.70686,CWE-835,"A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

 This vulnerability is due to incomplete error checking when parsing an HTTP header. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted web server on a device. A successful exploit could allow the attacker to cause a DoS condition when the device reloads.",2024-04-24,CISA,cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.10:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.11:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.12:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.13:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.14:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.15:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.16:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.17:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.18:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.7:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.8:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.9:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.10:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.11:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.12:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.13:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.14:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.15:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.16:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.17:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.7:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.8:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.9:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.5.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.5.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.7.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.7:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.7.0.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.7.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.2.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.6.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.4.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.3.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.3.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.4.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.4.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.1.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.1.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.2.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.2.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.2.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.2.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.3.12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.3.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.3.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.3.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.24:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.26:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.29:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.30:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.35:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.37:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.38:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.39:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.40:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.41:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.47:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.48:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.50:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.52:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.54:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.55:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.56:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.58:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.62:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.65:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.1.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.1.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.1.19:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.1.30:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.1.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.2.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.2.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.2.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.2.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3.11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.17:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.22:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.23:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.16:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.17:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.21:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.1.28:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.2.11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.2.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.2.14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.2.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.2.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.3.14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.3.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.3.19:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.3.23:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.3.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.19:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.27:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.38:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.39:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.42:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.48:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.55:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.20:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.30:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.33:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.1.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.2.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.2.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.2.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.3.39:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.3.46:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.3.53:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.3.55:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.3.56:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.4.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.4.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.22:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.24:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.27:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.20.1.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.20.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.20.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.1.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.1.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.17:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.20:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.24:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.26:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.28:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.33:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.35:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.38:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.16:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.21:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.26:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.29:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.17:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.20:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.22:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.25:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.26:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.29:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.32:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.33:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.34:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.35:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.39:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.40:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.41:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.43:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.44:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.45:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.46:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.48:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4:*:*:*:*:*:*:*,Cisco,Adaptive Security Appliance Software
CVE-2024-20359,6.0,CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N,0.19434,CWE-94,"A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary code with root-level privileges. Administrator-level privileges are required to exploit this vulnerability.

 This vulnerability is due to improper validation of a file when it is read from system flash memory. An attacker could exploit this vulnerability by copying a crafted file to the disk0: file system of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the affected device after the next reload of the device, which could alter system behavior. Because the injected code could persist across device reboots, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High.",2024-04-24,CISA,cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.10:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.11:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.12:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.13:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.14:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.15:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.16:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.17:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.18:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.7:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.8:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3.9:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.2.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.10:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.11:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.12:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.13:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.14:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.15:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.16:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.17:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.7:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.8:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0.9:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.4.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.5.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.5.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.7.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.6.7:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.7.0.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:6.7.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.2.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.6.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.0.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.4.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.2.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.3.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.3.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.4.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.4.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.1.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.1.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.2.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.2.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.2.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.2.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.3.12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.3.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.3.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.3.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.24:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.26:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.29:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.30:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.35:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.37:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.38:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.39:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.40:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.41:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.47:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.48:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.50:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.52:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.54:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.55:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.56:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.58:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.62:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.65:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.1.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.1.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.1.19:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.1.30:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.1.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.2.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.2.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.2.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.2.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3.11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.17:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.22:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.23:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.16:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.17:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.21:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.1.28:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.2.11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.2.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.2.14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.2.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.2.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.3.14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.3.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.3.19:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.3.23:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.3.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.19:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.27:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.38:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.39:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.42:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.48:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.55:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.20:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.30:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.33:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.1.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.2.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.2.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.2.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.3.39:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.3.46:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.3.53:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.3.55:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.3.56:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.4.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.4.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.22:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.24:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.27:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.20.1.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.20.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.20.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.1.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.1.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.17:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.20:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.24:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.26:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.28:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.33:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.35:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.38:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.16:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.21:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.26:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.29:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.17:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.20:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.22:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.25:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.26:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.29:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.32:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.33:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.34:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.35:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.39:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.40:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.41:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.43:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.44:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.45:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.46:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.48:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4:*:*:*:*:*:*:*,Cisco,Adaptive Security Appliance Software
CVE-2024-20399,6.0,CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N,0.04271,CWE-78,"A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator credentials to execute arbitrary commands as root on the underlying operating system of an affected device.

This vulnerability is due to insufficient validation of arguments that are passed to specific configuration CLI commands. An attacker could exploit this vulnerability by including crafted input as the argument of an affected configuration CLI command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of root.
Note: To successfully exploit this vulnerability on a Cisco NX-OS device, an attacker must have Administrator credentials. The following Cisco devices already allow administrative users to access the underlying operating system through the bash-shell feature, so, for these devices, this vulnerability does not grant any additional privileges:

Nexus 3000 Series Switches
Nexus 7000 Series Switches that are running Cisco NX-OS Software releases 8.1(1) and later
Nexus 9000 Series Switches in standalone NX-OS mode",2024-07-01,CISA,cpe:2.3:h:cisco:mds_9000:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:mds_9100:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:mds_9132t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:mds_9134:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:mds_9140:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:mds_9148:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:mds_9148s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:mds_9148t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:mds_9200:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:mds_9216:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:mds_9216a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:mds_9216i:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:mds_9222i:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:mds_9250i:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:mds_9396s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:mds_9396t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:mds_9500:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:mds_9506:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:mds_9509:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:mds_9513:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:mds_9700:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:mds_9706:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:mds_9710:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:mds_9718:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3000:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3016:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3016q:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3048:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3064-32t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3064-t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3064-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3064:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3064t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3064x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3100-v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3100-z:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3100:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3100v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_31108pc-v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_31108pv-v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_31108tc-v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_31128pq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3132c-z:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3132q-v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3132q-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3132q-x\/3132q-xl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3132q-xl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3132q:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3164q:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3172:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3172pq-xl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3172pq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3172pq\/pq-xl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3172tq-32t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3172tq-xl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3172tq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3200:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3232:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3232c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3232c_:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3264c-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3264q:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3400:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3408-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_34180yc:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_34200yc-sm:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3432d-s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3464c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3500:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3524-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3524-x\/xl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3524-xl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3524:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3548-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3548-x\/xl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3548-xl:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3548:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3600:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_36180yc-r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_3636c-r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_5000:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_5010:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_5020:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_5500:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_5548p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_5548up:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_5596t:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_5596up:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_5600:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_56128p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_5624q:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_5648q:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_5672up-16g:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_5672up:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_5696q:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_7000:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_7000_10-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_7000_18-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_7000_4-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_7000_9-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_7000_supervisor_1:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_7000_supervisor_2:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_7000_supervisor_2e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_7004:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_7009:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_7010:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_7018:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_7700:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_7700_10-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_7700_18-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_7700_2-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_7700_6-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_7700_supervisor_2e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_7700_supervisor_3e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_7702:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_7706:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_7710:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_7718:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9000:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9000_in_aci_mode:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9000_in_standalone:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9000_in_standalone_nx-os_mode:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9000v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9200:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9200yc:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_92160yc-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9221c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_92300yc:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_92304qc:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9232e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_92348gc-x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9236c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9272q:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9300:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93108tc-ex-24:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93108tc-ex:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93108tc-fx-24:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93108tc-fx3h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93108tc-fx3p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93108tc-fx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93120tx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93128:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93128tx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9316d-gx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93180lc-ex:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93180tc-ex:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93180yc-ex-24:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93180yc-ex:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93180yc-fx-24:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93180yc-fx3:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93180yc-fx3h:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93180yc-fx3s:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93180yc-fx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93216tc-fx2:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93240tc-fx2:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93240yc-fx2:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9332c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9332d-gx2b:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9332d-h2r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9332pq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93360yc-fx2:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9336c-fx2-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9336c-fx2:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9336pq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9336pq_aci:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9336pq_aci_spine:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9348d-gx2a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9348gc-fx3:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9348gc-fxp:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_93600cd-gx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9364c-gx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9364c:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9364d-gx2a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9372px-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9372px:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9372tx-e:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9372tx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9396px:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9396tx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9408:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9432pq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9500:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9500_16-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9500_4-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9500_8-slot:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9500_supervisor_a:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9500_supervisor_a\+:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9500_supervisor_b:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9500_supervisor_b\+:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9500r:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9504:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9508:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9516:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9536pq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9636pq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9716d-gx:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9736pq:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9800:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9804:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:nexus_9808:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:10.1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:10.1\(2\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:10.2\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:10.2\(1q\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:10.2\(2\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:10.2\(3\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:10.2\(4\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:10.2\(5\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:10.2\(6\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:10.2\(7\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:10.2\(8\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:10.3\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:10.3\(2\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:10.3\(3\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:10.3\(4a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:10.3\(5\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:10.3\(99w\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:10.3\(99x\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:10.4\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:10.4\(2\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a6\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a6\(1a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a6\(2\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a6\(2a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a6\(3\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a6\(3a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a6\(4\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a6\(4a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a6\(5\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a6\(5a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a6\(5b\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a6\(6\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a6\(7\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a6\(8\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a8\(10\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a8\(10a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a8\(11\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a8\(11a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a8\(11b\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a8\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a8\(2\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a8\(3\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a8\(4\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a8\(4a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a8\(5\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a8\(6\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a8\(7\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a8\(7a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a8\(7b\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a8\(8\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)a8\(9\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)u6\(10\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)u6\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)u6\(1a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)u6\(2\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)u6\(2a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)u6\(3\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)u6\(3a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)u6\(4\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)u6\(4a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)u6\(5\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)u6\(5a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)u6\(5b\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)u6\(5c\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)u6\(6\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)u6\(7\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)u6\(8\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.0\(2\)u6\(9\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(10\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(11\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(11b\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(11c\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(11d\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(11e\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(12\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(13\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(13a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(13b\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(14\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(15\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(16\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(17\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(18\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(19\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(20\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(20a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(21\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(22\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(23\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(24\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(24a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(25\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(27\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(29\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(2\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(2a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(31\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(33\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(3\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(5\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(5a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(5b\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(6\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(6a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(6b\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(7\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(8\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(8a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(8b\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(9\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(9a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(9b\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:6.2\(9c\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)f1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)f2\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)f2\(2\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)f3\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)f3\(2\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)f3\(3\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)f3\(3a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)f3\(3c\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)f3\(4\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)f3\(5\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i4\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i4\(2\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i4\(3\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i4\(4\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i4\(5\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i4\(6\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i4\(7\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i4\(8\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i4\(8a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i4\(8b\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i4\(8z\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i4\(9\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i5\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i5\(2\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i6\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i6\(2\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i7\(10\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i7\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i7\(2\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i7\(3\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i7\(4\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i7\(5\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i7\(5a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i7\(6\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i7\(7\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i7\(8\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.0\(3\)i7\(9\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.1\(0\)n1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.1\(0\)n1\(1a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.1\(0\)n1\(1b\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.1\(1\)n1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.1\(2\)n1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.1\(3\)n1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.1\(3\)n1\(2\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.1\(4\)n1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.1\(5\)n1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.1\(5\)n1\(1b\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.2\(0\)d1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.2\(1\)d1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.2\(2\)d1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.2\(2\)d1\(2\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(0\)d1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(0\)dx\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(0\)dy\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(0\)n1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(10\)n1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(11\)n1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(12\)n1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(13\)n1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(14\)n1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(1\)d1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(1\)dy\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(1\)n1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(2\)d1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(2\)d1\(2\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(2\)d1\(3\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(2\)d1\(3a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(2\)n1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(3\)d1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(3\)n1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(4\)d1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(4\)n1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(5\)d1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(5\)n1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(6\)d1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(6\)n1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(7\)d1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(7\)n1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(7\)n1\(1a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(7\)n1\(1b\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(8\)d1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(8\)n1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(9\)d1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:7.3\(9\)n1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.0\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.1\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.1\(1a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.1\(1b\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.1\(2\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.1\(2a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.2\(10\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.2\(11\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.2\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.2\(2\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.2\(3\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.2\(4\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.2\(5\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.2\(6\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.2\(7\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.2\(7a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.2\(8\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.2\(9\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.3\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.3\(2\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.4\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.4\(1a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.4\(2\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.4\(2a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.4\(2b\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.4\(2c\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.4\(2d\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.4\(2e\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.4\(2f\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.4\(3\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.4\(4\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.4\(4a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.4\(5\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.4\(6\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.4\(6a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.4\(7\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.4\(8\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.4\(9\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:8.5\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.2\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.2\(1a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.2\(2\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.2\(2t\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.2\(2v\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.2\(3\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.2\(4\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.3\(10\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.3\(11\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.3\(12\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.3\(13\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.3\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.3\(2\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.3\(2a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.3\(3\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.3\(4\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.3\(5\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.3\(6\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.3\(7\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.3\(7a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.3\(8\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.3\(9\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.4\(1\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.4\(1a\):*:*:*:*:*:*:*;cpe:2.3:o:cisco:nx-os:9.4\(2\):*:*:*:*:*:*:*,Cisco,Nx-Os
CVE-2024-20404,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.21738,CWE-918,"A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct an SSRF attack on an affected system.

 This vulnerability is due to insufficient validation of user-supplied input for specific HTTP requests that are sent to an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to obtain limited sensitive information for services that are associated to the affected device.",2024-06-05,Nuclei,cpe:2.3:a:cisco:finesse:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:finesse:11.6\(1\):-:*:*:*:*:*:*;cpe:2.3:a:cisco:finesse:11.6\(1\):es4:*:*:*:*:*:*;cpe:2.3:a:cisco:finesse:11.6\(1\):es5:*:*:*:*:*:*;cpe:2.3:a:cisco:finesse:11.6\(1\):es6:*:*:*:*:*:*;cpe:2.3:a:cisco:finesse:11.6\(1\):es7:*:*:*:*:*:*;cpe:2.3:a:cisco:finesse:11.6\(1\):es8:*:*:*:*:*:*;cpe:2.3:a:cisco:finesse:12.6\(2\):-:*:*:*:*:*:*;cpe:2.3:a:cisco:finesse:12.6\(2\):es01:*:*:*:*:*:*;cpe:2.3:a:cisco:finesse:12.6\(2\):es02:*:*:*:*:*:*,Cisco,Finesse
CVE-2024-20419,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.80635,CWE-620,"A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users.

 This vulnerability is due to improper implementation of the password-change process. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user.",2024-07-17,Metasploit/Nuclei,cpe:2.3:a:cisco:smart_software_manager_on-prem:*:*:*:*:*:*:*:*,Cisco,Smart Software Manager On-Prem
CVE-2024-20439,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.92062,CWE-912,"A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential.

 This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. A successful exploit could allow the attacker to login to the affected system with administrative rights over the CSLU application API.",2024-09-04,CISA/Nuclei,cpe:2.3:a:cisco:smart_license_utility:*:*:*:*:*:*:*:*,Cisco,Smart License Utility
CVE-2024-2044,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.79326,CWE-31,"pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Linux, an authenticated attacker can upload pickle objects, deserialize them, and gain code execution.",2024-03-07,Metasploit,cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*;cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2024-20440,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.51897,CWE-532,"A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information.

This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain log files that contain sensitive data, including credentials that can be used to access the API.",2024-09-04,Nuclei,cpe:2.3:a:cisco:smart_license_utility:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:smart_license_utility:2.1.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:smart_license_utility:2.2.0:*:*:*:*:*:*:*,Cisco,Smart License Utility
CVE-2024-20481,5.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L,0.15953,CWE-772,"A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of the RAVPN service.

 This vulnerability is due to resource exhaustion. An attacker could exploit this vulnerability by sending a large number of VPN authentication requests to an affected device. A successful exploit could allow the attacker to exhaust resources, resulting in a DoS of the RAVPN service on the affected device. Depending on the impact of the attack, a reload of the device may be required to restore the RAVPN service. Services that are not related to VPN are not affected.

 Cisco Talos discussed these attacks in the blog post Large-scale brute-force activity targeting VPNs, SSH services with commonly used login credentials.",2024-10-23,CISA,cpe:2.3:a:cisco:firepower_threat_defense_software:6.2.3.10:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.2.3.11:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.2.3.12:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.2.3.13:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.2.3.14:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.2.3.15:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.2.3.16:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.2.3.17:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.2.3.18:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.2.3.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.2.3.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.2.3.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.2.3.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.2.3.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.2.3.7:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.2.3.8:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.2.3.9:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.2.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.4.0.10:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.4.0.11:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.4.0.12:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.4.0.13:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.4.0.14:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.4.0.15:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.4.0.16:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.4.0.17:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.4.0.18:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.4.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.4.0.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.4.0.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.4.0.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.4.0.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.4.0.7:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.4.0.8:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.4.0.9:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.4.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.6.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.6.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.6.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.6.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.6.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.6.5.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.6.5.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.6.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.6.7.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.6.7.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.6.7:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.7.0.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:6.7.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.0.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.0.2.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.0.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.0.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.0.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.0.6.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.0.6.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.0.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.2.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.2.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.2.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.2.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.2.4.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.2.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.2.5.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.2.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.2.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.2.7:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.2.8.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.2.8:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.3.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.3.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.4.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.4.1.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense_software:7.4.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.1.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.1.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.2.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.2.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.2.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.2.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.3.12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.3.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.3.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.3.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.24:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.26:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.29:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.30:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.35:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.37:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.38:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.39:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.40:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.41:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.47:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.48:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.50:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.52:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.54:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.55:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.56:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.58:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.62:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.65:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.67:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.12.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.1.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.1.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.1.19:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.1.30:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.1.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.2.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.2.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.2.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.2.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3.11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.17:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.22:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.23:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.24:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.14.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.16:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.17:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.21:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.15.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.1.28:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.2.11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.2.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.2.14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.2.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.2.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.3.14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.3.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.3.19:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.3.23:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.3.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.19:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.27:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.38:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.39:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.42:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.48:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.55:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.57:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.61:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.20:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.30:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.33:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.39:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.17.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.1.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.2.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.2.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.2.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.3.39:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.3.46:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.3.53:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.3.55:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.3.56:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.4.22:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.4.24:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.4.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.4.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.22:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.24:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.27:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.28:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.31:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.19.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.20.1.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.20.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.20.2.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.20.2.21:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.20.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.1.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.1.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.17:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.20:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.24:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.26:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.28:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.33:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.35:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.38:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.45:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.16:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.18:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.21:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.26:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.29:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.17:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.20:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.22:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.25:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.26:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.29:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.32:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.33:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.34:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.35:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.39:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.40:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.41:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.43:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.44:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.45:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.46:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.48:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8.4:*:*:*:*:*:*:*,Cisco,Adaptive Security Appliance Software
CVE-2024-2053,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.44579,CWE-23,"The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the ""www-data"" user. This issue was demonstrated on version 4.50 of the The Artica-Proxy administrative web application attempts to prevent local file inclusion. These protections can be bypassed and arbitrary file requests supplied by unauthenticated users will be returned according to the privileges of the ""www-data"" user.",2024-03-21,Nuclei,cpe:2.3:a:articatech:artica_proxy:4.40.000000:*:*:*:*:*:*:*;cpe:2.3:a:articatech:artica_proxy:4.50.000000:*:*:*:*:*:*:*,Articatech,Artica Proxy
CVE-2024-2054,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.8126,CWE-502,"The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the ""www-data"" user.",2024-03-21,Metasploit,cpe:2.3:a:articatech:artica_proxy:4.50.000000:*:*:*:*:*:*:*,Articatech,Artica Proxy
CVE-2024-20767,7.4,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N,0.98514,CWE-284,"ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet.",2024-03-18,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update10:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update11:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update12:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update7:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update8:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2021:update9:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:*,Adobe,Coldfusion
CVE-2024-20953,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03405,NVD-CWE-noinfo,"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",2024-02-17,CISA,cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*,Oracle,Agile Product Lifecycle Management
CVE-2024-21136,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.01783,NVD-CWE-noinfo,"Vulnerability in the Oracle Retail Xstore Office product of Oracle Retail Applications (component: Security).  Supported versions that are affected are 19.0.5, 20.0.3, 20.0.4, 22.0.0 and  23.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Office.  While the vulnerability is in Oracle Retail Xstore Office, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Retail Xstore Office accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).",2024-07-16,Nuclei,cpe:2.3:a:oracle:retail_xstore_office:19.0.5:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_office:20.0.3:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_office:20.0.4:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_office:22.0.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:retail_xstore_office:23.0.1:*:*:*:*:*:*:*,Oracle,Retail Xstore Office
CVE-2024-21182,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.49689,NVD-CWE-noinfo,"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).",2024-07-16,CISA,cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*,Oracle,Weblogic Server
CVE-2024-21287,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01496,CWE-863,"Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM Framework.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile PLM Framework accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).",2024-11-18,CISA,cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*,Oracle,Agile Product Lifecycle Management
CVE-2024-21338,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.51865,CWE-822,Windows Kernel Elevation of Privilege Vulnerability,2024-02-13,CISA,cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1809
CVE-2024-21351,7.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L,0.30344,CWE-94,Windows SmartScreen Security Feature Bypass Vulnerability,2024-02-13,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2024-21410,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.12661,CWE-287,Microsoft Exchange Server Elevation of Privilege Vulnerability,2024-02-13,CISA,cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_13:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_14:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2024-21412,8.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N,0.95443,CWE-693,Internet Shortcut Files Security Feature Bypass Vulnerability,2024-02-13,CISA/EPSS,cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1809
CVE-2024-21413,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9466,CWE-20,Microsoft Outlook Remote Code Execution Vulnerability,2024-02-13,CISA,cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*;cpe:2.3:a:microsoft:office_2016:-:*:*:*:-:*:x64:*;cpe:2.3:a:microsoft:office_2016:-:*:*:*:-:*:x86:*;cpe:2.3:a:microsoft:office_2019:-:*:*:*:*:*:x64:*;cpe:2.3:a:microsoft:office_2019:-:*:*:*:*:*:x86:*;cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:*:*,Microsoft,365 Apps
CVE-2024-21485,6.5,CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N,0.01475,CWE-79,"Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable to Cross-site Scripting (XSS) when the href of the a tag is controlled by an adversary. An authenticated attacker who stores a view that exploits this vulnerability could steal the data that's visible to another user who opens that view - not just the data already included on the page, but they could also, in theory, make additional requests and access other data accessible to this user. In some cases, they could also steal the access tokens of that user, which would allow the attacker to act as that user, including viewing other apps and resources hosted on the same server.

**Note:**

This is only exploitable in Dash apps that include some mechanism to store user input to be reloaded by a different user.",2024-02-02,Nuclei,cpe:2.3:a:plotly:dash:*:*:*:*:*:*:*:*,Plotly,Dash
CVE-2024-21626,8.6,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.18087,CWE-403,"runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem (""attack 2""). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run (""attack 1""). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes (""attack 3a"" and ""attack 3b""). runc 1.1.12 includes patches for this issue.",2024-01-31,Metasploit,cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2024-21633,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.0132,CWE-22,"Apktool is a tool for reverse engineering Android APK files. In versions 2.9.1 and prior, Apktool infers resource files' output path according to their resource names which can be manipulated by attacker to place files at desired location on the system Apktool runs on. Affected environments are those in which an attacker may write/overwrite any file that user has write access, and either user name is known or cwd is under user folder. Commit d348c43b24a9de350ff6e5bd610545a10c1fc712 contains a patch for this issue.",2024-01-03,Nuclei,cpe:2.3:a:apktool:apktool:*:*:*:*:*:*:*:*,Apktool,Apktool
CVE-2024-21641,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N,0.01067,CWE-601,"Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum `/logout` route includes a redirect parameter that allows any third party to redirect users from a (trusted) domain of the Flarum installation to redirect to any link. For logged-in users, the logout must be confirmed. Guests are immediately redirected. This could be used by spammers to redirect to a web address using a trusted domain of a running Flarum installation. The vulnerability has been fixed and published as flarum/core v1.8.5. As a workaround, some extensions modifying the logout route can remedy this issue if their implementation is safe.",2024-01-05,Nuclei,cpe:2.3:a:flarum:flarum:*:*:*:*:*:*:*:*,Flarum,Flarum
CVE-2024-21644,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.42173,CWE-284,"pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77.",2024-01-08,Nuclei,cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:*;cpe:2.3:a:pyload:pyload:0.5.0:beta1:*:*:*:*:*:*;cpe:2.3:a:pyload:pyload:0.5.0:beta2:*:*:*:*:*:*,Pyload,Pyload
CVE-2024-21645,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.24513,CWE-74,"pyLoad is the free and open-source Download Manager written in pure Python. A log injection vulnerability was identified in `pyload` allowing any unauthenticated actor to inject arbitrary messages into the logs gathered by `pyload`. Forged or otherwise, corrupted log files can be used to cover an attacker’s tracks or even to implicate another party in the commission of a malicious act. This vulnerability has been patched in version 0.5.0b3.dev77.
",2024-01-08,Nuclei,cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:*;cpe:2.3:a:pyload:pyload:0.5.0:beta1:*:*:*:*:*:*;cpe:2.3:a:pyload:pyload:0.5.0:beta2:*:*:*:*:*:*,Pyload,Pyload
CVE-2024-21650,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.9348,CWE-95,"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to a remote code execution (RCE) attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the ""first name"" or ""last name"" fields during user registration. This impacts all installations that have user registration enabled for guests. This vulnerability has been patched in XWiki 14.10.17, 15.5.3 and 15.8 RC1.",2024-01-08,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2024-21683,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.88267,NVD-CWE-noinfo,"This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server.

This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. 

Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html

You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives.

This vulnerability was found internally.",2024-05-21,Metasploit/Nuclei,cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:lts:*:*:*;cpe:2.3:a:atlassian:confluence_data_center:8.7.1:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:confluence_data_center:8.7.2:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:confluence_data_center:8.8.0:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:confluence_data_center:8.8.1:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:confluence_server:*:*:*:*:lts:*:*:*;cpe:2.3:a:atlassian:confluence_server:8.7.1:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:confluence_server:8.7.2:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:confluence_server:8.8.0:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:confluence_server:8.8.1:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*;cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:lts:*:*:*;cpe:2.3:a:atlassian:jira_server:*:*:*:*:lts:*:*:*;cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*;cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*;cpe:2.3:a:atlassian:jira_service_management:5.15.2:*:*:*:server:*:*:*,Atlassian,Confluence Data Center
CVE-2024-21762,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.83428,CWE-787,"A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specifically crafted requests",2024-02-09,CISA,cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*,Fortinet,Fortios
CVE-2024-21887,9.1,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H,0.99999,CWE-77,"A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x)  allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.",2024-01-12,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:ivanti:connect_secure:22.1:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.1:r6:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.2:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.2:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.3:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.4:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.4:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.5:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.6:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.6:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.6:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r10:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r12.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r12:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r13.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r13:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r14:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r15.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r15:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r16.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r16:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r17.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r17:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r18:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.1:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.1:r6:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.2:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.2:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.3:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.3:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.4:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.4:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.4:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.5:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.5:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.6:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.0:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r10:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r11:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r12:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r13.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r13:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r14:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r15:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r16:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r17:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r18:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r3.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r4.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r4.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r5:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r6:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r7:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r8.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r8.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r8:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r9:*:*:*:*:*:*,Ivanti,Connect Secure
CVE-2024-21893,8.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N,0.99999,CWE-918,"A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.",2024-01-31,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:ivanti:connect_secure:21.12:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:21.9:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.1:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.1:r6:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.2:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.2:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.3:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.4:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.4:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.6:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.6:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.6:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.6:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3.5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r4.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r5.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.0:r6.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r10:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r12.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r12:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r13.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r13:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r14:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r15.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r15:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r16.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r16:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r17.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r17:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r18.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r18.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r18:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*;cpe:2.3:a:ivanti:neurons_for_zero-trust_access:-:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.2:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.2:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.2:r5:*:*:*:*:*:*;cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.3:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.3:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.4:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.4:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.5:r1.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.5:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.6:r1.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.6:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.1:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.1:r6:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.2:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.2:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.3:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.3:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.4:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.4:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.4:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.5:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.6:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.0:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.0:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.0:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.0:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.0:r3.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.0:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.0:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r10:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r11:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r12:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r13.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r13:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r14:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r15:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r16:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r17:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r18.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r18.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r18:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r3.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r4.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r4.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r4.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r5:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r6:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r7:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r8.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r8.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r8:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:9.1:r9:*:*:*:*:*:*,Ivanti,Connect Secure
CVE-2024-22024,8.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L,0.94721,CWE-611,"An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.",2024-02-13,Nuclei,cpe:2.3:a:ivanti:connect_secure:22.4:r2.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.5:r1.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.5:r2.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r14.4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r17.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r18.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.5:r1.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:zero_trust_access_gateway:22.6:r1.3:*:*:*:*:*:*,Ivanti,Connect Secure
CVE-2024-22207,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.02001,CWE-1188,"fastify-swagger-ui is a Fastify plugin for serving Swagger UI.  Prior to 2.1.0, the default configuration of `@fastify/swagger-ui` without `baseDir` set will lead to all files in the module's directory being exposed via http routes served by the module.  The vulnerability is fixed in v2.1.0. Setting the `baseDir` option can also work around this vulnerability.",2024-01-15,Nuclei,cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:node.js:*:*,Smartbear,Swagger Ui
CVE-2024-22319,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.764,CWE-74,"


IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.



",2024-02-02,Nuclei,cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:operational_decision_manager:8.10.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:operational_decision_manager:8.11:*:*:*:*:*:*:*;cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*,Ibm,Operational Decision Manager
CVE-2024-22320,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.73398,CWE-502,"IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code in the context of SYSTEM.  IBM X-Force ID:  279146.",2024-02-02,Nuclei,cpe:2.3:a:ibm:operational_decision_manager:8.10.3:*:*:*:*:*:*:*;cpe:2.3:a:ibm:operational_decision_manager:8.10.4:*:*:*:*:*:*:*;cpe:2.3:a:ibm:operational_decision_manager:8.10.5.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*;cpe:2.3:a:ibm:operational_decision_manager:8.11:*:*:*:*:*:*:*;cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*,Ibm,Operational Decision Manager
CVE-2024-22476,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.33357,CWE-20,Improper input validation in some Intel(R) Neural Compressor software before version 2.5.0 may allow an unauthenticated user to potentially enable escalation of privilege via remote access.,2024-05-16,Nuclei,,,
CVE-2024-22729,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.70779,CWE-77,NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page.,2024-01-25,Metasploit/Nuclei,cpe:2.3:h:netis-systems:mw5360:-:*:*:*:*:*:*:*;cpe:2.3:o:netis-systems:mw5360_firmware:1.0.1.3031:*:*:*:*:*:*:*,Netis-Systems,Mw5360 Firmware
CVE-2024-22927,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01028,CWE-79,Cross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.,2024-02-01,Nuclei,cpe:2.3:a:eyoucms:eyoucms:1.6.5:*:*:*:*:*:*:*,Eyoucms,Eyoucms
CVE-2024-23055,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00911,NVD-CWE-Other,An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for remote code execution via improper validation of input by the HOST headers.,2024-01-25,Nuclei,cpe:2.3:a:plone:plone_docker_official_image:5.2.13:*:*:*:*:*:*:*,Plone,Plone Docker Official Image
CVE-2024-23108,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.78375,CWE-78,An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet  allows attacker to execute unauthorized code or commands via via crafted API requests.,2024-02-05,Nuclei,cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortisiem:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortisiem:7.1.1:*:*:*:*:*:*:*,Fortinet,Fortisiem
CVE-2024-23113,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.61725,CWE-134,"A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.",2024-02-15,CISA,cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortipam:*:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortipam:1.2.0:*:*:*:*:*:*:*,Fortinet,Fortios
CVE-2024-23222,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.10593,CWE-843,"A type confusion issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 15.8.7 and iPadOS 15.8.7, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.3, macOS Sonoma 14.3, macOS Ventura 13.6.4, tvOS 17.3, visionOS 1.0.2. Processing maliciously crafted web content may lead to arbitrary code execution. This fix associated with the Coruna exploit was shipped in iOS 17.3 on January 22, 2024. This update brings that fix to devices that cannot update to the latest iOS version.",2024-01-23,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2024-23225,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01481,CWE-787,"A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5, tvOS 17.4, visionOS 1.1, watchOS 10.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.",2024-03-05,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2024-23296,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01411,CWE-787,"A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.4 and iPadOS 17.4, macOS Monterey 12.7.6, macOS Sonoma 14.4, macOS Ventura 13.6.7, tvOS 17.4, visionOS 1.1, watchOS 10.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.",2024-03-05,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2024-2330,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.17622,CWE-89,A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. This affects an unknown part of the file /protocol/index.php. The manipulation of the argument IPAddr leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256281 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2024-03-09,Nuclei,cpe:2.3:a:netentsec:application_security_gateway:6.3:*:*:*:*:*:*:*,Netentsec,Application Security Gateway
CVE-2024-23334,5.9,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N,0.76875,CWE-22,"aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present.  Disabling follow_symlinks and using a reverse proxy are encouraged mitigations.  Version 3.9.2 fixes this issue.",2024-01-29,Nuclei,cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2024-2340,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.27997,CWE-548,"The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via an Avada created form with a file upload mechanism.",2024-04-09,Nuclei,cpe:2.3:a:theme-fusion:avada:*:*:*:*:*:wordpress:*:*,Theme-Fusion,Avada
CVE-2024-23692,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99485,CWE-1336,"Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.",2024-05-31,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:rejetto:http_file_server:*:*:*:*:*:*:*:*,Rejetto,Http File Server
CVE-2024-23759,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.47829,CWE-434,"Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via ""search"" parameter of the Parcelshopfinder/AddAddressBookEntry"" function.",2024-02-12,Metasploit,cpe:2.3:a:gambio:gambio:4.9.2.0:*:*:*:*:*:*:*,Gambio,Gambio
CVE-2024-2389,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.93901,CWE-78,"In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified.  An unauthenticated user can gain entry to the system via the Flowmon management interface, allowing for the execution of arbitrary system commands.

",2024-04-02,Metasploit/Nuclei,cpe:2.3:a:progress:flowmon:*:*:*:*:*:*:*:*,Progress,Flowmon
CVE-2024-23897,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99999,CWE-22,"Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.",2024-01-24,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*;cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*,Jenkins,Jenkins
CVE-2024-23917,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.5373,CWE-288,In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible,2024-02-06,Nuclei,cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*,Jetbrains,Teamcity
CVE-2024-23985,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.03574,NVD-CWE-noinfo,"EzServer 6.4.017 allows a denial of service (daemon crash) via a long string, such as one for the RNTO command.",2024-01-25,Metasploit,cpe:2.3:a:ezhometech:ezserver:6.4.017:*:*:*:*:*:*:*,Ezhometech,Ezserver
CVE-2024-24112,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03348,CWE-89,xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter.,2024-02-06,Nuclei,cpe:2.3:a:exrick:xmall:1.1:*:*:*:*:*:*:*,Exrick,Xmall
CVE-2024-24116,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.28214,NVD-CWE-noinfo,An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config_menu.htm.,2024-10-02,Nuclei,cpe:2.3:h:ruijie:rg-nbs2009g-p:-:*:*:*:*:*:*:*;cpe:2.3:o:ruijie:rg-nbs2009g-p_firmware:10.4\(1\)p2_release\(9736\):*:*:*:*:*:*:*,Ruijie,Rg-Nbs2009G-P Firmware
CVE-2024-24131,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00924,CWE-79,SuperWebMailer v9.31.0.01799 was discovered to contain a reflected cross-site scripting (XSS) vulenrability via the component api.php.,2024-02-07,Nuclei,cpe:2.3:a:superwebmailer:superwebmailer:9.31.0.01799:*:*:*:*:*:*:*,Superwebmailer,Superwebmailer
CVE-2024-24328,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06172,CWE-78,TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setMacFilterRules function.,2024-01-30,Nuclei,cpe:2.3:h:totolink:a3300r:-:*:*:*:*:*:*:*;cpe:2.3:o:totolink:a3300r_firmware:17.0.0cu.557_b20221024:*:*:*:*:*:*:*,Totolink,A3300R Firmware
CVE-2024-24329,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06172,CWE-78,TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules function.,2024-01-30,Nuclei,cpe:2.3:h:totolink:a3300r:-:*:*:*:*:*:*:*;cpe:2.3:o:totolink:a3300r_firmware:17.0.0cu.557_b20221024:*:*:*:*:*:*:*,Totolink,A3300R Firmware
CVE-2024-24565,5.7,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N,0.03084,CWE-22,"CrateDB is a distributed SQL database that makes it simple to store and analyze massive amounts of data in real-time. There is a COPY FROM function in the CrateDB database that is used to import file data into database tables. This function has a flaw, and authenticated attackers can use the COPY FROM function to import arbitrary file content into database tables, resulting in information leakage. This vulnerability is patched in 5.3.9, 5.4.8, 5.5.4, and 5.6.1.",2024-01-30,Nuclei,cpe:2.3:a:cratedb:cratedb:*:*:*:*:*:*:*:*,Cratedb,Cratedb
CVE-2024-24578,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.08739,CWE-23,"RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior to version 3.75.6.20240316 contains a unauthenticated remote code execution (RCE) vulnerability, caused by multiple issues within the Java based `HMIPServer.jar` component. RaspberryMatric includes a Java based `HMIPServer`, that can be accessed through URLs starting with `/pages/jpages`. The `FirmwareController` class does however not perform any session id checks, thus this feature can be accessed without a valid session. Due to this issue, attackers can gain remote code execution as root user, allowing a full system compromise. Version 3.75.6.20240316 contains a patch.",2024-03-18,Metasploit,cpe:2.3:o:raspberrymatic:raspberrymatic:*:*:*:*:*:*:*:*,Raspberrymatic,Raspberrymatic
CVE-2024-24725,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.5132,CWE-502,Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI.,2024-03-23,Metasploit,cpe:2.3:a:gibbonedu:gibbon:*:*:*:*:*:*:*:*,Gibbonedu,Gibbon
CVE-2024-2473,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01235,CWE-863,"The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is created when the 'action=postpass' parameter is supplied. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin.",2024-06-11,Nuclei,cpe:2.3:a:wpserveur:wps_hide_login:*:*:*:*:*:wordpress:*:*,Wpserveur,Wps Hide Login
CVE-2024-24759,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L,0.04936,CWE-918,"MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the server-side request forgery protection on the whole website with DNS Rebinding. The vulnerability can also lead to denial of service. Version 23.12.4.2 contains a patch.",2024-09-05,Nuclei,cpe:2.3:a:mindsdb:mindsdb:*:*:*:*:*:*:*:*,Mindsdb,Mindsdb
CVE-2024-24763,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L,0.01057,CWE-601,"JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exploit this vulnerability to construct malicious links, leading users to click on them, thereby facilitating phishing attacks or cross-site scripting attacks. Version 3.10.0 contains a patch for this issue. No known workarounds are available.",2024-02-20,Nuclei,cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:*,Fit2Cloud,Jumpserver
CVE-2024-24809,8.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L,0.54413,CWE-27,"Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this vulnerability to upload files with the prefix `device.` under any folder. Attackers can use this vulnerability for phishing, cross-site scripting attacks, and potentially execute arbitrary commands on the server. Version 6.0 contains a patch for the issue.",2024-04-10,Metasploit/Nuclei,,,
CVE-2024-24882,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02112,CWE-266,Incorrect Privilege Assignment vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.7.2.,2024-05-17,Nuclei,cpe:2.3:a:themegrill:masteriyo:*:*:*:*:free:wordpress:*:*,Themegrill,Masteriyo
CVE-2024-24919,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.99978,CWE-200,Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.,2024-05-28,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:checkpoint:cloudguard_network_security:r80.40:*:*:*:*:*:*:*;cpe:2.3:a:checkpoint:cloudguard_network_security:r81.10:*:*:*:*:*:*:*;cpe:2.3:a:checkpoint:cloudguard_network_security:r81.20:*:*:*:*:*:*:*;cpe:2.3:a:checkpoint:cloudguard_network_security:r81:*:*:*:*:*:*:*;cpe:2.3:h:checkpoint:quantum_security_gateway:-:*:*:*:*:*:*:*;cpe:2.3:h:checkpoint:quantum_spark:-:*:*:*:*:*:*:*;cpe:2.3:o:checkpoint:quantum_security_gateway_firmware:r80.40:*:*:*:*:*:*:*;cpe:2.3:o:checkpoint:quantum_security_gateway_firmware:r81.10:*:*:*:*:*:*:*;cpe:2.3:o:checkpoint:quantum_security_gateway_firmware:r81.20:*:*:*:*:*:*:*;cpe:2.3:o:checkpoint:quantum_security_gateway_firmware:r81:*:*:*:*:*:*:*;cpe:2.3:o:checkpoint:quantum_spark_firmware:r80.20:*:*:*:*:*:*:*;cpe:2.3:o:checkpoint:quantum_spark_firmware:r80.40:*:*:*:*:*:*:*;cpe:2.3:o:checkpoint:quantum_spark_firmware:r81.10:*:*:*:*:*:*:*;cpe:2.3:o:checkpoint:quantum_spark_firmware:r81:*:*:*:*:*:*:*,Checkpoint,Quantum Spark Firmware
CVE-2024-25600,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.88234,CWE-94,Improper Control of Generation of Code ('Code Injection') vulnerability in Codeer Limited Bricks Builder allows Code Injection.This issue affects Bricks Builder: from n/a through 1.9.6.,2024-06-04,Metasploit/Nuclei,,,
CVE-2024-25608,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0096,CWE-601,"HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, (3) `noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect.",2024-02-20,Nuclei,cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_10:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_11:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_12:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_13:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_14:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_15:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_16:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_17:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_18:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_8:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_1:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_2:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_3:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_4:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_5:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_6:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_1:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_2:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_1:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_3:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update10:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update11:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update12:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update13:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update14:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update15:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update16:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update17:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update18:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update2:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update3:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update4:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update5:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update6:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update7:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update8:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update9:*:*:*:*:*:*;cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*,Liferay,Digital Experience Platform
CVE-2024-25641,9.1,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H,0.86303,CWE-20,"Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the ""Package Import"" feature, allows authenticated users having the ""Import Templates"" permission to execute arbitrary PHP code on the web server. The vulnerability is located within the `import_package()` function defined into the `/lib/import.php` script. The function blindly trusts the filename and file content provided within the XML data, and writes such files into the Cacti base path (or even outside, since path traversal sequences are not filtered). This can be exploited to write or overwrite arbitrary files on the web server, leading to execution of arbitrary PHP code or other security impacts. Version 1.2.27 contains a patch for this issue.",2024-05-14,Metasploit,cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2024-25723,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.70581,NVD-CWE-noinfo,"ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2.",2024-02-27,Nuclei,cpe:2.3:a:zenml:zenml:*:*:*:*:*:*:*:*;cpe:2.3:a:zenml:zenml:0.43.0:*:*:*:*:*:*:*,Zenml,Zenml
CVE-2024-25735,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.50622,CWE-319,An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext passwords via a SoftAP /device/config GET request.,2024-03-27,Nuclei,cpe:2.3:h:wyrestorm:apollo_vx20:-:*:*:*:*:*:*:*;cpe:2.3:o:wyrestorm:apollo_vx20_firmware:*:*:*:*:*:*:*:*,Wyrestorm,Apollo Vx20 Firmware
CVE-2024-25852,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.16519,CWE-284,"Linksys RE7000 v2.0.9, v2.0.11, and v2.0.15 have a command execution vulnerability in the ""AccessControlList"" parameter of the access control function point. An attacker can use the vulnerability to obtain device administrator rights.",2024-04-11,Nuclei,cpe:2.3:h:linksys:re7000:-:*:*:*:*:*:*:*;cpe:2.3:o:linksys:re7000_firmware:2.0.11:*:*:*:*:*:*:*;cpe:2.3:o:linksys:re7000_firmware:2.0.15:*:*:*:*:*:*:*;cpe:2.3:o:linksys:re7000_firmware:2.0.9:*:*:*:*:*:*:*,Linksys,Re7000 Firmware
CVE-2024-26169,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.04014,CWE-269,Windows Error Reporting Service Elevation of Privilege Vulnerability,2024-03-12,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2024-2621,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.0194,CWE-89,A vulnerability was found in Fujian Kelixin Communication Command and Dispatch Platform up to 20240318 and classified as critical. Affected by this issue is some unknown functionality of the file api/client/user/pwd_update.php. The manipulation of the argument uuid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257198 is the identifier assigned to this vulnerability.,2024-03-19,Nuclei,cpe:2.3:a:kelixin_communication_command_and_dispatch_project:kelixin_communication_command_and_dispatch:*:*:*:*:*:*:*:*,Kelixin Communication Command And Dispatch Project,Kelixin Communication Command And Dispatch
CVE-2024-26291,0.0,,0.01083,CWE-285,"An Unauthenticated Arbitrary File Read vulnerability affects the
Agent when installed on a system. The parameter filename does not validate the
path thus allowing users to read arbitrary files. As
the application runs with the highest privileges (root/NT_AUTHORITY SYSTEM)
by default attackers are able to obtain sensitive information.

This issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS PRO+: before 2025.5.1; System Director Appliance (SDA+): before 2025.5.1.",2025-07-14,Nuclei,,,
CVE-2024-26331,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.49322,CWE-287,"ReCrystallize Server 5.10.0.0 uses a authorization mechanism that relies on the value of a cookie, but it does not bind the cookie value to a session ID. Attackers can easily modify the cookie value, within a browser or by implementing client-side code outside of a browser. Attackers can bypass the authentication mechanism by modifying the cookie to contain an expected value.",2024-04-30,Nuclei,,,
CVE-2024-2667,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05794,CWE-434,"The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to  insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This makes it possible for unauthenticated attackers to upload arbitrary files.",2024-05-02,Nuclei,cpe:2.3:a:instawp:instawp_connect:*:*:*:*:*:wordpress:*:*,Instawp,Instawp Connect
CVE-2024-27115,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0459,CWE-434,"A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. With this vulnerability, an attacker can upload executable files that are moved to a publicly accessible folder before verifying any requirements. This leads to the possibility of execution of code on the underlying system when the file is triggered. The vulnerability has been remediated in version 1.52.02.",2024-09-11,Nuclei,cpe:2.3:a:soplanning:soplanning:*:*:*:*:*:*:*:*,Soplanning,Soplanning
CVE-2024-27198,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99938,CWE-288,In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible,2024-03-04,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*,Jetbrains,Teamcity
CVE-2024-27199,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.99991,CWE-23,In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions  was possible,2024-03-04,CISA/EPSS/Nuclei,cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*,Jetbrains,Teamcity
CVE-2024-27292,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.69486,CWE-706,Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been patched in version 1.4.97 of the master branch.,2024-03-21,Nuclei,cpe:2.3:a:jhpyle:docassemble:*:*:*:*:*:*:*:*,Jhpyle,Docassemble
CVE-2024-27348,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9921,NVD-CWE-noinfo,"RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11

Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.",2024-04-22,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:hugegraph:*:*:*:*:*:*:*:*,Apache,Hugegraph
CVE-2024-27443,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.20834,CWE-79,"An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload. When a victim views this message in the Zimbra webmail classic interface, the payload is executed in the context of the victim's session, potentially leading to execution of arbitrary JavaScript code.",2024-08-12,CISA/Nuclei,cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p10:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p11:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p12:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p13:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p14:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p15:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p16:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p19:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p20:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p21:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p23:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p24.1:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p24:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p25:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p26:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p27:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p2:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p30:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p31:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p32:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p33:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p34:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p35:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p36:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p37:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p38:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p3:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p5:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p6:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p8:*:*:*:*:*:*;cpe:2.3:a:zimbra:collaboration:9.0.0:p9:*:*:*:*:*:*,Zimbra,Collaboration
CVE-2024-27497,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.2646,CWE-284,Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file.,2024-03-01,Nuclei,cpe:2.3:h:linksys:e2000:-:*:*:*:*:*:*:*;cpe:2.3:o:linksys:e2000_firmware:1.0.06:*:*:*:*:*:*:*,Linksys,E2000 Firmware
CVE-2024-27564,5.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N,0.40637,CWE-918,"pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter. NOTE: the references section has an archived copy of pictureproxy.php from its original GitHub location, but the repository name might later change because it is misleading.",2024-03-05,Nuclei,cpe:2.3:a:dirk1983:chatgpt:2023-05-23:*:*:*:*:*:*:*,Dirk1983,Chatgpt
CVE-2024-2771,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02333,CWE-862,"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint in all versions up to, and including, 5.1.16. This makes it possible for unauthenticated attackers to grant users with Fluent Form management permissions which gives them access to all of the plugin's settings and features. This also makes it possible for unauthenticated attackers to delete manager accounts.",2024-05-18,Nuclei,cpe:2.3:a:fluentforms:contact_form:*:*:*:*:*:wordpress:*:*,Fluentforms,Contact Form
CVE-2024-27718,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01101,CWE-89,SQL Injection vulnerability in Baizhuo Network Smart s200 Management Platform v.S200 allows a local attacker to obtain sensitive information and escalate privileges via the /importexport.php component.,2024-03-05,Nuclei,,,
CVE-2024-2782,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N,0.0123,CWE-862,"The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/fluentform/v1/global-settings REST API endpoint in all versions up to, and including, 5.1.16. This makes it possible for unauthenticated attackers to modify all of the plugin's settings.",2024-05-18,Nuclei,cpe:2.3:a:fluentforms:contact_form:*:*:*:*:*:wordpress:*:*,Fluentforms,Contact Form
CVE-2024-27822,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.01312,NVD-CWE-noinfo,A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sonoma 14.5. An app may be able to gain root privileges.,2024-05-14,Metasploit,cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*,Apple,Macos
CVE-2024-27954,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N,0.72953,CWE-22,"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Automatic Automatic allows Path Traversal, Server Side Request Forgery.This issue affects Automatic: from n/a through 3.92.0.",2024-05-17,Nuclei,,,
CVE-2024-27956,9.9,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L,0.93971,CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.,2024-03-21,Metasploit/Nuclei,cpe:2.3:a:valvepress:automatic:*:*:*:*:*:wordpress:*:*,Valvepress,Automatic
CVE-2024-28000,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.68266,CWE-266,Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 6.3.0.1.,2024-08-21,Nuclei,cpe:2.3:a:litespeedtech:litespeed_cache:*:*:*:*:*:wordpress:*:*,Litespeedtech,Litespeed Cache
CVE-2024-28185,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.07057,CWE-59,"Judge0 is an open-source online code execution system. The application does not account for symlinks placed inside the sandbox directory, which can be leveraged by an attacker to write to arbitrary files and gain code execution outside of the sandbox. When executing a submission, Judge0 writes a `run_script` to the sandbox directory. The security issue is that an attacker can create a symbolic link (symlink) at the path `run_script` before this code is executed, resulting in the `f.write` writing to an arbitrary file on the unsandboxed system. An attacker can leverage this vulnerability to overwrite scripts on the system and gain code execution outside of the sandbox.
",2024-04-18,Metasploit,,,
CVE-2024-28189,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.07211,CWE-59,"Judge0 is an open-source online code execution system. The application uses the UNIX chown command on an untrusted file within the sandbox. An attacker can abuse this by creating a symbolic link (symlink) to a file outside the sandbox, allowing the attacker to run chown on arbitrary files outside of the sandbox. This vulnerability is not impactful on it's own, but it can be used to bypass the patch for CVE-2024-28185 and obtain a complete sandbox escape. This vulnerability is fixed in 1.13.1.",2024-04-18,Metasploit,,,
CVE-2024-28200,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.01946,CWE-288,"The N-central server is vulnerable to an authentication bypass of the user interface. This vulnerability is present in all deployments of N-central prior to 2024.2.

This vulnerability was discovered through internal N-central source code review and N-able has not observed any exploitation in the wild.",2024-07-01,Nuclei,cpe:2.3:a:n-able:n-central:*:*:*:*:*:*:*:*,N-Able,N-Central
CVE-2024-28253,9.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L,0.12527,CWE-94,"OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. `CompiledRule::validateExpression` is also called from `PolicyRepository.prepare`. `prepare()` is called from `EntityRepository.prepareInternal()` which, in turn, gets called from `EntityResource.createOrUpdate()`. Note that even though there is an authorization check (`authorizer.authorize()`), it gets called after `prepareInternal()` gets called and therefore after the SpEL expression has been evaluated. In order to reach this method, an attacker can send a PUT request to `/api/v1/policies` which gets handled by `PolicyResource.createOrUpdate()`. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query and is also tracked as `GHSL-2023-252`. This issue may lead to Remote Code Execution and has been addressed in version 1.3.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.",2024-03-15,Nuclei,cpe:2.3:a:open-metadata:openmetadata:*:*:*:*:*:*:*:*,Open-Metadata,Openmetadata
CVE-2024-28254,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.45725,CWE-78,"OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `‎AlertUtil::validateExpression` method evaluates an SpEL expression using `getValue` which by default uses the `StandardEvaluationContext`, allowing the expression to reach and interact with Java classes such as `java.lang.Runtime`, leading to Remote Code Execution. The `/api/v1/events/subscriptions/validation/condition/<expression>` endpoint passes user-controlled data `AlertUtil::validateExpession` allowing authenticated (non-admin) users to execute arbitrary system commands on the underlaying operating system. In addition, there is a missing authorization check since `Authorizer.authorize()` is never called in the affected path and, therefore, any authenticated non-admin user is able to trigger this endpoint and evaluate arbitrary SpEL expressions leading to arbitrary command execution. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query and is also tracked as `GHSL-2023-235`. This issue may lead to Remote Code Execution and has been addressed in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.",2024-03-15,Metasploit,cpe:2.3:a:open-metadata:openmetadata:*:*:*:*:*:*:*:*,Open-Metadata,Openmetadata
CVE-2024-28255,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.73255,CWE-287,"OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `JwtFilter` handles the API authentication by requiring and verifying JWT tokens. When a new request comes in, the request's path is checked against this list. When the request's path contains any of the excluded endpoints the filter returns without validating the JWT. Unfortunately, an attacker may use Path Parameters to make any path contain any arbitrary strings. For example, a request to `GET /api/v1;v1%2fusers%2flogin/events/subscriptions/validation/condition/111` will match the excluded endpoint condition and therefore will be processed with no JWT validation allowing an attacker to bypass the authentication mechanism and reach any arbitrary endpoint, including the ones listed above that lead to arbitrary SpEL expression injection. This bypass will not work when the endpoint uses the `SecurityContext.getUserPrincipal()` since it will return `null` and will throw an NPE. This issue may lead to authentication bypass and has been addressed in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-237`.",2024-03-15,Metasploit/Nuclei,cpe:2.3:a:open-metadata:openmetadata:*:*:*:*:*:*:*:*,Open-Metadata,Openmetadata
CVE-2024-28397,5.3,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.04548,CWE-94,An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.,2024-06-20,Metasploit/Nuclei,,,
CVE-2024-2862,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H,0.51001,CWE-287,"
This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant.

",2024-03-25,Nuclei,cpe:2.3:a:lg:lg_led_assistant:2.1.65:*:*:*:*:*:*:*,Lg,Lg Led Assistant
CVE-2024-28623,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01317,CWE-79,RiteCMS v3.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component main_menu/edit_section.,2024-03-13,Nuclei,cpe:2.3:a:ritecms:ritecms:3.0:*:*:*:*:*:*:*,Ritecms,Ritecms
CVE-2024-2863,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.63999,CWE-35,This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant.,2024-03-25,Nuclei,cpe:2.3:a:lg:lg_led_assistant:2.1.65:*:*:*:*:*:*:*,Lg,Lg Led Assistant
CVE-2024-28734,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L,0.01791,CWE-79,Cross Site Scripting vulnerability in Unit4 Financials by Coda prior to 2023Q4 allows a remote attacker to run arbitrary code via a crafted GET request using the cols parameter.,2024-03-19,Nuclei,,,
CVE-2024-28741,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.78158,CWE-79,Cross Site Scripting vulnerability in EginDemirbilek NorthStar C2 v1 allows a remote attacker to execute arbitrary code via the login.php component.,2024-04-06,Metasploit,,,
CVE-2024-28752,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N,0.05849,CWE-918,"A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.",2024-03-15,Nuclei,cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:*,Apache,Cxf
CVE-2024-2876,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.80596,CWE-89,"The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IG_ES_Subscribers_Query' class in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2024-05-02,Nuclei,,,
CVE-2024-2879,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.18402,CWE-89,The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.,2024-04-03,Nuclei,cpe:2.3:a:kreaturamedia:layerslider:7.10.0:*:*:*:*:wordpress:*:*;cpe:2.3:a:kreaturamedia:layerslider:7.9.11:*:*:*:*:wordpress:*:*,Kreaturamedia,Layerslider
CVE-2024-28986,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.84628,CWE-502,"SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. 

While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing.  

However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.",2024-08-13,CISA/Nuclei,cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:web_help_desk:12.8.3:-:*:*:*:*:*:*,Solarwinds,Web Help Desk
CVE-2024-28987,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.93299,CWE-798,"The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.",2024-08-21,CISA/Metasploit/Nuclei,cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:web_help_desk:12.8.3:-:*:*:*:*:*:*;cpe:2.3:a:solarwinds:web_help_desk:12.8.3:hotfix1:*:*:*:*:*:*,Solarwinds,Web Help Desk
CVE-2024-28995,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.99614,CWE-22,SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.,2024-06-06,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u:15.4.2:-:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u:15.4.2:hotfix1:*:*:*:*:*:*,Solarwinds,Serv-U
CVE-2024-29028,5.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N,0.01049,CWE-918,"memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated users to enumerate the internal network and receive limited html values in json form. This vulnerability is fixed in 0.16.1.",2024-04-19,Nuclei,cpe:2.3:a:usememos:memos:*:*:*:*:*:*:*:*,Usememos,Memos
CVE-2024-29029,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0108,CWE-79,"memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/image that allows unauthenticated users to enumerate the internal network and retrieve images. The response from the image request is then copied into the response of the current server request, causing a reflected XSS vulnerability. Version 0.22.0 of memos removes the vulnerable file.",2024-04-19,Nuclei,cpe:2.3:a:usememos:memos:*:*:*:*:*:*:*:*,Usememos,Memos
CVE-2024-29030,5.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N,0.01135,CWE-918,"memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /api/resource that allows authenticated users to enumerate the internal network. Version 0.22.0 of memos removes the vulnerable file.",2024-04-19,Nuclei,cpe:2.3:a:usememos:memos:*:*:*:*:*:*:*:*,Usememos,Memos
CVE-2024-29059,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.98624,CWE-209,.NET Framework Information Disclosure Vulnerability,2024-03-23,CISA/EPSS/Nuclei,cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.6:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:-:*:*:*:*:*:*:*,Microsoft,Windows 10 1607
CVE-2024-29137,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.00622,CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.7.,2024-03-19,Nuclei,cpe:2.3:a:themefic:tourfic:*:*:*:*:*:wordpress:*:*,Themefic,Tourfic
CVE-2024-29138,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.00622,CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joachim Jensen Restrict User Access – Membership Plugin with Force restrict-user-access.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through <= 2.5.,2024-03-19,Nuclei,cpe:2.3:a:dev.institute:restrict_user_access:*:*:*:*:*:wordpress:*:*,Dev.Institute,Restrict User Access
CVE-2024-29198,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01923,CWE-918,"GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. It possible to achieve Service Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. Upgrading to GeoServer 2.24.4, or 2.25.2, removes the TestWfsPost servlet resolving this issue.",2025-06-10,Nuclei,cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*,Osgeo,Geoserver
CVE-2024-29269,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05848,CWE-77,An issue discovered in Telesquare TLR-2005Ksh 1.0.0 and 1.1.4 allows attackers to run arbitrary system commands via the Cmd parameter.,2024-04-10,Nuclei,cpe:2.3:h:telesquare:tlr-2005ksh:-:*:*:*:*:*:*:*;cpe:2.3:o:telesquare:tlr-2005ksh_firmware:1.0.0:*:*:*:*:*:*:*;cpe:2.3:o:telesquare:tlr-2005ksh_firmware:1.1.4:*:*:*:*:*:*:*,Telesquare,Tlr-2005Ksh Firmware
CVE-2024-29272,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.09366,CWE-434,"Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php.",2024-03-22,Nuclei,cpe:2.3:a:vvveb:vvvebjs:*:*:*:*:*:*:*:*,Vvveb,Vvvebjs
CVE-2024-2928,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.21847,CWE-29,"A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system, including sensitive files like '/etc/passwd'. The vulnerability is a bypass to a previous patch that only addressed similar manipulation within the URI's query string, highlighting the need for comprehensive validation of all parts of a URI to prevent LFI attacks.",2024-06-06,Nuclei,cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*,Lfprojects,Mlflow
CVE-2024-29510,6.3,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N,0.27974,CWE-693,"Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.",2024-07-03,Metasploit,cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*,Artifex,Ghostscript
CVE-2024-2961,7.3,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H,0.8833,CWE-787,"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.",2024-04-17,Metasploit,cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*;cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:hci_h300s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:hci_h410c:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:hci_h410s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:hci_h500s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:hci_h610c:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:hci_h610s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:hci_h615c:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:hci_h700s:-:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:hci_h300s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:hci_h410c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:hci_h410s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:hci_h500s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:hci_h610c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:hci_h610s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:hci_h615c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:hci_h700s_firmware:-:*:*:*:*:*:*:*,Netapp,Hci H300S Firmware
CVE-2024-29745,5.5,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.00482,CWE-908,there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.,2024-04-05,CISA,cpe:2.3:o:google:android:-:*:*:*:*:*:*:*,Google,Android
CVE-2024-29748,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.0068,CWE-755,there is a possible way to bypass  due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.,2024-04-05,CISA,cpe:2.3:h:google:pixel:-:*:*:*:*:*:*:*;cpe:2.3:o:google:android:*:*:*:*:*:*:*:*,Google,Android
CVE-2024-29792,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.0074,CWE-79,"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through <= 1.5.93.",2024-03-27,Nuclei,cpe:2.3:a:unlimited-elements:unlimited_elements_for_elementor:*:*:*:*:*:wordpress:*:*,Unlimited-Elements,Unlimited Elements For Elementor
CVE-2024-29823,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9986,CWE-89,An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. ,2024-05-31,EPSS,cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su1:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su2:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su3:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su4:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su5:*:*:*:*:*:*,Ivanti,Endpoint Manager
CVE-2024-29824,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99951,CWE-89,An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.,2024-05-31,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su1:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su2:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su3:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su4:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su5:*:*:*:*:*:*,Ivanti,Endpoint Manager
CVE-2024-29825,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99877,CWE-89,An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.,2024-05-31,EPSS,cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su1:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su2:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su3:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su4:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su5:*:*:*:*:*:*,Ivanti,Endpoint Manager
CVE-2024-29826,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99877,CWE-89,An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.,2024-05-31,EPSS,cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su1:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su2:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su3:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su4:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2022:su5:*:*:*:*:*:*,Ivanti,Endpoint Manager
CVE-2024-29868,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.05995,CWE-338,"Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-registration and password recovery mechanism.
This allows an attacker to guess the recovery token in a reasonable time and thereby to take over the attacked user's account.
This issue affects Apache StreamPipes: from 0.69.0 through 0.93.0.

Users are recommended to upgrade to version 0.95.0, which fixes the issue.

",2024-06-24,Nuclei,cpe:2.3:a:apache:streampipes:*:*:*:*:*:*:*:*,Apache,Streampipes
CVE-2024-29889,7.1,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N,0.6296,CWE-89,"GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searches feature to alter another user account data take control of it. This vulnerability is fixed in 10.0.15.",2024-05-07,Nuclei,cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*,Glpi-Project,Glpi
CVE-2024-29895,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.94294,CWE-77,"Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.",2024-05-14,Nuclei,,,
CVE-2024-29931,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.00753,CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPGMaps WP Go Maps wp-google-maps.This issue affects WP Go Maps: from n/a through <= 9.0.29.,2024-03-27,Nuclei,cpe:2.3:a:codecabin:wp_go_maps:*:*:*:*:basic:wordpress:*:*;cpe:2.3:a:codecabin:wp_go_maps:*:*:*:*:pro:wordpress:*:*,Codecabin,Wp Go Maps
CVE-2024-29972,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.89326,CWE-78,"** UNSUPPORTED WHEN ASSIGNED **
The command injection vulnerability in the CGI program ""remote_help-cgi"" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.",2024-06-04,Nuclei,cpe:2.3:h:zyxel:nas326:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:nas542:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:nas326_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:nas542_firmware:*:*:*:*:*:*:*:*,Zyxel,Nas326 Firmware
CVE-2024-29973,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.86089,CWE-78,"** UNSUPPORTED WHEN ASSIGNED **
The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.",2024-06-04,Nuclei,cpe:2.3:h:zyxel:nas326:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:nas542:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:nas326_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:nas542_firmware:*:*:*:*:*:*:*:*,Zyxel,Nas326 Firmware
CVE-2024-29988,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.45151,CWE-693,SmartScreen Prompt Security Feature Bypass Vulnerability,2024-04-09,CISA,cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1809
CVE-2024-30038,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02551,CWE-122,Win32k Elevation of Privilege Vulnerability,2024-05-14,Metasploit,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2024-30040,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.03939,CWE-20,Windows MSHTML Platform Security Feature Bypass Vulnerability,2024-05-14,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2024-30051,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.05687,CWE-122,Windows DWM Core Library Elevation of Privilege Vulnerability,2024-05-14,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2024-30085,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.15127,CWE-122,Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability,2024-06-11,Metasploit,cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1809
CVE-2024-30088,7.0,CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.68202,CWE-367,Windows Kernel Elevation of Privilege Vulnerability,2024-06-11,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2024-30163,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.08676,CWE-89,"Invision Community before 4.7.16 allow SQL injection via the applications/nexus/modules/front/store/store.php IPS\nexus\modules\front\store\_store::_categoryView() method, where user input passed through the filter request parameter is not properly sanitized before being used to execute SQL queries. This can be exploited by unauthenticated attackers to carry out Blind SQL Injection attacks.",2024-06-07,Nuclei,cpe:2.3:a:invisioncommunity:invisioncommunity:*:*:*:*:*:*:*:*,Invisioncommunity,Invisioncommunity
CVE-2024-30188,8.1,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N,0.05987,CWE-20,"File read and write vulnerability in Apache DolphinScheduler ,  authenticated users can illegally access additional resource files.
This issue affects Apache DolphinScheduler: from 3.1.0 before 3.2.2.

Users are recommended to upgrade to version 3.2.2, which fixes the issue.",2024-08-12,Nuclei,cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*,Apache,Dolphinscheduler
CVE-2024-30194,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.00727,CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.1.1.,2024-03-27,Nuclei,cpe:2.3:a:sunshinephotocart:sunshine_photo_cart:*:*:*:*:*:wordpress:*:*,Sunshinephotocart,Sunshine Photo Cart
CVE-2024-30269,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.16,CWE-200,"DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the `/de2api/engine/getEngine;.js` path via a browser reveals that the platform's database configuration is returned. The vulnerability has been fixed in v2.5.0. No known workarounds are available aside from upgrading.",2024-04-08,Nuclei,cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*,Dataease,Dataease
CVE-2024-3032,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00823,CWE-601,"Themify Builder WordPress plugin before 7.5.8 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue",2024-06-13,Nuclei,cpe:2.3:a:themify:builder:*:*:*:*:-:wordpress:*:*,Themify,Builder
CVE-2024-30464,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L,0.01517,CWE-862,Missing Authorization vulnerability in WPZOOM Social Icons Widget & Block by WPZOOM.This issue affects Social Icons Widget & Block by WPZOOM: from n/a through 4.2.15.,2024-06-09,Nuclei,cpe:2.3:a:wpzoom:social_icons_widget:*:*:*:*:free:wordpress:*:*,Wpzoom,Social Icons Widget
CVE-2024-30490,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L,0.02267,CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.8.,2024-03-29,Nuclei,cpe:2.3:a:metagauss:profilegrid:*:*:*:*:*:wordpress:*:*,Metagauss,Profilegrid
CVE-2024-30498,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L,0.02267,CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks CRM Perks Forms.This issue affects CRM Perks Forms: from n/a through 1.1.4.,2024-03-29,Nuclei,cpe:2.3:a:crmperks:crm_perks_forms:*:*:*:*:*:wordpress:*:*,Crmperks,Crm Perks Forms
CVE-2024-30502,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L,0.02267,CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9.,2024-03-29,Nuclei,cpe:2.3:a:wptravelengine:wp_travel_engine:*:*:*:*:*:wordpress:*:*,Wptravelengine,Wp Travel Engine
CVE-2024-30568,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.47197,CWE-94,Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the c4-IPAddr parameter.,2024-04-03,Nuclei,cpe:2.3:h:netgear:r6850:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6850_firmware:1.1.0.88:*:*:*:*:*:*:*,Netgear,R6850 Firmware
CVE-2024-30569,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01923,CWE-200,An information leak in currentsetting.htm of Netgear R6850 v1.1.0.88 allows attackers to obtain sensitive information without any authentication required.,2024-04-03,Nuclei,cpe:2.3:h:netgear:r6850:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6850_firmware:1.1.0.88:*:*:*:*:*:*:*,Netgear,R6850 Firmware
CVE-2024-30570,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.01231,CWE-200,An information leak in debuginfo.htm of Netgear R6850 v1.1.0.88 allows attackers to obtain sensitive information without any authentication required.,2024-04-03,Nuclei,cpe:2.3:h:netgear:r6850:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:r6850_firmware:1.1.0.88:*:*:*:*:*:*:*,Netgear,R6850 Firmware
CVE-2024-3080,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.43456,CWE-287,"Certain ASUS router models have authentication bypass vulnerability, allowing unauthenticated remote attackers to log in the device.",2024-06-14,Nuclei,,,
CVE-2024-30851,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.04611,CWE-22,Directory Traversal vulnerability in codesiddhant Jasmin Ransomware v.1.0.1 allows an attacker to obtain sensitive information via the download_file.php component.,2024-05-03,Metasploit,cpe:2.3:a:codesiddhant:jasmin-ransomware:1.0.1:*:*:*:*:*:*:*,Codesiddhant,Jasmin-Ransomware
CVE-2024-3097,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.38023,CWE-862,"The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_item function in versions up to, and including, 3.59. This makes it possible for unauthenticated attackers to extract sensitive data including EXIF and other metadata of any image uploaded through the plugin.",2024-04-09,Nuclei,cpe:2.3:a:imagely:nextgen_gallery:*:*:*:*:*:wordpress:*:*,Imagely,Nextgen Gallery
CVE-2024-3116,7.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L,0.64846,NVD-CWE-noinfo,"pgAdmin <= 8.4 is affected by a  Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the underlying data.",2024-04-04,Metasploit,cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2024-31214,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.17631,CWE-434,"Traccar is an open source GPS tracking system. Traccar versions 5.1 through 5.12 allow arbitrary files to be uploaded through the device image upload API. Attackers have full control over the file contents, full control over the directory where the file is stored, full control over the file extension, and partial control over the file name. While it's not  for an attacker to overwrite an existing file, an attacker can create new files with certain names and attacker-controlled extensions anywhere on the file system. This can potentially lead to remote code execution, XSS, DOS, etc. The default install of Traccar makes this vulnerability more severe. Self-registration is enabled by default, allowing anyone to create an account to exploit this vulnerability. Traccar also runs by default with root/system privileges, allowing files to be placed anywhere on the file system. Version 6.0 contains a fix for the issue. One may also turn off self-registration by default, as that would make most vulnerabilities in the application much harder to exploit by default and reduce the severity considerably.
",2024-04-10,Metasploit,cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:*,Traccar,Traccar
CVE-2024-31223,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01114,CWE-497,"Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address, private domain name, and/or port. A vulnerability present starting in version 2.19.0 and prior to version 2.39.2rc0 allows an unauthenticated attacker to make a HTTP GET request from the Privacy Center that discloses the value of this server-side URL. This could result in disclosure of server-side configuration giving an attacker information on server-side ports, private IP addresses, and/or private domain names. The vulnerability has been patched in Fides version 2.39.2rc0. No known workarounds are available.",2024-07-03,Nuclei,cpe:2.3:a:ethyca:fides:*:*:*:*:*:*:*:*,Ethyca,Fides
CVE-2024-3136,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05018,CWE-98,"The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.",2024-04-09,Nuclei,cpe:2.3:a:stylemixthemes:masterstudy_lms:*:*:*:*:*:wordpress:*:*,Stylemixthemes,Masterstudy Lms
CVE-2024-31621,7.6,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L,0.59867,CWE-94,An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component.,2024-04-29,Nuclei,cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*,Flowiseai,Flowise
CVE-2024-31750,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.1942,CWE-89,SQL injection vulnerability in f-logic datacube3 v.1.0 allows a remote attacker to obtain sensitive information via the req_id parameter.,2024-04-19,Nuclei,cpe:2.3:h:f-logic:datacube3:-:*:*:*:*:*:*:*;cpe:2.3:o:f-logic:datacube3_firmware:1.0:*:*:*:*:*:*:*,F-Logic,Datacube3 Firmware
CVE-2024-31819,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.15635,CWE-94,An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php component.,2024-04-10,Metasploit,cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*,Wwbn,Avideo
CVE-2024-31839,4.8,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N,0.08104,CWE-79,Cross Site Scripting vulnerability in tiagorlampert CHAOS v.5.0.1 allows a remote attacker to escalate privileges via the sendCommandHandler function in the handler.go component.,2024-04-12,Metasploit/Nuclei,cpe:2.3:a:tiagorlampert:chaos:5.0.1:*:*:*:*:*:*:*,Tiagorlampert,Chaos
CVE-2024-31848,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.08151,CWE-22,"A path traversal vulnerability exists in the Java version of CData API Server < 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application.",2024-04-05,Nuclei,,,
CVE-2024-31849,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06076,CWE-22,"A path traversal vulnerability exists in the Java version of CData Connect < 23.4.8846 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application.",2024-04-05,Nuclei,,,
CVE-2024-31850,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L,0.03037,CWE-22,"A path traversal vulnerability exists in the Java version of CData Arc < 23.4.8839 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions.",2024-04-05,Nuclei,,,
CVE-2024-31851,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L,0.02885,CWE-22,"A path traversal vulnerability exists in the Java version of CData Sync < 23.4.8843 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions.",2024-04-05,Nuclei,,,
CVE-2024-31982,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.3428,CWE-95,"XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search allows remote code execution through the search text. This allows remote code execution for any visitor of a public wiki or user of a closed wiki as the database search is by default accessible for all users. This impacts the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.20, 15.5.4 and 15.10RC1. As a workaround, one may manually apply the patch to the page `Main.DatabaseSearch`. Alternatively, unless database search is explicitly used by users, this page can be deleted as this is not the default search interface of XWiki.",2024-04-10,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2024-32019,8.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.01165,CWE-426,"Netdata is an open source observability tool. In affected versions the `ndsudo` tool shipped with affected versions of the Netdata Agent allows an attacker to run arbitrary programs with root permissions. The `ndsudo` tool is packaged as a `root`-owned executable with the SUID bit set. It only runs a restricted set of external commands, but its search paths are supplied by the `PATH` environment variable. This allows an attacker to control where `ndsudo` looks for these commands, which may be a path the attacker has write access to. This may lead to local privilege escalation. This vulnerability has been addressed in versions 1.45.3 and 1.45.2-169. Users are advised to upgrade. There are no known workarounds for this vulnerability.",2024-04-12,Metasploit,,,
CVE-2024-32113,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99442,CWE-22,"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13.

Users are recommended to upgrade to version 18.12.13, which fixes the issue.",2024-05-08,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*,Apache,Ofbiz
CVE-2024-32114,8.5,CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H,0.0692,CWE-1188,"In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located).
It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API).

To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement:
<bean id=""securityConstraintMapping"" class=""org.eclipse.jetty.security.ConstraintMapping"">
  <property name=""constraint"" ref=""securityConstraint"" />
  <property name=""pathSpec"" value=""/"" />
</bean>

Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.
",2024-05-02,Nuclei,cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*,Apache,Activemq
CVE-2024-32128,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L,0.01706,CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Realtyna Realtyna Organic IDX plugin.This issue affects Realtyna Organic IDX plugin: from n/a through 4.14.4.,2024-04-15,Nuclei,,,
CVE-2024-32231,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.0117,CWE-89,Stash up to v0.25.1 was discovered to contain a SQL injection vulnerability via the sort parameter.,2024-08-15,Nuclei,cpe:2.3:a:stashapp:stash:*:*:*:*:*:*:*:*,Stashapp,Stash
CVE-2024-32238,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.53229,CWE-522,H3C ER8300G2-X is vulnerable to Incorrect Access Control. The password for the router's management system can be accessed via the management system page login interface.,2024-04-22,Nuclei,,,
CVE-2024-3231,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00684,CWE-79,"The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.",2024-05-17,Nuclei,cpe:2.3:a:ivanweb:popup4phone:*:*:*:*:*:wordpress:*:*,Ivanweb,Popup4Phone
CVE-2024-3234,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03757,CWE-22,"The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the `web_assets` folder. However, the outdated version of gradio it employs is susceptible to path traversal, as identified in CVE-2023-51449. This vulnerability allows unauthorized users to bypass the intended restrictions and access sensitive files, such as `config.json`, which contains API keys. The issue affects the latest version of chuanhuchatgpt prior to the fixed version released on 20240305.",2024-06-06,Nuclei,cpe:2.3:a:gaizhenbiao:chuanhuchatgpt:*:*:*:*:*:*:*:*,Gaizhenbiao,Chuanhuchatgpt
CVE-2024-32399,7.6,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L,0.0316,CWE-22,Directory Traversal vulnerability in RaidenMAILD Mail Server v.4.9.4 and before allows a remote attacker to obtain sensitive information via the /webeditor/ component.,2024-04-22,Nuclei,,,
CVE-2024-32640,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.70366,CWE-89,"MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulnerability in the `processAsyncObject` method that can result in remote code execution. Versions 7.4.5, 7.3.12, and 7.2.7 contain a fix for the issue.",2025-08-11,Nuclei,,,
CVE-2024-32651,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.83722,CWE-1336,"changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run any system command without any restriction and they could use a reverse shell. The impact is critical as the attacker can completely takeover the server machine. This can be reduced if changedetection is behind a login page, but this isn't required by the application (not by default and not enforced).",2024-04-26,Nuclei,,,
CVE-2024-32709,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L,0.05851,CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Plechev Andrey WP-Recall.This issue affects WP-Recall: from n/a through 16.26.5.,2024-04-24,Nuclei,,,
CVE-2024-3272,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98038,CWE-798,"** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user with the input messagebus leads to hard-coded credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259283. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.",2024-04-04,CISA/EPSS/Nuclei,cpe:2.3:h:dlink:dnr-202l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dnr-322l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dnr-326:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-1100-4:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-1200-05:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-120:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-1550-04:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-315l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-320:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-320l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-320lw:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-321:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-323:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-325:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-326:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-327l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-340l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-343:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-345:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-726-4:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dnr-202l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dnr-322l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dnr-326_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-1100-4_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-1200-05_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-120_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-1550-04_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-315l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-320_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-320l_firmware:1.01.0702.2013:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-320l_firmware:1.03.0904.2013:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-320l_firmware:1.11:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-320lw_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-321_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-323_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-325_firmware:1.01:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-326_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-327l_firmware:1.00.0409.2013:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-327l_firmware:1.09:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-340l_firmware:1.08:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-343_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-345_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-726-4_firmware:-:*:*:*:*:*:*:*,D-Link,Dns-320L Firmware
CVE-2024-3273,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.99997,CWE-77,"** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.",2024-04-04,CISA/EPSS/Nuclei,cpe:2.3:h:dlink:dnr-202l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dnr-322l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dnr-326:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-1100-4:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-1200-05:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-120:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-1550-04:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-315l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-320:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-320l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-320lw:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-321:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-323:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-325:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-326:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-327l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-340l:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-343:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-345:-:*:*:*:*:*:*:*;cpe:2.3:h:dlink:dns-726-4:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dnr-202l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dnr-322l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dnr-326_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-1100-4_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-1200-05_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-120_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-1550-04_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-315l_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-320_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-320l_firmware:1.01.0702.2013:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-320l_firmware:1.03.0904.2013:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-320l_firmware:1.11:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-320lw_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-321_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-323_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-325_firmware:1.01:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-326_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-327l_firmware:1.00.0409.2013:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-327l_firmware:1.09:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-340l_firmware:1.08:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-343_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-345_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dns-726-4_firmware:-:*:*:*:*:*:*:*,D-Link,Dns-320L Firmware
CVE-2024-32735,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06765,CWE-306,"An issue regarding missing authentication for certain utilities exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can access the PDNU REST APIs, which may result in compromise of the application.",2024-05-14,Nuclei,cpe:2.3:a:cyberpower:powerpanel:*:*:*:*:enterprise:windows:*:*,Cyberpower,Powerpanel
CVE-2024-32736,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.05408,CWE-89,"A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the ""query_utask_verbose"" function within MCUDBHelper.
",2024-05-14,Nuclei,cpe:2.3:a:cyberpower:powerpanel:*:*:*:*:enterprise:windows:*:*,Cyberpower,Powerpanel
CVE-2024-32737,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.05408,CWE-89,"A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the ""query_contract_result"" function within MCUDBHelper.
",2024-05-14,Nuclei,cpe:2.3:a:cyberpower:powerpanel:*:*:*:*:enterprise:windows:*:*,Cyberpower,Powerpanel
CVE-2024-32738,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04515,CWE-89,"A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the ""query_ptask_lean"" function within MCUDBHelper.
",2024-05-14,Nuclei,cpe:2.3:a:cyberpower:powerpanel:*:*:*:*:enterprise:windows:*:*,Cyberpower,Powerpanel
CVE-2024-32739,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.05408,CWE-89,"A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the ""query_ptask_verbose"" function within MCUDBHelper.
",2024-05-14,Nuclei,cpe:2.3:a:cyberpower:powerpanel:*:*:*:*:enterprise:windows:*:*,Cyberpower,Powerpanel
CVE-2024-3274,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.33484,CWE-200,"** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DNS-320L, DNS-320LW and DNS-327L up to 20240403 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/info.cgi of the component HTTP GET Request Handler. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259285 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.",2024-04-04,Nuclei,,,
CVE-2024-32825,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02015,CWE-201,Insertion of Sensitive Information Into Sent Data vulnerability in Simply Static Simply Static simply-static.This issue affects Simply Static: from n/a through <= 3.1.3.,2024-04-24,Nuclei,,,
CVE-2024-32870,5.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N,0.00731,CWE-200,"Combodo iTop is a simple, web based IT Service Management tool. Server, OS, DBMS, PHP, and iTop info (name, version and parameters) can be read by anyone having access to iTop URI. This issue has been patched in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.",2024-11-05,Nuclei,cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*,Combodo,Itop
CVE-2024-32896,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.0301,CWE-670,there is a possible way to bypass  due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.,2024-06-13,CISA,cpe:2.3:o:google:android:-:*:*:*:*:*:*:*,Google,Android
CVE-2024-32964,9.0,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H,0.52683,CWE-918,"Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause Server-Side Request Forgery without logging in, attack intranet services, and leak sensitive information.",2024-05-14,Nuclei,cpe:2.3:a:lobehub:lobe_chat:*:*:*:*:*:*:*:*,Lobehub,Lobe Chat
CVE-2024-3300,9.0,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H,0.02761,CWE-502,An unsafe .NET object deserialization vulnerability in DELMIA Apriso Release 2019 through Release 2024 could lead to pre-authentication remote code execution.,2024-05-30,Nuclei,,,
CVE-2024-33113,5.3,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.03419,CWE-77,D-LINK DIR-845L <=v1.01KRb03 is vulnerable to Information disclosurey via bsc_sms_inbox.php.,2024-05-06,Nuclei,cpe:2.3:h:dlink:dir-845l:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-845l_firmware:*:*:*:*:*:*:*:*,D-Link,Dir-845L Firmware
CVE-2024-33288,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.0081,CWE-89,Prison Management System Using PHP v1.0 was discovered to contain a SQL injection vulnerability via the username on the Admin login page.,2026-05-08,Nuclei,,,
CVE-2024-33326,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0081,CWE-79,A cross-site scripting (XSS) vulnerability in the component XsltResultControllerHtml.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the lumPageID parameter.,2024-06-26,Nuclei,,,
CVE-2024-33575,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01121,CWE-200,Exposure of Sensitive Information to an Unauthorized Actor vulnerability in User Meta user-meta.This issue affects User Meta: from n/a through 3.0.,2024-04-29,Nuclei,,,
CVE-2024-33605,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.06226,CWE-22,"Improper processing of some parameters of installed_emanual_list.html leads to a path traversal vulnerability. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].",2024-11-26,Nuclei,,,
CVE-2024-33610,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.45842,CWE-288,"""sessionlist.html"" and ""sys_trayentryreboot.html"" are accessible with no authentication. ""sessionlist.html"" provides logged-in users' session information including session cookies, and ""sys_trayentryreboot.html"" allows to reboot the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].",2024-11-26,Nuclei,,,
CVE-2024-33724,5.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N,0.00551,CWE-79,SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php.,2026-05-08,Nuclei,,,
CVE-2024-3378,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N,0.22002,CWE-79,A vulnerability has been found in iboss Secure Web Gateway up to 10.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /login of the component Login Portal. The manipulation of the argument redirectUrl leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 10.2.0.160 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-259501 was assigned to this vulnerability.,2024-04-06,Nuclei,cpe:2.3:a:iboss:secure_web_gateway:*:*:*:*:*:*:*:*,Iboss,Secure Web Gateway
CVE-2024-33832,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.0072,CWE-918,OneNav v0.9.35-20240318 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /index.php?c=api&method=get_link_info.,2024-04-30,Nuclei,,,
CVE-2024-3393,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.26636,CWE-754,A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.,2024-12-27,CISA,cpe:2.3:a:paloaltonetworks:prisma_access:-:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h7:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h9:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h9:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h13:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h15:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h18:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h19:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h11:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h14:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h16:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h18:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h9:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h12:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h14:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h15:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h9:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h11:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h4:*:*:*:*:*:*,Paloaltonetworks,Pan-Os
CVE-2024-33939,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00843,CWE-288,Authentication Bypass Using an Alternate Path or Channel vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.7.3.,2025-05-19,Nuclei,cpe:2.3:a:themegrill:masteriyo:*:*:*:*:free:wordpress:*:*,Themegrill,Masteriyo
CVE-2024-3400,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.99999,CWE-20,"A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.

Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.",2024-04-12,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.1:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.1:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h11:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h12:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h9:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.5:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.5:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.5:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.6:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.6:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.4:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.0:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.0:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.0:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.1:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h1:*:*:*:*:*:*,Paloaltonetworks,Pan-Os
CVE-2024-34061,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N,0.01281,CWE-79,"changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. In affected versions Input in parameter notification_urls is not processed resulting in javascript execution in the application. A reflected XSS vulnerability happens when the user input from a URL or POST data is reflected on the page without being stored, thus allowing the attacker to inject malicious content. This issue has been addressed in version 0.45.22. Users are advised to upgrade. There are no known workarounds for this vulnerability.",2024-05-02,Nuclei,,,
CVE-2024-34069,7.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.03397,CWE-352,"Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.",2024-05-06,Metasploit,cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2024-3408,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.77803,CWE-798,"man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. The vulnerability arises from a hardcoded `SECRET_KEY` in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled. Additionally, the application fails to properly restrict custom filter queries, enabling attackers to execute arbitrary code on the server by bypassing the restriction on the `/update-settings` endpoint, even when `enable_custom_filters` is not enabled. This vulnerability allows attackers to bypass authentication mechanisms and execute remote code on the server.",2024-06-06,Metasploit/Nuclei,cpe:2.3:a:man:d-tale:3.10.0:*:*:*:*:*:*:*,Man,D-Tale
CVE-2024-34102,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99994,CWE-611,"Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.",2024-06-13,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:adobe:commerce:2.4.2:-:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.2:ext-1:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.2:ext-2:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.2:ext-3:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.2:ext-4:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.2:ext-7:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.3:ext-1:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.3:ext-2:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.3:ext-3:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.3:ext-4:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.3:ext-7:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.4:p8:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.5:p4:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.5:p5:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.5:p7:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.6:p2:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.6:p3:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.6:p5:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.7:-:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_webhooks:*:*:*:*:*:*:*:*;cpe:2.3:a:adobe:magento:2.4.4:-:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.4:p1:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.4:p2:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.4:p3:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.4:p4:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.4:p5:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.4:p6:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.4:p7:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.4:p8:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.5:-:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.5:p1:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.5:p2:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.5:p3:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.5:p4:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.5:p5:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.5:p6:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.5:p7:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.6:-:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.6:p1:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.6:p2:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.6:p3:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.6:p4:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.6:p5:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.7:-:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.7:b1:*:*:open_source:*:*:*,Adobe,Commerce
CVE-2024-34257,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03817,CWE-285,"TOTOLINK EX1800T V9.1.0cu.2112_B20220316 has a vulnerability in the apcliEncrypType parameter that allows unauthorized execution of arbitrary commands, allowing an attacker to obtain device administrator privileges.",2024-05-08,Nuclei,cpe:2.3:h:totolink:ex1800t:-:*:*:*:*:*:*:*;cpe:2.3:o:totolink:ex1800t_firmware:9.1.0cu.2112_b20220316:*:*:*:*:*:*:*,Totolink,Ex1800T Firmware
CVE-2024-34351,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.05453,CWE-918,"Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself. The required conditions are 1) Next.js is running in a self-hosted manner; 2) the Next.js application makes use of Server Actions; and 3) the Server Action performs a redirect to a relative path which starts with a `/`. This vulnerability was fixed in Next.js `14.1.1`.",2024-05-14,Nuclei,cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*,Vercel,Next.Js
CVE-2024-34470,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.06699,CWE-29,"An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An Unauthenticated Path Traversal vulnerability exists in the /public/loader.php file. The path parameter does not properly filter whether the file and directory passed are part of the webroot, allowing an attacker to read arbitrary files on the server.",2024-05-06,Nuclei,cpe:2.3:a:hsclabs:mailinspector:*:*:*:*:*:*:*:*,Hsclabs,Mailinspector
CVE-2024-3469,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00637,CWE-79,"The GP Premium plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the message parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",2024-06-05,Nuclei,cpe:2.3:a:generatepress:generatepress:*:*:*:*:premium:wordpress:*:*,Generatepress,Generatepress
CVE-2024-3495,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.13618,CWE-89,"The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' parameters in versions up to, and including, 2.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2024-05-22,Nuclei,,,
CVE-2024-34982,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04675,CWE-434,An arbitrary file upload vulnerability in the component /include/file.php of lylme_spage v1.9.5 allows attackers to execute arbitrary code via uploading a crafted file.,2024-05-17,Nuclei,cpe:2.3:a:lylme:lylme_spage:1.9.5:*:*:*:*:*:*:*,Lylme,Lylme Spage
CVE-2024-35219,8.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H,0.03592,CWE-22,"OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Prior to version 7.6.0, attackers can exploit a path traversal vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the `outputFolder` option. The issue was fixed in version 7.6.0 by removing the usage of the `outputFolder` option. No known workarounds are available.",2024-05-27,Nuclei,,,
CVE-2024-35250,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.25222,CWE-822,Windows Kernel-Mode Driver Elevation of Privilege Vulnerability,2024-06-11,CISA/Metasploit,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2024-35286,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.65559,CWE-89,A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access sensitive information and execute arbitrary database and management operations.,2024-10-21,Nuclei,cpe:2.3:a:mitel:micollab:*:*:*:*:*:*:*:*,Mitel,Micollab
CVE-2024-3552,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.67288,CWE-89,"The Web Directory Free WordPress plugin before 1.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based.",2024-06-13,Nuclei,cpe:2.3:a:salephpscripts:web_directory_free:*:*:*:*:*:wordpress:*:*,Salephpscripts,Web Directory Free
CVE-2024-35584,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.05857,CWE-89,"SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9.1 to 8.0, and possibly earlier versions. It is possible for an authenticated user to perform SQL Injection due to the lack to sanitisation. The application takes arbitrary value from ""X-Forwarded-For"" header and appends it to a SQL INSERT statement directly, leading to SQL Injection.",2024-10-15,Nuclei,cpe:2.3:a:os4ed:opensis:8.0:*:*:*:community:*:*:*;cpe:2.3:a:os4ed:opensis:9.1:*:*:*:community:*:*:*,Os4Ed,Opensis
CVE-2024-35627,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00957,CWE-79,tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /data/v3/?key.,2024-05-22,Nuclei,,,
CVE-2024-35693,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.0059,CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list.This issue affects 12 Step Meeting List: from n/a through <= 3.14.33.,2024-06-08,Nuclei,cpe:2.3:a:code4recovery:12_step_meeting_list:*:*:*:*:*:wordpress:*:*,Code4Recovery,12 Step Meeting List
CVE-2024-35694,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.00668,CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja.This issue affects WPMobile.App: from n/a through <= 11.41.,2024-06-08,Nuclei,cpe:2.3:a:amauri:wpmobile.app:*:*:*:*:*:wordpress:*:*,Amauri,Wpmobile.App
CVE-2024-3605,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.04186,CWE-89,"The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in all versions up to, and including, 2.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2024-06-20,Nuclei,cpe:2.3:a:thimpress:wp_hotel_booking:*:*:*:*:*:wordpress:*:*,Thimpress,Wp Hotel Booking
CVE-2024-36104,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.87883,CWE-22,"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14.

Users are recommended to upgrade to version 18.12.14, which fixes the issue.",2024-06-04,Nuclei,cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*,Apache,Ofbiz
CVE-2024-36117,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L,0.03145,CWE-22,"Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version 3.5.12. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-074.",2024-06-19,Nuclei,cpe:2.3:a:reposilite:reposilite:*:*:*:*:*:*:*:*,Reposilite,Reposilite
CVE-2024-36401,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99813,CWE-95,"GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions.

The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code.

Versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the `gt-complex-x.y.jar` file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed.",2024-07-01,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*;cpe:2.3:a:geotools:geotools:*:*:*:*:*:*:*:*;cpe:2.3:a:geotools:geotools:30.0:-:*:*:*:*:*:*;cpe:2.3:a:geotools:geotools:30.0:rc:*:*:*:*:*:*;cpe:2.3:a:geotools:geotools:31.0:-:*:*:*:*:*:*;cpe:2.3:a:geotools:geotools:31.0:rc:*:*:*:*:*:*,Geoserver,Geoserver
CVE-2024-36404,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.74908,CWE-95,"GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the `gt-complex` jar from one's application. As an example of the impact, application schema `datastore` would not function without the ability to use XPath expressions to query complex content. Alternatively, one may utilize a drop-in replacement GeoTools jar from SourceForge for versions 31.1, 30.3, 30.2, 29.2, 28.2, 27.5, 27.4, 26.7, 26.4, 25.2, and 24.0. These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications.",2024-07-02,Nuclei,,,
CVE-2024-36412,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.05692,CWE-89,"SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in events response entry point allows for a SQL injection attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue.",2024-06-10,Nuclei,cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*,Salesagility,Suitecrm
CVE-2024-36420,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01776,CWE-74,"Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the `/api/v1/openai-assistants-file` endpoint in `index.ts` is vulnerable to arbitrary file read due to lack of sanitization of the `fileName` body parameter. No known patches for this issue are available.",2024-07-01,Nuclei,cpe:2.3:a:flowiseai:flowise:1.4.3:*:*:*:*:*:*:*,Flowiseai,Flowise
CVE-2024-36527,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.02581,CWE-22,puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive information from the server.,2024-06-17,Nuclei,,,
CVE-2024-3656,8.1,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N,0.02862,CWE-200,"A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.",2024-10-09,Nuclei,,,
CVE-2024-36675,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.01438,CWE-918,LyLme_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get_head function.,2024-06-04,Nuclei,cpe:2.3:a:lylme:lylme_spage:1.9.5:*:*:*:*:*:*:*,Lylme,Lylme Spage
CVE-2024-36683,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.00963,CWE-89,"SQL injection vulnerability in the module ""Products Alert"" (productsalert) before 1.7.4 from Smart Modules for PrestaShop allows attackers to obtain sensitive information and cause other impacts via the ProductsAlertAjaxProcessModuleFrontController::initContent method.",2024-06-24,Nuclei,,,
CVE-2024-3673,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H,0.05578,NVD-CWE-Other,"The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Local File Inclusion issues.",2024-08-30,Nuclei,cpe:2.3:a:salephpscripts:web_directory_free:*:*:*:*:*:wordpress:*:*,Salephpscripts,Web Directory Free
CVE-2024-36837,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.08306,CWE-89,SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file.,2024-06-05,Nuclei,cpe:2.3:a:crmeb:crmeb:5.2.2:*:*:*:*:*:*:*,Crmeb,Crmeb
CVE-2024-36857,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02054,NVD-CWE-noinfo,Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface.,2024-06-04,Nuclei,cpe:2.3:a:homebrew:jan:0.4.12:*:*:*:*:*:*:*,Homebrew,Jan
CVE-2024-36858,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0306,CWE-434,An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file.,2024-06-04,Nuclei,cpe:2.3:a:homebrew:jan:0.4.12:*:*:*:*:*:*:*,Homebrew,Jan
CVE-2024-36971,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02701,CWE-416,"In the Linux kernel, the following vulnerability has been resolved:

net: fix __dst_negative_advice() race

__dst_negative_advice() does not enforce proper RCU rules when
sk->dst_cache must be cleared, leading to possible UAF.

RCU rules are that we must first clear sk->sk_dst_cache,
then call dst_release(old_dst).

Note that sk_dst_reset(sk) is implementing this protocol correctly,
while __dst_negative_advice() uses the wrong order.

Given that ip6_negative_advice() has special logic
against RTF_CACHE, this means each of the three ->negative_advice()
existing methods must perform the sk_dst_reset() themselves.

Note the check against NULL dst is centralized in
__dst_negative_advice(), there is no need to duplicate
it in various callbacks.

Many thanks to Clement Lecigne for tracking this issue.

This old bug became visible after the blamed commit, using UDP sockets.",2024-06-10,CISA,cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2024-36985,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.06517,CWE-687,"In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or power Splunk roles could cause a Remote Code Execution through an external lookup that references the “splunk_archiver“ application.",2024-07-01,Metasploit,cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*,Splunk,Splunk
CVE-2024-36991,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.1311,CWE-35,"In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.",2024-07-01,Nuclei,cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2024-37032,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.89633,CWE-22,"Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial ../ substring.",2024-05-31,Metasploit/Nuclei,cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*,Ollama,Ollama
CVE-2024-37079,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.22377,CWE-787,vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.,2024-06-18,CISA,cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3e:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3f:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3g:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3h:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3i:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3j:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3k:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3l:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3m:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3n:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3o:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3p:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update2:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update2a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update2b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update2c:*:*:*:*:*:*,Vmware,Cloud Foundation
CVE-2024-37081,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.04989,CWE-556,The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.,2024-06-18,Metasploit,cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3e:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3f:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3g:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3h:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3i:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3j:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3k:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3l:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3m:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3n:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3o:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3p:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3q:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1e:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update2:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update2a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update2b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update2c:*:*:*:*:*:*,Vmware,Vcenter Server
CVE-2024-37085,6.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H,0.2677,CWE-287,VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously  configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html  by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.,2024-06-25,CISA,cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:*:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_1d:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_2b:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_2c:*:*:*:*:*:*,Vmware,Esxi
CVE-2024-37152,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.02348,CWE-287,"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by  /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.",2024-06-06,Nuclei,cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*,Argoproj,Argo Cd
CVE-2024-37259,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.0063,CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through <= 2.4.7.,2024-07-22,Nuclei,cpe:2.3:a:wpextended:wp_extended:*:*:*:*:*:wordpress:*:*,Wpextended,Wp Extended
CVE-2024-37261,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.0063,CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Lab WP-Lister Lite for Amazon wp-lister-for-amazon.This issue affects WP-Lister Lite for Amazon: from n/a through <= 2.6.16.,2024-07-22,Nuclei,cpe:2.3:a:wplab:wp-lister_lite_for_amazon:*:*:*:*:*:wordpress:*:*,Wplab,Wp-Lister Lite For Amazon
CVE-2024-37383,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.73296,CWE-79,Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.,2024-06-07,CISA,cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2024-37393,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03304,CWE-319,"Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the /secserver HTTP endpoint. This may include ms-Mcs-AdmPwd, which has a cleartext password for the Local Administrator Password Solution (LAPS) feature.",2024-06-10,Nuclei,cpe:2.3:a:securenvoy:multi-factor_authentication_solutions:*:*:*:*:*:*:*:*,Securenvoy,Multi-Factor Authentication Solutions
CVE-2024-37404,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.67291,NVD-CWE-noinfo,"Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution.",2024-10-18,Metasploit,cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:r1.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:r1.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:r1.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:r1.4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:r1.5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r10.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r10:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.0:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11.5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r11:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r12.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r12.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r12:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r13.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r13:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r14.4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r14:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r15.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r15:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r16.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r16:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r17.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r17.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r17:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r18.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r18.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r18.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r18.7:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r18.8:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r18:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8.4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r9.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:*:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.7:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.7:r1:*:*:*:*:*:*,Ivanti,Connect Secure
CVE-2024-3742,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.0143,CWE-312,Electrolink transmitters store credentials in clear-text. Use of these credentials could allow an attacker to access the system.,2024-04-18,Nuclei,,,
CVE-2024-3753,5.9,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L,0.00807,CWE-79,"The Hostel WordPress plugin before 1.1.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",2024-07-13,Nuclei,cpe:2.3:a:kibokolabs:hostel:*:*:*:*:*:wordpress:*:*,Kibokolabs,Hostel
CVE-2024-37656,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00494,CWE-601,An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the insufficient URL parameter verification in bbs/logout.php.,2025-07-07,Nuclei,cpe:2.3:a:sir:gnuboard:5.5.16:*:*:*:*:*:*:*,Sir,Gnuboard
CVE-2024-37728,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01852,CWE-22,"Arbitrary File Read vulnerability in Xi'an Daxi Information Technology Co., Ltd OfficeWeb365 v.7.18.23.0 and v8.6.1.0 allows a remote attacker to obtain sensitive information via the ""Pic/Indexes"" interface",2024-09-10,Nuclei,,,
CVE-2024-37843,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.51282,CWE-89,Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.,2024-06-25,Nuclei,cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*,Craftcms,Craft Cms
CVE-2024-37881,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01174,CWE-201,"SiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php and implements a measure to avoid redirection from other URLs. However, SiteGuard WP Plugin versions prior to 1.7.7 missed to implement a measure to avoid redirection from wp-register.php. As a result, the customized path to the login page may be exposed.",2024-06-19,Nuclei,,,
CVE-2024-38014,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.06008,CWE-269,Windows Installer Elevation of Privilege Vulnerability,2024-09-10,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2024-38080,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.07058,CWE-190,Windows Hyper-V Elevation of Privilege Vulnerability,2024-07-09,CISA,cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*,Microsoft,Windows 11 21H2
CVE-2024-38094,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.47826,CWE-502,Microsoft SharePoint Remote Code Execution Vulnerability,2024-07-09,CISA,cpe:2.3:a:microsoft:sharepoint_server:-:*:*:*:subscription:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*,Microsoft,Sharepoint Server
CVE-2024-38106,7.0,CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.06337,CWE-591,Windows Kernel Elevation of Privilege Vulnerability,2024-08-13,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2024-38107,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01635,CWE-416,Windows Power Dependency Coordinator Elevation of Privilege Vulnerability,2024-08-13,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2024-38112,7.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.84345,CWE-451,Windows MSHTML Platform Spoofing Vulnerability,2024-07-09,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2024-38178,7.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.4138,CWE-843,Scripting Engine Memory Corruption Vulnerability,2024-08-13,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2024-38189,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.08194,CWE-20,Microsoft Project Remote Code Execution Vulnerability,2024-08-13,CISA,cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*;cpe:2.3:a:microsoft:office_2019:-:*:*:*:*:*:x64:*;cpe:2.3:a:microsoft:office_2019:-:*:*:*:*:*:x86:*;cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:x64:*;cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:x86:*;cpe:2.3:a:microsoft:project_2016:*:*:*:*:*:*:*:*,Microsoft,365 Apps
CVE-2024-38193,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.27561,CWE-416,Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability,2024-08-13,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2024-38213,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N,0.13626,CWE-693,Windows Mark of the Web Security Feature Bypass Vulnerability,2024-08-13,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2024-38217,5.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L,0.09756,CWE-693,Windows Mark of the Web Security Feature Bypass Vulnerability,2024-09-10,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2024-3822,4.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N,0.00741,CWE-79,"The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",2024-05-15,Nuclei,cpe:2.3:a:mranderson:base64_encoderdecoder:*:*:*:*:*:wordpress:*:*,Mranderson,Base64 Encoderdecoder
CVE-2024-38226,7.3,CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H,0.02667,CWE-693,Microsoft Publisher Security Feature Bypass Vulnerability,2024-09-10,CISA,cpe:2.3:a:microsoft:office_2019:-:*:*:*:*:*:x64:*;cpe:2.3:a:microsoft:office_2019:-:*:*:*:*:*:x86:*;cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:x64:*;cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:x86:*;cpe:2.3:a:microsoft:publisher:2016:*:*:*:*:*:x64:*;cpe:2.3:a:microsoft:publisher:2016:*:*:*:*:*:x86:*,Microsoft,Office 2019
CVE-2024-38288,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.03216,CWE-77,A command-injection issue in the Certificate Signing Request (CSR) functionality in R-HUB TurboMeeting through 8.x allows authenticated attackers with administrator privileges to execute arbitrary commands on the underlying server as root.,2024-07-25,Nuclei,cpe:2.3:a:rhubcom:turbomeeting:*:*:*:*:*:*:*:*,Rhubcom,Turbomeeting
CVE-2024-38289,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.40874,CWE-89,"A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to extract hashed passwords from the database, and authenticate to the application, via crafted SQL input.",2024-07-25,Nuclei,cpe:2.3:a:rhubcom:turbomeeting:*:*:*:*:*:*:*:*,Rhubcom,Turbomeeting
CVE-2024-38353,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01158,CWE-338,"CodiMD allows realtime collaborative markdown notes on all platforms. CodiMD before 2.5.4 is missing authentication and access control vulnerability allowing an unauthenticated attacker to gain unauthorised access to image data uploaded to CodiMD. CodiMD does not require valid authentication to access uploaded images or to upload new image data. An attacker who can determine an uploaded image's URL can gain unauthorised access to uploaded image data. Due to the insecure random filename generation in the underlying Formidable library, an attacker can determine the filenames for previously uploaded images and the likelihood of this issue being exploited is increased. This vulnerability is fixed in 2.5.4.
",2024-07-10,Nuclei,cpe:2.3:a:hackmd:codimd:*:*:*:*:*:*:*:*,Hackmd,Codimd
CVE-2024-38472,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.6795,CWE-918,"SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content 
Users are recommended to upgrade to version 2.4.60 which fixes this issue.  Note: Existing configurations that access UNC paths will have to configure new directive ""UNCList"" to allow access during request processing.",2024-07-01,Nuclei,cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:*,Apache,Http Server
CVE-2024-38473,8.1,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H,0.25878,CWE-116,"Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests.
Users are recommended to upgrade to version 2.4.60, which fixes this issue.",2024-07-01,Nuclei,cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:*,Apache,Http Server
CVE-2024-38475,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.99957,CWE-116,"Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. 

Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected.  Some unsafe RewiteRules will be broken by this change and the rewrite flag ""UnsafePrefixStat"" can be used to opt back in once ensuring the substitution is appropriately constrained.",2024-07-01,CISA/EPSS/Nuclei,cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:ontap_9:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_200:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_210:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_400:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_410:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_500v:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_210_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_400_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_410_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_500v_firmware:*:*:*:*:*:*:*:*,Sonicwall,Sma 200 Firmware
CVE-2024-3848,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.43284,CWE-29,"A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '#' character can be used to insert a path into the fragment, effectively skipping validation. This allows an attacker to construct a URL that, when processed, ignores the protocol scheme and uses the provided path for filesystem access. As a result, an attacker can read arbitrary files, including sensitive information such as SSH and cloud keys, by exploiting the way the application converts the URL into a filesystem path. The issue stems from insufficient validation of the fragment portion of the URL, leading to arbitrary file read through path traversal.",2024-05-16,Nuclei,cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*,Lfprojects,Mlflow
CVE-2024-3850,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.009,CWE-79,"Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack (XSS). An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability also requires authentication before it can be exploited, so the scope and severity is limited. Also, even if JavaScript is executed, no additional benefits are obtained.",2024-06-10,Nuclei,cpe:2.3:h:uniview:nvr301-04s2-p4:-:*:*:*:*:*:*:*;cpe:2.3:o:uniview:nvr301-04s2-p4_firmware:*:*:*:*:*:*:*:*,Uniview,Nvr301-04S2-P4 Firmware
CVE-2024-38514,7.4,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N,0.02186,CWE-918,"NextChat is a cross-platform ChatGPT/Gemini UI. There is a Server-Side Request Forgery (SSRF) vulnerability due to a lack of validation of the `endpoint` GET parameter on the WebDav API endpoint. This SSRF can be used to perform arbitrary HTTPS request from the vulnerable instance (MKCOL, PUT and GET methods supported), or to target NextChat users and make them execute arbitrary JavaScript code in their browser. This vulnerability has been patched in version 2.12.4.
",2024-06-28,Nuclei,,,
CVE-2024-38653,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.91984,CWE-611,XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.,2024-08-14,Nuclei,cpe:2.3:a:ivanti:avalanche:6.3.1.1507:*:*:*:premise:*:*:*;cpe:2.3:a:ivanti:avalanche:6.3.1:*:*:*:premise:*:*:*;cpe:2.3:a:ivanti:avalanche:6.3.2.3490:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:avalanche:6.3.2.3490:*:*:*:premise:*:*:*;cpe:2.3:a:ivanti:avalanche:6.3.2:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:avalanche:6.3.2:*:*:*:*:windows:*:*;cpe:2.3:a:ivanti:avalanche:6.3.2:*:*:*:premise:*:*:*;cpe:2.3:a:ivanti:avalanche:6.3.3.101:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:avalanche:6.3.3.101:*:*:*:premise:*:*:*;cpe:2.3:a:ivanti:avalanche:6.3.3:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:avalanche:6.3.3:*:*:*:premise:*:*:*;cpe:2.3:a:ivanti:avalanche:6.3.4.153:*:*:*:premise:*:*:*;cpe:2.3:a:ivanti:avalanche:6.3.4:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:avalanche:6.3.4:*:*:*:premise:*:*:*;cpe:2.3:a:ivanti:avalanche:6.4.0:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:avalanche:6.4.1.207:*:*:*:premise:*:*:*;cpe:2.3:a:ivanti:avalanche:6.4.1.236:*:*:*:premise:*:*:*;cpe:2.3:a:ivanti:avalanche:6.4.1:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:avalanche:6.4.1:*:*:*:premise:*:*:*;cpe:2.3:a:ivanti:avalanche:6.4.2:*:*:*:premise:*:*:*,Ivanti,Avalanche
CVE-2024-38773,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L,0.02004,CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adrian Tobey FormLift for Infusionsoft Web Forms allows Blind SQL Injection.This issue affects FormLift for Infusionsoft Web Forms: from n/a through 7.5.17.,2024-07-22,Nuclei,cpe:2.3:a:formlift:formlift_for_infusionsoft_web_forms:*:*:*:*:*:wordpress:*:*,Formlift,Formlift For Infusionsoft Web Forms
CVE-2024-38812,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.54143,CWE-122,The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.,2024-09-17,CISA,cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3e:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3f:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3g:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3h:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3i:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3j:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3k:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3l:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3m:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3n:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3o:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3p:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3q:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3r:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3s:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1e:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update2:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update2a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update2b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update2c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update2d:*:*:*:*:*:*,Vmware,Cloud Foundation
CVE-2024-38813,7.5,CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.16676,CWE-250,The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.,2024-09-17,CISA,cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3e:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3f:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3g:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3h:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3i:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3j:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3k:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3l:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3m:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3n:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3o:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3p:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3q:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3r:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:7.0:update3s:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1d:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update1e:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update2:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update2a:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update2b:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update2c:*:*:*:*:*:*;cpe:2.3:a:vmware:vcenter_server:8.0:update2d:*:*:*:*:*:*,Vmware,Cloud Foundation
CVE-2024-38816,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.14718,CWE-22,"Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.

Specifically, an application is vulnerable when both of the following are true:

  *  the web application uses RouterFunctions to serve static resources
  *  resource handling is explicitly configured with a FileSystemResource location


However, malicious requests are blocked and rejected when any of the following is true:

  *  the  Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html  is in use
  *  the application runs on Tomcat or Jetty",2024-09-13,Nuclei,,,
CVE-2024-38819,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.54862,CWE-22,Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.,2024-12-19,Nuclei,,,
CVE-2024-38856,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99427,CWE-863,"Incorrect Authorization vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: through 18.12.14.

Users are recommended to upgrade to version 18.12.15, which fixes the issue.

Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).",2024-08-05,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*,Apache,Ofbiz
CVE-2024-39205,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.16513,Missing_Data,An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP request.,2024-10-28,Metasploit,,,
CVE-2024-3922,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.53196,CWE-89,"The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2024-06-13,Nuclei,cpe:2.3:a:dokan:dokan:*:*:*:*:pro:wordpress:*:*,Dokan,Dokan
CVE-2024-39250,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04927,CWE-89,EfroTech Timetrax v8.3 was discovered to contain an unauthenticated SQL injection vulnerability via the q parameter in the search web interface.,2024-07-22,Nuclei,cpe:2.3:a:efrotech:timetrax:8.3:*:*:*:*:*:*:*,Efrotech,Timetrax
CVE-2024-39646,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.00624,CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kunal Custom 404 Pro custom-404-pro.This issue affects Custom 404 Pro: from n/a through <= 3.11.1.,2024-08-01,Nuclei,cpe:2.3:a:kunalnagar:custom_404_pro:*:*:*:*:*:wordpress:*:*,Kunalnagar,Custom 404 Pro
CVE-2024-39713,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.03201,CWE-918,A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.,2024-08-05,Nuclei,cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*,Rocket.Chat,Rocket.Chat
CVE-2024-39717,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.03973,CWE-434,The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.,2024-08-22,CISA,cpe:2.3:a:versa-networks:versa_director:21.2.2:*:*:*:*:*:*:*;cpe:2.3:a:versa-networks:versa_director:21.2.3:*:*:*:*:*:*:*;cpe:2.3:a:versa-networks:versa_director:22.1.1:*:*:*:*:*:*:*;cpe:2.3:a:versa-networks:versa_director:22.1.2:*:*:*:*:*:*:*;cpe:2.3:a:versa-networks:versa_director:22.1.3:*:*:*:*:*:*:*,Versa-Networks,Versa Director
CVE-2024-39887,4.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N,0.04433,CWE-89,"An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection.

This issue affects Apache Superset: before 4.0.2.

Users are recommended to upgrade to version 4.0.2, which fixes the issue.",2024-07-16,Nuclei,cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*,Apache,Superset
CVE-2024-39891,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01477,CWE-203,"In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were not compromised, however.)",2024-07-02,CISA,cpe:2.3:a:twilio:authy:*:*:*:*:*:iphone_os:*:*;cpe:2.3:a:twilio:authy_authenticator:*:*:*:*:*:android:*:*,Twilio,Authy
CVE-2024-39903,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L,0.02884,CWE-22,"Solara is a pure Python, React-style framework for scaling Jupyter and web apps. A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version <1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.",2024-07-12,Nuclei,cpe:2.3:a:widgetti:solara:*:*:*:*:*:*:*:*,Widgetti,Solara
CVE-2024-39907,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.29396,CWE-89,"1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. These sql injections have been resolved in version 1.10.12-tls. Users are advised to upgrade. There are no known workarounds for these issues.",2024-07-18,Nuclei,cpe:2.3:a:fit2cloud:1panel:*:*:*:*:*:*:*:*,Fit2Cloud,1Panel
CVE-2024-39914,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.23414,CWE-77,"FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php. This vulnerability is fixed in 1.5.10.34.",2024-07-12,Nuclei,cpe:2.3:a:fogproject:fogproject:*:*:*:*:*:*:*:*,Fogproject,Fogproject
CVE-2024-40348,8.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L,0.0829,CWE-22,An issue in the component /api/swaggerui/static of Bazaar v1.4.3 allows unauthenticated attackers to execute a directory traversal.,2024-07-20,Nuclei,cpe:2.3:a:bazarr:bazarr:*:*:*:*:*:*:*:*,Bazarr,Bazarr
CVE-2024-4040,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99539,CWE-1336,"A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.",2024-04-22,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*,Crushftp,Crushftp
CVE-2024-40422,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.11414,CWE-22,The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshot_path parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized access to critical system files and compromise the confidentiality and integrity of the system.,2024-07-24,Nuclei,cpe:2.3:a:stitionai:devika:1.0:*:*:*:*:*:*:*,Stitionai,Devika
CVE-2024-40711,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.90369,CWE-502,A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).,2024-09-07,CISA/Nuclei,cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:*,Veeam,Veeam Backup & Replication
CVE-2024-40766,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.15593,CWE-284,"An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.",2024-08-23,CISA,cpe:2.3:h:sonicwall:nsa_2650:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_2700:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_3600:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_3650:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_3700:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_4600:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_4650:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_4700:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_5600:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_5650:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_5700:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_6600:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_6650:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_6700:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nssp_10700:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nssp_11700:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nssp_12400:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nssp_12800:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nssp_13700:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sm9800:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sm_9200:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sm_9250:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sm_9400:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sm_9450:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sm_9600:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sm_9650:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:soho:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:soho_250:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:soho_250w:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sohow:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz270:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz270w:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz370:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz370w:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz470:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz470w:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz570:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz570p:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz570w:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz670:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz_300:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz_300p:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz_300w:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz_350:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz_350w:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz_400:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz_400w:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz_500:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz_500w:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz_600:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz_600p:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:*,Sonicwall,Sonicos
CVE-2024-40890,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.22421,CWE-78,"**UNSUPPORTED WHEN ASSIGNED**
A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.",2025-02-04,CISA,cpe:2.3:h:zyxel:sbg3300-n000:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:sbg3300-nb00:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:sbg3500-nb00:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vmg1312-b10a:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vmg1312-b10b:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vmg1312-b10e:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vmg3312-b10a:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vmg3313-b10a:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vmg3926-b10b:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vmg4325-b10a:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vmg4380-b10a:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vmg8324-b10a:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vmg8924-b10a:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:sbg3300-n000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:sbg3300-nb00_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:sbg3500-n000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:sbg3500-nb00_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vmg1312-b10a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vmg1312-b10b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vmg1312-b10e_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vmg3312-b10a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vmg3313-b10a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vmg3926-b10b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vmg4325-b10a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vmg4380-b10a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vmg8324-b10a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vmg8924-b10a_firmware:-:*:*:*:*:*:*:*,Zyxel,Vmg1312-B10A Firmware
CVE-2024-40891,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.21996,CWE-78,"**UNSUPPORTED WHEN ASSIGNED**
A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.",2025-02-04,CISA,cpe:2.3:h:zyxel:sbg3300-n000:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:sbg3300-nb00:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:sbg3500-nb00:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vmg1312-b10a:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vmg1312-b10b:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vmg1312-b10e:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vmg3312-b10a:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vmg3313-b10a:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vmg3926-b10b:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vmg4325-b10a:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vmg4380-b10a:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vmg8324-b10a:-:*:*:*:*:*:*:*;cpe:2.3:h:zyxel:vmg8924-b10a:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:sbg3300-n000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:sbg3300-nb00_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:sbg3500-n000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:sbg3500-nb00_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vmg1312-b10a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vmg1312-b10b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vmg1312-b10e_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vmg3312-b10a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vmg3313-b10a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vmg3926-b10b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vmg4325-b10a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vmg4380-b10a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vmg8324-b10a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:zyxel:vmg8924-b10a_firmware:-:*:*:*:*:*:*:*,Zyxel,Vmg1312-B10A Firmware
CVE-2024-41107,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.1776,CWE-290,"The CloudStack SAML authentication (disabled by default) does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an attacker that initiates CloudStack SAML single sign-on authentication can bypass SAML authentication by submitting a spoofed SAML response with no signature and known or guessed username and other user details of a SAML-enabled CloudStack user-account. In such environments, this can result in a complete compromise of the resources owned and/or accessible by a SAML enabled user-account.

Affected users are recommended to disable the SAML authentication plugin by setting the ""saml2.enabled"" global setting to ""false"", or upgrade to version 4.18.2.2, 4.19.1.0 or later, which addresses this issue.",2024-07-19,Nuclei,cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*,Apache,Cloudstack
CVE-2024-41628,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.06464,CWE-22,"Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9780 allows a remote attacker to include and display file content in an HTTP request via the CMON API.",2024-07-26,Nuclei,,,
CVE-2024-41667,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03536,CWE-94,"OpenAM is an open access management solution. In versions 15.0.3 and prior, the `getCustomLoginUrlTemplate` method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to override the default OpenAM login, they did not restrict the `CustomLoginUrlTemplate`, allowing it to be set freely. Commit fcb8432aa77d5b2e147624fe954cb150c568e0b8 introduces `TemplateClassResolver.SAFER_RESOLVER` to disable the resolution of commonly exploited classes in FreeMarker template injection. As of time of publication, this fix is expected to be part of version 15.0.4.",2024-07-24,Nuclei,,,
CVE-2024-41710,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.41646,CWE-88,"A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system.",2024-08-12,CISA,cpe:2.3:h:mitel:6863i_sip:-:*:*:*:*:*:*:*;cpe:2.3:h:mitel:6865i_sip:-:*:*:*:*:*:*:*;cpe:2.3:h:mitel:6867i_sip:-:*:*:*:*:*:*:*;cpe:2.3:h:mitel:6869i_sip:-:*:*:*:*:*:*:*;cpe:2.3:h:mitel:6873i_sip:-:*:*:*:*:*:*:*;cpe:2.3:h:mitel:6905_sip:-:*:*:*:*:*:*:*;cpe:2.3:h:mitel:6910_sip:-:*:*:*:*:*:*:*;cpe:2.3:h:mitel:6915_sip:-:*:*:*:*:*:*:*;cpe:2.3:h:mitel:6920_sip:-:*:*:*:*:*:*:*;cpe:2.3:h:mitel:6920w_sip:-:*:*:*:*:*:*:*;cpe:2.3:h:mitel:6930_sip:-:*:*:*:*:*:*:*;cpe:2.3:h:mitel:6930w_sip:-:*:*:*:*:*:*:*;cpe:2.3:h:mitel:6940_sip:-:*:*:*:*:*:*:*;cpe:2.3:h:mitel:6940w_sip:-:*:*:*:*:*:*:*;cpe:2.3:h:mitel:6970:-:*:*:*:*:*:*:*;cpe:2.3:o:mitel:6863i_sip_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:mitel:6865i_sip_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:mitel:6867i_sip_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:mitel:6869i_sip_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:mitel:6873i_sip_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:mitel:6905_sip_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:mitel:6910_sip_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:mitel:6915_sip_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:mitel:6920_sip_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:mitel:6920w_sip_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:mitel:6930_sip_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:mitel:6930w_sip_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:mitel:6940_sip_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:mitel:6940w_sip_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:mitel:6970_firmware:*:*:*:*:*:*:*:*,Mitel,6970 Firmware
CVE-2024-41713,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.98067,CWE-22,"A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.",2024-10-21,CISA/EPSS/Nuclei,cpe:2.3:a:mitel:micollab:*:*:*:*:*:-:*:*,Mitel,Micollab
CVE-2024-4180,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.01834,CWE-79,The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering some views via AJAX.,2024-06-04,Nuclei,cpe:2.3:a:stellarwp:the_events_calendar:*:*:*:*:*:wordpress:*:*,Stellarwp,The Events Calendar
CVE-2024-41810,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01176,CWE-79,"Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.",2024-07-29,Nuclei,cpe:2.3:a:twisted:twisted:*:*:*:*:*:*:*:*,Twisted,Twisted
CVE-2024-41955,5.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N,0.01,CWE-601,"Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability exist in MobSF authentication view. Update to MobSF v4.0.5.",2024-07-31,Nuclei,cpe:2.3:a:opensecurity:mobile_security_framework:*:*:*:*:*:*:*:*,Opensecurity,Mobile Security Framework
CVE-2024-42009,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N,0.84446,CWE-79,A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.,2024-08-05,CISA/Nuclei,cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*,Roundcube,Webmail
CVE-2024-42323,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.04054,CWE-502,"SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating). 

This vulnerability can only be exploited by authorized attackers.
This issue affects Apache HertzBeat (incubating): before 1.6.0.

Users are recommended to upgrade to version 1.6.0, which fixes the issue.",2024-09-21,Nuclei,cpe:2.3:a:apache:hertzbeat:*:*:*:*:*:*:*:*,Apache,Hertzbeat
CVE-2024-42365,7.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L,0.04703,CWE-267,"Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with `write=originate` may change all configuration files in the `/etc/asterisk/` directory. This occurs because they are able to curl remote files and write them to disk, but are also able to append to existing files using the `FILE` function inside the `SET` application. This issue may result in privilege escalation, remote code execution and/or blind server-side request forgery with arbitrary protocol. Asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2 contain a fix for this issue.",2024-08-08,Metasploit,cpe:2.3:a:asterisk:asterisk:*:*:*:*:*:*:*:*;cpe:2.3:a:asterisk:asterisk:21.4.0:*:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:13.13.0:*:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:13.13.0:cert1-rc1:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:13.13.0:cert1-rc2:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:13.13.0:cert1-rc3:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:13.13.0:cert1-rc4:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:13.13.0:cert1:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:13.13.0:cert2:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:13.13.0:cert3:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:13.13.0:rc1:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:13.13.0:rc2:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8.0:-:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert10:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert11:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert12:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert1:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert2:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert3:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert4:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert5:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert6:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert7:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert8:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert9:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8:cert1-rc1:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8:cert1-rc2:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8:cert1-rc3:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8:cert1-rc4:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8:cert1-rc5:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8:cert10:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8:cert11:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8:cert12:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8:cert13:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8:cert14:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8:cert4-rc1:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8:cert4-rc2:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8:cert4-rc3:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:16.8:cert4-rc4:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:18.9:cert1-rc1:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:18.9:cert10:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:18.9:cert1:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:18.9:cert2:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:18.9:cert3:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:18.9:cert4:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:18.9:cert5:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:18.9:cert6:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:18.9:cert7:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:18.9:cert8-rc1:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:18.9:cert8-rc2:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:18.9:cert8:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:18.9:cert9:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:*;cpe:2.3:a:asterisk:certified_asterisk:20.7:cert1:*:*:*:*:*:*,Asterisk,Asterisk
CVE-2024-4257,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.12051,CWE-89,A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1. It has been classified as critical. This affects an unknown part of the file /xds/deleteStudy.php. The manipulation of the argument documentUniqueId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-262149 was assigned to this vulnerability.,2024-04-27,Nuclei,cpe:2.3:a:bluenettechnology:clinical_browsing_system:1.2.1:*:*:*:*:*:*:*,Bluenettechnology,Clinical Browsing System
CVE-2024-42640,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.43464,CWE-434,"angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an attacker to upload arbitrary content to the server, which can subsequently be accessed through demo/uploads. This leads to the execution of previously uploaded content and enables the attacker to achieve code execution on the server. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.",2024-10-11,Nuclei,,,
CVE-2024-42852,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00731,CWE-79,Cross Site Scripting vulnerability in AcuToWeb server v.10.5.0.7577C8b allows a remote attacker to execute arbitrary code via the index.php component.,2024-08-23,Nuclei,,,
CVE-2024-4295,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.10161,CWE-89,"The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in all versions up to, and including, 5.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2024-06-05,Nuclei,cpe:2.3:a:icegram:email_subscribers_\&_newsletters:*:*:*:*:*:wordpress:*:*,Icegram,Email Subscribers & Newsletters
CVE-2024-43047,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.00674,CWE-416,Memory corruption while maintaining memory maps of HLOS memory.,2024-10-07,CISA,cpe:2.3:h:qualcomm:fastconnect_6700:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_6800:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_6900:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qam8295p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6174a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6426:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6436:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6584au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6595:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6595au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6688aq:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6696:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6698aq:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs410:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs610:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs6490:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa4150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa4155p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6145p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6155p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8145p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8155p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8195p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8295p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd660:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd865_5g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sg4150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_660_mobile:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_680_4g_mobile:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_685_4g_mobile:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_865\+_5g_mobile:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_865_5g_mobile:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_870_5g_mobile:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_888\+_5g_mobile:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_888_5g_mobile:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8_gen_1_mobile:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_auto_5g_modem-rf:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_auto_5g_modem-rf_gen_2:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_x55_5g_modem-rf:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_xr2_5g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sw5100:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sw5100p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sxr2130:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:video_collaboration_vc1_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:video_collaboration_vc3_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9335:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9341:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3980:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3988:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3990:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_6700_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_6800_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qam8295p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6174a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6426_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6436_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6584au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6595_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6595au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6688aq_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6696_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6698aq_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs410_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs610_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs6490_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa4150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa4155p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6145p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6155p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8145p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8155p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8195p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8295p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd660_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd865_5g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sg4150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_660_mobile_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_680_4g_mobile_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_685_4g_mobile_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_865\+_5g_mobile_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_865_5g_mobile_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_870_5g_mobile_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_888\+_5g_mobile_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_888_5g_mobile_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8_gen_1_mobile_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_auto_5g_modem-rf_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_auto_5g_modem-rf_gen_2_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_x55_5g_modem-rf_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_xr2_5g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sw5100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sw5100p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sxr2130_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:video_collaboration_vc1_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:video_collaboration_vc3_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9335_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9341_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3980_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3990_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*,Qualcomm,Fastconnect 6700 Firmware
CVE-2024-43093,7.3,CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H,0.00714,CWE-176,"In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to  incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.",2024-11-13,CISA,cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:12.1:*:*:*:*:*:*:*;cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*,Google,Android
CVE-2024-43144,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L,0.02002,CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Cost Calculator Builder allows SQL Injection.This issue affects Cost Calculator Builder: from n/a through 3.2.15.,2024-08-29,Nuclei,cpe:2.3:a:stylemixthemes:cost_calculator_builder:*:*:*:*:*:wordpress:*:*,Stylemixthemes,Cost Calculator Builder
CVE-2024-43160,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.04624,CWE-434,Unrestricted Upload of File with Dangerous Type vulnerability in BerqWP allows Code Injection.This issue affects BerqWP: from n/a through 1.7.6.,2024-08-13,Nuclei,,,
CVE-2024-4322,0.0,,0.30987,CWE-29,"A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `/list_personalities` endpoint. By manipulating the `category` parameter, an attacker can traverse the directory structure and list any directory on the system. This issue affects the latest version of the application. The vulnerability is due to improper handling of user-supplied input in the `list_personalities` function, where the `category` parameter can be controlled to specify arbitrary directories for listing. Successful exploitation of this vulnerability could allow an attacker to list all folders in the drive on the system, potentially leading to information disclosure.",2024-05-16,Nuclei,cpe:2.3:a:lollms:lollms_web_ui:*:*:*:*:*:*:*:*,Lollms,Lollms Web Ui
CVE-2024-4325,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.37366,CWE-918,"A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the `/queue/join` endpoint and the `save_url_to_cache` function. The vulnerability arises when the `path` value, obtained from the user and expected to be a URL, is used to make an HTTP request without sufficient validation checks. This flaw allows an attacker to send crafted requests that could lead to unauthorized access to the local network or the AWS metadata endpoint, thereby compromising the security of internal servers.",2024-06-06,Nuclei,cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*,Gradio Project,Gradio
CVE-2024-43283,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01104,CWE-201,Insertion of Sensitive Information Into Sent Data vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through <= 23.1.2.,2024-08-26,Nuclei,cpe:2.3:a:contest-gallery:contest_gallery:*:*:*:*:*:wordpress:*:*,Contest-Gallery,Contest Gallery
CVE-2024-43360,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06222,CWE-89,"ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61.",2024-08-12,Nuclei,cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*,Zoneminder,Zoneminder
CVE-2024-43425,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.83343,CWE-94,A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions.,2024-11-07,Metasploit/Nuclei,cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*,Moodle,Moodle
CVE-2024-43441,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.69651,CWE-302,"Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server.

This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0.

Users are recommended to upgrade to version 1.5.0, which fixes the issue.",2024-12-24,Nuclei,cpe:2.3:a:apache:hugegraph:*:*:*:*:*:*:*:*,Apache,Hugegraph
CVE-2024-43451,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.81817,CWE-73,NTLM Hash Disclosure Spoofing Vulnerability,2024-11-12,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2024-43461,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.51883,CWE-451,Windows MSHTML Platform Spoofing Vulnerability,2024-09-10,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2024-43468,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.6111,CWE-89,Microsoft Configuration Manager Remote Code Execution Vulnerability,2024-10-08,CISA,cpe:2.3:a:microsoft:configuration_manager_2403:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:configuration_manager_2409:-:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:configuration_manager_2503:-:*:*:*:*:*:*:*,Microsoft,Configuration Manager 2403
CVE-2024-4348,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N,0.01828,CWE-79,"A vulnerability, which was classified as problematic, was found in osCommerce 4. Affected is an unknown function of the file /catalog/all-products. The manipulation of the argument cat leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-262488. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",2024-04-30,Nuclei,,,
CVE-2024-43572,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.66571,CWE-707,Microsoft Management Console Remote Code Execution Vulnerability,2024-10-08,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x32:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2024-43573,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.43679,CWE-79,Windows MSHTML Platform Spoofing Vulnerability,2024-10-08,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2024-4358,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97482,CWE-290,"In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.",2024-05-29,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:telerik:report_server_2024:*:*:*:*:*:*:*:*,Telerik,Report Server 2024
CVE-2024-43917,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L,0.21769,CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TemplateInvaders TI WooCommerce Wishlist allows SQL Injection.This issue affects TI WooCommerce Wishlist: from n/a through 2.8.2.,2024-08-29,Metasploit/Nuclei,cpe:2.3:a:templateinvaders:ti_woocommerce_wishlist:*:*:*:*:free:wordpress:*:*,Templateinvaders,Ti Woocommerce Wishlist
CVE-2024-43919,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.43313,CWE-862,"Access Control vulnerability in YARPP YARPP allows .

This issue affects YARPP: from n/a through 5.30.10.",2024-11-01,Nuclei,cpe:2.3:a:yarpp:yet_another_related_posts_plugin:*:*:*:*:*:wordpress:*:*,Yarpp,Yet Another Related Posts Plugin
CVE-2024-43965,8.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L,0.0188,CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smackcoders SendGrid for WordPress allows SQL Injection.This issue affects SendGrid for WordPress: from n/a through 1.4.,2024-08-29,Nuclei,cpe:2.3:a:smackcoders:sendgrid:*:*:*:*:*:wordpress:*:*,Smackcoders,Sendgrid
CVE-2024-43971,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.00593,CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.5.,2024-09-18,Nuclei,cpe:2.3:a:sunshinephotocart:sunshine_photo_cart:*:*:*:*:*:wordpress:*:*,Sunshinephotocart,Sunshine Photo Cart
CVE-2024-4399,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.01821,CWE-918,"The  does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attack",2024-05-23,Nuclei,cpe:2.3:a:apereo:central_authentication_service:-:*:*:*:*:wordpress:*:*,Apereo,Central Authentication Service
CVE-2024-44000,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.83178,CWE-522,Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n/a through < 6.5.0.1.,2024-10-20,Metasploit/Nuclei,cpe:2.3:a:litespeedtech:litespeed_cache:*:*:*:*:*:wordpress:*:*,Litespeedtech,Litespeed Cache
CVE-2024-44308,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.09039,NVD-CWE-noinfo,"The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.",2024-11-20,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2024-44309,6.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L,0.20724,CWE-79,"A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.",2024-11-20,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2024-4434,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.36925,CWE-89,"The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘term_id’ parameter in versions up to, and including, 4.2.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2024-05-14,Nuclei,cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:*,Thimpress,Learnpress
CVE-2024-44349,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05778,CWE-89,A SQL injection vulnerability in login portal in AnteeoWMS before v4.7.34 allows unauthenticated attackers to execute arbitrary SQL commands via the username parameter and disclosure of some data in the underlying DB.,2024-10-08,Nuclei,,,
CVE-2024-4439,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.70822,CWE-80,"WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.",2024-05-03,Nuclei,cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*,Wordpress,Wordpress
CVE-2024-4443,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.10272,CWE-89,"The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘listingfields’ parameter in all versions up to, and including, 6.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2024-05-22,Nuclei,cpe:2.3:a:businessdirectoryplugin:business_directory:*:*:*:*:*:wordpress:*:*,Businessdirectoryplugin,Business Directory
CVE-2024-4455,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.0101,CWE-79,"The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘item’ parameter in versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",2024-05-24,Nuclei,cpe:2.3:a:yithemes:yith_woocommerce_ajax_search:*:*:*:*:*:wordpress:*:*,Yithemes,Yith Woocommerce Ajax Search
CVE-2024-44762,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.02566,CWE-209,A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts.,2024-10-16,Nuclei,cpe:2.3:a:webmin:usermin:2.100:*:*:*:*:*:*:*,Webmin,Usermin
CVE-2024-44849,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.46287,CWE-434,Qualitor up to 8.24 is vulnerable to Remote Code Execution (RCE) via Arbitrary File Upload in checkAcesso.php.,2024-09-09,Nuclei,cpe:2.3:a:qualitor:qualitor:8.20:*:*:*:*:*:*:*;cpe:2.3:a:qualitor:qualitor:8.24:*:*:*:*:*:*:*,Qualitor,Qualitor
CVE-2024-45195,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.99983,CWE-425,"Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 18.12.16.

Users are recommended to upgrade to version 18.12.16, which fixes the issue.",2024-09-04,CISA/EPSS/Nuclei,cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*,Apache,Ofbiz
CVE-2024-45216,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.90955,CWE-287,"Improper Authentication vulnerability in Apache Solr.

Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass.
A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path.
This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.


This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.

Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.",2024-10-16,Nuclei,cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*,Apache,Solr
CVE-2024-45241,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.13623,CWE-22,"A traversal vulnerability in GeneralDocs.aspx in CentralSquare CryWolf (False Alarm Management) through 2024-08-09 allows unauthenticated attackers to read files outside of the working web directory via the rpt parameter, leading to the disclosure of sensitive information.",2024-08-26,Nuclei,,,
CVE-2024-45256,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05635,CWE-22,An arbitrary file write issue in the exfiltration endpoint in BYOB (Build Your Own Botnet) 2.0 allows attackers to overwrite SQLite databases and bypass authentication via an unauthenticated HTTP request with a crafted parameter. This occurs in file_add in api/files/routes.py.,2024-08-26,Metasploit,,,
CVE-2024-45257,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.03891,CWE-77,A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbitrary commands on the server via a crafted build parameter. This occurs in freeze in core/generators.py.,2026-05-08,Metasploit,,,
CVE-2024-45293,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02799,CWE-611,"PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces. On servers that allow users to upload their own Excel (XLSX) sheets, Server files and sensitive information can be disclosed by providing a crafted sheet. The security scan function in src/PhpSpreadsheet/Reader/Security/XmlScanner.php contains a flawed XML encoding check to retrieve the input file's XML encoding in the toUtf8 function. The function searches for the XML encoding through a defined regex which looks for `encoding=""*""` and/or `encoding='*'`, if not found, it defaults to the UTF-8 encoding which bypasses the conversion logic. This logic can be used to pass a UTF-7 encoded XXE payload, by utilizing a whitespace before or after the = in the attribute definition. Sensitive information disclosure through the XXE on sites that allow users to upload their own excel spreadsheets, and parse them using PHPSpreadsheet's Excel parser. This issue has been addressed in release versions 1.29.1, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.",2024-10-07,Nuclei,cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*,Phpoffice,Phpspreadsheet
CVE-2024-45309,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.24822,CWE-200,"OneDev is a Git server with CI/CD, kanban, and packages. A vulnerability in versions prior to 11.0.9 allows unauthenticated users to read arbitrary files accessible by the OneDev server process. This issue has been fixed in version 11.0.9.",2024-10-21,Metasploit/Nuclei,cpe:2.3:a:onedev_project:onedev:*:*:*:*:*:*:*:*,Onedev Project,Onedev
CVE-2024-45388,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.5585,CWE-200,"Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The `/api/v2/simulation` POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary files from the Hoverfly server. Note that, although the code prevents absolute paths from being specified, an attacker can escape out of the `hf.Cfg.ResponsesBodyFilesPath` base path by using `../` segments and reach any arbitrary files. This issue was found using the Uncontrolled data used in path expression CodeQL query for python. Users are advised to make sure the final path (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, filePath)`) is contained within the expected base path (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, ""/"")`). This issue is also tracked as GHSL-2023-274.",2024-09-02,Nuclei,cpe:2.3:a:hoverfly:hoverfly:*:*:*:*:*:*:*:*,Hoverfly,Hoverfly
CVE-2024-45440,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.09269,CWE-209,core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.,2024-08-29,Nuclei,cpe:2.3:a:drupal:drupal:2023-05-09:*:*:*:*:*:*:*,Drupal,Drupal
CVE-2024-4548,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.29425,CWE-20,"An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform SQLi via the fourth field.",2024-05-06,Metasploit,cpe:2.3:a:deltaww:diaenergie:*:*:*:*:*:*:*:*,Deltaww,Diaenergie
CVE-2024-45488,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.50603,Missing_Data,"One Identity Safeguard for Privileged Passwords before 7.5.2 allows unauthorized access because of an issue related to cookies. This only affects virtual appliance installations (VMware or HyperV). The fixed versions are 7.0.5.1 LTS, 7.4.2, and 7.5.2.",2024-08-30,Nuclei,,,
CVE-2024-45507,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.93382,CWE-94,"Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 18.12.16.

Users are recommended to upgrade to version 18.12.16, which fixes the issue.",2024-09-04,Nuclei,cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*,Apache,Ofbiz
CVE-2024-45519,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.99877,NVD-CWE-noinfo,"The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.",2024-10-02,CISA/EPSS/Nuclei,cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:10.1.0:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p10:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p11:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p12:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p13:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p14:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p15:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p16:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p17:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p18:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p19:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p20:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p21:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p22:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p23:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p24:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p25:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p26:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p27:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p28:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p29:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p30:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31.1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p32:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p33:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p34:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p35:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p36:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p37:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p38:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p39:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p40:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p41:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p42:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p43:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p44:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p45:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p6:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p7:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p8:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p9:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p12:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p15:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p21:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24.1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p26:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p27:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p28:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p29:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p30:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p31:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p32:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p33:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p34:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p35:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p36:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p37:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p38:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p39:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p40:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p5:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p6:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p8:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p9:*:*:*:*:*:*,Synacor,Zimbra Collaboration Suite
CVE-2024-45591,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.03417,CWE-359,"XWiki Platform is a generic wiki platform. The REST API exposes the history of any page in XWiki of which the attacker knows the name. The exposed information includes for each modification of the page the time of the modification, the version number, the author of the modification (both username and displayed name) and the version comment. This information is exposed regardless of the rights setup, and even when the wiki is configured to be fully private. On a private wiki, this can be tested by accessing /xwiki/rest/wikis/xwiki/spaces/Main/pages/WebHome/history, if this shows the history of the main page then the installation is vulnerable. This has been patched in XWiki 15.10.9 and XWiki 16.3.0RC1.",2024-09-10,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2024-45622,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.36679,CWE-89,ASIS (aka Aplikasi Sistem Sekolah using CodeIgniter 3) 3.0.0 through 3.2.0 allows index.php username SQL injection for Authentication Bypass.,2024-09-02,Nuclei,,,
CVE-2024-4577,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99987,CWE-78,"In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use ""Best-Fit"" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.",2024-06-09,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:php:php:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2024-4610,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.00758,CWE-416,"Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r34p0 through r40p0; Valhall GPU Kernel Driver: from r34p0 through r40p0.",2024-06-07,CISA,cpe:2.3:a:arm:bifrost_gpu_kernel_driver:*:*:*:*:*:*:*:*;cpe:2.3:a:arm:valhall_gpu_kernel_driver:*:*:*:*:*:*:*:*,Arm,Bifrost Gpu Kernel Driver
CVE-2024-4620,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03345,NVD-CWE-noinfo,The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploaded when an upload file input is included on a form,2024-06-07,Nuclei,cpe:2.3:a:reputeinfosystems:arforms:*:*:*:*:*:wordpress:*:*,Reputeinfosystems,Arforms
CVE-2024-46310,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.02434,CWE-281,Incorrect Access Control in Cfx.re FXServer v9601 and earlier allows unauthenticated users to modify and read arbitrary user data via exposed API endpoint,2025-01-13,Nuclei,,,
CVE-2024-46506,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.6293,CWE-306,"NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. This is related to settings.php and util.php.",2025-05-13,Metasploit/Nuclei,cpe:2.3:a:netalertx:netalertx:*:*:*:*:*:*:*:*,Netalertx,Netalertx
CVE-2024-46507,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.03919,CWE-94,A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows attackers to execute code on the application server.,2026-05-08,Nuclei,cpe:2.3:a:yeti-platform:yeti:*:*:*:*:*:*:*:*,Yeti-Platform,Yeti
CVE-2024-46627,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.04099,CWE-284,Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests.,2024-09-26,Nuclei,,,
CVE-2024-4671,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.08348,CWE-416,Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High),2024-05-14,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2024-46938,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.46077,NVD-CWE-noinfo,"An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Release. An unauthenticated attacker can read arbitrary files.",2024-09-15,Nuclei,cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:*,Sitecore,Experience Commerce
CVE-2024-46986,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.35461,CWE-74,Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on (depending on the permissions of the underlying filesystem). E.g. This can lead to a delayed remote code execution in case an attacker is able to write a Ruby file into the config/initializers/ subfolder of the Ruby on Rails application. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.,2024-09-18,Nuclei,cpe:2.3:a:tuzitio:camaleon_cms:*:*:*:*:*:*:*:*,Tuzitio,Camaleon Cms
CVE-2024-46987,7.7,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N,0.1456,CWE-22,Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file permissions). This issue may lead to Information Disclosure. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.,2024-09-18,Metasploit,cpe:2.3:a:tuzitio:camaleon_cms:*:*:*:*:*:*:*:*,Tuzitio,Camaleon Cms
CVE-2024-47062,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.04457,CWE-89,"Navidrome is an open source web-based music collection server and streamer. Navidrome automatically adds parameters in the URL to SQL queries. This can be exploited to access information by adding parameters like `password=...` in the URL (ORM Leak). Furthermore, the names of the parameters are not properly escaped, leading to SQL Injections. Finally, the username is used in a `LIKE` statement, allowing people to log in with `%` instead of their username. When adding parameters to the URL, they are automatically included in an SQL `LIKE` statement (depending on the parameter's name). This allows attackers to potentially retrieve arbitrary information. For example, attackers can use the following request to test whether some encrypted passwords start with `AAA`. This results in an SQL query like `password LIKE 'AAA%'`, allowing attackers to slowly brute-force passwords. When adding parameters to the URL, they are automatically added to an SQL query. The names of the parameters are not properly escaped. This behavior can be used to inject arbitrary SQL code (SQL Injection). These vulnerabilities can be used to leak information and dump the contents of the database and have been addressed in release version 0.53.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.",2024-09-20,Nuclei,cpe:2.3:a:navidrome:navidrome:*:*:*:*:*:*:*:*,Navidrome,Navidrome
CVE-2024-47073,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.01223,CWE-347,DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions a the lack of signature verification of jwt tokens allows attackers to forge jwts which then allow access to any interface. The vulnerability has been fixed in v2.10.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.,2024-11-07,Nuclei,cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*,Dataease,Dataease
CVE-2024-47076,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N,0.76959,CWE-20,"CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. The `cfGetPrinterAttributes5` function in `libcupsfilters` does not sanitize IPP attributes returned from an IPP server. When these IPP attributes are used, for instance, to generate a PPD file, this can lead to attacker controlled data to be provided to the rest of the CUPS system.",2024-09-26,Metasploit,cpe:2.3:a:openprinting:libcupsfilters:*:*:*:*:*:*:*:*;cpe:2.3:a:openprinting:libcupsfilters:2.1:beta1:*:*:*:*:*:*,Openprinting,Libcupsfilters
CVE-2024-47175,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N,0.62474,CWE-20,"CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176.",2024-09-26,Metasploit,cpe:2.3:a:openprinting:libppd:*:*:*:*:*:*:*:*;cpe:2.3:a:openprinting:libppd:2.1:beta1*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2024-47176,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.50174,CWE-1327,"CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to trust any packet from any source, and can cause the `Get-Printer-Attributes` IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to.",2024-09-26,Metasploit/Nuclei,cpe:2.3:a:openprinting:cups-browsed:2.0.1:*:*:*:*:*:*:*,Openprinting,Cups-Browsed
CVE-2024-47308,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L,0.01695,CWE-862,Missing Authorization vulnerability in WPDeveloper Templately templately.This issue affects Templately: from n/a through <= 3.1.2.,2024-11-01,Nuclei,cpe:2.3:a:templately:templately:*:*:*:*:*:wordpress:*:*,Templately,Templately
CVE-2024-47374,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L,0.0138,CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through <= 6.5.0.2.,2024-10-05,Nuclei,cpe:2.3:a:litespeedtech:litespeed_cache:*:*:*:*:*:wordpress:*:*,Litespeedtech,Litespeed Cache
CVE-2024-47407,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.64168,CWE-78,A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands.,2024-11-22,Metasploit,,,
CVE-2024-47533,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03948,CWE-287,"Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. `utils.get_shared_secret()` always returns `-1`, which allows anyone to connect to cobbler XML-RPC as user `''` password `-1` and make any changes. This gives anyone with network access to a cobbler server full control of the server. Versions 3.2.3 and 3.3.7 fix the issue.",2024-11-18,Nuclei,,,
CVE-2024-47575,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.94761,CWE-306,"A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests.",2024-10-23,CISA/Metasploit,cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortimanager_cloud:*:*:*:*:*:*:*:*,Fortinet,Fortimanager
CVE-2024-4761,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.11007,CWE-787,Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High),2024-05-14,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2024-48208,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H,0.01511,CWE-125,pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file.,2024-10-24,Nuclei,cpe:2.3:a:pureftpd:pure-ftpd:*:*:*:*:*:*:*:*,Pureftpd,Pure-Ftpd
CVE-2024-48248,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.9408,CWE-36,NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).,2025-03-04,CISA/Nuclei,cpe:2.3:a:nakivo:backup_\&_replication_director:*:*:*:*:*:*:*:*,Nakivo,Backup & Replication Director
CVE-2024-48259,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.00907,CWE-89,Cloudlog 2.6.15 allows Oqrs.php request_form SQL injection via station_id or callsign.,2024-10-14,Nuclei,cpe:2.3:a:magicbug:cloudlog:2.6.15:*:*:*:*:*:*:*,Magicbug,Cloudlog
CVE-2024-48307,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.4457,CWE-89,JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData.,2024-10-31,Nuclei,cpe:2.3:a:jeecg:jeecg_boot:3.7.1:*:*:*:*:*:*:*,Jeecg,Jeecg Boot
CVE-2024-4836,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02651,CWE-552,"Web services managed by Edito CMS (Content Management System) in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration files by an unauthenticated user.
The issue in versions 3.5 - 3.25 was removed in releases which dates from 10th of January 2014. Higher versions were never affected.",2024-07-02,Nuclei,,,
CVE-2024-48360,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03905,CWE-918,Qualitor v8.24 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /request/viewValidacao.php.,2024-10-31,Nuclei,cpe:2.3:a:qualitor:qualitor:8.20:*:*:*:*:*:*:*;cpe:2.3:a:qualitor:qualitor:8.24:*:*:*:*:*:*:*,Qualitor,Qualitor
CVE-2024-4841,3.3,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N,0.00674,CWE-29,"A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'add_reference_to_local_mode' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest. By exploiting this vulnerability, an attacker can predict the folders, subfolders, and files present on the victim's computer. The vulnerability is present in the way the application handles the 'path' parameter in HTTP requests to the '/add_reference_to_local_model' endpoint.",2024-06-23,Nuclei,cpe:2.3:a:lollms:lollms-webui:9.6:*:*:*:*:*:*:*,Lollms,Lollms-Webui
CVE-2024-48455,2.7,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N,0.06356,Missing_Data,"An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3503 and Netis Wifi 11AC Router NC21 3.0.0.3800, 3.0.0.3500 and 3.0.0.3329 and Netis Wifi Router MW5360 1.0.1.3442 and 1.0.1.3031 allows a remote attacker to obtain sensitive information via the mode_name, wl_link parameters of the skk_get.cgi component.",2025-01-06,Metasploit/Nuclei,,,
CVE-2024-48456,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.17289,CWE-125,"An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3503 and Netis Wifi 11AC Router NC21 3.0.0.3800, 3.0.0.3500 and 3.0.0.3329 and Netis Wifi Router MW5360 1.0.1.3442 and 1.0.1.3031 allows a remote attacker to obtain sensitive information via the parameter password at the change admin password page at the router web interface.",2025-01-06,Metasploit,,,
CVE-2024-48457,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03081,CWE-125,"An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3503 and Netis Wifi 11AC Router NC21 3.0.0.3800, 3.0.0.3500 and 3.0.0.3329 and Netis Wifi Router MW5360 1.0.1.3442 and 1.0.1.3031 allows a remote attacker to obtain sensitive information via the endpoint /cgi-bin/skk_set.cgi and binary /bin/scripts/start_wifi.sh",2025-01-06,Metasploit,,,
CVE-2024-48594,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03275,CWE-434,File Upload vulnerability in Prison Management System v.1.0 allows a remote attacker to execute arbitrary code via the file upload component.,2024-10-28,Metasploit,cpe:2.3:a:fast5:prison_management_system:1.0:*:*:*:*:*:*:*,Fast5,Prison Management System
CVE-2024-48651,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02204,CWE-863,"In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.",2024-11-29,Nuclei,,,
CVE-2024-48760,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.45109,CWE-434,"An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function. The attacker can upload a malicious perlcmd.cgi file that overwrites the original upload.cgi file, enabling remote command execution.",2025-01-14,Metasploit,cpe:2.3:a:gestioip:gestioip:3.5.7:*:*:*:*:*:*:*,Gestioip,Gestioip
CVE-2024-48766,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.68616,CWE-698,"NetAlertX 24.7.18 before 24.10.12 allows unauthenticated file reading because an HTTP client can ignore a redirect, and because of factors related to strpos and directory traversal, as exploited in the wild in May 2025. This is related to components/logs.php.",2025-05-13,Metasploit/Nuclei,cpe:2.3:a:netalertx:netalertx:*:*:*:*:*:*:*:*,Netalertx,Netalertx
CVE-2024-4879,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99976,CWE-1287,"ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted instances, and ServiceNow released the update to our partners and self-hosted customers. Listed below are the patches and hot fixes that address the vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.",2024-07-10,CISA/EPSS/Nuclei,cpe:2.3:a:servicenow:servicenow:utah:-:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:early_availability:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_10:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_10_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_10_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_10a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_10a_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_3:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_4:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_3:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_3_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_3_hotfix_1b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_4:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_2a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_2b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_3:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_3b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_4:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_4b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_5:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_5:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_5_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_6:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_6_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_6_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_7:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_7_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_7_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_7a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_7b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_8:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_8_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_9:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_9_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_9_hotfix_1a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_9_hotfix_1b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:-:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_10:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_1_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix1a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_1a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_3:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_3:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_3:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_4:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_4:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_2b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_5:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_5_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_6:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_6_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_7:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_1a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_3a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_8:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_3:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_9:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:washington_dc:-:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:washington_dc:patch_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:washington_dc:patch_2_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:washington_dc:patch_3:*:*:*:*:*:*,Servicenow,Servicenow
CVE-2024-4885,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99288,CWE-22,"In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold.  The 

WhatsUp.ExportUtilities.Export.GetFileWithoutZip



 allows execution of commands with iisapppool\nmconsole privileges.",2024-06-25,CISA/EPSS/Nuclei,cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*,Progress,Whatsup Gold
CVE-2024-48914,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H,0.60429,CWE-20,"Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data such as configuration files, environment variables, and other critical data stored on the server. In the same code path is an additional vector for crashing the server via a malformed URI. Patches are available in versions 3.0.5 and 2.3.3. Some workarounds are also available. One may use object storage rather than the local file system, e.g. MinIO or S3, or define middleware which detects and blocks requests with urls containing `/../`.",2024-10-15,Nuclei,,,
CVE-2024-4898,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04156,CWE-862,"The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site to InstaWP API, edit arbitrary site options and create administrator accounts.",2024-06-12,Nuclei,cpe:2.3:a:instawp:instawp_connect:*:*:*:*:*:wordpress:*:*,Instawp,Instawp Connect
CVE-2024-48990,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.19924,CWE-427,"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.",2024-11-19,Metasploit,cpe:2.3:a:needrestart_project:needrestart:*:*:*:*:*:*:*:*,Needrestart Project,Needrestart
CVE-2024-49035,8.7,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N,0.01339,CWE-269,An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.,2024-11-26,CISA,cpe:2.3:a:microsoft:partner_center:-:*:*:*:*:*:*:*,Microsoft,Partner Center
CVE-2024-49039,8.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.13719,CWE-287,Windows Task Scheduler Elevation of Privilege Vulnerability,2024-11-12,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2024-49138,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.25414,CWE-122,Windows Common Log File System Driver Elevation of Privilege Vulnerability,2024-12-12,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:sp2:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2024-49357,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.20599,CWE-200,"ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoints in ZimaOS, such as `http://<Server-IP>/v1/users/image?path=/var/lib/casaos/1/app_order.json` and `http://<Server-IP>/v1/users/image?path=/var/lib/casaos/1/system.json`, expose sensitive data like installed applications and system information without requiring any authentication or authorization. This sensitive data leak can be exploited by attackers to gain detailed knowledge about the system setup, installed applications, and other critical information. As of time of publication, no known patched versions are available.",2024-10-24,Nuclei,cpe:2.3:o:zimaspace:zimaos:*:*:*:*:*:*:*:*,Zimaspace,Zimaos
CVE-2024-49380,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N,0.02763,CWE-74,"Plenti, a static site generator, has an arbitrary file write vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write vulnerability when a plenti user serves their website. This issue may lead to Remote Code Execution. Version 0.7.2 fixes the vulnerability.",2024-10-25,Nuclei,cpe:2.3:a:plenti:plenti:*:*:*:*:*:*:*:*,Plenti,Plenti
CVE-2024-4940,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01021,CWE-601,"An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting (XSS), Server-Side Request Forgery (SSRF), amongst others. This issue is due to improper validation of user-supplied input in the handling of URLs. Attackers can exploit this vulnerability by crafting a malicious URL that, when processed by the application, redirects the user to an attacker-controlled web page.",2024-06-22,Nuclei,cpe:2.3:a:gradio_project:gradio:4.36.0:*:*:*:*:python:*:*,Gradio Project,Gradio
CVE-2024-4947,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.15111,CWE-843,Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High),2024-05-15,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2024-4956,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.18245,CWE-22,Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1.,2024-05-16,Nuclei,,,
CVE-2024-49757,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02572,CWE-287,"The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the ""User Registration allowed"" option only hid the registration button on the login page. Users could bypass this restriction by directly accessing the registration URL (/ui/login/loginname) and register a user that way. Versions 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available.",2024-10-25,Nuclei,cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*,Zitadel,Zitadel
CVE-2024-4978,8.4,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H,0.26937,CWE-506,"Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor may exploit this vulnerability to execute of unauthorized PowerShell commands.",2024-05-23,CISA,cpe:2.3:a:javs:javs_viewer:8.3.7.250:*:*:*:*:*:*:*,Javs,Javs Viewer
CVE-2024-50302,5.5,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.00809,CWE-908,"In the Linux kernel, the following vulnerability has been resolved:

HID: core: zero-initialize the report buffer

Since the report buffer is used by all kinds of drivers in various ways, let's
zero-initialize it during allocation to make sure that it can't be ever used
to leak kernel memory via specially-crafted report.",2024-11-19,CISA,cpe:2.3:h:siemens:ruggedcom_rst2428p:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xc316-8:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xc319-4:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xc324-4:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xc324-4eec:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xc332:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xc416-8:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xc419-4:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xc424-4:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xc432:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xch328:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xcm324:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xcm328:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xcm332:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xr302-32:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xr322-12:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xr326-8:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xr326-8eec:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xr502-32:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xr522-12:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xr524-8c:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xr524-8wg:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xr526-8:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xr526-8c:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xr528-6m:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xr552-12m:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xrh334:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:scalance_xrm334:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_s7-1500_tm_mfp:-:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_s7-1500_tm_mfp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:siemens:sinec_os:*:*:*:*:*:*:*:*,Siemens,Simatic S7-1500 Tm Mfp Firmware
CVE-2024-50334,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01008,CWE-288,"Scoold is a Q&A and a knowledge sharing platform for teams. A semicolon path injection vulnerability was found on the /api;/config endpoint. By appending a semicolon in the URL, attackers can bypass authentication and gain unauthorised access to sensitive configuration data. Furthermore, PUT requests on the /api;/config endpoint while setting the Content-Type: application/hocon header allow unauthenticated attackers to file reading via HOCON file inclusion. This allows attackers to retrieve sensitive information such as configuration files from the server, which can be leveraged for further exploitation. The vulnerability has been fixed in Scoold 1.64.0. A workaround would be to disable the Scoold API with scoold.api_enabled = false.",2024-10-29,Nuclei,cpe:2.3:a:erudika:scoold:*:*:*:*:*:*:*:*,Erudika,Scoold
CVE-2024-50340,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.63422,CWE-74,"symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes. All users are advised to upgrade. There are no known workarounds for this vulnerability.",2024-11-06,Nuclei,,,
CVE-2024-50477,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07959,CWE-288,Authentication Bypass Using an Alternate Path or Channel vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Authentication Bypass.This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3.,2024-10-28,Nuclei,cpe:2.3:a:stacksmarket:stacks_mobile_app_builder:*:*:*:*:*:wordpress:*:*,Stacksmarket,Stacks Mobile App Builder
CVE-2024-50498,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.5364,CWE-94,Improper Control of Generation of Code ('Code Injection') vulnerability in Ajit Bohra WP Query Console wp-query-console allows Code Injection.This issue affects WP Query Console: from n/a through <= 1.0.,2024-10-28,Nuclei,cpe:2.3:a:lubus:wp_query_console:*:*:*:*:*:wordpress:*:*,Lubus,Wp Query Console
CVE-2024-5057,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L,0.02588,CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Easy Digital Downloads allows SQL Injection.This issue affects Easy Digital Downloads: from n/a through 3.2.12.,2024-08-29,Nuclei,cpe:2.3:a:awesomemotive:easy_digital_downloads:*:*:*:*:*:wordpress:*:*,Awesomemotive,Easy Digital Downloads
CVE-2024-50603,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.98545,CWE-78,"An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.",2025-01-08,CISA/EPSS/Nuclei,cpe:2.3:a:aviatrix:controller:*:*:*:*:*:*:*:*,Aviatrix,Controller
CVE-2024-50623,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98529,CWE-434,"In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.",2024-10-28,CISA/EPSS/Nuclei,cpe:2.3:a:cleo:harmony:*:*:*:*:*:*:*:*;cpe:2.3:a:cleo:lexicom:*:*:*:*:*:*:*:*;cpe:2.3:a:cleo:vltrader:*:*:*:*:*:*:*:*,Cleo,Harmony
CVE-2024-5082,0.0,,0.01956,CWE-94,"A Remote Code Execution vulnerability has been discovered in Sonatype Nexus Repository 2. 

This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1.",2024-11-14,Nuclei,,,
CVE-2024-5084,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.50653,CWE-434,"The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'file_upload_action' function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.",2024-05-23,Metasploit/Nuclei,cpe:2.3:a:hashthemes:hash_form:*:*:*:*:*:wordpress:*:*,Hashthemes,Hash Form
CVE-2024-50857,4.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N,0.01192,CWE-79,The ip_do_job request in GestioIP v3.5.7 is vulnerable to Cross-Site Scripting (XSS). It allows data exfiltration and enables CSRF attacks. The vulnerability requires specific user permissions within the application to exploit successfully.,2025-01-14,Nuclei,cpe:2.3:a:gestioip:gestioip:3.5.7:*:*:*:*:*:*:*,Gestioip,Gestioip
CVE-2024-50967,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.01644,CWE-862,"The /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability. An attacker can remotely access this endpoint without authentication, leading to unauthorized disclosure of sensitive information.",2025-01-17,Nuclei,,,
CVE-2024-51092,9.1,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L,0.06933,CWE-78,"LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's initRrdDirectory().",2026-05-08,Metasploit,cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*,Librenms,Librenms
CVE-2024-51211,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02271,CWE-89,"SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input validation of the $username_stn_id parameter, which can be manipulated by an attacker to inject arbitrary SQL commands.",2024-11-08,Nuclei,cpe:2.3:a:os4ed:opensis:9.0:*:*:*:*:*:*:*;cpe:2.3:a:os4ed:opensis:9.1:*:*:*:*:*:*:*,Os4Ed,Opensis
CVE-2024-51228,6.8,CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.0379,CWE-78,An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1420 and TOTOLINK-CX-N300RT V2.1.8-B20171113.1408 and TOTOLINK-CX-N300RT V2.1.8-B20191010.1107 and TOTOLINK-CX-N302RE V2.0.2-B20170511.1523 allows a remote attacker to execute arbitrary code via the /boafrm/formSysCmd component.,2024-11-27,Nuclei,,,
CVE-2024-51378,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.94798,CWE-78,"getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.",2024-10-29,CISA/Metasploit/Nuclei,cpe:2.3:a:cyberpanel:cyberpanel:*:*:*:*:*:*:*:*,Cyberpanel,Cyberpanel
CVE-2024-51482,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.36899,CWE-89,"ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder v1.37.* <= 1.37.64 is vulnerable to boolean-based SQL Injection in function of web/ajax/event.php. This is fixed in 1.37.65.",2024-10-31,Nuclei,,,
CVE-2024-51483,0.0,,0.0229,CWE-22,"changedetection.io is free, open source web page change detection software. Prior to version 0.47.5, when a WebDriver is used to fetch files, `source:file:///etc/passwd` can be used to retrieve local system files, where the more traditional `file:///etc/passwd` gets blocked. Version 0.47.5 fixes the issue.",2024-11-01,Nuclei,,,
CVE-2024-51567,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.86725,CWE-306,"upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.",2024-10-29,CISA/Metasploit/Nuclei,cpe:2.3:a:cyberpanel:cyberpanel:*:*:*:*:*:*:*:*,Cyberpanel,Cyberpanel
CVE-2024-51568,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.45682,CWE-78,CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. There is /filemanager/upload (aka File Manager upload) unauthenticated remote code execution via shell metacharacters.,2024-10-29,Metasploit/Nuclei,cpe:2.3:a:cyberpanel:cyberpanel:*:*:*:*:*:*:*:*,Cyberpanel,Cyberpanel
CVE-2024-51739,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01259,CWE-200,"Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a valid account. As a fix the sentence displayed after resetting password no longer shows if the user exists or not. This fix is included in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. Users unable to upgrade may overload the dictionary entry `""UI:ResetPwd-Error-WrongLogin""` through an extension and replace it with a generic message.",2024-11-05,Nuclei,cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*,Combodo,Itop
CVE-2024-51977,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.77472,CWE-538,"An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631), can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mnt_info.csv can be accessed via a GET request and no authentication is required. The returned result is a comma separated value (CSV) table of information. The leaked information includes the device’s model, firmware version, IP address, and serial number.",2025-06-25,Metasploit/Nuclei,,,
CVE-2024-51978,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.23635,CWE-1391,"An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated attacker can first discover the target device's serial number via CVE-2024-51977 over HTTP/HTTPS/IPP, or via a PJL request, or via an SNMP request.",2025-06-25,Metasploit/Nuclei,,,
CVE-2024-5217,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99628,CWE-184,"ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.",2024-07-10,CISA/EPSS/Nuclei,cpe:2.3:a:servicenow:servicenow:utah:-:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:early_availability:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_10:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_10_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_10_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_10a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_10a_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_10b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_3:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_4:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_3:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_3_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_3_hotfix_1b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_4:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_2a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_2b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_3:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_3b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_4:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_4b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_5:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_5:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_5_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_6:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_6_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_6_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_7:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_7_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_7_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_7a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_7b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_8:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_8_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_9:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_9_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_9_hotfix_1a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:utah:patch_9_hotfix_1b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:-:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_1_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix1a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_1a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_3:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_3:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_3:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_4:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_4:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_2b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_5:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_5_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_6:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_6_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_7:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_1a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_3a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_4:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_1a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_1b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_2a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_2b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_8:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_3:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:vancouver:patch_9:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:washington_dc:-:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2a:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2b:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:washington_dc:patch_2:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:washington_dc:patch_2_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:washington_dc:patch_3:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:washington_dc:patch_3_hotfix_1:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:washington_dc:patch_4:*:*:*:*:*:*;cpe:2.3:a:servicenow:servicenow:washington_dc:patch_5:*:*:*:*:*:*,Servicenow,Servicenow
CVE-2024-5230,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.18768,CWE-200,A vulnerability has been found in EnvaySoft FleetCart up to 4.1.1 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument razorpayKeyId leads to information disclosure. The attack can be launched remotely. It is recommended to upgrade the affected component. The identifier VDB-265981 was assigned to this vulnerability.,2024-05-23,Nuclei,,,
CVE-2024-52433,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0307,CWE-502,Deserialization of Untrusted Data vulnerability in Mindstien Technologies My Geo Posts Free my-geo-posts-free allows Object Injection.This issue affects My Geo Posts Free: from n/a through <= 1.2.,2024-11-18,Nuclei,cpe:2.3:a:mindstien:my_geo_posts_free:*:*:*:*:*:wordpress:*:*,Mindstien,My Geo Posts Free
CVE-2024-5274,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.1002,CWE-843,Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High),2024-05-28,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*;cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*,Fedoraproject,Fedora
CVE-2024-5276,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.90067,CWE-20,"A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data.  Likely impacts include creation of administrative users and deletion or modification of data in the application database. Data exfiltration via SQL injection is not possible using this vulnerability. Successful unauthenticated exploitation requires a Workflow system with anonymous access enabled, otherwise an authenticated user is required. This issue affects all versions of FileCatalyst Workflow from 5.1.6 Build 135 and earlier.",2024-06-25,Metasploit/Nuclei,cpe:2.3:a:fortra:filecatalyst_workflow:*:*:*:*:*:*:*:*;cpe:2.3:a:fortra:filecatalyst_workflow:5.1.6:-:*:*:*:*:*:*;cpe:2.3:a:fortra:filecatalyst_workflow:5.1.6:build112:*:*:*:*:*:*;cpe:2.3:a:fortra:filecatalyst_workflow:5.1.6:build114:*:*:*:*:*:*;cpe:2.3:a:fortra:filecatalyst_workflow:5.1.6:build126:*:*:*:*:*:*;cpe:2.3:a:fortra:filecatalyst_workflow:5.1.6:build130:*:*:*:*:*:*;cpe:2.3:a:fortra:filecatalyst_workflow:5.1.6:build135:*:*:*:*:*:*,Fortra,Filecatalyst Workflow
CVE-2024-52762,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.00752,CWE-79,"A cross-site scripting (XSS) vulnerability in the component /master/header.php of Ganglia-web v3.73 to v3.76 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ""tz"" parameter.",2024-11-19,Nuclei,cpe:2.3:a:ganglia:ganglia-web:*:*:*:*:*:*:*:*,Ganglia,Ganglia-Web
CVE-2024-52763,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.00628,CWE-79,"A cross-site scripting (XSS) vulnerability in the component /graph_all_periods.php of Ganglia-web v3.73 to v3.75 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ""g"" parameter.",2024-11-19,Nuclei,cpe:2.3:a:ganglia:ganglia-web:*:*:*:*:*:*:*:*,Ganglia,Ganglia-Web
CVE-2024-52875,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.29116,CWE-113,"An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertException.cs and /nonauth/guestConfirm.cs and /nonauth/expiration.cs pages is not properly sanitized before being used to generate a Location HTTP header in a 302 HTTP response. This can be exploited to perform Open Redirect or HTTP Response Splitting attacks, which in turn lead to Reflected Cross-Site Scripting (XSS). Remote command execution can be achieved by leveraging the upgrade feature in the admin interface.",2025-01-31,Nuclei,cpe:2.3:a:gfi:kerio_control:*:*:*:*:*:*:*:*,Gfi,Kerio Control
CVE-2024-53104,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03301,CWE-787,"In the Linux kernel, the following vulnerability has been resolved:

media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format

This can lead to out of bounds writes since frames of this type were not
taken into account when calculating the size of the frames buffer in
uvc_parse_streaming.",2024-12-02,CISA,cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2024-5315,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.32872,CWE-89,"Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters 

viewstatut in /dolibarr/commande/list.php.",2024-05-24,Nuclei,cpe:2.3:a:dolibarr:dolibarr_erp\/crm:9.0.1:*:*:*:*:*:*:*,Dolibarr,Dolibarr Erp/Crm
CVE-2024-53150,7.1,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H,0.01351,CWE-125,"In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Fix out of bounds reads when finding clock sources

The current USB-audio driver code doesn't check bLength of each
descriptor at traversing for clock descriptors.  That is, when a
device provides a bogus descriptor with a shorter bLength, the driver
might hit out-of-bounds reads.

For addressing it, this patch adds sanity checks to the validator
functions for the clock descriptor traversal.  When the descriptor
length is shorter than expected, it's skipped in the loop.

For the clock source and clock multiplier descriptors, we can just
check bLength against the sizeof() of each descriptor type.
OTOH, the clock selector descriptor of UAC2 and UAC3 has an array
of bNrInPins elements and two more fields at its tail, hence those
have to be checked in addition to the sizeof() check.",2024-12-24,CISA,cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2024-53197,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03558,CWE-787,"In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices

A bogus device can provide a bNumConfigurations value that exceeds the
initial value used in usb_get_configuration for allocating dev->config.

This can lead to out-of-bounds accesses later, e.g. in
usb_destroy_configuration.",2024-12-27,CISA,cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2024-53326,7.3,CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H,0.00488,CWE-502,"LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(), leading to code execution.",2026-05-08,Metasploit,,,
CVE-2024-5333,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01092,NVD-CWE-noinfo,"The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access information about password protected events.",2024-12-16,Nuclei,cpe:2.3:a:stellarwp:the_events_calendar:*:*:*:*:*:wordpress:*:*,Stellarwp,The Events Calendar
CVE-2024-5334,0.0,,0.02073,CWE-73,"A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshot_path' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by crafting a request with a malicious 'snapshot_path' parameter, leading to arbitrary file read from the system. This issue impacts the security of the application by allowing unauthorized access to sensitive files on the server.",2024-06-27,Nuclei,cpe:2.3:a:stitionai:devika:1.0:*:*:*:*:*:*:*,Stitionai,Devika
CVE-2024-53704,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.95132,CWE-287,An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.,2025-01-09,CISA/EPSS/Nuclei,cpe:2.3:h:sonicwall:nsa_2700:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_3700:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_4700:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_5700:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsa_6700:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nssp_10700:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nssp_11700:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nssp_13700:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nssp_15700:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsv_270:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsv_470:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:nsv_870:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz270:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz270w:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz370:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz370w:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz470:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz470w:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz570:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz570p:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz570w:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz670:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:tz80:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sonicos:7.1.2-7019:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sonicos:8.0.0-8035:*:*:*:*:*:*:*,Sonicwall,Sonicos
CVE-2024-53900,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.03988,CWE-89,"Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.",2024-12-02,Nuclei,cpe:2.3:a:mongoosejs:mongoose:*:*:*:*:*:node.js:*:*;cpe:2.3:a:mongoosejs:mongoose:7.0.0:rc0:*:*:*:node.js:*:*;cpe:2.3:a:mongoosejs:mongoose:8.0.0:rc0:*:*:*:node.js:*:*,Mongoosejs,Mongoose
CVE-2024-53991,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.25431,CWE-200,"Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use `FileStore::LocalStore` which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick nginx into sending the Discourse backup file with a well crafted request. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. Users unable to upgrade can either 1. Download all local backups on to another storage device, disable the `enable_backups` site setting and delete all backups until the site has been upgraded to pull in the fix. Or  2. Change the `backup_location` site setting to `s3` so that backups are stored and downloaded directly from S3.",2024-12-19,Nuclei,cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*;cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*;cpe:2.3:a:discourse:discourse:3.4.0:beta1:*:*:beta:*:*:*;cpe:2.3:a:discourse:discourse:3.4.0:beta2:*:*:beta:*:*:*;cpe:2.3:a:discourse:discourse:3.4.0:beta3:*:*:beta:*:*:*,Discourse,Discourse
CVE-2024-53995,0.0,,0.00951,CWE-601,"SickChill is an automatic video library manager for TV shows. A user-controlled `login` endpoint's `next_` parameter takes arbitrary content. Prior to commit c7128a8946c3701df95c285810eb75b2de18bf82, an authenticated attacker may use this to redirect the user to arbitrary destinations, leading to open redirect. Commit c7128a8946c3701df95c285810eb75b2de18bf82 changes the login page to redirect to `settings.DEFAULT_PAGE` instead of to the `next` parameter.",2025-01-08,Nuclei,,,
CVE-2024-54085,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.61462,CWE-290,"AMI’s SPx contains
a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation
of this vulnerability may lead to a loss of confidentiality, integrity, and/or
availability.",2025-03-11,CISA,cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:sg1100:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:sg110:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:sg6160:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:sgf6112:-:*:*:*:*:*:*:*;cpe:2.3:o:ami:megarac_sp-x:*:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:sg1100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:sg110_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:sg6160_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:sgf6112_firmware:-:*:*:*:*:*:*:*,Netapp,H300S Firmware
CVE-2024-5420,0.0,,0.055,CWE-79,"Missing input validation in the SEH Computertechnik utnserver Pro, SEH Computertechnik utnserver ProMAX, SEH Computertechnik INU-100 web-interface allows stored Cross-Site Scripting (XSS)..This issue affects utnserver Pro, utnserver ProMAX, INU-100 version 20.1.22 and below.",2024-06-04,Nuclei,,,
CVE-2024-5421,0.0,,0.03692,CWE-78,"Missing input validation and OS command integration of the input in the utnserver Pro, utnserver ProMAX, INU-100 web-interface allows authenticated command injection.This issue affects utnserver Pro, utnserver ProMAX, INU-100 version 20.1.22 and below.",2024-06-04,Nuclei,,,
CVE-2024-54330,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.01461,CWE-918,Server-Side Request Forgery (SSRF) vulnerability in hurraki Hurrakify hurrakify allows Server Side Request Forgery.This issue affects Hurrakify: from n/a through <= 2.4.,2024-12-13,Nuclei,,,
CVE-2024-54385,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.05213,CWE-918,Server-Side Request Forgery (SSRF) vulnerability in princeahmed Radio Player radio-player allows Server Side Request Forgery.This issue affects Radio Player: from n/a through <= 2.0.83.,2024-12-16,Nuclei,,,
CVE-2024-54763,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.00759,Missing_Data,An access control issue in the component /login/hostinfo.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information without authentication.,2025-01-06,Nuclei,,,
CVE-2024-54764,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.01024,Missing_Data,An access control issue in the component /login/hostinfo2.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information without authentication.,2025-01-06,Nuclei,,,
CVE-2024-54767,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01787,CWE-203,"An access control issue in the component /juis_boxinfo.xml of AVM FRITZ!Box 7530 AX v7.59 allows attackers to obtain sensitive information without authentication. NOTE: this is disputed by the Supplier because it cannot be reproduced, and the issue report focuses on an unintended configuration with direct Internet exposure.",2025-01-06,Nuclei,,,
CVE-2024-5483,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01008,CWE-200,"The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.8 due to incorrect implementation of get_items_permissions_check function. This makes it possible for unauthenticated attackers to extract basic information about website users, including their emails",2024-06-05,Nuclei,cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:*,Thimpress,Learnpress
CVE-2024-5488,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03744,CWE-502,"The SEOPress  WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.",2024-07-09,Nuclei,cpe:2.3:a:seopress:seopress:*:*:*:*:*:wordpress:*:*,Seopress,Seopress
CVE-2024-55218,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00685,CWE-79,IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting (XSS) via the meta parameter.,2025-01-07,Nuclei,cpe:2.3:a:icewarp:icewarp:10.2.1:*:*:*:*:*:*:*,Icewarp,Icewarp
CVE-2024-5522,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.02618,CWE-89,"The HTML5 Video Player  WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks",2024-06-20,Nuclei,cpe:2.3:a:bplugins:html5_video_player:*:*:*:*:*:wordpress:*:*,Bplugins,Html5 Video Player
CVE-2024-55415,5.7,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N,0.15666,CWE-22,DevDojo Voyager through 1.8.0 is vulnerable to path traversal at the /admin/compass.,2025-01-30,Nuclei,cpe:2.3:a:thecontrolgroup:voyager:*:*:*:*:*:laravel:*:*,Thecontrolgroup,Voyager
CVE-2024-55416,3.5,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N,0.24095,CWE-79,"DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed.",2025-01-30,Nuclei,cpe:2.3:a:thecontrolgroup:voyager:*:*:*:*:*:laravel:*:*,Thecontrolgroup,Voyager
CVE-2024-55417,4.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N,0.13218,CWE-434,DevDojo Voyager through version 1.8.0 is vulnerable to bypassing the file type verification when an authenticated user uploads a file via /admin/media/upload. An authenticated user can upload a web shell causing arbitrary code execution on the server.,2025-01-30,Nuclei,cpe:2.3:a:thecontrolgroup:voyager:*:*:*:*:*:laravel:*:*,Thecontrolgroup,Voyager
CVE-2024-55457,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.03007,CWE-22,"MasterSAM Star Gate 11 is vulnerable to directory traversal via /adama/adama/downloadService. An attacker can exploit this vulnerability by manipulating the file parameter to access arbitrary files on the server, potentially exposing sensitive information.",2025-02-20,Nuclei,,,
CVE-2024-55550,2.7,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N,0.38104,CWE-22,"Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information. This vulnerability does not allow file modification or privilege escalation.",2024-12-10,CISA/Nuclei,cpe:2.3:a:mitel:micollab:*:*:*:*:*:-:*:*,Mitel,Micollab
CVE-2024-55555,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.06611,CWE-502,"Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APP_KEY. This is exacerbated by .env files, available from the product's repository, that have default APP_KEY values. The route/{hash} route defined in the invoiceninja/routes/client.php file can be accessed without authentication. The parameter {hash} is passed to the function decrypt that expects a Laravel ciphered value containing a serialized object. (Furthermore, Laravel contains several gadget chains usable to trigger remote command execution from arbitrary deserialization.) Therefore, an attacker in possession of the APP_KEY is able to fully control a string passed to an unserialize function.",2025-01-07,Metasploit,,,
CVE-2024-55556,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.44126,CWE-502,"A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on the server by manipulating the laravel_session cookie, exploiting arbitrary deserialization through the encrypted session data. The exploitation vector of this vulnerability relies on an attacker obtaining Laravel's secret APP_KEY, which would allow them to decrypt and manipulate session cookies (laravel_session) containing serialized data. By altering this data and re-encrypting it with the APP_KEY, the attacker could trigger arbitrary deserialization on the server, potentially leading to remote command execution (RCE). The vulnerability is primarily exploited by accessing an exposed cookie and manipulating it using the secret key to gain malicious access to the server.",2025-01-07,Metasploit,,,
CVE-2024-55591,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98259,CWE-288,An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.,2025-01-14,CISA/EPSS/Nuclei,cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*,Fortinet,Fortios
CVE-2024-55956,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.93804,CWE-77,"In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.",2024-12-13,CISA/Metasploit/Nuclei,cpe:2.3:a:cleo:harmony:*:*:*:*:*:*:*:*;cpe:2.3:a:cleo:lexicom:*:*:*:*:*:*:*:*;cpe:2.3:a:cleo:vltrader:*:*:*:*:*:*:*:*,Cleo,Harmony
CVE-2024-55964,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06268,CWE-94,"An issue was discovered in Appsmith before 1.52. An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside the Appsmith Docker container. The attacker must be able to access Appsmith, login to it, create a datasource, create a query against that datasource, and execute that query.",2025-03-26,Metasploit,cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:*,Appsmith,Appsmith
CVE-2024-56145,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.97446,CWE-94,"Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable `register_argc_argv` to mitigate the issue.",2024-12-18,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*,Craftcms,Craft Cms
CVE-2024-56159,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01494,CWE-219,"Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to read parts of the server source code. During build, along with client assets such as css and font files, the sourcemap files **for the server code** are moved to a publicly-accessible folder. Any outside party can read them with an unauthorized HTTP GET request to the same server hosting the rest of the website. While some server files are hashed, making their access obscure, the files corresponding to the file system router (those in `src/pages`) are predictably named. For example. the sourcemap file for `src/pages/index.astro` gets named `dist/client/pages/index.astro.mjs.map`. This vulnerability is the root cause of issue #12703, which links to a simple stackblitz project demonstrating the vulnerability. Upon build, notice the contents of the `dist/client` (referred to as `config.build.client` in astro code) folder. All astro servers make the folder in question accessible to the public internet without any authentication. It contains `.map` files corresponding to the code that runs on the server. All **server-output** projects on Astro 5 versions **v5.0.3** through **v5.0.7**, that have **sourcemaps enabled**, either directly or through an add-on such as `sentry`, are affected. The fix for **server-output** projects was released in **astro@5.0.8**. Additionally, all **static-output** projects built using Astro 4 versions **4.16.17 or older**, or Astro 5 versions **5.0.8 or older**, that have **sourcemaps enabled** are also affected. The fix for **static-output** projects was released in **astro@5.0.9**, and backported to Astro v4 in **astro@4.16.18**. The immediate impact is limited to source code. Any secrets or environment variables are not exposed unless they are present verbatim in the source code. There is no immediate loss of integrity within the the vulnerable server. However, it is possible to subsequently discover another vulnerability via the revealed source code . There is no immediate impact to availability of the vulnerable server. However, the presence of an unsafe regular expression, for example, can quickly be exploited to subsequently compromise the availability. The fix for **server-output** projects was released in **astro@5.0.8**, and the fix for **static-output** projects was released in **astro@5.0.9** and backported to Astro v4 in **astro@4.16.18**. Users are advised to update immediately if they are using sourcemaps or an integration that enables sourcemaps.",2024-12-19,Nuclei,cpe:2.3:a:astro:astro:*:*:*:*:*:node.js:*:*,Astro,Astro
CVE-2024-56325,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.78668,CWE-288,"Authentication Bypass Issue

If the path does not contain / and contain., authentication is not required.

Expected Normal Request and Response Example

curl -X POST -H ""Content-Type: application/json"" -d {\""username\"":\""hack2\"",\""password\"":\""hack\"",\""component\"":\""CONTROLLER\"",\""role\"":\""ADMIN\"",\""tables\"":[],\""permissions\"":[],\""usernameWithComponent\"":\""hack_CONTROLLER\""}  http://{server_ip}:9000/users 


Return: {""code"":401,""error"":""HTTP 401 Unauthorized""}


Malicious Request and Response Example 

curl -X POST -H ""Content-Type: application/json"" -d '{\""username\"":\""hack\"",\""password\"":\""hack\"",\""component\"":\""CONTROLLER\"",\""role\"":\""ADMIN\"",\""tables\"":[],\""permissions\"":[],\""usernameWithComponent\"":\""hack_CONTROLLER\""}'  http://{serverip}:9000/users; http://{serverip}:9000/users; .


Return: {""users"":{}}



 

A new user gets added bypassing authentication, enabling the user to control Pinot.",2025-04-01,Nuclei,cpe:2.3:a:apache:pinot:*:*:*:*:*:*:*:*,Apache,Pinot
CVE-2024-56511,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.20883,CWE-289,"DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be bypassed and cause the risk of unauthorized access. In the io.dataease.auth.filter.TokenFilter class, ”request.getRequestURI“ is used to obtain the request URL, and it is passed to the ""WhitelistUtils.match"" method to determine whether the URL request is an interface that does not require authentication. The ""match"" method filters semicolons, but this is not enough. When users set ""server.servlet.context-path"" when deploying products, there is still a risk of being bypassed, which can be bypassed by any whitelist prefix /geo/../context-path/. The vulnerability has been fixed in v2.10.4.",2025-01-10,Nuclei,cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*,Dataease,Dataease
CVE-2024-56512,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N,0.03156,CWE-638,"Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups.

Creating a new Process Group can include binding to a Parameter Context, but in cases where the Process Group did not reference any Parameter values, the framework did not check user authorization for the bound Parameter Context. Missing authorization for a bound Parameter Context enabled clients to download non-sensitive Parameter values after creating the Process Group.

Creating a new Process Group can also include referencing existing Controller Services or Parameter Providers. The framework did not check user authorization for referenced Controller Services or Parameter Providers, enabling clients to create Process Groups and use these components that were otherwise unauthorized.

This vulnerability is limited in scope to authenticated users authorized to create Process Groups. The scope is further limited to deployments with component-based authorization policies. Upgrading to Apache NiFi 2.1.0 is the recommended mitigation, which includes authorization checking for Parameter and Controller Service references on Process Group creation.",2024-12-28,Nuclei,cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*,Apache,Nifi
CVE-2024-57045,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.31974,CWE-287,A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals to bypass the authentication. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page.,2025-02-18,Nuclei,cpe:2.3:h:dlink:dir-859_a3:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-859_a3_firmware:*:*:*:*:*:*:*:*,D-Link,Dir-859 A3 Firmware
CVE-2024-57046,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02084,CWE-287,"A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier permits unauthorized individuals to bypass the authentication. When adding ""?x=1.gif"" to the the requested url, it will be recognized as passing the authentication.",2025-02-18,Nuclei,cpe:2.3:h:netgear:dgn2200:-:*:*:*:*:*:*:*;cpe:2.3:o:netgear:dgn2200_firmware:*:*:*:*:*:*:*:*,Netgear,Dgn2200 Firmware
CVE-2024-5721,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0583,CWE-306,"Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the cluster HTTP API, which listens on TCP port 1924 when enabled. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24169.",2024-11-22,Metasploit,cpe:2.3:a:logsign:unified_secops_platform:*:*:*:*:*:*:*:*,Logsign,Unified Secops Platform
CVE-2024-57241,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.01125,CWE-601,"Dedecms 5.71sp1 and earlier is vulnerable to URL redirect. In the web application, a logic error does not judge the input GET request resulting in URL redirection.",2025-02-11,Nuclei,cpe:2.3:a:dedecms:dedecms:-:*:*:*:*:*:*:*,Dedecms,Dedecms
CVE-2024-57487,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.02466,CWE-94,"In Code-Projects Online Car Rental System 1.0, the file upload feature does not validate file extensions or MIME types allowing an attacker to upload a PHP shell without any restrictions and execute commands on the server.",2025-01-13,Metasploit,cpe:2.3:a:code-projects:online_car_rental_system:1.0:*:*:*:*:*:*:*,Code-Projects,Online Car Rental System
CVE-2024-57514,4.8,CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.00875,CWE-79,"The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting (XSS) due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL. This allows the attacker to inject malicious code into the page, executing JavaScript on the victim's browser, which could then be used for further malicious actions. The vulnerability was identified in the 1.0.6 Build 20231011 rel.85717(5553) version.",2025-01-28,Nuclei,,,
CVE-2024-5765,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.27434,CWE-89,"The WpStickyBar  WordPress plugin through 2.1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection",2024-07-30,Nuclei,cpe:2.3:a:a17lab:wpstickybar:*:*:*:*:*:wordpress:*:*,A17Lab,Wpstickybar
CVE-2024-57726,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.08632,NVD-CWE-noinfo,SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.,2025-01-15,CISA,cpe:2.3:a:simple-help:simplehelp:*:*:*:*:*:*:*:*,Simple-Help,Simplehelp
CVE-2024-57727,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.95151,CWE-22,SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.,2025-01-15,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:simple-help:simplehelp:*:*:*:*:*:*:*:*,Simple-Help,Simplehelp
CVE-2024-57728,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.06982,CWE-59,SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.,2025-01-15,CISA,cpe:2.3:a:simple-help:simplehelp:*:*:*:*:*:*:*:*,Simple-Help,Simplehelp
CVE-2024-57968,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.32514,CWE-434,"Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsing by other users). upload.aspx can be used for this.",2025-02-03,CISA,cpe:2.3:a:advantive:veracore:*:*:*:*:*:*:*:*,Advantive,Veracore
CVE-2024-5806,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.81474,CWE-287,"Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2.",2024-06-25,Metasploit,cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*;cpe:2.3:a:progress:moveit_transfer:2024.0.0:*:*:*:*:*:*:*,Progress,Moveit Transfer
CVE-2024-58136,9.0,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H,0.84758,CWE-424,"Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.",2025-04-10,CISA/Nuclei,cpe:2.3:a:yiiframework:yii:*:*:*:*:*:*:*:*,Yiiframework,Yii
CVE-2024-5827,0.0,,0.03452,CWE-89,"Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents `<?php system($_GET[0]); ?>`. This can lead to command execution or the creation of backdoors.",2024-06-28,Nuclei,,,
CVE-2024-5910,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.91783,CWE-306,"Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition.

Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.",2024-07-10,CISA/Metasploit/Nuclei,cpe:2.3:a:paloaltonetworks:expedition:*:*:*:*:*:*:*:*,Paloaltonetworks,Expedition
CVE-2024-5932,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.74283,CWE-502,"The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.",2024-08-20,Metasploit/Nuclei,cpe:2.3:a:givewp:givewp:*:*:*:*:*:wordpress:*:*,Givewp,Givewp
CVE-2024-5936,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.28925,CWE-601,"An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization. The impact of this vulnerability includes potential phishing attacks, malware distribution, and credential theft.",2024-06-27,Nuclei,cpe:2.3:a:pribai:privategpt:0.5.0:*:*:*:*:*:*:*,Pribai,Privategpt
CVE-2024-5947,6.5,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02418,CWE-306,"Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the web-based UI. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-22679.",2024-06-13,Nuclei,cpe:2.3:h:deepseaelectronics:dse855:-:*:*:*:*:*:*:*;cpe:2.3:o:deepseaelectronics:dse855_firmware:1.1.0:*:*:*:*:*:*:*,Deepseaelectronics,Dse855 Firmware
CVE-2024-5975,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.01958,CWE-89,"The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection",2024-07-30,Nuclei,cpe:2.3:a:contrive:cz_loan_management:*:*:*:*:*:wordpress:*:*,Contrive,Cz Loan Management
CVE-2024-6028,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.11755,CWE-89,"The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the 'ays_questions' parameter in all versions up to, and including, 6.5.8.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2024-06-25,Nuclei,cpe:2.3:a:ays-pro:quiz_maker:*:*:*:*:*:wordpress:*:*,Ays-Pro,Quiz Maker
CVE-2024-6047,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.10072,CWE-78,Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device.,2024-06-17,CISA,cpe:2.3:h:geovision:gv-bx130:-:*:*:*:*:*:*:*;cpe:2.3:h:geovision:gv-bx1500:-:*:*:*:*:*:*:*;cpe:2.3:h:geovision:gv-cb220:-:*:*:*:*:*:*:*;cpe:2.3:h:geovision:gv-dsp_lpr:2.0:*:*:*:*:*:*:*;cpe:2.3:h:geovision:gv-ebl1100:-:*:*:*:*:*:*:*;cpe:2.3:h:geovision:gv-efd1100:-:*:*:*:*:*:*:*;cpe:2.3:h:geovision:gv-fd2410:-:*:*:*:*:*:*:*;cpe:2.3:h:geovision:gv-fd3400:-:*:*:*:*:*:*:*;cpe:2.3:h:geovision:gv-fe3401:-:*:*:*:*:*:*:*;cpe:2.3:h:geovision:gv-fe420:-:*:*:*:*:*:*:*;cpe:2.3:h:geovision:gv-gm8186_vs14:-:*:*:*:*:*:*:*;cpe:2.3:h:geovision:gv-vs03:-:*:*:*:*:*:*:*;cpe:2.3:h:geovision:gv-vs04a:-:*:*:*:*:*:*:*;cpe:2.3:h:geovision:gv-vs04h:-:*:*:*:*:*:*:*;cpe:2.3:h:geovision:gv-vs14:-:*:*:*:*:*:*:*;cpe:2.3:h:geovision:gv-vs21600:-:*:*:*:*:*:*:*;cpe:2.3:h:geovision:gv-vs2410:-:*:*:*:*:*:*:*;cpe:2.3:h:geovision:gv-vs2800:-:*:*:*:*:*:*:*;cpe:2.3:h:geovision:gv-vs2820:-:*:*:*:*:*:*:*;cpe:2.3:h:geovision:gvlx_4:2.0:*:*:*:*:*:*:*;cpe:2.3:h:geovision:gvlx_4:3.0:*:*:*:*:*:*:*;cpe:2.3:o:geovision:gv-bx130_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:geovision:gv-bx1500_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:geovision:gv-cb220_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:geovision:gv-dsp_lpr_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:geovision:gv-ebl1100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:geovision:gv-efd1100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:geovision:gv-fd2410_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:geovision:gv-fd3400_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:geovision:gv-fe3401_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:geovision:gv-fe420_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:geovision:gv-gm8186_vs14_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:geovision:gv-vs03_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:geovision:gv-vs04a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:geovision:gv-vs04h_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:geovision:gv-vs14_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:geovision:gv-vs21600_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:geovision:gv-vs2410_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:geovision:gv-vs2800_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:geovision:gv-vs2820_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:geovision:gvlx_4_firmware:-:*:*:*:*:*:*:*,Geovision,Gv-Dsp Lpr Firmware
CVE-2024-6049,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04325,CWE-32,"The web server of Lawo AG vsm LTC Time Sync (vTimeSync) is affected by a ""..."" (triple dot) path traversal vulnerability. By sending a specially crafted HTTP request, an unauthenticated remote attacker could download arbitrary files from the operating system. As a limitation, the exploitation is only possible if the requested file has some file extension, e. g. .exe or .txt.",2024-10-24,Nuclei,,,
CVE-2024-6095,5.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N,0.02475,CWE-918,"A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery (SSRF) and partial Local File Inclusion (LFI). The endpoint supports both http(s):// and file:// schemes, where the latter can lead to LFI. However, the output is limited due to the length of the error message. This vulnerability can be exploited by an attacker with network access to the LocalAI instance, potentially allowing unauthorized access to internal HTTP(s) servers and partial reading of local files. The issue is fixed in version 2.17.",2024-07-06,Nuclei,cpe:2.3:a:mudler:localai:*:*:*:*:*:*:*:*,Mudler,Localai
CVE-2024-6127,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.10263,CWE-22,"BC Security Empire before 5.9.3 is vulnerable to a path traversal issue that can lead to remote code execution. A remote, unauthenticated attacker can exploit this vulnerability over HTTP by acting as a normal agent, completing all cryptographic handshakes, and then triggering an upload of payload data containing a malicious path.",2024-06-27,Metasploit,,,
CVE-2024-6159,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02491,CWE-89,"The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection",2025-05-15,Nuclei,cpe:2.3:a:pnfpb:push_notification_for_post_and_buddypress:*:*:*:*:*:wordpress:*:*,Pnfpb,Push Notification For Post And Buddypress
CVE-2024-6188,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.02053,CWE-425,A vulnerability was found in Parsec Automation TrackSYS 11.x.x and classified as problematic. This issue affects some unknown processing of the file /TS/export/pagedefinition. The manipulation of the argument ID leads to direct request. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269159. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2024-06-20,Nuclei,,,
CVE-2024-6205,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04168,CWE-89,"The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated users, leading to an SQL injection vulnerability.",2024-07-19,Nuclei,cpe:2.3:a:payplus:payplus_payment_gateway:*:*:*:*:*:wordpress:*:*,Payplus,Payplus Payment Gateway
CVE-2024-6220,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.35708,CWE-434,"The 简数采集器 (Keydatas) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the keydatas_downloadImages function in all versions up to, and including, 2.5.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.",2024-07-17,Nuclei,cpe:2.3:a:keydatas:keydatas:*:*:*:*:*:wordpress:*:*,Keydatas,Keydatas
CVE-2024-6235,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.21331,CWE-287,Sensitive information disclosure in NetScaler Console,2024-07-10,Nuclei,cpe:2.3:a:citrix:netscaler_console:*:*:*:*:*:*:*:*,Citrix,Netscaler Console
CVE-2024-6250,0.0,,0.01957,CWE-36,"An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the `open_file` endpoint of `lollms_advanced.py`. The `sanitize_path` function with `allow_absolute_path=True` allows an attacker to access arbitrary files and directories on a Windows system. This vulnerability can be exploited to read any file and list arbitrary directories on the affected system.",2024-06-27,Nuclei,cpe:2.3:a:lollms:lollms_web_ui:9.6:*:*:*:*:*:*:*,Lollms,Lollms Web Ui
CVE-2024-6265,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.024,CWE-89,"The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uwp_sort_by’ parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2024-06-29,Nuclei,cpe:2.3:a:ayecode:userswp:*:*:*:*:*:wordpress:*:*,Ayecode,Userswp
CVE-2024-6289,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00904,CWE-601,"The WPS Hide Login WordPress plugin before 1.9.16.4 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.",2024-07-15,Nuclei,cpe:2.3:a:wpserveur:wps_hide_login:*:*:*:*:*:wordpress:*:*,Wpserveur,Wps Hide Login
CVE-2024-6366,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.28993,CWE-434,"The User Profile Builder  WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP.",2024-07-29,Nuclei,cpe:2.3:a:cozmoslabs:profile_builder:*:*:*:*:*:wordpress:*:*,Cozmoslabs,Profile Builder
CVE-2024-6387,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99506,CWE-364,"A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.",2024-07-01,EPSS,cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*;cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:*;cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*;cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:*;cpe:2.3:a:netapp:ontap_tools:9:*:*:*:*:vmware_vsphere:*:*;cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*;cpe:2.3:a:openbsd:openssh:4.4:-:*:*:*:*:*:*;cpe:2.3:a:openbsd:openssh:8.5:p1:*:*:*:*:*:*;cpe:2.3:a:openbsd:openssh:8.6:-:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*;cpe:2.3:h:netapp:500f:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:8300:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:8700:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:a150:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:a1k:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:a220:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:a250:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:a400:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:a700s:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:a70:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:a800:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:a900:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:a90:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:a9500:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:c190:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:c250:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:c400:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:c800:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:fas2720:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:fas2750:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:fas2820:-:*:*:*:*:*:*:*;cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_6200:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_6210:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_7200:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_7210:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma_8200v:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sra_ex_7000:-:*:*:*:*:*:*:*;cpe:2.3:o:almalinux:almalinux:9.0:-:*:*:*:*:*:*;cpe:2.3:o:amazon:amazon_linux:2023.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:22.10:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:23.10:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:*;cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:13.2:-:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:13.2:p10:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:13.2:p11:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:13.2:p1:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:13.2:p2:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:13.2:p3:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:13.2:p4:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:13.2:p5:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:13.2:p6:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:13.2:p7:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:13.2:p8:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:13.2:p9:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:13.3:-:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:13.3:p1:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:13.3:p2:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:13.3:p3:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:14.0:-:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:14.0:beta5:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:14.0:p1:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:14.0:p2:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:14.0:p3:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:14.0:p4:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:14.0:p5:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:14.0:p6:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:14.0:p7:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:14.0:rc3:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:14.0:rc4-p1:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:14.1:-:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:14.1:p1:*:*:*:*:*:*;cpe:2.3:o:netapp:500f_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:8300_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:8700_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:a150_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:a1k_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:a220_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:a400_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:a70_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:a800_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:a900_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:a90_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:a9500_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:c190_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:c250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:c400_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:c800_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:fas2720_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:fas2750_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netapp:fas2820_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:netbsd:netbsd:*:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_6200_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_6210_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_7200_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_7210_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma_8200v_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sra_ex_7000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_micro:6.0:*:*:*:*:*:*:*,Sonicwall,Sma 6200 Firmware
CVE-2024-6396,0.0,,0.53113,CWE-29,"A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the `run_hash` and `repo.path` parameters, which can be manipulated to create and write to arbitrary file paths. This can lead to denial of service by overwriting critical system files, loss of private data, and potential remote code execution. ",2024-07-12,Nuclei,cpe:2.3:a:aimstack:aim:3.19.3:*:*:*:*:python:*:*,Aimstack,Aim
CVE-2024-6420,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L,0.018,NVD-CWE-noinfo,"The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.",2024-07-23,Nuclei,cpe:2.3:a:wpplugins:hide_my_wp_ghost:*:*:*:*:*:wordpress:*:*,Wpplugins,Hide My Wp Ghost
CVE-2024-6460,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04826,NVD-CWE-Other,"The Grow by Tradedoubler  WordPress plugin through 2.0.21 is vulnerable to Local File Inclusion via the component parameter. This makes it possible for attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files.",2024-08-16,Nuclei,cpe:2.3:a:tradedoubler:grow:*:*:*:*:*:wordpress:*:*,Tradedoubler,Grow
CVE-2024-6517,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00665,CWE-79,"The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users.",2024-09-26,Nuclei,cpe:2.3:a:dotsquares:contact_form_7_math_captcha:*:*:*:*:*:wordpress:*:*,Dotsquares,Contact Form 7 Math Captcha
CVE-2024-6555,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00927,CWE-200,"The WP Popups – WordPress Popup builder plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.2.0.1. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.",2024-07-12,Nuclei,,,
CVE-2024-6569,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00849,CWE-200,"The Campaign Monitor for WordPress plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.8.15. This is due the plugin not properly restricting direct access to /forms/views/admin/create.php and display_errors being enabled. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.",2024-07-27,Nuclei,,,
CVE-2024-6586,7.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N,0.01786,CWE-201,"Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user’s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover.",2024-08-30,Nuclei,,,
CVE-2024-6587,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.37197,CWE-918,"A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows users to specify the `api_base` parameter when making requests to `POST /chat/completions`, causing the application to send the request to the domain specified by `api_base`. This request includes the OpenAI API key. A malicious user can set the `api_base` to their own domain and intercept the OpenAI API key, leading to unauthorized access and potential misuse of the API key.",2024-09-13,Nuclei,cpe:2.3:a:litellm:litellm:1.38.10:*:*:*:*:*:*:*,Litellm,Litellm
CVE-2024-6646,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.45681,CWE-200,A vulnerability was found in Netgear WN604 up to 20240710. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /downloadFile.php of the component Web Interface. The manipulation of the argument file with the input config leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271052. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2024-07-10,Nuclei,,,
CVE-2024-6651,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.15012,CWE-79,"The WordPress File Upload WordPress plugin before 4.24.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",2024-08-06,Nuclei,cpe:2.3:a:iptanus:wordpress_file_upload:*:*:*:*:*:wordpress:*:*,Iptanus,Wordpress File Upload
CVE-2024-6670,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.94661,CWE-89,"In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.",2024-08-29,CISA/Metasploit/Nuclei,cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*,Progress,Whatsup Gold
CVE-2024-6671,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.14886,CWE-89,"In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.",2024-08-29,Nuclei,cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*,Progress,Whatsup Gold
CVE-2024-6690,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00473,CWE-601,"The wccp-pro WordPress plugin before 15.3 contains an open-redirect flaw via the referrer parameter, allowing redirection of users to external sites",2025-05-15,Nuclei,cpe:2.3:a:wp-buy:wp_content_copy_protection_\&_no_right_click:*:*:*:*:pro:wordpress:*:*,Wp-Buy,Wp Content Copy Protection & No Right Click
CVE-2024-6746,4.3,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.03333,CWE-24,"A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown functionality of the file \EasySpider\resources\app\server.js of the component HTTP GET Request Handler. The manipulation with the input /../../../../../../../../../Windows/win.ini leads to path traversal: '../filedir'. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. The identifier VDB-271477 was assigned to this vulnerability. NOTE: The code maintainer explains, that this is not a big issue ""because the default is that the software runs locally without going through the Internet"".",2024-07-15,Nuclei,cpe:2.3:a:easyspider:easyspider:0.6.2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2024-6753,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.00829,CWE-79,"The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mapTypes’ parameter in the 'wpw_auto_poster_map_wordpress_post_type' AJAX function in all versions up to, and including, 5.3.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",2024-07-24,Nuclei,cpe:2.3:a:wpwebinfotech:social_auto_poster:*:*:*:*:*:wordpress:*:*,Wpwebinfotech,Social Auto Poster
CVE-2024-6781,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.62696,CWE-22,Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read.,2024-08-06,Nuclei,cpe:2.3:a:calibre-ebook:calibre:*:*:*:*:*:*:*:*,Calibre-Ebook,Calibre
CVE-2024-6782,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.83393,CWE-863,Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution.,2024-08-06,Metasploit/Nuclei,,,
CVE-2024-6842,0.0,,0.29187,CWE-306,"In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings. The data returned by the `currentSettings` function includes sensitive information such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets.",2025-03-20,Nuclei,cpe:2.3:a:mintplexlabs:anythingllm:1.5.5:*:*:*:*:*:*:*,Mintplexlabs,Anythingllm
CVE-2024-6845,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01113,CWE-862,"The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrieve the encoded key and then decode it, thereby leaking the OpenAI API key",2024-09-25,Nuclei,cpe:2.3:a:webdigit:chatbot_with_chatgpt:*:*:*:*:*:wordpress:*:*,Webdigit,Chatbot With Chatgpt
CVE-2024-6846,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.01263,NVD-CWE-noinfo,"The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs",2024-09-05,Nuclei,cpe:2.3:a:webdigit:chatbot_with_chatgpt:*:*:*:*:*:wordpress:*:*,Webdigit,Chatbot With Chatgpt
CVE-2024-6886,0.0,,0.32936,CWE-79,Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.,2024-08-06,Nuclei,,,
CVE-2024-6892,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00756,CWE-81,Attackers can craft a malicious link that once clicked will execute arbitrary JavaScript in the context of the Journyx web application.,2024-08-08,Nuclei,cpe:2.3:a:journyx:journyx:11.5.4:*:*:*:*:*:*:*,Journyx,Journyx
CVE-2024-6893,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.32916,CWE-611,"The ""soap_cgi.pyc"" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources.",2024-08-08,Nuclei,cpe:2.3:a:journyx:journyx:11.5.4:*:*:*:*:linux:*:*,Journyx,Journyx
CVE-2024-6911,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04944,CWE-552,Files on the Windows system are accessible without authentication to external parties due to a local file inclusion in PerkinElmer ProcessPlus.This issue affects ProcessPlus: through 1.11.6507.0.,2024-07-22,Nuclei,cpe:2.3:a:perkinelmer:processplus:*:*:*:*:*:*:*:*,Perkinelmer,Processplus
CVE-2024-6922,0.0,,0.30172,CWE-918,Automation Anywhere Automation 360 v21-v32 is vulnerable to Server-Side Request Forgery in a web API component. An attacker with unauthenticated access to the Automation 360 Control Room HTTPS service (port 443) or HTTP service (port 80) can trigger arbitrary web requests from the server.,2024-07-26,Nuclei,,,
CVE-2024-6924,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03292,CWE-89,"The TrueBooker  WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.",2024-09-08,Nuclei,cpe:2.3:a:themetechmount:truebooker:*:*:*:*:*:wordpress:*:*,Themetechmount,Truebooker
CVE-2024-6926,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03292,CWE-89,"The Viral Signup  WordPress plugin through 2.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection",2024-09-04,Nuclei,cpe:2.3:a:wow-company:viral_signup:*:*:*:*:*:wordpress:*:*,Wow-Company,Viral Signup
CVE-2024-6928,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03292,CWE-89,"The Opti Marketing WordPress plugin through 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.",2024-09-08,Nuclei,cpe:2.3:a:opti.marketing:opti_marketing:*:*:*:*:*:wordpress:*:*,Opti.Marketing,Opti Marketing
CVE-2024-7008,5.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N,0.25607,CWE-79,Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting.,2024-08-06,Nuclei,cpe:2.3:a:calibre-ebook:calibre:*:*:*:*:*:*:*:*,Calibre-Ebook,Calibre
CVE-2024-7029,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.38998,CWE-77,Commands can be injected over the network and executed without authentication.,2024-08-02,Nuclei,cpe:2.3:h:avtech:avm1203:-:*:*:*:*:*:*:*;cpe:2.3:o:avtech:avm1203_firmware:*:*:*:*:*:*:*:*,Avtech,Avm1203 Firmware
CVE-2024-7097,4.3,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.00606,CWE-863,"An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration settings. This vulnerability enables malicious actors to create new user accounts without proper authorization.

Exploitation of this flaw could allow an attacker to create multiple low-privileged user accounts, gaining unauthorized access to the system. Additionally, continuous exploitation could lead to system resource exhaustion through mass user creation.",2025-05-30,Nuclei,cpe:2.3:a:wso2:api_manager:2.1.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:2.2.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:2.5.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:2.6.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:3.0.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:5.2.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:5.3.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:5.4.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:5.4.1:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:5.5.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:5.6.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:5.7.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:5.8.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:5.9.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:6.1.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_as_key_manager:5.3.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_as_key_manager:5.5.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_as_key_manager:5.6.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_as_key_manager:5.7.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_as_key_manager:5.9.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:open_banking_km:1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:open_banking_km:1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:open_banking_km:1.5.0:*:*:*:*:*:*:*,Wso2,Api Manager
CVE-2024-7120,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.934,CWE-78,"A vulnerability, which was classified as critical, was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. This affects an unknown part of the file list_base_config.php of the component Web Interface. The manipulation of the argument template leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272451.",2024-07-26,Nuclei,cpe:2.3:h:raisecom:msg1200:-:*:*:*:*:*:*:*;cpe:2.3:h:raisecom:msg2100e:-:*:*:*:*:*:*:*;cpe:2.3:h:raisecom:msg2200:-:*:*:*:*:*:*:*;cpe:2.3:h:raisecom:msg2300:-:*:*:*:*:*:*:*;cpe:2.3:o:raisecom:msg1200_firmware:3.90:*:*:*:*:*:*:*;cpe:2.3:o:raisecom:msg2100e_firmware:3.90:*:*:*:*:*:*:*;cpe:2.3:o:raisecom:msg2200_firmware:3.90:*:*:*:*:*:*:*;cpe:2.3:o:raisecom:msg2300_firmware:3.90:*:*:*:*:*:*:*,Raisecom,Msg2300 Firmware
CVE-2024-7188,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.07016,CWE-89,A vulnerability was found in Bylancer Quicklancer 2.4. It has been rated as critical. This issue affects some unknown processing of the file /listing of the component GET Parameter Handler. The manipulation of the argument range2 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272609 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2024-07-29,Nuclei,cpe:2.3:a:bylancer:quicklancer:2.4:*:*:*:*:*:*:*,Bylancer,Quicklancer
CVE-2024-7262,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.01773,CWE-22,"Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library.
The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document",2024-08-15,CISA,cpe:2.3:a:kingsoft:wps_office:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2024-7313,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01444,CWE-79,"The Shield Security  WordPress plugin before 20.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2024-08-26,Nuclei,cpe:2.3:a:getshieldsecurity:shield_security:*:*:*:*:*:wordpress:*:*,Getshieldsecurity,Shield Security
CVE-2024-7314,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.51468,CWE-288,"anji-plus AJ-Report is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append "";swagger-ui"" to HTTP requests to bypass authentication and execute arbitrary Java on the victim server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.",2024-08-02,Nuclei,cpe:2.3:a:anji-plus:report:*:*:*:*:*:*:*:*,Anji-Plus,Report
CVE-2024-7332,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.20737,CWE-259,A vulnerability was found in TOTOLINK CP450 4.1.0cu.747_B20191224. It has been classified as critical. This affects an unknown part of the file /web_cste/cgi-bin/product.ini of the component Telnet Service. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273255. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.,2024-08-01,Nuclei,cpe:2.3:h:totolink:cp450:-:*:*:*:*:*:*:*;cpe:2.3:o:totolink:cp450_firmware:4.1.0cu.747_b20191224:*:*:*:*:*:*:*,Totolink,Cp450 Firmware
CVE-2024-7339,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.32028,CWE-200,"A vulnerability has been found in TVT DVR TD-2104TS-CL, DVR TD-2108TS-HP, Provision-ISR DVR SH-4050A5-5L(MM) and AVISION DVR AV108T and classified as problematic. This vulnerability affects unknown code of the file /queryDevInfo. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-273262 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",2024-08-01,Nuclei,cpe:2.3:h:provision-isr:sh-4050a5-5l\(mm\):-:*:*:*:*:*:*:*;cpe:2.3:h:tvt:avision_av108t:-:*:*:*:*:*:*:*;cpe:2.3:h:tvt:td-2104ts-cl:-:*:*:*:*:*:*:*;cpe:2.3:h:tvt:td-2108ts-hp:-:*:*:*:*:*:*:*;cpe:2.3:o:provision-isr:sh-4050a5-5l\(mm\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:provision-isr:sh-4050a5-5l\(mm\)_firmware:1.3.3.20657b180918.d06.u2\(4a41t\):*:*:*:*:*:*:*;cpe:2.3:o:provision-isr:sh-4050a5-5l\(mm\)_firmware:1.3.4.22966b181219.d00.u1\(4a21s\):*:*:*:*:*:*:*;cpe:2.3:o:provision-isr:sh-4050a5-5l\(mm\)_firmware:1.3.4.22966b181219.d14.u1\(8a41t\):*:*:*:*:*:*:*;cpe:2.3:o:provision-isr:sh-4050a5-5l\(mm\)_firmware:1.3.4.22966b181219.d44.u1\(16a82t\):*:*:*:*:*:*:*;cpe:2.3:o:provision-isr:sh-4050a5-5l\(mm\)_firmware:1.3.4.24513b190218.d00.u1\(8a21s\):*:*:*:*:*:*:*;cpe:2.3:o:provision-isr:sh-4050a5-5l\(mm\)_firmware:1.3.4.24879b190222.d00.u2\(8a21s\):*:*:*:*:*:*:*;cpe:2.3:o:tvt:avision_av108t_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:tvt:avision_av108t_firmware:1.3.3.20657b180918.d06.u2\(4a41t\):*:*:*:*:*:*:*;cpe:2.3:o:tvt:avision_av108t_firmware:1.3.4.22966b181219.d00.u1\(4a21s\):*:*:*:*:*:*:*;cpe:2.3:o:tvt:avision_av108t_firmware:1.3.4.22966b181219.d14.u1\(8a41t\):*:*:*:*:*:*:*;cpe:2.3:o:tvt:avision_av108t_firmware:1.3.4.22966b181219.d44.u1\(16a82t\):*:*:*:*:*:*:*;cpe:2.3:o:tvt:avision_av108t_firmware:1.3.4.24513b190218.d00.u1\(8a21s\):*:*:*:*:*:*:*;cpe:2.3:o:tvt:avision_av108t_firmware:1.3.4.24879b190222.d00.u2\(8a21s\):*:*:*:*:*:*:*;cpe:2.3:o:tvt:td-2104ts-cl_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:tvt:td-2104ts-cl_firmware:1.3.3.20657b180918.d06.u2\(4a41t\):*:*:*:*:*:*:*;cpe:2.3:o:tvt:td-2104ts-cl_firmware:1.3.4.22966b181219.d00.u1\(4a21s\):*:*:*:*:*:*:*;cpe:2.3:o:tvt:td-2104ts-cl_firmware:1.3.4.22966b181219.d14.u1\(8a41t\):*:*:*:*:*:*:*;cpe:2.3:o:tvt:td-2104ts-cl_firmware:1.3.4.22966b181219.d44.u1\(16a82t\):*:*:*:*:*:*:*;cpe:2.3:o:tvt:td-2104ts-cl_firmware:1.3.4.24513b190218.d00.u1\(8a21s\):*:*:*:*:*:*:*;cpe:2.3:o:tvt:td-2104ts-cl_firmware:1.3.4.24879b190222.d00.u2\(8a21s\):*:*:*:*:*:*:*;cpe:2.3:o:tvt:td-2108ts-hp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:tvt:td-2108ts-hp_firmware:1.3.3.20657b180918.d06.u2\(4a41t\):*:*:*:*:*:*:*;cpe:2.3:o:tvt:td-2108ts-hp_firmware:1.3.4.22966b181219.d00.u1\(4a21s\):*:*:*:*:*:*:*;cpe:2.3:o:tvt:td-2108ts-hp_firmware:1.3.4.22966b181219.d14.u1\(8a41t\):*:*:*:*:*:*:*;cpe:2.3:o:tvt:td-2108ts-hp_firmware:1.3.4.22966b181219.d44.u1\(16a82t\):*:*:*:*:*:*:*;cpe:2.3:o:tvt:td-2108ts-hp_firmware:1.3.4.24513b190218.d00.u1\(8a21s\):*:*:*:*:*:*:*;cpe:2.3:o:tvt:td-2108ts-hp_firmware:1.3.4.24879b190222.d00.u2\(8a21s\):*:*:*:*:*:*:*,Provision-Isr,Sh-4050A5-5L(Mm) Firmware
CVE-2024-7340,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.04974,CWE-22,"The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin.",2024-07-31,Nuclei,,,
CVE-2024-7354,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00662,CWE-79,"The Ninja Forms  WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",2024-09-02,Nuclei,cpe:2.3:a:ninjaforms:ninja_forms:*:*:*:*:*:wordpress:*:*,Ninjaforms,Ninja Forms
CVE-2024-7399,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.91941,CWE-22,Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.,2024-08-12,CISA/Metasploit/Nuclei,cpe:2.3:a:samsung:magicinfo_9_server:*:*:*:*:*:*:*:*,Samsung,Magicinfo 9 Server
CVE-2024-7591,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.43844,CWE-78,"Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection.This issue affects:

* LoadMaster: 7.2.40.0 and above

* ECS: All versions

* Multi-Tenancy: 7.1.35.4 and above",2024-09-05,Nuclei,cpe:2.3:a:kemptechnologies:loadmaster:*:*:*:*:*:*:*:*;cpe:2.3:o:kemptechnologies:multi-tenant_hypervisor_firmware:*:*:*:*:*:*:*:*,Kemptechnologies,Multi-Tenant Hypervisor Firmware
CVE-2024-7593,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9999,CWE-287,Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.,2024-08-13,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:ivanti:virtual_traffic_manager:22.2:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:virtual_traffic_manager:22.3:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:virtual_traffic_manager:22.3:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:virtual_traffic_manager:22.5:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:virtual_traffic_manager:22.6:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:virtual_traffic_manager:22.7:r1:*:*:*:*:*:*,Ivanti,Virtual Traffic Manager
CVE-2024-7694,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.01807,CWE-434,"ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with  administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server.",2024-08-12,CISA,cpe:2.3:a:teamt5:threatsonar_anti-ransomware:*:*:*:*:*:*:*:*,Teamt5,Threatsonar Anti-Ransomware
CVE-2024-7714,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N,0.00848,NVD-CWE-noinfo,"The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 lacks sufficient access controls allowing an unauthenticated user to disconnect the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 from OpenAI, thereby disabling the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0. Multiple actions are accessible: 'ays_chatgpt_disconnect', 'ays_chatgpt_connect', and  'ays_chatgpt_save_feedback'",2024-09-27,Nuclei,cpe:2.3:a:ays-pro:chatgpt_assistant:*:*:*:*:free:wordpress:*:*,Ays-Pro,Chatgpt Assistant
CVE-2024-7786,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01635,NVD-CWE-noinfo,"The Sensei LMS  WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates.",2024-09-04,Nuclei,cpe:2.3:a:automattic:sensei_lms:*:*:*:*:*:wordpress:*:*,Automattic,Sensei Lms
CVE-2024-7854,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.04317,CWE-89,"The Woo Inquiry plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 0.1 due to insufficient escaping on the user supplied parameter 'dbid' and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2024-08-21,Nuclei,cpe:2.3:a:sjhoo:woo_inquiry:0.1:*:*:*:*:*:*:*,Sjhoo,Woo Inquiry
CVE-2024-7928,4.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N,0.16882,CWE-22,"A vulnerability, which was classified as problematic, has been found in FastAdmin up to 1.3.3.20220121. Affected by this issue is some unknown functionality of the file /index/ajax/lang. The manipulation of the argument lang leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.4.20220530 is able to address this issue. It is recommended to upgrade the affected component.",2024-08-19,Nuclei,cpe:2.3:a:fastadmin:fastadmin:*:*:*:*:*:*:*:*,Fastadmin,Fastadmin
CVE-2024-7954,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.90053,CWE-95,"The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.",2024-08-23,Metasploit/Nuclei,,,
CVE-2024-7965,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.17227,CWE-787,Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High),2024-08-21,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*,Google,Chrome
CVE-2024-7971,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.19272,CWE-843,Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High),2024-08-21,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*,Google,Chrome
CVE-2024-8021,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00723,CWE-601,"An open redirect vulnerability exists in the latest version of gradio-app/gradio. The vulnerability allows an attacker to redirect users to a malicious website by URL encoding. This can be exploited by sending a crafted request to the application, which results in a 302 redirect to an attacker-controlled site.",2025-03-20,Nuclei,cpe:2.3:a:gradio_project:gradio:-:*:*:*:*:python:*:*,Gradio Project,Gradio
CVE-2024-8068,8.0,CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01399,CWE-269,Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain,2024-11-12,CISA,cpe:2.3:a:citrix:session_recording:*:*:*:*:-:*:*:*;cpe:2.3:a:citrix:session_recording:1912:-:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:1912:cu1:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:1912:cu2:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:1912:cu3:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:1912:cu4:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:1912:cu5:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:1912:cu6:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:1912:cu7:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:1912:cu8:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:2203:-:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:2203:cu1:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:2203:cu2:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:2203:cu3:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:2203:cu4:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:2203:cu5:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:2402:-:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:2407:-:*:*:-:*:*:*,Citrix,Session Recording
CVE-2024-8069,8.0,CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.14736,CWE-502,Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server,2024-11-12,CISA,cpe:2.3:a:citrix:session_recording:*:*:*:*:-:*:*:*;cpe:2.3:a:citrix:session_recording:1912:-:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:1912:cu1:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:1912:cu2:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:1912:cu3:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:1912:cu4:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:1912:cu5:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:1912:cu6:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:1912:cu7:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:1912:cu8:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:2203:-:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:2203:cu1:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:2203:cu2:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:2203:cu3:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:2203:cu4:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:2402:-:*:*:ltsr:*:*:*;cpe:2.3:a:citrix:session_recording:2407:-:*:*:-:*:*:*,Citrix,Session Recording
CVE-2024-8181,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.42783,CWE-287,"An Authentication Bypass vulnerability exists in Flowise version 1.8.2. This could allow a remote, unauthenticated attacker to access API endpoints as an administrator and allow them to access restricted functionality.",2024-08-27,Nuclei,cpe:2.3:a:flowiseai:flowise:1.8.2:*:*:*:*:*:*:*,Flowiseai,Flowise
CVE-2024-8190,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.88955,CWE-78,An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.,2024-09-10,CISA,cpe:2.3:a:ivanti:cloud_services_appliance:4.6:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:cloud_services_appliance:4.6:patch_518:*:*:*:*:*:*,Ivanti,Cloud Services Appliance
CVE-2024-8252,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03034,CWE-98,"The Clean Login plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.14.5 via the 'template' attribute of the clean-login-register shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.",2024-08-30,Nuclei,cpe:2.3:a:codection:clean_login:*:*:*:*:*:wordpress:*:*,Codection,Clean Login
CVE-2024-8353,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.2872,CWE-502,"The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'give_title' and 'card_address'. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files and achieve remote code execution. This is essentially the same vulnerability as CVE-2024-5932, however, it was discovered the the presence of stripslashes_deep on user_info allows the is_serialized check to be bypassed. This issue was mostly patched in 3.16.1, but further hardening was added in 3.16.2.",2024-09-28,Metasploit/Nuclei,cpe:2.3:a:givewp:givewp:*:*:*:*:*:wordpress:*:*,Givewp,Givewp
CVE-2024-8425,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03858,CWE-434,"The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwb_wgm_preview_mail' and 'mwb_wgm_woocommerce_add_cart_item_data' functions in all versions up to, and including, 2.9.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note that this may have been patched on an older version than 2.9.2, however, we do not have access to older versions of the software to confirm when the patch was added. The only patched version we have confirmed is 2.9.3.",2025-02-28,Nuclei,cpe:2.3:a:wpswings:woocommerce_ultimate_gift_card:*:*:*:*:*:wordpress:*:*,Wpswings,Woocommerce Ultimate Gift Card
CVE-2024-8484,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03792,CWE-89,"The REST API TO MiniProgram plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/watch-life-net/v1/comment/getcomments REST API endpoint in all versions up to, and including, 4.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2024-09-25,Nuclei,cpe:2.3:a:jianbo:rest_api_to_miniprogram:*:*:*:*:*:wordpress:*:*,Jianbo,Rest Api To Miniprogram
CVE-2024-8503,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.80023,CWE-89,"An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.",2024-09-10,Metasploit/Nuclei,,,
CVE-2024-8504,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.75384,CWE-78,"An attacker with authenticated access to VICIdial as an ""agent"" can execute arbitrary shell commands as the ""root"" user. This attack can be chained with CVE-2024-8503 to execute arbitrary shell commands starting from an unauthenticated perspective.",2024-09-10,Metasploit,,,
CVE-2024-8517,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.94532,CWE-73,"SPIP before 4.3.2, 4.2.16, and 
4.1.18 is vulnerable to a command injection issue. A 
remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.",2024-09-06,Metasploit/Nuclei,cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*;cpe:2.3:a:spip:spip:4.3.0:*:*:*:*:*:*:*;cpe:2.3:a:spip:spip:4.3.1:*:*:*:*:*:*:*,Spip,Spip
CVE-2024-8522,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.62882,CWE-89,"The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2024-09-12,Metasploit/Nuclei,cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:*,Thimpress,Learnpress
CVE-2024-8529,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.11831,CWE-89,"The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1/courses/archive-course REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2024-09-12,Metasploit/Nuclei,cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:*,Thimpress,Learnpress
CVE-2024-8625,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.02277,CWE-89,"The TS Poll  WordPress plugin before 2.4.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks",2024-10-21,Nuclei,cpe:2.3:a:total-soft:ts_poll:*:*:*:*:*:wordpress:*:*,Total-Soft,Ts Poll
CVE-2024-8673,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.01618,NVD-CWE-noinfo,The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript.,2025-05-15,Nuclei,cpe:2.3:a:urbanbase:z-downloads:*:*:*:*:*:wordpress:*:*,Urbanbase,Z-Downloads
CVE-2024-8698,7.7,CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L,0.0203,CWE-347,"A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.",2024-09-19,Nuclei,,,
CVE-2024-8752,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.11666,CWE-22,The Windows version of WebIQ 2.15.9 is affected by a directory traversal vulnerability that allows remote attackers to read any file on the system.,2024-09-16,Nuclei,cpe:2.3:a:smart-hmi:webiq:2.15.9:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2024-8852,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01175,CWE-200,"The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.86 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information such as full paths contained in the exposed log files.",2024-10-22,Nuclei,cpe:2.3:a:servmask:all-in-one_wp_migration:*:*:*:*:free:wordpress:*:*,Servmask,All-In-One Wp Migration
CVE-2024-8856,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.93709,CWE-434,"The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.",2024-11-16,Metasploit/Nuclei,cpe:2.3:a:revmakx:backup_and_staging_by_wp_time_capsule:*:*:*:*:*:wordpress:*:*,Revmakx,Backup And Staging By Wp Time Capsule
CVE-2024-8859,0.0,,0.02484,CWE-29,"A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the file protocol results in an arbitrary file read vulnerability. This issue occurs because only the path part of the URL is checked, while parts such as query and parameters are not handled. The vulnerability is triggered if the user has configured the dbfs service, and during usage, the service is mounted to a local directory.",2025-03-20,Nuclei,cpe:2.3:a:lfprojects:mlflow:2.15.1:*:*:*:*:*:*:*,Lfprojects,Mlflow
CVE-2024-8877,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.7703,CWE-89,Improper neutralization of special elements results in a SQL Injection vulnerability in Riello Netman 204. It is only limited to the SQLite database of measurement data.This issue affects Netman 204: through 4.05.,2024-09-25,Nuclei,cpe:2.3:h:riello-ups:netman_204:-:*:*:*:*:*:*:*;cpe:2.3:o:riello-ups:netman_204_firmware:*:*:*:*:*:*:*:*,Riello-Ups,Netman 204 Firmware
CVE-2024-8883,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01959,CWE-601,"A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.",2024-09-19,Nuclei,cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:text-only:*:*:*;cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.10:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.9:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:*;cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*;cpe:2.3:a:redhat:single_sign-on:7.6:*:*:*:*:*:*:*,Redhat,Build Of Keycloak
CVE-2024-8911,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0288,CWE-89,"The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to, and including, 5.0.11. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note that changing a WordPress user's password is only possible if the ""Use WordPress users as customers"" setting is enabled, which is disabled by default. Without this setting enabled, only the passwords of plugin customers, which are stored and managed in a separate database table, can be modified.",2024-10-08,Nuclei,cpe:2.3:a:latepoint:latepoint:*:*:*:*:*:wordpress:*:*,Latepoint,Latepoint
CVE-2024-8943,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03054,CWE-288,"The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including,  5.0.12. This is due to insufficient verification on the user being supplied during the booking customer step. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. Note that logging in as a WordPress user is only possible if the ""Use WordPress users as customers"" setting is enabled, which is disabled by default. The vulnerability is partially patched in version 5.0.12 and fully patched in version 5.0.13.",2024-10-08,Nuclei,cpe:2.3:a:latepoint:latepoint:*:*:*:*:*:wordpress:*:*,Latepoint,Latepoint
CVE-2024-8956,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.60879,CWE-306,"PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.",2024-09-17,CISA,cpe:2.3:h:ptzoptics:pt30x-ndi-xx-g2:-:*:*:*:*:*:*:*;cpe:2.3:h:ptzoptics:pt30x-sdi:-:*:*:*:*:*:*:*;cpe:2.3:o:ptzoptics:pt30x-ndi-xx-g2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ptzoptics:pt30x-sdi_firmware:*:*:*:*:*:*:*:*,Ptzoptics,Pt30X-Sdi Firmware
CVE-2024-8957,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.81973,CWE-78,"PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.",2024-09-17,CISA,cpe:2.3:h:ptzoptics:pt30x-ndi-xx-g2:-:*:*:*:*:*:*:*;cpe:2.3:h:ptzoptics:pt30x-sdi:-:*:*:*:*:*:*:*;cpe:2.3:o:ptzoptics:pt30x-ndi-xx-g2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ptzoptics:pt30x-sdi_firmware:*:*:*:*:*:*:*:*,Ptzoptics,Pt30X-Sdi Firmware
CVE-2024-8963,9.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L,0.98557,CWE-22,Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.,2024-09-19,CISA/EPSS/Nuclei,cpe:2.3:a:ivanti:endpoint_manager_cloud_services_appliance:4.6:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager_cloud_services_appliance:4.6:patch_512:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager_cloud_services_appliance:4.6:patch_518:*:*:*:*:*:*,Ivanti,Endpoint Manager Cloud Services Appliance
CVE-2024-9007,3.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N,0.00949,CWE-79,A vulnerability classified as problematic has been found in jeanmarc77 123solar 1.8.4.5. This affects an unknown part of the file /detailed.php. The manipulation of the argument date1 leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named 94bf9ab7ad0ccb7fbdc02f172f37f0e2ea08d48f. It is recommended to apply a patch to fix this issue.,2024-09-19,Nuclei,cpe:2.3:a:jeanmarc77:123solar:1.8.4.5:*:*:*:*:*:*:*,Jeanmarc77,123Solar
CVE-2024-9014,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.09685,CWE-522,"pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.",2024-09-23,Nuclei,cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*,Pgadmin,Pgadmin 4
CVE-2024-9047,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.93199,CWE-22,"The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.",2024-10-12,Nuclei,cpe:2.3:a:iptanus:wordpress_file_upload:*:*:*:*:*:wordpress:*:*,Iptanus,Wordpress File Upload
CVE-2024-9061,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.5228,CWE-94,"The The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wp_ajax_nopriv_shortcode_Api_Add AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. NOTE: This vulnerability was partially fixed in version 1.3.5 with a nonce check, which effectively prevented access to the affected function. However, version 1.3.6 incorporates the correct authorization check to prevent unauthorized access.",2024-10-16,Nuclei,cpe:2.3:a:themehunk:wp_popup_builder:*:*:*:*:*:wordpress:*:*,Themehunk,Wp Popup Builder
CVE-2024-9161,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L,0.02131,CWE-862,"The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'update_metadata' function in all versions up to, and including, 1.0.228. This makes it possible for unauthenticated attackers to insert new and update existing metadata beginning with 'rank_math', and delete arbitrary existing user metadata and term metadata. Deleting existing usermeta can cause a loss of access to the administrator dashboard for any registered users, including Administrators.",2024-10-05,Nuclei,cpe:2.3:a:rankmath:seo:*:*:*:*:free:wordpress:*:*,Rankmath,Seo
CVE-2024-9166,0.0,,0.01578,CWE-78,"The device enables an unauthorized attacker to execute system commands with elevated privileges. This exploit is facilitated through the use of the 'getcommand' query within the application, allowing the attacker to gain root access.",2024-09-26,Nuclei,,,
CVE-2024-9186,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.02259,CWE-89,"The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and escape the bwfan-track-id  parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks",2024-11-14,Nuclei,cpe:2.3:a:funnelkit:funnelkit_automations:*:*:*:*:*:wordpress:*:*,Funnelkit,Funnelkit Automations
CVE-2024-9193,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03111,CWE-98,"The WHMpress - WHMCS WordPress Integration Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.3-revision-0 via the whmpress_domain_search_ajax_extended_results() function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. Utilizing the /admin/services.php file, this can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.",2025-02-28,Nuclei,cpe:2.3:a:whmpress:whmcs:*:*:*:*:*:wordpress:*:*;cpe:2.3:a:whmpress:whmcs:6.3:rev0:*:*:*:wordpress:*:*,Whmpress,Whmcs
CVE-2024-9234,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.10446,CWE-862,"The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the install_and_activate_plugin_from_external() function  (install-active-plugin REST API endpoint) in all versions up to, and including, 2.1.0. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins, or utilize the functionality to upload arbitrary files spoofed like plugins.",2024-10-11,Nuclei,,,
CVE-2024-9264,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.97781,CWE-94,"The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack.  The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.",2024-10-18,EPSS/Nuclei,cpe:2.3:a:grafana:grafana:11.0.0:*:*:*:*:*:*:*,Grafana,Grafana
CVE-2024-9362,0.0,,0.0428,CWE-22,"An unauthenticated directory traversal vulnerability exists in Polyaxon, affecting the latest version. This vulnerability allows an attacker to retrieve directory information and file contents from the server without proper authorization, leading to sensitive information disclosure. The issue enables access to system directories such as `/etc`, potentially resulting in significant security risks.",2025-03-20,Nuclei,,,
CVE-2024-9379,6.5,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H,0.43364,CWE-89,SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.,2024-10-08,CISA,cpe:2.3:a:ivanti:endpoint_manager_cloud_services_appliance:*:*:*:*:*:*:*:*,Ivanti,Endpoint Manager Cloud Services Appliance
CVE-2024-9380,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.62785,CWE-77,An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution.,2024-10-08,CISA,cpe:2.3:a:ivanti:endpoint_manager_cloud_services_appliance:*:*:*:*:*:*:*:*,Ivanti,Endpoint Manager Cloud Services Appliance
CVE-2024-9463,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.98494,CWE-78,"An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.",2024-10-09,CISA/EPSS/Nuclei,cpe:2.3:a:paloaltonetworks:expedition:*:*:*:*:*:*:*:*,Paloaltonetworks,Expedition
CVE-2024-9465,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.99609,CWE-89,"An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.",2024-10-09,CISA/EPSS/Nuclei,cpe:2.3:a:paloaltonetworks:expedition:*:*:*:*:*:*:*:*,Paloaltonetworks,Expedition
CVE-2024-9474,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.94766,CWE-78,"A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.

Cloud NGFW and Prisma Access are not impacted by this vulnerability.",2024-11-18,CISA/Metasploit/Nuclei,cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.0.6:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.5:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:-:*:*:*:*:*:*,Paloaltonetworks,Pan-Os
CVE-2024-9537,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03852,NVD-CWE-noinfo,"ScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party component packaged with SL1. The vulnerability is addressed in SL1 versions 12.1.3+, 12.2.3+, and 12.3+.  Remediations have been made available for all SL1 versions back to version lines 10.1.x, 10.2.x, 11.1.x, 11.2.x, and 11.3.x.",2024-10-18,CISA,cpe:2.3:a:sciencelogic:sl1:*:*:*:*:*:*:*:*,Sciencelogic,Sl1
CVE-2024-9593,8.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L,0.12392,CWE-94,"The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock) and 1.1.4 (for Time Clock Pro) via the 'etimeclockwp_load_function_callback' function. This allows unauthenticated attackers to execute code on the server. The invoked function's parameters cannot be specified.",2024-10-18,Nuclei,cpe:2.3:a:wpplugin:time_clock:*:*:*:*:-:wordpress:*:*;cpe:2.3:a:wpplugin:time_clock:*:*:*:*:pro:wordpress:*:*,Wpplugin,Time Clock
CVE-2024-9617,0.0,,0.01557,CWE-639,"An IDOR vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to view any files. The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/{file_id} interface to view any user's file.",2025-03-20,Nuclei,,,
CVE-2024-9643,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0293,CWE-489,The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to authentication bypass due to hard-coded credentials in the administrative web server. An attacker with knowledge of the credentials can gain administrative access via crafted HTTP requests. This issue appears similar to CVE-2023-32645.,2025-02-04,Nuclei,cpe:2.3:h:four-faith:f3x36:-:*:*:*:*:*:*:*;cpe:2.3:o:four-faith:f3x36_firmware:2.0:*:*:*:*:*:*:*,Four-Faith,F3X36 Firmware
CVE-2024-9680,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.23184,CWE-416,"An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.",2024-10-09,CISA,cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*;cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*;cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*;cpe:2.3:a:mozilla:thunderbird:131.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2024-9707,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09078,CWE-862,"The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/themehunk-import REST API endpoint in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.",2024-10-11,Nuclei,cpe:2.3:a:themehunk:hunk_companion:*:*:*:*:*:wordpress:*:*,Themehunk,Hunk Companion
CVE-2024-9765,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.01414,NVD-CWE-noinfo,The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directory,2025-05-15,Nuclei,cpe:2.3:a:lukashuser:ekc_tournament_manager:*:*:*:*:*:wordpress:*:*,Lukashuser,Ekc Tournament Manager
CVE-2024-9772,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.01411,CWE-94,"The The Uix Shortcodes – Compatible with Gutenberg plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.9.9. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.",2024-10-26,Nuclei,cpe:2.3:a:uiux:uix_shortcodes:*:*:*:*:*:wordpress:*:*,Uiux,Uix Shortcodes
CVE-2024-9796,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02996,CWE-89,"The WP-Advanced-Search WordPress plugin before 3.3.9.2 does not sanitize and escape the t parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks",2024-10-10,Nuclei,cpe:2.3:a:internet-formation:wp-advanced-search:*:*:*:*:*:wordpress:*:*,Internet-Formation,Wp-Advanced-Search
CVE-2024-9916,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.7352,CWE-78,"A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality of the file app/modules/ut-cac/admin/cli.php. The manipulation of the argument o leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",2024-10-13,Nuclei,cpe:2.3:a:usualtool:usualtoolcms:9.0:*:*:*:*:*:*:*,Usualtool,Usualtoolcms
CVE-2024-9935,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.07486,CWE-22,"The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.0.0 via the rtw_pgaepb_dwnld_pdf() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-24569 may be a duplicate of this issue.",2024-11-16,Nuclei,,,
CVE-2024-9989,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07217,CWE-288,"The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.18. This is due to a limited arbitrary method call to 'crypto_connect_ajax_process::log_in' function in the 'crypto_connect_ajax_process' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.",2024-10-29,Nuclei,cpe:2.3:a:odude:crypto_tool:*:*:*:*:*:wordpress:*:*,Odude,Crypto Tool
CVE-2025-0107,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.77503,CWE-78,"An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.",2025-01-11,Nuclei,cpe:2.3:a:paloaltonetworks:expedition:*:*:*:*:*:*:*:*,Paloaltonetworks,Expedition
CVE-2025-0108,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.98455,CWE-306,"An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS.

You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended  best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

This issue does not affect Cloud NGFW or Prisma Access software.",2025-02-12,CISA/EPSS/Nuclei,cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h7:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h8:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h11:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h12:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h13:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h7:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h8:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h9:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h11:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h7:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h8:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h9:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h11:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h12:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h13:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h14:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h15:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h16:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h17:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h18:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h19:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h20:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h21:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h22:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h23:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h7:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h8:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h9:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h11:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h12:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h13:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h14:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h15:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h16:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h17:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h18:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h19:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h20:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h7:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h8:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h9:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h11:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h12:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h13:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h14:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h15:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h16:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h17:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h18:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h19:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h20:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h7:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h8:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h9:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h11:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h12:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h13:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h14:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h15:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h16:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h17:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h7:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h8:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h9:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h11:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h12:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h7:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h8:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h9:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.5:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h3:*:*:*:*:*:*,Paloaltonetworks,Pan-Os
CVE-2025-0111,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.01927,CWE-73,"An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.

You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended  best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .



This issue does not affect Cloud NGFW or Prisma Access software.",2025-02-12,CISA,cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h8:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h12:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h16:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h18:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h19:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h21:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h8:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h13:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h15:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h18:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h19:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h11:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h14:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h16:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h18:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h19:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h9:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h2:*:*:*:*:*:*,Paloaltonetworks,Pan-Os
CVE-2025-0133,0.0,,0.45119,CWE-79,"A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software enables execution of malicious JavaScript in the context of an authenticated Captive Portal user's browser when they click on a specially crafted link. The primary risk is phishing attacks that can lead to credential theft—particularly if you enabled Clientless VPN.

There is no availability impact to GlobalProtect features or GlobalProtect users. Attackers cannot use this vulnerability to tamper with or modify contents or configurations of the GlobalProtect portal or gateways. The integrity impact of this vulnerability is limited to enabling an attacker to create phishing and credential-stealing links that appear to be hosted on the GlobalProtect portal.



For GlobalProtect users with Clientless VPN enabled, there is a limited impact on confidentiality due to inherent risks of Clientless VPN that facilitate credential theft. You can read more about this risk in the informational bulletin  PAN-SA-2025-0005 https://security.paloaltonetworks.com/PAN-SA-2025-0005   https://security.paloaltonetworks.com/PAN-SA-2025-0005 . There is no impact to confidentiality for GlobalProtect users if you did not enable (or you disable) Clientless VPN.",2025-05-14,Nuclei,,,
CVE-2025-0282,9.0,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H,0.99971,CWE-121,"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.",2025-01-08,CISA/EPSS/Nuclei,cpe:2.3:a:ivanti:connect_secure:22.7:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:r2.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:r2.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:r2.4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.7:r2.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.7:r2.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.7:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.7:r1.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.7:r1.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.7:r1:*:*:*:*:*:*,Ivanti,Connect Secure
CVE-2025-0411,7.0,CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.67071,CWE-693,"7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.",2025-01-25,CISA,cpe:2.3:a:7-zip:7-zip:*:*:*:*:*:*:*:*;cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*,Netapp,Active Iq Unified Manager
CVE-2025-0674,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03523,CWE-288,"Multiple Elber products are affected by an authentication bypass 
vulnerability which allows unauthorized access to the password 
management functionality. Attackers can exploit this issue by 
manipulating the endpoint to overwrite any user's password within the 
system. This grants them unauthorized administrative access to protected
 areas of the application, compromising the device's system security.",2025-02-07,Nuclei,,,
CVE-2025-0868,0.0,,0.14437,CWE-95,"A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint..

This issue affects DocsGPT: from 0.8.1 through 0.12.0.",2025-02-20,Nuclei,,,
CVE-2025-0994,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.31309,CWE-502,Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.,2025-02-06,CISA,cpe:2.3:a:trimble:cityworks:*:*:*:*:*:*:*:*,Trimble,Cityworks
CVE-2025-10035,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.99614,CWE-77,"A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.",2025-09-18,CISA/EPSS/Nuclei,cpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:*,Fortra,Goanywhere Managed File Transfer
CVE-2025-10090,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.01664,CWE-74,A flaw has been found in Jinher OA up to 1.2. The impacted element is an unknown function of the file /C6/Jhsoft.Web.departments/GetTreeDate.aspx. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.,2025-09-08,Nuclei,cpe:2.3:a:jinher:jinher_oa:*:*:*:*:*:*:*:*,Jinher,Jinher Oa
CVE-2025-10162,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03632,Missing_Data,"The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin before 14 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files via a path traversal attack",2025-10-07,Nuclei,,,
CVE-2025-10204,0.0,,0.00451,CWE-306,A vulnerability has been discovered in AC Smart II where passwords can be changed without authorization. This page contains a hidden form for resetting the administrator password. The attacker can manipulate the page using developer tools to display and use the form. This form allows you to change the administrator password without verifying login status or user permissions.,2025-09-14,Nuclei,,,
CVE-2025-10210,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.01195,CWE-74,A weakness has been identified in yanyutao0402 ChanCMS up to 3.3.0. Impacted is the function Search of the file app/modules/api/service/Api.js. Executing manipulation of the argument key can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.,2025-09-10,Nuclei,cpe:2.3:a:chancms:chancms:*:*:*:*:*:*:*:*,Chancms,Chancms
CVE-2025-10211,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.00649,CWE-918,A security vulnerability has been detected in yanyutao0402 ChanCMS 3.3.0. The affected element is the function CollectController of the file /cms/collect/getArticle. The manipulation of the argument taskUrl leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.,2025-09-10,Nuclei,cpe:2.3:a:chancms:chancms:3.3.0:*:*:*:*:*:*:*,Chancms,Chancms
CVE-2025-1023,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02386,CWE-89,"A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated into an SQL query without proper sanitization, allowing an attacker to manipulate database queries and execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion.",2025-02-18,Nuclei,cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*,Churchcrm,Churchcrm
CVE-2025-1025,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N,0.19493,CWE-434,Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extension to bypass the upload filter.,2025-02-05,Nuclei,,,
CVE-2025-1035,5.7,CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.09782,CWE-22,"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Komtera Technolgies KLog Server allows Manipulating Web Input to File System Calls.

This issue affects KLog Server: before 3.1.1.",2025-02-18,Nuclei,,,
CVE-2025-10353,0.0,,0.02503,CWE-43,File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker to upload a malicious file via a POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' using the 'mcsdetail_img' parameter.,2025-10-08,Nuclei,,,
CVE-2025-10585,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05426,CWE-843,Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High),2025-09-24,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:cadra:-:*:*:*:*:*:*:*,Google,Chrome
CVE-2025-10897,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.01844,CWE-22,"The WooCommerce Designer Pro theme for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.9.28. This makes it possible for unauthenticated attackers to read arbitrary files on the server, which can expose DB credentials when the wp-config.php file is read.",2025-10-31,Nuclei,,,
CVE-2025-1094,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9003,CWE-149,"Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns.  Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal.  Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when client_encoding is BIG5 and server_encoding is one of EUC_TW or MULE_INTERNAL.  Versions before PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected.",2025-02-13,Metasploit,,,
CVE-2025-1097,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.34677,CWE-20,"A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)",2025-03-25,Nuclei,,,
CVE-2025-1098,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.83066,CWE-20,"A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)",2025-03-25,Nuclei,,,
CVE-2025-11307,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.01873,Missing_Data,"The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.48 does not sanitize user input provided via an AJAX action, allowing unauthenticated users to store XSS payloads which are later retrieved from another AJAX call and output unescaped.",2025-11-11,Nuclei,,,
CVE-2025-11368,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00999,CWE-200,"The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in the REST endpoint /wp-json/lp/v1/load_content_via_ajax which allows arbitrary callback execution of admin-only template methods. This makes it possible for unauthenticated attackers to retrieve admin curriculum HTML, quiz questions with correct answers, course materials, and other sensitive educational content via the REST API endpoint granted they can supply valid numeric IDs.",2025-11-21,Nuclei,,,
CVE-2025-11371,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.92094,CWE-552,"In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. 

This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560",2025-10-09,CISA/Metasploit/Nuclei,cpe:2.3:a:gladinet:centrestack:*:*:*:*:*:*:*:*;cpe:2.3:a:gladinet:triofox:*:*:*:*:*:*:*:*,Gladinet,Centrestack
CVE-2025-11580,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01004,CWE-862,A weakness has been identified in PowerJob up to 5.1.2. This affects the function list of the file /user/list. This manipulation causes missing authorization. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.,2025-10-10,Nuclei,cpe:2.3:a:powerjob:powerjob:*:*:*:*:*:*:*:*,Powerjob,Powerjob
CVE-2025-11693,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01954,CWE-200,"The Export WP Page to Static HTML & PDF plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.4 through publicly exposed cookies.txt files containing authentication cookies. This makes it possible for unauthenticated attackers to cookies that may have been injected into the log file if the site administrator triggered a back-up using a specific user role like 'administrator.'",2025-12-13,Nuclei,,,
CVE-2025-11700,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.307,CWE-611,N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure,2025-11-12,Metasploit/Nuclei,cpe:2.3:a:n-able:n-central:*:*:*:*:*:*:*:*,N-Able,N-Central
CVE-2025-11749,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.75063,CWE-200,"The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the 'Bearer Token' value when 'No-Auth URL' is enabled. This makes it possible for unauthenticated attackers to extract the bearer token, which can be used to gain access to a valid session and perform many actions like creating a new administrator account, leading to privilege escalation.",2025-11-05,Metasploit/Nuclei,,,
CVE-2025-11750,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00711,CWE-544,"In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. Specifically, when a login or registration attempt is made with a non-existent username or email, the system responds with a message such as ""account not found."" Conversely, when the username or email exists but the password is incorrect, a different error message is returned. This discrepancy allows an attacker to enumerate valid user accounts by analyzing the error responses, potentially facilitating targeted social engineering, brute force, or credential stuffing attacks.",2025-10-22,Nuclei,cpe:2.3:a:langgenius:dify:1.6.0:*:*:*:*:node.js:*:*,Langgenius,Dify
CVE-2025-11833,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.51507,CWE-862,"The Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the __construct function in all versions up to, and including, 3.6.0. This makes it possible for unauthenticated attackers to read arbitrary logged emails sent through the Post SMTP plugin, including password reset emails containing password reset links, which can lead to account takeover.",2025-11-01,Nuclei,,,
CVE-2025-11953,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.62378,CWE-78,"The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.",2025-11-03,CISA,cpe:2.3:a:react-native-community:react_native_community_cli:*:*:*:*:*:*:*:*;cpe:2.3:a:react-native-community:react_native_community_cli:18.0.0:*:*:*:*:*:*:*;cpe:2.3:a:react-native-community:react_native_community_cli:20.0.0:alpha0:*:*:*:*:*:*;cpe:2.3:a:react-native-community:react_native_community_cli:20.0.0:alpha1:*:*:*:*:*:*;cpe:2.3:a:react-native-community:react_native_community_cli:20.0.0:alpha2:*:*:*:*:*:*,React-Native-Community,React Native Community Cli
CVE-2025-12055,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03572,CWE-22,"HYDRA X, MIP 2 and FEDRA 2 of MPDV Mikrolab GmbH suffer from an unauthenticated local file disclosure vulnerability in all releases until Maintenance Pack 36 with Servicepack 8 (week 36/2025), which allows an attacker to read arbitrary files from the Windows operating system. The ""Filename"" parameter of the public $SCHEMAS$ ressource is vulnerable and can be exploited easily.",2025-10-27,Nuclei,,,
CVE-2025-12101,0.0,,0.254,CWE-79,"Cross-Site Scripting (XSS) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server",2025-11-11,Nuclei,,,
CVE-2025-12139,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02362,CWE-200,"The File Manager for Google Drive – Integrate Google Drive with WordPress plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.5.3 via the ""get_localize_data"" function. This makes it possible for unauthenticated attackers to extract sensitive data including Google OAuth credentials (client_id and client_secret) and Google account email addresses.",2025-11-05,Nuclei,,,
CVE-2025-1232,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.01856,CWE-79,"The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenticated users to perform Stored XSS attacks",2025-03-19,Nuclei,cpe:2.3:a:geminilabs:site_reviews:*:*:*:*:*:wordpress:*:*,Geminilabs,Site Reviews
CVE-2025-12480,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.90532,CWE-284,"Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.",2025-11-10,CISA/Nuclei,cpe:2.3:a:gladinet:triofox:*:*:*:*:*:*:*:*,Gladinet,Triofox
CVE-2025-12536,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00809,CWE-359,"The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srfm_email_notification' post meta registration. This is due to setting the 'auth_callback' parameter to '__return_true', which allows unauthenticated access to the metadata. This makes it possible for unauthenticated attackers to extract sensitive data including email notification configurations, which frequently contain vendor-provided CRM/help desk dropbox addresses, CC/BCC recipients, and notification templates that can be abused to inject malicious data into downstream systems.",2025-11-13,Nuclei,,,
CVE-2025-12548,9.0,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H,0.01164,CWE-306,"A flaw was found in Eclipse Che che-machine-exec. This vulnerability allows unauthenticated remote arbitrary command execution and secret exfiltration (SSH keys, tokens, etc.) from other users' Developer Workspace containers, via an unauthenticated JSON-RPC / websocket API exposed on TCP port 3333.",2026-01-13,Metasploit,,,
CVE-2025-12841,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.00654,Missing_Data,The Bookit WordPress plugin before 2.5.1 has a publicly accessible REST endpoint that allows unauthenticated update of the plugins Stripe payment options.,2025-12-12,Nuclei,,,
CVE-2025-1302,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.10224,CWE-94,"Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.

**Note:**

This is caused by an incomplete fix for [CVE-2024-21534](https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884).",2025-02-15,Nuclei,,,
CVE-2025-1303,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00525,CWE-79,"The Plugin Oficial  WordPress plugin through 1.7.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.",2025-05-15,Nuclei,cpe:2.3:a:coffee-code:plugin_oficial:*:*:*:*:*:wordpress:*:*,Coffee-Code,Plugin Oficial
CVE-2025-13138,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01554,CWE-89,"The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'columns_search' parameter of the select_2_ajax() function in all versions up to, and including, 1.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2025-11-21,Nuclei,,,
CVE-2025-1316,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.7227,CWE-78,Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device,2025-03-05,CISA,cpe:2.3:h:edimax:ic-7100:-:*:*:*:*:*:*:*;cpe:2.3:o:edimax:ic-7100_firmware:*:*:*:*:*:*:*:*,Edimax,Ic-7100 Firmware
CVE-2025-13223,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.04915,CWE-843,Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High),2025-11-17,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:a:siemens:cadra:-:*:*:*:*:*:*:*,Google,Chrome
CVE-2025-1323,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02886,CWE-89,"The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in all versions up to, and including, 16.26.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2025-03-08,Nuclei,cpe:2.3:a:plechevandrey:wp-recall:*:*:*:*:*:wordpress:*:*,Plechevandrey,Wp-Recall
CVE-2025-13315,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.32941,CWE-420,Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password.,2025-11-19,Metasploit/Nuclei,cpe:2.3:a:lynxtechnology:twonky_server:8.5.2:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2025-13316,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02719,CWE-321,"Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys. An attacker with knowledge of the encrypted administrator password can decrypt the value with static keys to view the plain text password and gain administrator-level access to Twonky Server.",2025-11-19,Metasploit,cpe:2.3:a:lynxtechnology:twonky_server:8.5.2:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2025-13339,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02056,CWE-22,"The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.1 via the template_redirect() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.",2025-12-10,Nuclei,,,
CVE-2025-1338,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.51091,CWE-74,A vulnerability was found in NUUO Camera up to 20250203. It has been declared as critical. This vulnerability affects the function print_file of the file /handle_config.php. The manipulation of the argument log leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.,2025-02-16,Nuclei,,,
CVE-2025-13390,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.04823,CWE-303,"The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the ""wdk_generate_auto_login_link"" function. This is due to the feature using a cryptographically weak token generation mechanism. This makes it possible for unauthenticated attackers to gain administrative access and achieve full site takeover via the auto-login endpoint with a predictable token.",2025-12-03,Nuclei,cpe:2.3:a:wpdirectorykit:wp_directory_kit:*:*:*:*:*:wordpress:*:*,Wpdirectorykit,Wp Directory Kit
CVE-2025-13418,6.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N,0.00598,CWE-79,"The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'plan_icons' parameter in all versions up to, and including, 5.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",2026-01-07,Nuclei,,,
CVE-2025-13486,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.74029,CWE-94,"The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func_array(). This makes it possible for unauthenticated attackers to execute arbitrary code on the server, which can be leveraged to inject backdoors or create new administrative user accounts.",2025-12-03,Metasploit/Nuclei,,,
CVE-2025-1361,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01265,CWE-285,"The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure in all versions up to, and including, 2.38.8 due to missing capability checks on the admin_init() function. This makes it possible for unauthenticated attackers to view the plugin's settings.",2025-02-22,Nuclei,cpe:2.3:a:ip2location:country_blocker:*:*:*:*:*:wordpress:*:*,Ip2Location,Country Blocker
CVE-2025-13652,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.01077,CWE-89,"The CBX Bookmark & Favorite plugin for WordPress is vulnerable to generic SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2026-01-06,Nuclei,,,
CVE-2025-13773,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.032,CWE-94,"The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.8.0 via the 'WooCommerce_Delivery_Notes::update' function. This is due to missing capability check in the 'WooCommerce_Delivery_Notes::update' function, PHP enabled in Dompdf, and missing escape in the 'template.php' file. This makes it possible for unauthenticated attackers to execute code on the server.",2025-12-24,Nuclei,,,
CVE-2025-13801,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01709,CWE-22,"The Yoco Payments plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 3.9.0 via the file parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.",2026-01-07,Nuclei,,,
CVE-2025-13920,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00669,CWE-200,"The WP Directory Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.9 via the wdk_public_action AJAX handler. This makes it possible for unauthenticated attackers to extract email addresses for users with Directory Kit-specific user roles.",2026-01-24,Nuclei,,,
CVE-2025-13956,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00917,CWE-862,"The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic function in all versions up to, and including, 4.3.1. This makes it possible for unauthenticated attackers to view the plugin's orders statistics, including total revenue summaries and order status counts",2025-12-16,Nuclei,,,
CVE-2025-14124,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.0156,Missing_Data,"The Team  WordPress plugin before 5.0.11 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.",2026-01-05,Nuclei,,,
CVE-2025-14155,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00715,CWE-862,"The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_template_content' function in all versions up to, and including, 4.11.53. This makes it possible for unauthenticated attackers to view the content of private, draft, and pending templates.",2025-12-23,Nuclei,cpe:2.3:a:leap13:premium_addons_for_elementor:*:*:*:*:*:wordpress:*:*,Leap13,Premium Addons For Elementor
CVE-2025-14174,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.22721,CWE-787,Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High),2025-12-12,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Apple,Macos
CVE-2025-14340,0.0,,0.01002,CWE-79,"Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload.",2026-02-18,Nuclei,,,
CVE-2025-14437,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01986,CWE-532,"The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request' function. This makes it possible for unauthenticated attackers to extract sensitive data including Cloudflare API credentials.",2025-12-18,Nuclei,,,
CVE-2025-14528,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.03559,CWE-200,A vulnerability was detected in D-Link DIR-803 up to 1.04. Impacted is an unknown function of the file /getcfg.php of the component Configuration Handler. The manipulation of the argument AUTHORIZED_GROUP results in information disclosure. The attack may be performed from remote. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.,2025-12-11,Nuclei,cpe:2.3:h:dlink:dir-803:a1:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-803_firmware:*:*:*:*:*:*:*:*,D-Link,Dir-803 Firmware
CVE-2025-14558,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.06272,CWE-20,"The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to resolvconf(8) unmodified.

resolvconf(8) is a shell script which does not validate its input.  A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed.",2026-03-09,Metasploit,cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:13.5:p3:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:13.5:p4:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:13.5:p5:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:13.5:p6:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:13.5:p7:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*;cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*,Freebsd,Freebsd
CVE-2025-14611,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.50949,CWE-798,Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. This opens the door for future exploitation and can be leveraged with previous vulnerabilities to gain a full system compromise.,2025-12-12,CISA/Metasploit/Nuclei,cpe:2.3:a:gladinet:centrestack:*:*:*:*:*:*:*:*;cpe:2.3:a:gladinet:triofox:*:*:*:*:*:*:*:*,Gladinet,Centrestack
CVE-2025-14726,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L,0.0083,CWE-200,"The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the '/trustindex_feed_hook_instagram/troubleshooting' and '/trustindex_feed_hook_instagram/submit-data' REST API endpoints in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to access and update plugin settings.",2026-05-02,Nuclei,,,
CVE-2025-14733,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.18346,CWE-787,"An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.5 and 2025.1 up to and including 2025.1.3.",2025-12-19,CISA,cpe:2.3:h:watchguard:firebox_m270:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m290:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m370:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m390:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m440:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m4600:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m470:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m4800:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m5600:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m570:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m5800:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m590:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m670:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m690:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_nv5:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t115-w:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t125-w:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t125:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t145-w:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t145:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t15:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t185:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t20:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t25:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t35:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t40:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t45:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t55:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t70:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t80:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t85:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:fireboxcloud:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:fireboxv:*:*:*:*:*:*:*:*;cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*,Watchguard,Fireware
CVE-2025-14847,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.83007,CWE-130,"Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.",2025-12-19,CISA/Metasploit/Nuclei,cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*;cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*,Mongodb,Mongodb
CVE-2025-15503,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.01907,CWE-284,A security flaw has been discovered in Sangfor Operation and Maintenance Management System up to 3.0.8. The impacted element is an unknown function of the file /fort/trust/version/common/common.jsp. Performing a manipulation of the argument File results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.,2026-01-10,Nuclei,cpe:2.3:a:sangfor:operation_and_maintenance_security_management_system:*:*:*:*:*:*:*:*,Sangfor,Operation And Maintenance Security Management System
CVE-2025-15556,7.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.01268,CWE-494,"Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.",2026-02-03,CISA,cpe:2.3:a:notepad-plus-plus:notepad\+\+:*:*:*:*:*:*:*:*,Notepad-Plus-Plus,Notepad++
CVE-2025-1562,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02904,CWE-862,"The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_or_activate_addon_plugins() function and a weak nonce hash in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to install arbitrary plugins on the site that can be leveraged to further infect a vulnerable site.",2025-06-18,Nuclei,cpe:2.3:a:funnelkit:funnelkit_automations:*:*:*:*:*:wordpress:*:*,Funnelkit,Funnelkit Automations
CVE-2025-1595,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01094,CWE-200,A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code of the file /api/v1/getbaseconfig. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.,2025-02-23,Nuclei,,,
CVE-2025-1661,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.54756,CWE-22,"The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.",2025-03-11,Nuclei,cpe:2.3:a:pluginus:husky_-_products_filter_professional_for_woocommerce:*:*:*:*:*:wordpress:*:*,Pluginus,Husky - Products Filter Professional For Woocommerce
CVE-2025-1743,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.0161,CWE-22,"A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",2025-02-27,Nuclei,,,
CVE-2025-1974,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99098,CWE-653,"A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)",2025-03-25,EPSS/Nuclei,,,
CVE-2025-1976,6.7,CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.00751,CWE-94,"Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with full root privileges on Fabric OS versions 9.1.0 through 9.1.1d6.",2025-04-24,CISA,cpe:2.3:o:broadcom:fabric_operating_system:*:*:*:*:*:*:*:*,Broadcom,Fabric Operating System
CVE-2025-2010,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01677,CWE-89,"The JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the 'jobwp_upload_resume' parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2025-04-19,Nuclei,,,
CVE-2025-2011,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.46435,CWE-89,"The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2025-05-06,Metasploit/Nuclei,,,
CVE-2025-20188,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.17894,CWE-798,"A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client debug bundles features of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system.

 This vulnerability is due to the presence of a hard-coded JSON Web Token (JWT) on an affected system.  An attacker could exploit this vulnerability by sending crafted HTTPS requests to the AP file upload interface. A successful exploit could allow the attacker to upload files, perform path traversal, and execute arbitrary commands with root privileges.",2025-05-07,Nuclei,cpe:2.3:o:cisco:ios_xe:17.11.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.11.99sw:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.13.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.14.1:*:*:*:*:*:*:*,Cisco,Ios Xe
CVE-2025-20281,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.96732,CWE-74,"A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability.

This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.",2025-06-25,CISA/EPSS/Nuclei,cpe:2.3:a:cisco:identity_services_engine:3.3.0:-:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch1:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch2:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch3:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch4:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch5:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch6:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine:3.4.0:-:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch1:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:-:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch1:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch2:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch3:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch4:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch5:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch6:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:-:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch1:*:*:*:*:*:*,Cisco,Identity Services Engine
CVE-2025-20333,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.40391,CWE-120,"A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device.

 This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.",2025-09-25,CISA,cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:firepower_threat_defense:7.6.0:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*,Cisco,Adaptive Security Appliance Software
CVE-2025-20337,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.65098,CWE-74,"A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability.

This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.",2025-07-16,CISA,cpe:2.3:a:cisco:identity_services_engine:3.3.0:-:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch1:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch2:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch3:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch4:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch5:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch6:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine:3.4.0:-:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch1:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:-:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch1:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch2:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch3:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch4:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch5:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch6:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:-:*:*:*:*:*:*;cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch1:*:*:*:*:*:*,Cisco,Identity Services Engine
CVE-2025-20352,7.7,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H,0.37613,CWE-121,"A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the following:

 
 An authenticated, remote attacker with low privileges could cause a denial of service (DoS) condition on an affected device that is running Cisco IOS Software or Cisco IOS XE Software. To cause the DoS, the attacker must have the SNMPv2c or earlier read-only community string or valid SNMPv3 user credentials. 
 An authenticated, remote attacker with high privileges could execute code as the root user on an affected device that is running Cisco IOS XE Software. To execute code as the root user, the attacker must have the SNMPv1 or v2c read-only community string or valid SNMPv3 user credentials and administrative or privilege 15 credentials on the affected device. 
 
 An attacker could exploit this vulnerability by sending a crafted SNMP packet to an affected device over IPv4 or IPv6 networks. 

 This vulnerability is due to a stack overflow condition in the SNMP subsystem of the affected software. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system.

 Note: This vulnerability affects all versions of SNMP.",2025-09-24,CISA,cpe:2.3:o:cisco:ios:12.2\(33\)sxi10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxi11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxi12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxi13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxi14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxi1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxi2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxi2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxi3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxi4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxi4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxi5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxi6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxi7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxi8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxi8a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxi9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxi:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxj10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxj1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxj2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxj3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxj4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxj5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxj6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxj7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxj8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxj9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(33\)sxj:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sq1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sq2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sq3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sq4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sq5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sq6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sq7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(50\)sq:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(53\)ez:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)ez:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(55\)se:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(58\)ez:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(58\)se1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(58\)se2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(58\)se:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:12.2\(60\)ez:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)ey1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)ey2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)ey:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)se1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)se2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)se3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)se:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)sy10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)sy1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)sy2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)sy3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)sy4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)sy5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)sy6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)sy7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)sy7a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)sy8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)sy9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(1\)sy:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ea1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ea:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ej1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ej:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ek1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ek:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ey1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ey2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ey3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)ey:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se10a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)se:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sg10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sg11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sg1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sg2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sg3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sg4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sg5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sg6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sg7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sg8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sg9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sqd1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sqd2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sqd3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sqd4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sqd5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sqd6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sqd7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sqd8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.0\(2\)sqd:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)sg1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)sg2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)sg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)sy1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)sy2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)sy3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)sy4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)sy5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)sy6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(1\)sy:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy16:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.1\(2\)sy:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)e3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)ey:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(1\)sy:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e5a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e5b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)ea1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)ea2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)ea3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)ea:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)gc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)jax:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)jb2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)jb3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)jb4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)jb5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)jb6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)jb:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)sy1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)sy2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)sy3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2\)sy:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2a\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(2a\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)e3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)e4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)ea:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)gc1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3\)gc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(3a\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e10a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e10d:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ea1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ea3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ea4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ea5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ea6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ea7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ea8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ea9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ea9a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ea:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ec1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)ec2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)gc1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)gc2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)gc3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)gc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)jb1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)jb2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)jb3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)jb3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)jb3b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)jb3h:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)jb4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)jb5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)jb6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)jb:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)jn:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m6a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(4\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5\)e2c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5\)ea:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5\)ex:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5a\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5a\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5b\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(5c\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(6\)e0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(6\)e0c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(6\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(6\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(6\)e2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(6\)e2b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(6\)e3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(6\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e0b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e3k:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7a\)e0b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(7b\)e0b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(8\)e1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(8\)e2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(8\)e3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(8\)e4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(8\)e5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(8\)e6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(8\)e7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.2\(8\)e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)sy1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)sy2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)sy:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(1\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(2\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(2\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(2\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(2\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(2\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)ja10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)ja11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)ja12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)ja1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)ja1m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)ja4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)ja5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)ja6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)ja7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)ja8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jaa11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jaa12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jaa:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jab:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jax1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jax2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jax:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jb:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jbb1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jbb2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jbb4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jbb5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jbb6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jbb6a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jbb8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jbb:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jc14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jc1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jc2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jc3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jc4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jc5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jc6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jc8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jc9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jca7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jca8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jca9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jd11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jd13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jd14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jd16:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jd17:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jd2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jd3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jd4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jd5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jd6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jd7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jd8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jd9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jd:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jda11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jda13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jda14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jda16:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jda17:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jda7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jda8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jda9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)je:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jf10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jf11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jf12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jf12i:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jf14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jf14i:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jf15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jf1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jf2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jf4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jf5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jf6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jf7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jf8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jf9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jf:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jg1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jh1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jh:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)ji1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)ji3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)ji4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)ji5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)ji6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jj1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jj:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jk10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jk11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jk1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jk1t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jk2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jk2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jk3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jk4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jk5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jk6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jk7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jk8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jk8a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jk8b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jk9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jk:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jn3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jn4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jn7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jn8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jn9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jnb1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jnb2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jnb3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jnb4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jnb5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jnb6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jnb:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jnc1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jnc4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jnc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jnd1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jnd2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jnd3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jnd:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jnp1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jnp3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jnp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpb1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpb:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpc1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpc2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpc3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpc5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpc:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpd:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpi10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpi1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpi1t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpi4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpi5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpi6a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpi7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpi8a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpi9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpj10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpj11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpj2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpj2t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpj3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpj3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpj4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpj5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpj6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpj7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpj7c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpj8a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpj9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpk1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpk2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpk3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpk4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpk5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpk6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpk7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpk8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpk9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpk:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpl:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpm:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpn1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpn2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpn3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpn4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpn5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpn6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpn:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpo:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpq1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpq2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpq3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpq4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpq5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpq:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpr:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jps:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpt1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpt2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)jpt:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m8a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.3\(3\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)cg1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)cg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)sy1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)sy2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)sy3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)sy4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)sy:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(1\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)cg:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.4\(2\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy14:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy15:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)sy:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(1\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)t4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(2\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m6a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s6a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s6b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s9a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.5\(3\)sn:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)t0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(1\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)s1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)s2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)s3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)s4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sn:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)t1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)t2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)t3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(2\)t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m6a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m6b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.6\(3\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m4b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.7\(3\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m0b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m3b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.8\(3\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m0a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m3b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m6a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m6b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m7a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m8b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios:15.9\(3\)m:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1d:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1f:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1g:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.10.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.11.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.11.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.11.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.11.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.11.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.10a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.11:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.12:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.13:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1w:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1x:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1y:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1z1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.1z2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.5a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.5b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.6a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.12.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.10:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.5a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.6.9:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.7.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.7.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.7.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.7.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.7.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.7.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.1c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.1d:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.1e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.8.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.5f:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:16.9.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.1.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.1.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.1.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.1.1t:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.1.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.10.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.10.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.10.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.11.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.11.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.1w:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.1x:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.1y:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.1z1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.1z2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.1z3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.1z4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.1z:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.4b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.5a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.5b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.12.5c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.13.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.13.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.14.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.14.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.15.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.15.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.15.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.15.1w:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.15.1x:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.15.1y:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.15.1z:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.15.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.15.2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.15.2b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.15.2c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.15.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.15.3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.15.3b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.15.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.16.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.16.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.17.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.18.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.2.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.2.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.2.1r:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.2.1v:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.2.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.2.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.1w:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.1x:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.1z:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.4b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.4c:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.5a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.5b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.3.8a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.4.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.4.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.4.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.4.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.4.2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.5.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.5.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.1w:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.1x:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.1y:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.1z1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.1z:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.5a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.6a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.8:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.6.8a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.7.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.7.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.7.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.7.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.8.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.8.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.1w:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.1x1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.1x:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.1y1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.1y:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.2a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.5a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.5b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.5e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.5f:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.6a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.7:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.7a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:17.9.7b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.0ce:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.0e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.1e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.2e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.10.3e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.0e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.10e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.11e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.12e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.1ae:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.1e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.2e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.3ae:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.3e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.4e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.5e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.6e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.7e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.8e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.11.9e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.14.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.14.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.14.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.14.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.14.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.15.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.15.1cs:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.15.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.15.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.15.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.15.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.0cs:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.10s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.1as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.2as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.2bs:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.3as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.4as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.4bs:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.4ds:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.5s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.6bs:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.6s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.7as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.7bs:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.7s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.8s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.16.9s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.17.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.17.1as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.17.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.17.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.17.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.17.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.0as:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.0s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.0sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.1asp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.1bsp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.1csp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.1s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.1sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.2asp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.2s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.2sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.3asp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.3bsp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.3s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.3sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.4s:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.4sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.5sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.6sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.7sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.8asp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.18.9sp:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.5.0e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.5.0sq:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.5.1e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.5.1sq:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.5.2e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.5.2sq:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.5.3e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.5.3sq:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.5.4sq:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.5.5sq:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.5.6sq:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.5.7sq:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.5.8sq:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.0e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.10e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.1e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.2ae:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.2e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.3e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.4e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.5ae:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.5e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.6e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.7be:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.7e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.8e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.6.9e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.7.0e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.7.1e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.7.2e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.7.3e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.7.4e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.7.5e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.0e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.10e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.1e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.2e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.3e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.4e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.5ae:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.5e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.6e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.7e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.8e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.8.9e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.9.0e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.9.1e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe:3.9.2e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe_sd-wan:16.10.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe_sd-wan:16.10.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe_sd-wan:16.10.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe_sd-wan:16.10.3a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe_sd-wan:16.10.3b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe_sd-wan:16.10.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe_sd-wan:16.10.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe_sd-wan:16.10.6:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe_sd-wan:16.11.1a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe_sd-wan:16.12.1b:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe_sd-wan:16.12.1d:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe_sd-wan:16.12.1e:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe_sd-wan:16.12.2r:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe_sd-wan:16.12.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe_sd-wan:16.12.4:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe_sd-wan:16.12.4a:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe_sd-wan:16.12.5:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe_sd-wan:16.9.1:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe_sd-wan:16.9.2:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe_sd-wan:16.9.3:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ios_xe_sd-wan:16.9.4:*:*:*:*:*:*:*,Cisco,Ios Xe Sd-Wan
CVE-2025-20362,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.85543,CWE-862,"Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software [""#fs""] section of this advisory.

 A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication.

 This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.",2025-09-25,CISA/Nuclei,cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*,Cisco,Adaptive Security Appliance Software
CVE-2025-20393,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.2951,CWE-20,"A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges.

This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with&nbsp;root privileges.",2025-12-17,CISA,cpe:2.3:a:cisco:secure_email_and_web_manager_virtual_appliance_m100v:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_email_and_web_manager_virtual_appliance_m300v:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_email_and_web_manager_virtual_appliance_m600v:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c100v:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c300v:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c600v:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:secure_email_and_web_manager_m170:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:secure_email_and_web_manager_m190:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:secure_email_and_web_manager_m195:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:secure_email_and_web_manager_m380:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:secure_email_and_web_manager_m390:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:secure_email_and_web_manager_m390x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:secure_email_and_web_manager_m395:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:secure_email_and_web_manager_m680:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:secure_email_and_web_manager_m690:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:secure_email_and_web_manager_m690x:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:secure_email_and_web_manager_m695:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:secure_email_gateway_c195:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:secure_email_gateway_c395:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:secure_email_gateway_c695:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*,Cisco,Asyncos
CVE-2025-2075,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02474,CWE-862,"The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.0.2. This is due to add_role() and user_role() functions missing proper capability checks performed through the validate_rest_call() function. This makes it possible for unauthenticated attackers to set the role of arbitrary users to administrator granting full access to the site, though privilege escalation requires an active account on the site so this is considered an authenticated privilege escalation.",2025-04-04,Nuclei,cpe:2.3:a:uncannyowl:uncanny_automator:*:*:*:*:*:wordpress:*:*,Uncannyowl,Uncanny Automator
CVE-2025-21042,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.11606,CWE-787,Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code.,2025-09-12,CISA,cpe:2.3:o:samsung:android:13.0:-:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-apr-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-apr-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-apr-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-aug-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-aug-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-aug-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-dec-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-dec-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-dec-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-dec-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-feb-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-feb-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-feb-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-feb-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jan-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jan-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jan-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jan-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jul-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jul-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jul-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jun-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jun-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jun-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-mar-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-mar-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-mar-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-may-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-may-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-may-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-may-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-nov-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-nov-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-nov-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-nov-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-oct-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-oct-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-oct-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-sep-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-sep-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-sep-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:-:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-apr-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-apr-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-apr-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-aug-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-aug-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-aug-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-dec-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-dec-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-dec-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-dec-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-feb-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-feb-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-feb-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-feb-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-jan-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-jan-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-jan-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-jan-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-jul-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-jul-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-jul-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-jun-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-jun-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-jun-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-mar-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-mar-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-mar-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-mar-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-may-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-may-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-may-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-nov-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-nov-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-nov-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-nov-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-oct-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-oct-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-oct-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-sep-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-sep-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-sep-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:15.0:-:*:*:*:*:*:*;cpe:2.3:o:samsung:android:15.0:smr-mar-2025-r1:*:*:*:*:*:*,Samsung,Android
CVE-2025-21043,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.01435,CWE-787,Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code.,2025-09-12,CISA,cpe:2.3:o:samsung:android:13.0:-:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-apr-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-apr-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-apr-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-apr-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-aug-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-aug-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-aug-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-aug-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-dec-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-dec-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-dec-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-dec-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-feb-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-feb-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-feb-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-feb-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jan-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jan-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jan-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jan-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jul-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jul-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jul-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jul-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jun-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jun-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jun-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-jun-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-mar-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-mar-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-mar-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-mar-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-may-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-may-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-may-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-may-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-nov-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-nov-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-nov-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-nov-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-oct-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-oct-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-oct-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-sep-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-sep-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:13.0:smr-sep-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:-:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-apr-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-apr-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-apr-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-apr-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-aug-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-aug-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-aug-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-aug-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-dec-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-dec-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-dec-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-dec-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-feb-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-feb-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-feb-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-feb-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-jan-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-jan-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-jan-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-jan-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-jul-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-jul-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-jul-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-jul-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-jun-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-jun-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-jun-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-jun-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-mar-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-mar-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-mar-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-mar-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-may-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-may-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-may-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-may-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-nov-2021-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-nov-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-nov-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-nov-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-oct-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-oct-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-oct-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-sep-2022-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-sep-2023-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:14.0:smr-sep-2024-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:15.0:-:*:*:*:*:*:*;cpe:2.3:o:samsung:android:15.0:smr-apr-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:15.0:smr-aug-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:15.0:smr-jul-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:15.0:smr-jun-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:15.0:smr-mar-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:15.0:smr-may-2025-r1:*:*:*:*:*:*;cpe:2.3:o:samsung:android:16.0:-:*:*:*:*:*:*;cpe:2.3:o:samsung:android:16.0:smr-aug-2025-r1:*:*:*:*:*:*,Samsung,Android
CVE-2025-2127,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N,0.0097,CWE-79,A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla. It has been classified as problematic. Affected is an unknown function of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties. The manipulation of the argument Itemid/jp_yearbuilt leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.,2025-03-09,Nuclei,cpe:2.3:a:joomlaux:jux_real_estate:3.4.0:*:*:*:*:joomla:*:*,Joomlaux,Jux Real Estate
CVE-2025-2129,5.6,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L,0.01045,CWE-1188,"A vulnerability was found in Mage AI 0.9.75. It has been classified as problematic. This affects an unknown part. The manipulation leads to insecure default initialization of resource. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. After 7 months of repeated follow-ups by the researcher, Mage AI has decided to not accept this issue as a valid security vulnerability and has confirmed that they will not be addressing it.",2025-03-09,Nuclei,,,
CVE-2025-21293,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.18481,CWE-284,Active Directory Domain Services Elevation of Privilege Vulnerability,2025-01-14,Metasploit,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*,Microsoft,Windows 10 1507
CVE-2025-21333,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.09798,CWE-122,Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability,2025-01-14,CISA,cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*,Microsoft,Windows 10 21H2
CVE-2025-21334,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.0153,CWE-416,Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability,2025-01-14,CISA,cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 21H2
CVE-2025-21335,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01363,CWE-416,Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability,2025-01-14,CISA,cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 21H2
CVE-2025-21391,7.1,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H,0.02258,CWE-59,Windows Storage Elevation of Privilege Vulnerability,2025-02-11,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2025-21418,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01537,CWE-122,Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability,2025-02-11,CISA,cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1607
CVE-2025-21479,8.6,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.00778,CWE-863,Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.,2025-06-03,CISA,"cpe:2.3:h:qualcomm:aqt1000:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_6200:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_6700:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_6800:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_6900:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm4490:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs4490:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd855:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm4635:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6650:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6650p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7325p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7635:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7675:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7675p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8550p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8635:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8635p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8650q:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_460_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_480\+_5g_mobile_platform_\(sm4350-ac\):-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_480_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_4_gen_1_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_662_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_680_4g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_685_4g_mobile_platform_\(sm6225-ad\):-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_690_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_695_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_720g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_778g\+_5g_mobile_platform_\(sm7325-ae\):-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_778g_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_782g_mobile_platform_\(sm7325-af\):-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_7c\+_gen_3_compute:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_855\+\/860_mobile_platform_\(sm8150-ac\):-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_855_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_865\+_5g_mobile_platform_\(sm8250-ab\):-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_865_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_870_5g_mobile_platform_\(sm8250-ac\):-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_888\+_5g_mobile_platform_\(sm8350-ac\):-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_888_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8\+_gen_2_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8_gen_2_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8_gen_3_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_ar1_gen_1:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_ar1_gen_1_platform_\""luna1\"":-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_x55_5g_modem-rf_system:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sxr2230p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sxr2250p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sxr2330p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9341:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9378:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9390:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9395:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3988:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6450:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6650:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6755:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn7861:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn7881:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8832:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8840:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8845:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8845h:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:aqt1000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_6200_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_6700_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_6800_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm4490_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs4490_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd855_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm4635_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6650_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6650p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7325p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7635_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7675_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7675p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8550p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8635_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8635p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8650q_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_460_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_480\+_5g_mobile_platform_\(sm4350-ac\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_480_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_4_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_662_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_680_4g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_685_4g_mobile_platform_\(sm6225-ad\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_690_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_695_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_720g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_778g\+_5g_mobile_platform_\(sm7325-ae\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_778g_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_782g_mobile_platform_\(sm7325-af\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_7c\+_gen_3_compute_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_855\+\/860_mobile_platform_\(sm8150-ac\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_855_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_865\+_5g_mobile_platform_\(sm8250-ab\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_865_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_870_5g_mobile_platform_\(sm8250-ac\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_888\+_5g_mobile_platform_\(sm8350-ac\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_888_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8\+_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_ar1_gen_1_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_ar1_gen_1_platform_\""luna1\""_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_x55_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sxr2230p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sxr2250p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sxr2330p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9341_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9378_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9390_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9395_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6450_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6650_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6755_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn7861_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn7881_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8832_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8840_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8845_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8845h_firmware:-:*:*:*:*:*:*:*",Qualcomm,Aqt1000 Firmware
CVE-2025-21480,8.6,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.00435,CWE-863,Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.,2025-06-03,CISA,"cpe:2.3:h:qualcomm:aqt1000:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_6200:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_6700:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_6800:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_6900:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm4490:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs4490:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sc8380xp:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd855:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm4635:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6650:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6650p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7325p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7635:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7675:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7675p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8550p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8635:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8635p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8650q:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_460_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_480\+_5g_mobile_platform_\(sm4350-ac\):-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_480_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_4_gen_1_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_662_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_680_4g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_685_4g_mobile_platform_\(sm6225-ad\):-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_690_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_695_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_720g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_778g\+_5g_mobile_platform_\(sm7325-ae\):-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_778g_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_782g_mobile_platform_\(sm7325-af\):-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_7c\+_gen_3_compute:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_855\+\/860_mobile_platform_\(sm8150-ac\):-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_855_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_865\+_5g_mobile_platform_\(sm8250-ab\):-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_865_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_870_5g_mobile_platform_\(sm8250-ac\):-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_888\+_5g_mobile_platform_\(sm8350-ac\):-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_888_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8\+_gen_2_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8_gen_2_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8_gen_3_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_ar1_gen_1:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_ar1_gen_1_platform_\""luna1\"":-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_x55_5g_modem-rf_system:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sxr2230p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sxr2250p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sxr2330p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9341:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9378:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9390:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9395:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3988:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6450:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6650:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6755:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn7861:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn7881:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8832:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8840:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8845:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8845h:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:aqt1000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_6200_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_6700_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_6800_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm4490_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs4490_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sc8380xp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd855_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm4635_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6650_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6650p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7325p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7635_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7675_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7675p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8550p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8635_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8635p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8650q_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_460_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_480\+_5g_mobile_platform_\(sm4350-ac\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_480_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_4_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_662_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_680_4g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_685_4g_mobile_platform_\(sm6225-ad\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_690_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_695_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_720g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_778g\+_5g_mobile_platform_\(sm7325-ae\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_778g_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_782g_mobile_platform_\(sm7325-af\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_7c\+_gen_3_compute_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_855\+\/860_mobile_platform_\(sm8150-ac\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_855_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_865\+_5g_mobile_platform_\(sm8250-ab\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_865_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_870_5g_mobile_platform_\(sm8250-ac\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_888\+_5g_mobile_platform_\(sm8350-ac\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_888_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8\+_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_ar1_gen_1_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_ar1_gen_1_platform_\""luna1\""_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_x55_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sxr2230p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sxr2250p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sxr2330p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9341_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9378_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9390_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9395_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6450_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6650_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6755_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn7861_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn7881_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8832_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8840_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8845_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8845h_firmware:-:*:*:*:*:*:*:*",Qualcomm,Aqt1000 Firmware
CVE-2025-21590,4.4,CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N,0.01657,CWE-653,"An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device.

A local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device.
This issue is not exploitable from the Junos CLI.
This issue affects Junos OS: 



  *  All versions before 21.2R3-S9,
  *  21.4 versions before 21.4R3-S10, 
  *  22.2 versions before 22.2R3-S6, 
  *  22.4 versions before 22.4R3-S6, 
  *  23.2 versions before 23.2R2-S3, 
  *  23.4 versions before 23.4R2-S4,
  *  24.2 versions before 24.2R1-S2, 24.2R2.",2025-03-12,CISA,cpe:2.3:o:juniper:junos:*:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s7:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3-s8:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.2:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:*:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s6:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s7:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s8:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3-s9:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:21.4:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r3-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.2:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:*:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r3-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r3-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r3-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r3-s4:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r3-s5:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:22.4:r3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:23.2:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:23.2:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:23.2:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:23.2:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:23.2:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:23.2:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:23.2:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:23.4:*:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:23.4:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:23.4:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:23.4:r1-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:23.4:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:23.4:r2-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:23.4:r2-s2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:23.4:r2-s3:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:23.4:r2:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:24.2:*:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:24.2:-:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:24.2:r1-s1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:24.2:r1:*:*:*:*:*:*;cpe:2.3:o:juniper:junos:24.2:r2:*:*:*:*:*:*,Juniper,Junos
CVE-2025-2221,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01708,CWE-89,"The WPCOM Member plugin for WordPress is vulnerable to time-based SQL Injection via the ‘user_phone’ parameter in all versions up to, and including, 1.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2025-03-14,Nuclei,cpe:2.3:a:wpcom:wpcom_member:*:*:*:*:*:wordpress:*:*,Wpcom,Wpcom Member
CVE-2025-22214,4.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N,0.01262,CWE-89,Landray EIS 2001 through 2006 allows Message/fi_message_receiver.aspx?replyid= SQL injection.,2025-01-02,Nuclei,,,
CVE-2025-22224,9.3,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.01524,CWE-367,"VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.",2025-03-04,CISA,cpe:2.3:a:vmware:cloud_foundation:-:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_infrastructure:2.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_infrastructure:2.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_infrastructure:2.7:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_infrastructure:3.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_platform:2.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_platform:2.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_platform:2.7:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_platform:3.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_platform:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_platform:4.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_platform:5.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:-:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:beta:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_1:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_1a:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_1b:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_1c:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_1d:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_1e:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_2:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_2a:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_2c:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_2d:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_2e:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3c:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3d:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3e:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3f:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3g:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3i:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3j:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3k:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3l:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3m:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3n:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3o:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3p:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3q:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3r:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_1d:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_2b:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_2c:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_3:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_3b:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_3c:*:*:*:*:*:*,Vmware,Esxi
CVE-2025-22225,8.2,CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H,0.00963,CWE-787,VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.,2025-03-04,CISA,cpe:2.3:a:vmware:cloud_foundation:-:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_infrastructure:2.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_infrastructure:2.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_infrastructure:2.7:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_infrastructure:3.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_platform:2.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_platform:2.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_platform:2.7:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_platform:3.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_platform:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_platform:4.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_platform:5.0:*:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:-:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:beta:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_1:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_1a:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_1b:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_1c:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_1d:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_1e:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_2:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_2a:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_2c:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_2d:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_2e:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3c:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3d:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3e:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3f:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3g:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3i:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3j:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3k:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3l:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3m:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3n:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3o:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3p:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3q:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3r:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_1d:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_2b:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_2c:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_3:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_3b:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_3c:*:*:*:*:*:*,Vmware,Esxi
CVE-2025-22226,7.1,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.01676,CWE-125,"VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.",2025-03-04,CISA,cpe:2.3:a:vmware:cloud_foundation:-:*:*:*:*:*:*:*;cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_infrastructure:2.2:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_infrastructure:2.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_infrastructure:2.7:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_infrastructure:3.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_platform:2.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_platform:2.5:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_platform:2.7:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_platform:3.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_platform:4.0.1:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_platform:4.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_platform:5.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:-:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:beta:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_1:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_1a:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_1b:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_1c:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_1d:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_1e:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_2:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_2a:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_2c:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_2d:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_2e:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3c:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3d:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3e:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3f:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3g:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3i:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3j:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3k:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3l:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3m:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3n:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3o:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3p:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3q:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:7.0:update_3r:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_1d:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_2b:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_2c:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_3:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_3b:*:*:*:*:*:*;cpe:2.3:o:vmware:esxi:8.0:update_3c:*:*:*:*:*:*,Vmware,Esxi
CVE-2025-22457,9.0,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H,0.99979,CWE-121,"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.",2025-04-03,CISA/EPSS/Metasploit,cpe:2.3:a:ivanti:connect_secure:*:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:r1.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:r1.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:r1.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:r1.4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:r1.5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:r2.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:r2.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:r2.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:r2.4:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:r2.5:*:*:*:*:*:*;cpe:2.3:a:ivanti:connect_secure:22.7:r2:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:*:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.7:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.7:r1.1:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.7:r1.2:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.7:r1.3:*:*:*:*:*:*;cpe:2.3:a:ivanti:policy_secure:22.7:r1:*:*:*:*:*:*;cpe:2.3:a:ivanti:zero_trust_access_gateway:*:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:zero_trust_access_gateway:22.8:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:zero_trust_access_gateway:22.8:r2.1:*:*:*:*:*:*,Ivanti,Connect Secure
CVE-2025-2264,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.38656,CWE-22,"A Path Traversal Information Disclosure vulnerability exists in ""Sante PACS Server.exe"". An unauthenticated remote attacker can exploit it to download arbitrary files on the disk drive where the application is installed.",2025-03-13,Metasploit/Nuclei,cpe:2.3:a:santesoft:sante_pacs_server:4.1.0:*:*:*:*:*:*:*,Santesoft,Sante Pacs Server
CVE-2025-22785,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L,0.02896,CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ComMotion Course Booking System course-booking-system allows SQL Injection.This issue affects Course Booking System: from n/a through <= 6.0.6.,2025-01-15,Nuclei,,,
CVE-2025-22896,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.03437,CWE-312,"mySCADA myPRO Manager


stores credentials in cleartext, which could allow an attacker to obtain sensitive information.",2025-02-13,Metasploit,cpe:2.3:a:myscada:mypro:*:*:*:*:*:*:*:*,Myscada,Mypro
CVE-2025-2292,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.0161,CWE-22,"Xorcom CompletePBX is vulnerable to an authenticated path traversal, allowing for arbitrary file reads via the Backup and Restore functionality.This issue affects CompletePBX: through 5.2.35.",2025-03-31,Metasploit,cpe:2.3:a:xorcom:completepbx:*:*:*:*:*:*:*:*,Xorcom,Completepbx
CVE-2025-2294,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.76761,CWE-22,"The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via thekubio_hybrid_theme_load_template function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.",2025-03-28,Nuclei,,,
CVE-2025-22952,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02818,CWE-918,"elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.",2025-02-27,Nuclei,cpe:2.3:a:usememos:memos:0.23.0:-:*:*:*:*:*:*,Usememos,Memos
CVE-2025-23006,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.23432,CWE-502,"Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.",2025-01-23,CISA,cpe:2.3:a:sonicwall:sma8200v:*:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma6200:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma6210:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma7200:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma7210:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sra_ex6000:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sra_ex7000:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sra_ex9000:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma6200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma6210_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma7200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma7210_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sra_ex6000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sra_ex7000_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sra_ex9000_firmware:*:*:*:*:*:*:*:*,Sonicwall,Sma6200 Firmware
CVE-2025-23061,9.0,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H,0.07144,CWE-94,"Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.",2025-01-15,Nuclei,cpe:2.3:a:mongoosejs:mongoose:*:*:*:*:*:node.js:*:*,Mongoosejs,Mongoose
CVE-2025-23209,8.0,CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H,0.04356,CWE-94,"Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.",2025-01-18,CISA,cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*;cpe:2.3:a:craftcms:craft_cms:4.0.0:-:*:*:*:*:*:*;cpe:2.3:a:craftcms:craft_cms:4.0.0:rc1:*:*:*:*:*:*;cpe:2.3:a:craftcms:craft_cms:4.0.0:rc2:*:*:*:*:*:*;cpe:2.3:a:craftcms:craft_cms:4.0.0:rc3:*:*:*:*:*:*;cpe:2.3:a:craftcms:craft_cms:5.0.0:-:*:*:*:*:*:*;cpe:2.3:a:craftcms:craft_cms:5.0.0:rc1:*:*:*:*:*:*,Craftcms,Craft Cms
CVE-2025-23211,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.03464,CWE-1336,"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the provided Docker Compose file as root. This vulnerability is fixed in 1.5.24.",2025-01-28,Nuclei,cpe:2.3:a:tandoor:recipes:*:*:*:*:*:*:*:*,Tandoor,Recipes
CVE-2025-24016,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H,0.9384,CWE-502,"Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.",2025-02-10,CISA/Metasploit/Nuclei,cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*,Wazuh,Wazuh
CVE-2025-24054,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.58974,CWE-73,External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.,2025-03-11,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2025-24085,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.18668,CWE-416,"A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3, watchOS 11.3. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2.",2025-01-27,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2025-24200,6.1,CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.04371,CWE-863,"An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5. A physical attack may disable USB Restricted Mode on a locked device. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.",2025-02-10,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2025-24201,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.0424,CWE-787,"An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).",2025-03-11,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*,Apple,Macos
CVE-2025-24354,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00844,CWE-918,"imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES set to false. This can expose services on the local host. This vulnerability is fixed in 3.27.2.",2025-01-27,Nuclei,,,
CVE-2025-24367,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.54024,CWE-144,"Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.",2025-01-27,Metasploit,cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*,Cacti,Cacti
CVE-2025-24472,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03092,CWE-288,"An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.",2025-02-11,CISA,cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*,Fortinet,Fortios
CVE-2025-24514,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.31809,CWE-20,"A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)",2025-03-25,Nuclei,,,
CVE-2025-24582,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00925,CWE-201,Insertion of Sensitive Information Into Sent Data vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Retrieve Embedded Sensitive Data.This issue affects 12 Step Meeting List: from n/a through <= 3.16.5.,2025-01-24,Nuclei,,,
CVE-2025-2473,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.02351,CWE-74,A vulnerability was found in PHPGurukul Company Visitor Management System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /index.php of the component Sign In. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.,2025-03-18,Nuclei,cpe:2.3:a:phpgurukul:company_visitor_management_system:2.0:*:*:*:*:*:*:*,Phpgurukul,Company Visitor Management System
CVE-2025-24786,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N,0.0263,CWE-22,"WhoDB is an open source database management tool. While the application only displays Sqlite3 databases present in the directory `/db`, there is no path traversal prevention in place. This allows an unauthenticated attacker to open any Sqlite3 database present on the host machine that the application is running on. Affected versions of WhoDB allow users to connect to Sqlite3 databases. By default, the databases must be present in `/db/` (or alternatively `./tmp/` if development mode is enabled).  If no databases are present in the default directory, the UI indicates that the user is unable to open any databases. The database file is an user-controlled value. This value is used in `.Join()` with the default directory, in order to get the full path of the database file to open. No checks are performed whether the database file that is eventually opened actually resides in the default directory `/db`. This allows an attacker to use path traversal (`../../`) in order to open any Sqlite3 database present on the system. This issue has been addressed in version 0.45.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.",2025-02-06,Nuclei,cpe:2.3:a:clidey:whodb:*:*:*:*:*:*:*:*,Clidey,Whodb
CVE-2025-24799,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.86067,CWE-89,GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.,2025-03-18,Metasploit/Nuclei,cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*,Glpi-Project,Glpi
CVE-2025-24813,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99945,CWE-44,"Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.
The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions 
may also be affected.


If all of the following were true, a malicious user was able to view       security sensitive files and/or inject content into those files:
- writes enabled for the default servlet (disabled by default)
- support for partial PUT (enabled by default)
- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads
- attacker knowledge of the names of security sensitive files being uploaded
- the security sensitive files also being uploaded via partial PUT

If all of the following were true, a malicious user was able to       perform remote code execution:
- writes enabled for the default servlet (disabled by default)
- support for partial PUT (enabled by default)
- application was using Tomcat's file based session persistence with the default storage location
- application included a library that may be leveraged in a deserialization attack

Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.",2025-03-10,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone17:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone18:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone19:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone20:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone11:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone12:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone13:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone14:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone15:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone16:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone17:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone18:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone19:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone20:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone21:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone22:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone23:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone24:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone25:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:*;cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2025-24865,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.06987,CWE-306,"The administrative web interface of 
mySCADA myPRO Manager

can be accessed without authentication 
which could allow an unauthorized attacker to retrieve sensitive 
information and upload files without the associated password.",2025-02-13,Metasploit,cpe:2.3:a:myscada:mypro:*:*:*:*:*:*:*:*,Myscada,Mypro
CVE-2025-24893,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99864,CWE-95,"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `<host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28""Hello%20from""%20%2B%20""%20search%20text%3A""%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.",2025-02-20,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:5.3:-:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:5.3:milestone2:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:5.3:rc1:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2025-24963,5.9,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02297,CWE-22,"Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a request to that handler from remote to get the content of arbitrary files.This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. This code was added by commit `2d62051`. Users explicitly exposing the browser mode server to the network by `browser.api.host: true` may get any files exposed. This issue has been addressed in versions 2.1.9 and 3.0.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.",2025-02-04,Nuclei,cpe:2.3:a:vitest.dev:vitest:*:*:*:*:*:node.js:*:*,Vitest.Dev,Vitest
CVE-2025-24983,7.0,CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01298,CWE-416,Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.,2025-03-11,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2025-24984,4.6,CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01831,CWE-532,Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.,2025-03-11,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*,Microsoft,Windows 10 1507
CVE-2025-24985,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.03705,CWE-122,Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.,2025-03-11,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*,Microsoft,Windows 10 1507
CVE-2025-24989,8.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N,0.01722,CWE-284,"An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control.
This vulnerability has already been mitigated in the service and all affected customers have been notified. This update addressed the registration control bypass. Affected customers have been given instructions on reviewing their sites for potential exploitation and clean up methods. If you've not been notified this vulnerability does not affect you.",2025-02-19,CISA,cpe:2.3:a:microsoft:power_pages:-:*:*:*:*:*:*:*,Microsoft,Power Pages
CVE-2025-24990,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.06003,CWE-822,"Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems.  This is an announcement of the upcoming removal of ltmdm64.sys driver.  The driver has been removed in the October cumulative update.
Fax modem hardware dependent on this specific driver will no longer work on Windows.
Microsoft recommends removing any existing dependencies on this hardware.",2025-10-14,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2025-24991,5.5,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.01852,CWE-125,Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.,2025-03-11,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*,Microsoft,Windows 10 1507
CVE-2025-24993,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.02092,CWE-122,Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.,2025-03-11,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*,Microsoft,Windows 10 1507
CVE-2025-25034,0.0,,0.02971,CWE-502,"A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the rest_data parameter before passing it to the unserialize() function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. Although SugarCRM released a prior fix in advisory sugarcrm-sa-2016-001, the patch was incomplete and failed to address some vectors. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-13 UTC.",2025-06-20,Metasploit/Nuclei,,,
CVE-2025-25037,0.0,,0.01443,CWE-200,"An information disclosure vulnerability exists in Aquatronica Controller System firmware versions <= 5.1.6 and web interface versions <= 2.0. The tcp.php endpoint fails to restrict unauthenticated access, allowing remote attackers to issue crafted POST requests and retrieve sensitive configuration data, including plaintext administrative credentials. Exploitation of this flaw can lead to full compromise of the system, enabling unauthorized manipulation of connected devices and aquarium parameters.",2025-06-20,Nuclei,,,
CVE-2025-25181,5.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N,0.50863,CWE-89,A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.,2025-02-03,CISA,cpe:2.3:a:advantive:veracore:*:*:*:*:*:*:*:*,Advantive,Veracore
CVE-2025-25205,8.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H,0.03999,CWE-202,"Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL. Attackers can craft URLs containing substrings like ""/api/items/1/cover"" in a query parameter (?r=/api/items/1/cover) to partially bypass authentication or trigger server crashes under certain routes. This could lead to information disclosure of otherwise protected data and, in some cases, a complete denial of service (server crash) if downstream code expects an authenticated user object. Version 2.19.1 contains a patch for the issue.",2025-02-12,Metasploit,cpe:2.3:a:audiobookshelf:audiobookshelf:*:*:*:*:*:*:*:*,Audiobookshelf,Audiobookshelf
CVE-2025-25231,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.20348,CWE-22,Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensitive information by sending crafted GET requests (read-only) to restricted API endpoints.,2025-08-11,Nuclei,,,
CVE-2025-25256,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.5534,CWE-78,"An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and before 6.7.9 allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests.",2025-08-12,Nuclei,cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*,Fortinet,Fortisiem
CVE-2025-25257,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9671,CWE-89,"An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.",2025-07-17,CISA/EPSS/Nuclei,cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*,Fortinet,Fortiweb
CVE-2025-25296,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0185,CWE-79,"Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's `/projects/upload-example` endpoint allows injection of arbitrary HTML through a `GET` request with an appropriately crafted `label_config` query parameter. By crafting a specially formatted XML label config with inline task data containing malicious HTML/JavaScript, an attacker can achieve Cross-Site Scripting (XSS). While the application has a Content Security Policy (CSP), it is only set in report-only mode, making it ineffective at preventing script execution. The vulnerability exists because the upload-example endpoint renders user-provided HTML content without proper sanitization on a GET request. This allows attackers to inject and execute arbitrary JavaScript in victims' browsers by getting them to visit a maliciously crafted URL. This is considered vulnerable because it enables attackers to execute JavaScript in victims' contexts, potentially allowing theft of sensitive data, session hijacking, or other malicious actions. Version 1.16.0 contains a patch for the issue.",2025-02-14,Nuclei,cpe:2.3:a:humansignal:label_studio:*:*:*:*:*:*:*:*,Humansignal,Label Studio
CVE-2025-2539,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01606,CWE-327,"The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers, leveraging the use of a reversible weak algorithm,  to read the contents of arbitrary files on the server, which can contain sensitive information.",2025-03-20,Nuclei,cpe:2.3:a:file_away_project:file_away:*:*:*:*:*:wordpress:*:*,File Away Project,File Away
CVE-2025-25570,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01999,CWE-522,Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials.,2025-02-27,Nuclei,,,
CVE-2025-2558,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.02264,NVD-CWE-noinfo,"The-wound WordPress theme through 0.0.1 does not validate some parameters before using them to generate paths passed to include function/s, allowing unauthenticated users to perform LFI attacks and download arbitrary file from the server",2025-04-24,Nuclei,cpe:2.3:a:the_wound_project:the_wound:*:*:*:*:*:wordpress:*:*,The Wound Project,The Wound
CVE-2025-2563,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.46384,NVD-CWE-noinfo,"The User Registration & Membership  WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges",2025-04-14,Metasploit/Nuclei,cpe:2.3:a:wpeverest:user_registration_\&_membership:*:*:*:*:free:wordpress:*:*;cpe:2.3:a:wpeverest:user_registration_\&_membership:*:*:*:*:pro:wordpress:*:*,Wpeverest,User Registration & Membership
CVE-2025-2609,8.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N,0.01089,CWE-79,"Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read"" cross-site scripting This vulnerability is associated with program files protected/components/MagnusLog.Php.

This issue affects MagnusBilling: through 7.3.0.",2025-03-21,Nuclei,cpe:2.3:a:magnussolution:magnusbilling:*:*:*:*:*:*:*:*,Magnussolution,Magnusbilling
CVE-2025-2610,7.6,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N,0.00888,CWE-79,"Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling (Alarm Module modules) allows authenticated stored cross-site scripting. This vulnerability is associated with program files protected/components/MagnusLog.Php.

This issue affects MagnusBilling: through 7.3.0.",2025-03-21,Nuclei,cpe:2.3:a:magnussolution:magnusbilling:*:*:*:*:*:*:*:*,Magnussolution,Magnusbilling
CVE-2025-2611,0.0,,0.05991,CWE-78,"The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling.




Versions 7.4 and below are known to be vulnerable.",2025-08-05,Metasploit/Nuclei,,,
CVE-2025-26319,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.50789,CWE-434,FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.,2025-03-04,Nuclei,cpe:2.3:a:flowiseai:flowise:2.2.6:-:*:*:*:*:*:*,Flowiseai,Flowise
CVE-2025-2636,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.10241,CWE-22,"The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85 via the 'instawp-database-manager' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file types can be uploaded and included, or are already present on the filesystem locally. There are currently no known vulnerabilities in this plugin that make file upload possible, meaning this won't be exploitable to achieve remote code execution on most instances with just this plugin alone. Another vulnerability would need to be present on the site allowing arbitrary file upload in order to leverage this to achieve remote code execution.",2025-04-11,Nuclei,,,
CVE-2025-26399,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.8833,CWE-502,"SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.",2025-09-23,CISA,cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:web_help_desk:12.8.7:-:*:*:*:*:*:*,Solarwinds,Web Help Desk
CVE-2025-26633,7.0,CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.31894,CWE-707,Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.,2025-03-11,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*,Microsoft,Windows 10 1507
CVE-2025-26793,0.0,,0.02329,CWE-1393,"The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, password viscount). The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires many steps. Attackers can use the credentials over the Internet via mesh.webadmin.MESHAdminServlet to gain access to dozens of Canadian and U.S. apartment buildings and obtain building residents' PII. NOTE: the Supplier's perspective is that the ""vulnerable systems are not following manufacturers' recommendations to change the default password.""",2025-02-15,Nuclei,,,
CVE-2025-27007,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.51036,CWE-266,Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through <= 1.0.82.,2025-05-01,Metasploit/Nuclei,,,
CVE-2025-27038,7.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.00831,CWE-416,Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.,2025-06-03,CISA,cpe:2.3:h:qualcomm:ar8031:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:csra6620:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:csra6640:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca2066:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm6125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm8550:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn9011:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn9012:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs6125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs8550:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6475:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6650:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6650p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7435:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7635:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7635p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smart_audio_400_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_4_gen_2_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_680_4g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_685_4g_mobile_platform_\(sm6225-ad\):-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_6_gen_1_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_w5\+_gen_1_wearable_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sw5100:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sw5100p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:video_collaboration_vc1_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9335:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9378:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9395:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3980:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3988:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6650:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6740:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6755:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8832:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ar8031_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:csra6620_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:csra6640_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca2066_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm6125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm8550_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn9011_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn9012_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs6125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs8550_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6475_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6650_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6650p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7435_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7635_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7635p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smart_audio_400_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_4_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_680_4g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_685_4g_mobile_platform_\(sm6225-ad\)_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_6_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_w5\+_gen_1_wearable_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sw5100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sw5100p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:video_collaboration_vc1_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9335_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9378_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9395_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3980_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6650_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6740_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6755_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8832_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*,Qualcomm,Ar8031 Firmware
CVE-2025-2709,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N,0.00872,CWE-79,A vulnerability has been found in Yonyou UFIDA ERP-NC 5.0 and classified as problematic. This vulnerability affects unknown code of the file /login.jsp. The manipulation of the argument key/redirect leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.,2025-03-24,Nuclei,cpe:2.3:a:yonyou:ufida_erp-nc:5.0:*:*:*:*:*:*:*,Yonyou,Ufida Erp-Nc
CVE-2025-2710,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N,0.00872,CWE-79,A vulnerability was found in Yonyou UFIDA ERP-NC 5.0 and classified as problematic. This issue affects some unknown processing of the file /menu.jsp. The manipulation of the argument flag leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.,2025-03-24,Nuclei,cpe:2.3:a:yonyou:ufida_erp-nc:5.0:*:*:*:*:*:*:*,Yonyou,Ufida Erp-Nc
CVE-2025-2711,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N,0.00872,CWE-79,A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has been classified as problematic. Affected is an unknown function of the file /help/systop.jsp. The manipulation of the argument langcode leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.,2025-03-24,Nuclei,cpe:2.3:a:yonyou:ufida_erp-nc:5.0:*:*:*:*:*:*:*,Yonyou,Ufida Erp-Nc
CVE-2025-27112,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.00947,CWE-287,"Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system, along with a salted hash of an empty password. Under these conditions, Navidrome treats the request as authenticated, granting access to various Subsonic endpoints without requiring valid credentials. An attacker can use any non-existent username to bypass the authentication system and gain access to various read-only data in Navidrome, such as user playlists. However, any attempt to modify data fails with a ""permission denied"" error due to insufficient permissions, limiting the impact to unauthorized viewing of information. Version 0.54.5 contains a patch for this issue.",2025-02-24,Nuclei,cpe:2.3:a:navidrome:navidrome:*:*:*:*:*:go:*:*,Navidrome,Navidrome
CVE-2025-2712,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N,0.0079,CWE-79,A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /help/top.jsp. The manipulation of the argument langcode leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.,2025-03-24,Nuclei,cpe:2.3:a:yonyou:ufida_erp-nc:5.0:*:*:*:*:*:*:*,Yonyou,Ufida Erp-Nc
CVE-2025-27134,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01809,CWE-284,"Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint `PATCH /api/users/:id` to set the `is_admin` field to 1. The vulnerability allows malicious low-privileged users to perform administrative actions without proper authorization. This issue has been patched in version 3.3.3.",2025-04-30,Nuclei,cpe:2.3:a:joplin_project:joplin:*:*:*:*:*:-:*:*,Joplin Project,Joplin
CVE-2025-27218,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.64739,CWE-94,Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization.,2025-02-20,Metasploit/Nuclei,,,
CVE-2025-27222,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.01867,CWE-22,"TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to read any local server file that is accessible by the TRUfusion user and can also be used to leak cleartext passwords of TRUfusion Enterprise itself.",2025-10-27,Nuclei,cpe:2.3:a:rocketsoftware:trufusion_enterprise:*:*:*:*:*:*:*:*,Rocketsoftware,Trufusion Enterprise
CVE-2025-27223,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02071,CWE-1004,"TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList. However, the application uses a static key to create the encrypted cookie, ultimately allowing anyone to forge cookies and gain access to sensitive internal information.",2025-10-27,Nuclei,cpe:2.3:a:rocketsoftware:trufusion_enterprise:*:*:*:*:*:*:*:*,Rocketsoftware,Trufusion Enterprise
CVE-2025-27225,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.17222,CWE-200,TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. This endpoint discloses sensitive internal information including PII to unauthenticated attackers.,2025-10-27,Nuclei,cpe:2.3:a:rocketsoftware:trufusion_enterprise:*:*:*:*:*:*:*:*,Rocketsoftware,Trufusion Enterprise
CVE-2025-27363,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.26049,CWE-787,An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.,2025-03-11,CISA,cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2025-2746,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.58431,CWE-288,An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.,2025-03-24,CISA/Nuclei,cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:*,Kentico,Xperience
CVE-2025-2747,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.92161,CWE-288,An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.,2025-03-24,CISA/Nuclei,cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:*,Kentico,Xperience
CVE-2025-2748,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.59066,CWE-79,"The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.",2025-03-24,Nuclei,cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:*,Kentico,Xperience
CVE-2025-2749,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.03854,CWE-22,"An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.",2025-03-24,CISA,cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:*,Kentico,Xperience
CVE-2025-27505,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01022,CWE-862,"GeoServer is an open source server that allows users to share and edit geospatial data. It is possible to bypass the default REST API security and access the index page. The REST API security handles rest and its subpaths but not rest with an extension (e.g., rest.html). The REST API index can disclose whether certain extensions are installed. This vulnerability is fixed in 2.26.3 and 2.25.6. As a workaround, in ${GEOSERVER_DATA_DIR}/security/config.xml, change the paths for the rest filter to /rest.*,/rest/** and change the paths for the gwc filter to /gwc/rest.*,/gwc/rest/** and restart GeoServer.",2025-06-10,Nuclei,cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*,Osgeo,Geoserver
CVE-2025-27506,5.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N,0.00683,CWE-79,"NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to implementation of the client-side template engine ejs, specifically on file resetPassword.ts where the template is using the insecure function “<%-“, which is rendered by the function renderPasswordReset. This vulnerability is fixed in 0.258.0.",2025-03-06,Nuclei,cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*,Nocodb,Nocodb
CVE-2025-27520,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.35674,CWE-502,BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution (RCE) vulnerability caused by insecure deserialization has been identified in the latest version (v1.4.2) of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. It exists an unsafe code segment in serde.py. This vulnerability is fixed in 1.4.3.,2025-04-04,Metasploit,cpe:2.3:a:bentoml:bentoml:*:*:*:*:*:*:*:*,Bentoml,Bentoml
CVE-2025-2775,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L,0.5461,CWE-611,"SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality,  allowing for administrator account takeover and file read primitives.",2025-05-07,CISA/Nuclei,cpe:2.3:a:sysaid:sysaid:*:*:*:*:on-premises:*:*:*,Sysaid,Sysaid
CVE-2025-2776,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L,0.72971,CWE-611,"SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.",2025-05-07,CISA/Nuclei,cpe:2.3:a:sysaid:sysaid:*:*:*:*:on-premises:*:*:*,Sysaid,Sysaid
CVE-2025-2777,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L,0.79475,CWE-611,"SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality,  allowing for administrator account takeover and file read primitives.",2025-05-07,Nuclei,cpe:2.3:a:sysaid:sysaid:*:*:*:*:on-premises:*:*:*,Sysaid,Sysaid
CVE-2025-27817,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.6468,CWE-918,"A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including ""sasl.oauthbearer.token.endpoint.url"" and ""sasl.oauthbearer.jwks.endpoint.url"". Apache Kafka allows clients to read an arbitrary file and return the content in the error log, or sending requests to an unintended location. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use the ""sasl.oauthbearer.token.endpoint.url"" and ""sasl.oauthbearer.jwks.endpoint.url"" configuratin to read arbitrary contents of the disk and environment variables or make requests to an unintended location. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment/URL access, which may be undesirable in certain environments, including SaaS products. 

Since Apache Kafka 3.9.1/4.0.0, we have added a system property (""-Dorg.apache.kafka.sasl.oauthbearer.allowed.urls"") to set the allowed urls in SASL JAAS configuration. In 3.9.1, it accepts all urls by default for backward compatibility. However in 4.0.0 and newer, the default value is empty list and users have to set the allowed urls explicitly.",2025-06-10,Nuclei,cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*,Apache,Kafka
CVE-2025-2783,8.3,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H,0.08404,NVD-CWE-noinfo,Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High),2025-03-26,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2025-27888,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.01521,CWE-79,"Severity: medium (5.8) / important

Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Druid.

This issue affects all previous Druid versions.


When using the Druid management proxy, a request that has a specially crafted URL could be used to redirect the request to an arbitrary server instead. This has the potential for XSS or XSRF. The user is required to be authenticated for this exploit. The management proxy is enabled in Druid's out-of-box configuration. It may be disabled to mitigate this vulnerability. If the management proxy is disabled, some web console features will not work properly, but core functionality is unaffected.


Users are recommended to upgrade to Druid 31.0.2 or Druid 32.0.1, which fixes the issue.",2025-03-20,Nuclei,cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:*,Apache,Druid
CVE-2025-27892,6.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L,0.11627,CWE-89,Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint. NOTE: this issue exists because of a CVE-2024-22406 and CVE-2024-42357 regression.,2025-04-15,Nuclei,cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*;cpe:2.3:a:shopware:shopware:6.7.0.0:rc1:*:*:*:*:*:*,Shopware,Shopware
CVE-2025-27915,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.04344,CWE-79,"An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.",2025-03-12,CISA/Nuclei,cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p12:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p15:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p21:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24.1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p26:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p27:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p28:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p29:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p30:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p31:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p32:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p33:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p34:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p35:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p36:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p37:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p38:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p39:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p40:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p41:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p42:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p43:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p5:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p6:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p8:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p9:*:*:*:*:*:*,Synacor,Zimbra Collaboration Suite
CVE-2025-27920,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.01782,CWE-24,"Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.",2025-05-05,CISA,cpe:2.3:a:srimax:output_messenger:*:*:*:*:*:*:*:*,Srimax,Output Messenger
CVE-2025-28228,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01754,CWE-522,"A credential exposure vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2 allows unauthorized attackers to access credentials in plaintext.",2025-04-18,Nuclei,cpe:2.3:a:electrolink:fm\/dab\/tv_transmitter_web_management_system:-:*:*:*:*:*:*:*,Electrolink,Fm/Dab/Tv Transmitter Web Management System
CVE-2025-28242,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01805,CWE-384,Improper session management in the /login_ok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session hijacking attack.,2025-04-18,Nuclei,,,
CVE-2025-28367,6.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N,0.02092,CWE-284,mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey.,2025-04-21,Nuclei,cpe:2.3:a:mojoportal:mojoportal:*:*:*:*:*:*:*:*,Mojoportal,Mojoportal
CVE-2025-28906,5.9,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L,0.00492,CWE-79,Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thiago S.F. Skitter Slideshow wp-skitter-slideshow allows Stored XSS.This issue affects Skitter Slideshow: from n/a through <= 2.5.2.,2025-03-11,Nuclei,,,
CVE-2025-2907,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01365,CWE-352,"The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin before 12.3.1. This leads to attackers being able to modify the default_user_role to administrator and users_can_register, allowing them to register as an administrator of the site for complete site takeover.",2025-04-26,Nuclei,cpe:2.3:a:tychesoftwares:order_delivery_date_pro_for_woocommerce:*:*:*:*:*:wordpress:*:*,Tychesoftwares,Order Delivery Date Pro For Woocommerce
CVE-2025-29085,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.28338,CWE-89,SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component.,2025-04-02,Nuclei,,,
CVE-2025-29306,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.43655,CWE-94,An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component.,2025-03-27,Nuclei,cpe:2.3:a:foxcms:foxcms:*:*:*:*:*:*:*:*,Foxcms,Foxcms
CVE-2025-2945,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.46222,CWE-94,"Remote Code Execution security vulnerability in pgAdmin 4  (Query Tool and Cloud Deployment modules).

The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution.


This issue affects pgAdmin 4: before 9.2.",2025-04-03,Metasploit,cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*,Pgadmin,Pgadmin 4
CVE-2025-29635,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.87239,CWE-77,"A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution.",2025-03-25,CISA/Nuclei,cpe:2.3:h:dlink:dir-823x:-:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-823x_firmware:240126:*:*:*:*:*:*:*;cpe:2.3:o:dlink:dir-823x_firmware:240802:*:*:*:*:*:*:*,D-Link,Dir-823X Firmware
CVE-2025-29824,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.13475,CWE-416,Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.,2025-04-08,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*,Microsoft,Windows 10 1507
CVE-2025-29925,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00906,CWE-402,"XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wikis/[wikiName]/pages even if the user doesn't have view rights on them. It's particularly true if the entire wiki is protected with ""Prevent unregistered user to view pages"": the endpoint would still list the pages of the wiki, though only for the main wiki. The problem has been patched in XWiki 15.10.14, 16.4.6, 16.10.0RC1. In those versions the endpoint can still be requested but the result is filtered out based on pages rights.",2025-03-19,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2025-29927,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.99301,CWE-285,"Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.",2025-03-21,EPSS/Metasploit/Nuclei,cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*,Vercel,Next.Js
CVE-2025-30004,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03853,CWE-78,"Xorcom CompletePBX is vulnerable to command injection in the administrator Task Scheduler functionality, allowing for attackers to execute arbitrary commands as the root user.




This issue affects CompletePBX: all versions up to and prior to 5.2.35",2025-03-31,Metasploit,cpe:2.3:a:xorcom:completepbx:*:*:*:*:*:*:*:*,Xorcom,Completepbx
CVE-2025-30005,8.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L,0.01697,CWE-22,"Xorcom CompletePBX is vulnerable to a path traversal via the Diagnostics reporting module, which will allow reading of arbitrary files and additionally delete any retrieved file in place of the expected report.




This issue affects CompletePBX: all versions up to and prior to 5.2.35",2025-03-31,Metasploit,cpe:2.3:a:xorcom:completepbx:*:*:*:*:*:*:*:*,Xorcom,Completepbx
CVE-2025-30066,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.41008,CWE-506,"tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)",2025-03-15,CISA,cpe:2.3:a:tj-actions:changed-files:*:*:*:*:*:*:*:*,Tj-Actions,Changed-Files
CVE-2025-30154,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.02296,CWE-506,"reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.",2025-03-19,CISA,cpe:2.3:a:reviewdog:action-ast-grep:*:*:*:*:*:*:*:*;cpe:2.3:a:reviewdog:action-composite-template:*:*:*:*:*:*:*:*;cpe:2.3:a:reviewdog:action-setup:1:*:*:*:*:*:*:*;cpe:2.3:a:reviewdog:action-shellcheck:*:*:*:*:*:*:*:*;cpe:2.3:a:reviewdog:action-staticcheck:*:*:*:*:*:*:*:*;cpe:2.3:a:reviewdog:action-typos:*:*:*:*:*:*:*:*,Reviewdog,Action-Ast-Grep
CVE-2025-30208,5.3,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N,0.74998,CWE-200,"Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.",2025-03-24,Nuclei,cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*,Vitejs,Vite
CVE-2025-30220,9.9,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L,0.52542,CWE-611,"GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. The gt-xsd-core Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured). This also impacts users of gt-wfs-ng DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended. This vulnerability is fixed in GeoTools 33.1, 32.3, 31.7, and 28.6.1, GeoServer 2.27.1, 2.26.3, and 2.25.7, and GeoNetwork 4.4.8 and 4.2.13.",2025-06-10,Nuclei,cpe:2.3:a:geotools:geotools:*:*:*:*:*:*:*:*;cpe:2.3:a:geotools:geotools:33.0:*:*:*:*:*:*:*;cpe:2.3:a:osgeo:geonetwork:*:*:*:*:*:*:*:*;cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*;cpe:2.3:a:osgeo:geoserver:2.27.0:*:*:*:*:*:*:*,Geotools,Geotools
CVE-2025-30397,7.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,0.21228,CWE-843,Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network.,2025-05-13,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2025-30400,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01763,CWE-416,Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.,2025-05-13,CISA,cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1809
CVE-2025-30406,9.0,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H,0.93842,CWE-321,"Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.",2025-04-03,CISA/Metasploit/Nuclei,cpe:2.3:a:gladinet:centrestack:*:*:*:*:*:*:*:*,Gladinet,Centrestack
CVE-2025-30567,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02628,CWE-22,Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP01 WP01 wp01 allows Path Traversal.This issue affects WP01: from n/a through <= 2.6.2.,2025-03-25,Nuclei,,,
CVE-2025-3096,0.0,,0.01376,CWE-89,Clinic’s Patient Management System versions 2.0 suffers from a SQL injection vulnerability in the login page.,2025-04-01,Metasploit,,,
CVE-2025-3102,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.7568,CWE-697,"The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all versions up to, and including, 1.0.78. This makes it possible for unauthenticated attackers to create administrator accounts on the target website when the plugin is installed and activated but not configured with an API key.",2025-04-10,Metasploit/Nuclei,,,
CVE-2025-31125,5.3,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N,0.58765,CWE-200,"Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.",2025-03-31,CISA/Nuclei,cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*,Vitejs,Vite
CVE-2025-31131,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.05366,CWE-22,"YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability is fixed in 4.5.2.",2025-04-01,Nuclei,cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:*,Yeswiki,Yeswiki
CVE-2025-31161,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99947,CWE-305,"CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka ""Unauthenticated HTTP(S) port access."" A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no password requirement. This will authenticate the session through the HMAC verification process and up until the server checks for user verification once more. The vulnerability can be further stabilized, eliminating the need for successfully triggering a race condition, by sending a mangled AWS4-HMAC header. By providing only the username and a following slash (/), the server will successfully find a username, which triggers the successful anypass authentication process, but the server will fail to find the expected SignedHeaders entry, resulting in an index-out-of-bounds error that stops the code from reaching the session cleanup. Together, these issues make it trivial to authenticate as any known or guessable user (e.g., crushadmin), and can lead to a full compromise of the system by obtaining an administrative account.",2025-04-03,CISA/EPSS/Nuclei,cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*,Crushftp,Crushftp
CVE-2025-31200,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.1966,CWE-119,"A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1.",2025-04-16,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Macos
CVE-2025-31201,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.14652,CWE-1220,"This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.",2025-04-16,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*,Apple,Macos
CVE-2025-31277,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.01481,CWE-119,"The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.",2025-07-30,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:*;cpe:2.3:a:wpewebkit:wpe_webkit:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_aus:8.2:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_aus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_aus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_els:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_tus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_tus:8.8:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:*,Apple,Ipados
CVE-2025-31324,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.99406,CWE-434,"SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.",2025-04-24,CISA/EPSS/Nuclei,cpe:2.3:a:sap:netweaver:7.50:*:*:*:*:*:*:*,Sap,Netweaver
CVE-2025-31486,5.3,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N,0.38685,CWE-200,"Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.",2025-04-03,Nuclei,,,
CVE-2025-31489,0.0,,0.02402,CWE-347,"MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access
to - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl. This issue is fixed in RELEASE.2025-04-03T14-56-28Z.",2025-04-03,Nuclei,,,
CVE-2025-32257,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00801,CWE-1258,Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability in 1clickmigration 1 Click WordPress Migration 1-click-migration allows Retrieve Embedded Sensitive Data.This issue affects 1 Click WordPress Migration: from n/a through <= 2.5.7.,2025-04-04,Nuclei,,,
CVE-2025-32355,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.01249,CWE-918,"Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming connections. However, the proxy is misconfigured in a way that allows specifying absolute URLs in the HTTP request line, causing the proxy to load the given resource.",2026-02-17,Nuclei,cpe:2.3:a:rocketsoftware:trufusion_enterprise:*:*:*:*:*:*:*:*,Rocketsoftware,Trufusion Enterprise
CVE-2025-32375,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.50446,CWE-502,"BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized arbitrary code on the server, which will grant the attackers to have the initial access and information disclosure on the server. This vulnerability is fixed in 1.4.8.",2025-04-09,Metasploit,cpe:2.3:a:bentoml:bentoml:*:*:*:*:*:*:*:*,Bentoml,Bentoml
CVE-2025-32395,0.0,,0.01725,CWE-200,"Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. HTTP 1.1 spec (RFC 9112) does not allow # in request-target. Although an attacker can send such a request. For those requests with an invalid request-line (it includes request-target), the spec recommends to reject them with 400 or 301. The same can be said for HTTP 2. On Node and Bun, those requests are not rejected internally and is passed to the user land. For those requests, the value of http.IncomingMessage.url contains #. Vite assumed req.url won't contain # when checking server.fs.deny, allowing those kinds of requests to bypass the check. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) and running the Vite dev server on runtimes that are not Deno (e.g. Node, Bun) are affected. This vulnerability is fixed in 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13.",2025-04-10,Nuclei,,,
CVE-2025-32429,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.8541,CWE-89,"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. This is fixed in versions 16.10.6 and 17.3.0-rc-1.",2025-07-24,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2025-32430,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00634,CWE-79,"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-3 through 16.4.7, 16.5.0-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, two templates contain reflected XSS vulnerabilities, allowing an attacker to execute malicious JavaScript code in the context of the victim's session by getting the victim to visit an attacker-controlled URL. This permits the attacker to perform arbitrary actions using the permissions of the victim. This issue is fixed in versions 16.4.8, 16.10.6 and 17.3.0-rc-1. To workaround the issue, manually patch the WAR with the same changes as the original patch.",2025-08-06,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:16.5.0:rc1:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:4.2:milestone3:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2025-32432,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L,0.99829,CWE-94,"Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.",2025-04-25,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*,Craftcms,Craft Cms
CVE-2025-32433,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.98594,CWE-306,"Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.",2025-04-16,CISA/EPSS/Metasploit,cpe:2.3:a:cisco:cloud_native_broadband_network_gateway:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:enterprise_nfv_infrastructure_software:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:inode_manager:-:*:*:*:*:*:*:*;cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:optical_site_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:smart_phy:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ultra_cloud_core:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ultra_packet_core:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:ultra_services_platform:-:*:*:*:*:*:*:*;cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_1001:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_1002:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_1004:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:ncs_2000_shelf_virtualization_orchestrator_module:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv160:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv160w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv260:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv260p:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv260w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv340:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv340w:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv345:-:*:*:*:*:*:*:*;cpe:2.3:h:cisco:rv345p:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:ncs_2000_shelf_virtualization_orchestrator_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv160_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv160w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv260_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv260p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv260w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv340_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv340w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv345_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:rv345p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:cisco:staros:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*,Cisco,Ncs 2000 Shelf Virtualization Orchestrator Firmware
CVE-2025-32463,9.3,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.48239,CWE-829,Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.,2025-06-30,CISA/Metasploit,cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*;cpe:2.3:a:sudo_project:sudo:1.9.17:-:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:24.10:*:*:*:-:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:25.04:*:*:*:-:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:13.0:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:15:sp6:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:15:sp7:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp2:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp6:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp7:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server_for_sap:12:sp6:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server_for_sap:12:sp7:*:*:*:*:*:*,Canonical,Ubuntu Linux
CVE-2025-3248,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.9999,CWE-306,"Langflow versions prior to 1.3.0 are susceptible to code injection in 
the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary
code.",2025-04-07,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*,Langflow,Langflow
CVE-2025-32614,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.0187,CWE-98,Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ashan Perera EventON eventon-lite allows PHP Local File Inclusion.This issue affects EventON: from n/a through <= 2.4.,2025-04-11,Nuclei,,,
CVE-2025-32701,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01291,CWE-416,Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.,2025-05-13,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2025-32706,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02129,CWE-20,Improper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.,2025-05-13,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2025-32709,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01658,CWE-416,Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.,2025-05-13,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2025-32756,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.31974,CWE-121,"A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.7, FortiNDR 7.2.0 through 7.2.4, FortiNDR 7.0.0 through 7.0.6, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0.0 through 7.0.5, FortiRecorder 6.4.0 through 6.4.5, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6, FortiVoice 6.4.0 through 6.4.10 allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.",2025-05-13,CISA,cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortindr:*:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortindr:1.1.0:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortindr:1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortindr:1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortindr:1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortindr:1.5.0:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortindr:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortindr:7.1.1:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortindr:7.6.0:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortirecorder:*:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortivoice:*:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortivoice:7.2.0:*:*:*:*:*:*:*;cpe:2.3:h:fortinet:forticamera:-:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:forticamera_firmware:*:*:*:*:*:*:*:*,Fortinet,Forticamera Firmware
CVE-2025-32778,0.0,,0.19326,CWE-78,"Web-Check is an all-in-one OSINT tool for analyzing any website. A command injection vulnerability exists in the screenshot API of the Web Check project (Lissy93/web-check). The issue stems from user-controlled input (url) being passed unsanitized into a shell command using exec(), allowing attackers to execute arbitrary system commands on the underlying host. This could be exploited by sending crafted url parameters to extract files or even establish remote access. The vulnerability has been patched by replacing exec() with execFile(), which avoids using a shell and properly isolates arguments.",2025-04-15,Metasploit/Nuclei,,,
CVE-2025-32813,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.4781,CWE-77,An issue was discovered in Infoblox NETMRI before 7.6.1. Remote Unauthenticated Command Injection can occur.,2025-05-22,Nuclei,cpe:2.3:a:infoblox:netmri:*:*:*:*:*:*:*:*,Infoblox,Netmri
CVE-2025-32814,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.38098,CWE-89,An issue was discovered in Infoblox NETMRI before 7.6.1. Unauthenticated SQL Injection can occur.,2025-05-22,Nuclei,cpe:2.3:a:infoblox:netmri:*:*:*:*:*:*:*:*,Infoblox,Netmri
CVE-2025-32815,6.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N,0.39695,CWE-287,An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur.,2025-05-22,Nuclei,cpe:2.3:a:infoblox:netmri:*:*:*:*:*:*:*:*,Infoblox,Netmri
CVE-2025-32966,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04309,CWE-290,"DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.8, authenticated users can complete RCE through the backend JDBC link. This issue has been patched in version 2.10.8.",2025-04-23,Nuclei,cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*,Dataease,Dataease
CVE-2025-32969,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.80716,CWE-89,"XWiki is a generic wiki platform. In versions starting from 1.8 and prior to 15.10.16, 16.4.6, and 16.10.1, it is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend, including when ""Prevent unregistered users from viewing pages, regardless of the page rights"" and ""Prevent unregistered users from editing pages, regardless of the page rights"" options are enabled. Depending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This issue has been patched in versions 16.10.1, 16.4.6 and 15.10.16. There is no known workaround, other than upgrading XWiki.",2025-04-23,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2025-32970,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00572,CWE-601,"XWiki is a generic wiki platform. In versions starting from 13.5-rc-1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0, an open redirect vulnerability in the HTML conversion request filter allows attackers to construct URLs on an XWiki instance that redirects to any URL. This issue has been patched in versions 15.10.13, 16.4.4, and 16.8.0.",2025-04-30,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:16.8.0:rc1:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2025-32975,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.02417,CWE-287,"Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. The vulnerability exists in the SSO authentication handling mechanism and can lead to complete administrative takeover.",2025-06-24,CISA,cpe:2.3:a:quest:kace_systems_management_appliance:*:*:*:*:*:*:*:*,Quest,Kace Systems Management Appliance
CVE-2025-33053,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.82097,CWE-73,External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.,2025-06-10,CISA/Metasploit,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*,Microsoft,Windows 10 1507
CVE-2025-33073,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.78515,CWE-284,Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.,2025-06-10,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2025-34023,0.0,,0.01441,CWE-22,"A path traversal vulnerability exists in the Karel IP1211 IP Phone's web management panel. The /cgi-bin/cgiServer.exx endpoint fails to properly sanitize user input to the page parameter, allowing remote authenticated attackers to access arbitrary files on the underlying system by using crafted path traversal sequences. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.",2025-06-20,Nuclei,,,
CVE-2025-34026,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.8323,CWE-288,"The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.",2025-05-21,CISA/Nuclei,cpe:2.3:a:versa-networks:concerto:*:*:*:*:*:*:*:*;cpe:2.3:a:versa-networks:concerto:12.1.2:-:*:*:*:*:*:*;cpe:2.3:a:versa-networks:concerto:12.2.0:*:*:*:*:*:*:*,Versa-Networks,Concerto
CVE-2025-34027,0.0,,0.36602,CWE-367,"The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The Spack upload endpoint can be leveraged for a Time-of-Check to Time-of-Use (TOCTOU) write in combination with a race condition to achieve remote code execution via path loading manipulation, allowing an unauthenticated actor to achieve remote code execution (RCE).This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.",2025-05-21,Nuclei,,,
CVE-2025-34028,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.97292,CWE-22,"The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP.





This issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438.",2025-04-22,CISA/EPSS/Nuclei,cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2025-34030,0.0,,0.60635,CWE-78,"An OS command injection vulnerability exists in sar2html version 3.2.2 and prior via the plot parameter in index.php. The application fails to sanitize user-supplied input before using it in a system-level context. Remote, unauthenticated attackers can inject shell commands by appending them to the plot parameter (e.g., ?plot=;id) in a crafted GET request. The output of the command is displayed in the application's interface after interacting with the host selection UI. Successful exploitation leads to arbitrary command execution on the underlying system. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-04 UTC.",2025-06-20,Nuclei,,,
CVE-2025-34031,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02963,CWE-22,"A path traversal vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the query parameter in jsmol.php. The script directly passes user input to the file_get_contents() function without proper validation, allowing attackers to read arbitrary files from the server's filesystem by crafting a malicious query value. This vulnerability can be exploited without authentication and may expose sensitive configuration data, including database credentials. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.",2025-06-24,Nuclei,cpe:2.3:a:geoffrowland:jmol:*:*:*:*:*:moodle:*:*,Geoffrowland,Jmol
CVE-2025-34032,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00626,CWE-79,"A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.",2025-06-24,Nuclei,cpe:2.3:a:geoffrowland:jmol:*:*:*:*:*:moodle:*:*,Geoffrowland,Jmol
CVE-2025-34035,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.12334,CWE-78,"An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected commands are executed with root privileges, leading to full system compromise. Exploitation evidence was observed by the Shadowserver Foundation on 2024-12-05 UTC.",2025-06-24,Nuclei,cpe:2.3:h:engeniustech:epg5000:-:*:*:*:*:*:*:*;cpe:2.3:h:engeniustech:esr1200:-:*:*:*:*:*:*:*;cpe:2.3:h:engeniustech:esr1750:-:*:*:*:*:*:*:*;cpe:2.3:h:engeniustech:esr300:-:*:*:*:*:*:*:*;cpe:2.3:h:engeniustech:esr350:-:*:*:*:*:*:*:*;cpe:2.3:h:engeniustech:esr600:-:*:*:*:*:*:*:*;cpe:2.3:h:engeniustech:esr900:-:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:epg5000_firmware:1.2.0:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:epg5000_firmware:1.3.0:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:epg5000_firmware:1.3.2:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:epg5000_firmware:1.3.3.17:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:epg5000_firmware:1.3.3:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:epg5000_firmware:1.3.7.20:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:epg5000_firmware:1.3.9.21:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr1200_firmware:1.1.0:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr1200_firmware:1.3.1.34:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr1200_firmware:1.4.1:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr1200_firmware:1.4.3:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr1200_firmware:1.4.5:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr1750_firmware:1.1.0:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr1750_firmware:1.2.2.27:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr1750_firmware:1.3.0:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr1750_firmware:1.3.1.34:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr1750_firmware:1.4.0:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr1750_firmware:1.4.1:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr1750_firmware:1.4.3:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr1750_firmware:1.4.5:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr300_firmware:1.1.0.28:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr300_firmware:1.3.1.42:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr300_firmware:1.4.0:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr300_firmware:1.4.1.28:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr300_firmware:1.4.2:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr300_firmware:1.4.7:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr300_firmware:1.4.9:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr350_firmware:1.1.0.29:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr350_firmware:1.3.1.41:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr350_firmware:1.4.0:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr350_firmware:1.4.11:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr350_firmware:1.4.2:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr350_firmware:1.4.5:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr350_firmware:1.4.9:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr600_firmware:1.1.0.50:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr600_firmware:1.2.1.46:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr600_firmware:1.3.1.63:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr600_firmware:1.4.0.23:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr600_firmware:1.4.11:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr600_firmware:1.4.1:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr600_firmware:1.4.2:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr600_firmware:1.4.3:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr600_firmware:1.4.5:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr600_firmware:1.4.9:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr900_firmware:1.1.0:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr900_firmware:1.2.2.23:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr900_firmware:1.3.0:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr900_firmware:1.3.1.26:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr900_firmware:1.3.5.18:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr900_firmware:1.4.0:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr900_firmware:1.4.3:*:*:*:*:*:*:*;cpe:2.3:o:engeniustech:esr900_firmware:1.4.5:*:*:*:*:*:*:*,Engeniustech,Esr300 Firmware
CVE-2025-34037,0.0,,0.85785,CWE-78,"An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the ""TheMoon"" worm  in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.",2025-06-24,Metasploit,,,
CVE-2025-34038,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01837,CWE-89,"A SQL injection vulnerability exists in Weaver E-cology 8.0 via the getdata.jsp endpoint. The application directly passes unsanitized user input from the sql parameter into a database query within the getSelectAllIds(sql, type) method, reachable through the cmd=getSelectAllId workflow in the AjaxManager. This allows unauthenticated attackers to execute arbitrary SQL queries, potentially exposing sensitive data such as administrator password hashes. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.",2025-06-24,Nuclei,cpe:2.3:a:weaver:e-cology:*:*:*:*:*:*:*:*,Weaver,E-Cology
CVE-2025-34040,0.0,,0.1438,CWE-22,"An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-01 UTC.",2025-06-24,Nuclei,,,
CVE-2025-34045,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.04311,CWE-22,"A path traversal vulnerability exists in WeiPHP 5.0, an open source WeChat public account platform development framework by Shenzhen Yuanmengyun Technology Co., Ltd. The flaw occurs in the picUrl parameter of the /public/index.php/material/Material/_download_imgage endpoint, where insufficient input validation allows unauthenticated remote attackers to perform directory traversal via crafted POST requests. This enables arbitrary file read on the server, potentially exposing sensitive information such as configuration files and source code. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.",2025-06-26,Nuclei,cpe:2.3:a:weiphp:weiphp:5.0:*:*:*:*:*:*:*,Weiphp,Weiphp
CVE-2025-34061,0.0,,0.01172,CWE-94,"A backdoor in PHPStudy versions 2016 through 2018 allows unauthenticated remote attackers to execute arbitrary PHP code on affected installations. The backdoor listens for base64-encoded PHP payloads in the Accept-Charset HTTP header of incoming requests, decodes and executes the payload without proper validation. This leads to remote code execution as the web server user, compromising the affected system.",2025-07-03,Metasploit,,,
CVE-2025-34073,0.0,,0.03884,CWE-78,"An unauthenticated command injection vulnerability exists in stamparm/maltrail (Maltrail) versions <=0.54. A remote attacker can execute arbitrary operating system commands via the username parameter in a POST request to the /login endpoint. This occurs due to unsafe handling of user-supplied input passed to subprocess.check_output() in core/http.py, allowing injection of shell metacharacters. Exploitation does not require authentication and commands are executed with the privileges of the Maltrail process.",2025-07-02,Metasploit/Nuclei,,,
CVE-2025-34074,0.0,,0.01134,CWE-94,"An authenticated remote code execution vulnerability exists in Lucee’s administrative interface due to insecure design in the scheduled task functionality. An administrator with access to /lucee/admin/web.cfm can configure a scheduled job to retrieve a remote .cfm file from an attacker-controlled server, which is written to the Lucee webroot and executed with the privileges of the Lucee service account. Because Lucee does not enforce integrity checks, path restrictions, or execution controls for scheduled task fetches, this feature can be abused to achieve arbitrary code execution. This issue is distinct from CVE-2024-55354.",2025-07-02,Metasploit,,,
CVE-2025-34076,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.01315,CWE-22,"An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the underlying filesystem. By specifying an absolute file path in the src parameter of the upload request, the server may relocate or delete the target file depending on the web service user’s privileges. The corresponding download endpoint can then be used to retrieve the file contents, effectively enabling local file disclosure. This behavior stems from insufficient validation of user-supplied paths and inadequate restrictions on file access and backup logic.",2025-07-02,Metasploit,cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*,Microweber,Microweber
CVE-2025-34077,0.0,,0.09903,CWE-94,"An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manipulating the user_id_social_site parameter, an attacker can generate a valid WordPress session cookie for any user ID, including administrators. Once authenticated, the attacker may exploit plugin upload functionality to install a malicious plugin containing arbitrary PHP code, resulting in remote code execution on the underlying server.",2025-07-09,Metasploit/Nuclei,,,
CVE-2025-34078,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.00513,CWE-522,"A local privilege escalation vulnerability exists in NSClient++ 0.5.2.35 when both the web interface and ExternalScripts features are enabled. The configuration file (nsclient.ini) stores the administrative password in plaintext and is readable by local users. By extracting this password, an attacker can authenticate to the NSClient++ web interface (typically accessible on port 8443) and abuse the ExternalScripts plugin to inject and execute arbitrary commands as SYSTEM by registering a custom script, saving the configuration, and triggering it via the API.

This behavior is documented but insecure, as the plaintext credential exposure undermines access isolation between local users and administrative functions.",2025-07-02,Metasploit,cpe:2.3:a:nsclient:nsclient\+\+:0.5.2.35:*:*:*:*:*:*:*,Nsclient,Nsclient++
CVE-2025-34079,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01277,CWE-94,"An authenticated remote code execution vulnerability exists in NSClient++ version 0.5.2.35 when the web interface and ExternalScripts module are enabled. A remote attacker with the administrator password can authenticate to the web interface (default port 8443), inject arbitrary commands as external scripts via the /settings/query.json API, save the configuration, and trigger the script via the /query/{name} endpoint. The injected commands are executed with SYSTEM privileges, enabling full remote compromise.

This capability is an intended feature, but the lack of safeguards or privilege separation makes it risky when exposed to untrusted actors.",2025-07-02,Metasploit,cpe:2.3:a:nsclient:nsclient\+\+:0.5.2.35:*:*:*:*:*:*:*,Nsclient,Nsclient++
CVE-2025-34082,0.0,,0.05277,CWE-78,"A command injection vulnerability exists in IGEL OS versions prior to 11.04.270 within the Secure Terminal and Secure Shadow services. The flaw arises due to improper input sanitization in the handling of specially crafted PROXYCMD commands on TCP ports 30022 and 5900. An unauthenticated attacker with network access to a vulnerable device can inject arbitrary commands, leading to remote code execution with elevated privileges.

NOTE: IGEL OS v10.x has reached end-of-life (EOL) status.",2025-07-03,Metasploit,,,
CVE-2025-34086,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02198,CWE-94,"Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field of the user profile, which is rendered unsanitized in backend templates. The attacker can then list and rename cached session files via the /async/browse/cache/.sessions and /async/folder/rename endpoints. By renaming a .session file to a path under the publicly accessible /files/ directory with a .php extension, the attacker can turn the injected code into an executable web shell. Finally, the attacker triggers the payload via a crafted HTTP GET request to the rogue file.

NOTE: The vendor announced that Bolt 3 reached end-of-life after 31 December 2021.",2025-07-03,Metasploit,cpe:2.3:a:boltcms:bolt:*:*:*:*:*:*:*:*,Boltcms,Bolt
CVE-2025-34087,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.04967,CWE-78,"An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. When adding a domain to the allowlist via the web interface, the domain parameter is not properly sanitized, allowing an attacker to append OS commands to the domain string. These commands are executed on the underlying operating system with the privileges of the Pi-hole service user.




This behavior was present in the legacy AdminLTE interface and has since been patched in later versions.",2025-07-03,Metasploit,cpe:2.3:a:pi-hole:pi-hole:*:*:*:*:*:*:*:*,Pi-Hole,Pi-Hole
CVE-2025-34088,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.0509,CWE-78,"An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php functionality allows authenticated users to execute arbitrary OS commands via the select_ips parameter when performing network tools operations, such as pinging. This occurs because user input is not properly sanitized before being passed to system commands, enabling command injection.",2025-07-03,Metasploit,cpe:2.3:a:pandorafms:pandora_fms:*:*:*:*:*:*:*:*,Pandorafms,Pandora Fms
CVE-2025-34089,0.0,,0.01389,CWE-94,"An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility developed by Aexol Studio, in versions up to and including 2025.7. When the application is configured with authentication disabled (i.e., the ""Allow unknown devices"" option is enabled), the /api/executeScript endpoint is exposed without access control. This allows unauthenticated remote attackers to inject arbitrary AppleScript payloads via the X-Script HTTP header, resulting in code execution using do shell script. Successful exploitation grants attackers the ability to run arbitrary commands on the macOS host with the privileges of the Remote for Mac background process.",2025-07-03,Metasploit,,,
CVE-2025-34093,0.0,,0.0201,CWE-78,"An authenticated command injection vulnerability exists in the Polycom HDX Series command shell interface accessible over Telnet. The lan traceroute command in the devcmds console accepts unsanitized input, allowing attackers to execute arbitrary system commands. By injecting shell metacharacters through the traceroute interface, an attacker can achieve remote code execution under the context of the root user. This flaw affects systems where Telnet access is enabled and either unauthenticated access is allowed or credentials are known.",2025-07-10,Metasploit,,,
CVE-2025-34095,0.0,,0.04418,CWE-78,"An OS command injection vulnerability exists in Mako Server versions 2.5 and 2.6, specifically within the tutorial interface provided by the examples/save.lsp endpoint. An unauthenticated attacker can send a crafted PUT request containing arbitrary Lua os.execute() code, which is then persisted on disk and triggered via a subsequent GET request to examples/manage.lsp. This allows remote command execution on the underlying operating system, impacting both Windows and Unix-based deployments.",2025-07-10,Metasploit,,,
CVE-2025-34096,0.0,,0.01077,CWE-119,"A stack-based buffer overflow vulnerability exists in Easy File Sharing HTTP Server version 7.2. The flaw is triggered when a crafted POST request is sent to the /sendemail.ghp endpoint containing an overly long Email parameter. The application fails to properly validate the length of this field, resulting in a memory corruption condition. An unauthenticated remote attacker can exploit this to execute arbitrary code with the privileges of the server process.",2025-07-10,Metasploit,,,
CVE-2025-34097,0.0,,0.01029,CWE-434,"An unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of uploaded plugin archives. An attacker with administrative privileges can upload a malicious .tar plugin file containing arbitrary PHP code. Upon installation, the plugin’s install() method is invoked, resulting in execution of attacker-supplied PHP code on the server with the privileges of the web server user. This vulnerability can be chained with CVE-2022-38577 — a privilege escalation flaw in the user profile page — to achieve full remote code execution from a low-privileged account.",2025-07-10,Metasploit,,,
CVE-2025-34098,0.0,,0.00717,CWE-200,"A path traversal vulnerability exists in Riverbed SteelHead VCX appliances (confirmed in VCX255U 9.6.0a) due to improper input validation in the log filtering functionality exposed via the management web interface. An authenticated attacker can exploit this flaw by submitting crafted filter expressions to the log_filter endpoint using the filterStr parameter. This input is processed by a backend parser that permits execution of file expansion syntax, allowing the attacker to retrieve arbitrary system files via the log viewing interface.",2025-07-10,Metasploit,,,
CVE-2025-34099,0.0,,0.01182,CWE-20,"An unauthenticated command injection vulnerability exists in VICIdial versions 2.9 RC1 through 2.13 RC1, within the vicidial_sales_viewer.php component when password encryption is enabled (a non-default configuration). The application improperly passes the HTTP Basic Authentication password directly to a call to exec() without adequate sanitation. This allows remote attackers to inject and execute arbitrary operating system commands as the web server user. NOTE: This vulnerability was mitigated in 2017.",2025-07-10,Metasploit,,,
CVE-2025-34100,0.0,,0.02313,CWE-20,"An unrestricted file upload vulnerability exists in BuilderEngine 3.5.0 via the integration of the elFinder 2.0 file manager and its use of the jQuery File Upload plugin. The plugin fails to properly validate or restrict file types or locations during upload operations, allowing an attacker to upload a malicious .php file and subsequently execute arbitrary PHP code on the server under the context of the web server process. While the root vulnerability lies within the jQuery File Upload component, BuilderEngine’s improper integration and lack of access controls expose this functionality to unauthenticated users, resulting in full remote code execution.",2025-07-10,Metasploit,,,
CVE-2025-34101,0.0,,0.0309,CWE-20,"An unauthenticated command injection vulnerability exists in Serviio Media Server versions 1.4 through 1.8 on Windows, in the /rest/action API endpoint exposed by the console component (default port 23423). The checkStreamUrl method accepts a VIDEO parameter that is passed unsanitized to a call to cmd.exe, enabling arbitrary command execution under the privileges of the web server. No authentication is required to exploit this issue, as the REST API is exposed by default and lacks access controls.",2025-07-10,Metasploit,,,
CVE-2025-34102,0.0,,0.06766,CWE-20,"A remote code execution vulnerability exists in CryptoLog (PHP version, discontinued since 2009) due to a chained exploitation of SQL injection and command injection vulnerabilities. An unauthenticated attacker can gain shell access as the web server user by first exploiting a SQL injection flaw in login.php to bypass authentication, followed by command injection in logshares_ajax.php to execute arbitrary operating system commands.


The login bypass is achieved by submitting crafted SQL via the user POST parameter. Once authenticated, the attacker can abuse the lsid POST parameter in the logshares_ajax.php endpoint to inject and execute a command using $(...) syntax, resulting in code execution under the web context.


This exploitation path does not exist in the ASP.NET version of CryptoLog released since 2009.",2025-07-10,Metasploit,,,
CVE-2025-34103,0.0,,0.04232,CWE-78,"An unauthenticated command injection vulnerability exists in WePresent WiPG-1000 firmware versions prior to 2.2.3.0, due to improper input handling in the undocumented /cgi-bin/rdfs.cgi endpoint. The Client parameter is not sanitized before being passed to a system call, allowing an unauthenticated remote attacker to execute arbitrary commands as the web server user.",2025-07-15,Metasploit,,,
CVE-2025-34104,0.0,,0.01128,CWE-306,"An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism. In vulnerable versions, an authenticated user with Superuser privileges can upload and activate a malicious plugin (ZIP archive), leading to arbitrary PHP code execution on the underlying system. Starting with version 3.0.3, plugin upload functionality is disabled by default unless explicitly enabled in the configuration file.",2025-07-15,Metasploit,,,
CVE-2025-34105,0.0,,0.00999,CWE-20,"A stack-based buffer overflow vulnerability exists in the built-in web interface of DiskBoss Enterprise versions 7.4.28, 7.5.12, and 8.2.14. The vulnerability arises from improper bounds checking on the path component of HTTP GET requests. By sending a specially crafted long URI, a remote unauthenticated attacker can trigger a buffer overflow, potentially leading to arbitrary code execution with SYSTEM privileges on vulnerable Windows hosts.",2025-07-15,Metasploit,,,
CVE-2025-34106,0.0,,0.0033,CWE-119,"A buffer overflow vulnerability exists in PDF Shaper versions 3.5 and 3.6 when converting a crafted PDF file to an image using the 'Convert PDF to Image' functionality. An attacker can exploit this vulnerability by tricking a user into opening a maliciously crafted PDF file, leading to arbitrary code execution under the context of the user. This vulnerability has been verified on Windows XP, 7, 8, and 10 platforms using the PDFTools.exe component.",2025-07-15,Metasploit,,,
CVE-2025-34107,0.0,,0.00757,CWE-121,"A buffer overflow vulnerability exists in the WinaXe FTP Client version 7.7 within the FTP banner parsing functionality, WCMDPA10.dll. When the client connects to a remote FTP server and receives an overly long '220 Server Ready' response, the vulnerable component responsible for parsing the banner overflows a stack buffer, leading to arbitrary code execution under the context of the user.",2025-07-15,Metasploit,,,
CVE-2025-34108,0.0,,0.00862,CWE-20,"A stack-based buffer overflow vulnerability exists in the login functionality of Disk Pulse Enterprise version 9.0.34. An attacker can send a specially crafted HTTP POST request to the /login endpoint with an overly long username parameter, causing a buffer overflow in the libspp.dll component. Successful exploitation allows arbitrary code execution with SYSTEM privileges.",2025-07-15,Metasploit,,,
CVE-2025-34109,0.0,,0.00284,CWE-427,"PSEvents.exe in multiple Panda Security products runs hourly with SYSTEM privileges and loads DLL files from a user-writable directory without proper validation. An attacker with low-privileged access who can write DLL files to the monitored directory can achieve arbitrary code execution with SYSTEM privileges. Affected products include Panda Global Protection 2016, Panda Antivirus Pro 2016, Panda Small Business Protection, and Panda Internet Security 2016 (all versions up to 16.1.2).",2025-07-15,Metasploit,,,
CVE-2025-34110,0.0,,0.013,CWE-22,"A directory traversal vulnerability exists in ColoradoFTP Server ≤ 1.3 Build 8 for Windows, allowing unauthenticated attackers to read or write arbitrary files outside the configured FTP root directory. The flaw is due to insufficient sanitation of user-supplied file paths in the FTP GET and PUT command handlers. Exploitation is possible by submitting traversal sequences during FTP operations, enabling access to system-sensitive files. This issue affects only the Windows version of ColoradoFTP.",2025-07-15,Metasploit,,,
CVE-2025-34111,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01521,CWE-20,"An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder component's default connector (connector.minimal.php), which allows remote attackers to upload and execute malicious PHP scripts in the context of the web server. The vulnerable component does not enforce file type validation, allowing attackers to craft a POST request to upload executable PHP payloads through the ELFinder interface exposed at /vendor_extra/elfinder/.",2025-07-15,Metasploit,cpe:2.3:a:tiki:tikiwiki_cms\/groupware:*:*:*:*:*:*:*:*,Tiki,Tikiwiki Cms/Groupware
CVE-2025-34112,0.0,,0.01997,CWE-78,An authenticated multi-stage remote code execution vulnerability exists in Riverbed SteelCentral NetProfiler and NetExpress 10.8.7 virtual appliances. A SQL injection vulnerability in the '/api/common/1.0/login' endpoint can be exploited to create a new user account in the appliance database. This user can then trigger a command injection vulnerability in the '/index.php?page=licenses' endpoint to execute arbitrary commands. The attacker may escalate privileges to root by exploiting an insecure sudoers configuration that allows the 'mazu' user to execute arbitrary commands as root via SSH key extraction and command chaining. Successful exploitation allows full remote root access to the virtual appliance.,2025-07-15,Metasploit,,,
CVE-2025-34113,0.0,,0.021,CWE-20,"An authenticated command injection vulnerability exists in Tiki Wiki CMS versions ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14 via the `viewmode` GET parameter in `tiki-calendar.php`. When the calendar module is enabled and an authenticated user has permission to access it, an attacker can inject and execute arbitrary PHP code. Successful exploitation leads to remote code execution in the context of the web server user.",2025-07-15,Metasploit,,,
CVE-2025-34115,0.0,,0.02321,CWE-20,An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 via the 'cmd_str' parameter in the command_test.php endpoint. A user with access to the web interface can exploit the 'Test this command' feature to execute arbitrary shell commands as the unprivileged web application user. The vulnerability resides in the configuration section of the application and requires valid login credentials with access to the command testing functionality. This issue is fixed in version 7.2.0.,2025-07-15,Metasploit,,,
CVE-2025-34116,0.0,,0.01136,CWE-20,"A remote command execution vulnerability exists in IPFire before version 2.19 Core Update 101 via the 'proxy.cgi' CGI interface. An authenticated attacker can inject arbitrary shell commands through crafted values in the NCSA user creation form fields, leading to command execution with web server privileges.",2025-07-15,Metasploit,,,
CVE-2025-34117,0.0,,0.22922,CWE-78,"A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an undocumented backdoor listener on UDP port 53413. Exact version boundaries remain undocumented. An unauthenticated remote attacker can send specially crafted UDP packets to execute arbitrary commands on the affected device. This backdoor uses a hardcoded authentication mechanism and accepts shell commands post-authentication. Some device models include a non-standard implementation of the `echo` command, which may affect exploitability.",2025-07-16,Metasploit,,,
CVE-2025-34118,0.0,,0.01429,CWE-20,"A path traversal vulnerability exists in Linknat VOS Manager versions prior to 2.1.9.07, including VOS2009 and early VOS3000 builds, that allows unauthenticated remote attackers to read arbitrary files on the server. The vulnerability is accessible via multiple localized subpaths such as '/eng/', '/chs/', or '/cht/', where the 'js/lang_en_us.js' or equivalent files are loaded. By injecting encoded traversal sequences such as '%c0%ae%c0%ae' into the request path, attackers can bypass input validation and disclose sensitive files.",2025-07-16,Metasploit,,,
CVE-2025-34119,0.0,,0.01519,CWE-306,"A remote file disclosure vulnerability exists in EasyCafe Server 2.2.14, exploitable by unauthenticated remote attackers via TCP port 831. The server listens for a custom protocol where opcode 0x43 can be used to request arbitrary files by absolute path. If the file exists and is accessible, its content is returned without authentication. This flaw allows attackers to retrieve sensitive files such as system configuration, password files, or application data.",2025-07-16,Metasploit,,,
CVE-2025-34120,0.0,,0.01213,CWE-22,"An unauthenticated file download vulnerability exists in LimeSurvey versions from 2.0+ up to and including 2.06+ Build 151014. The application fails to validate serialized input to the admin backup endpoint (`index.php/admin/update/sa/backup`), allowing attackers to specify arbitrary file paths using a crafted `datasupdateinfo` payload. The files are packaged in a ZIP archive and made available for download without authentication. This vulnerability can be exploited to read arbitrary files on the host system, including sensitive OS and configuration files.",2025-07-16,Metasploit,,,
CVE-2025-34121,0.0,,0.01682,CWE-306,"An unauthenticated arbitrary file upload vulnerability exists in Idera Up.Time Monitoring Station versions up to and including 7.2. The `wizards/post2file.php` script accepts arbitrary POST parameters, allowing attackers to upload crafted PHP files to the webroot. Successful exploitation results in remote code execution as the web server user. NOTE: The bypass for this vulnerability is tracked as CVE-2015-9263.",2025-07-16,Metasploit,,,
CVE-2025-34123,0.0,,0.00461,CWE-20,"A stack-based buffer overflow vulnerability exists in VideoCharge Studio 2.12.3.685 when processing a specially crafted .VSC configuration file. The issue occurs due to improper handling of user-supplied data in the XML 'Name' attribute, leading to an SEH overwrite condition. An attacker can exploit this vulnerability by convincing a user to open a malicious .VSC file, resulting in arbitrary code execution under the context of the user.",2025-07-16,Metasploit,,,
CVE-2025-34124,0.0,,0.0038,CWE-20,"A buffer overflow vulnerability exists in Heroes of Might and Magic III Complete 4.0.0.0, HD Mod 3.808 build 9, and Demo 1.0.0.0 via malicious .h3m map files that exploit object sprite name parsing logic. The vulnerability occurs during in-game map loading when a crafted object name causes a buffer overflow, potentially allowing arbitrary code execution. Exploitation requires the victim to open a malicious map file within the game.",2025-07-16,Metasploit,,,
CVE-2025-34125,0.0,,0.03126,CWE-78,"An unauthenticated command injection vulnerability exists in the cookie handling process of the lighttpd web server on D-Link DSP-W110A1 firmware version 1.05B01. This occurs when specially crafted cookie values are processed, allowing remote attackers to execute arbitrary commands on the underlying Linux operating system. Successful exploitation enables full system compromise.",2025-07-16,Metasploit,,,
CVE-2025-34126,0.0,,0.01461,CWE-22,A path traversal vulnerability exists in RIPS Scanner version 0.54. The vulnerability allows remote attackers to read arbitrary files on the system with the privileges of the web server by sending crafted HTTP GET requests to the 'windows/code.php' script with a manipulated 'file' parameter. This can lead to disclosure of sensitive information.,2025-07-16,Metasploit,,,
CVE-2025-34127,0.0,,0.01123,CWE-94,"A stack-based buffer overflow exists in Achat v0.150 in its default configuration. By sending a specially crafted message to the UDP port 9256, an attacker can overwrite the structured exception handler (SEH) due to insufficient bounds checking on user-supplied input leading to remote code execution.",2025-07-16,Metasploit,,,
CVE-2025-34128,0.0,,0.00854,CWE-94,A buffer overflow vulnerability exists in the X360 VideoPlayer ActiveX control (VideoPlayer.ocx) version 2.6 when handling overly long arguments to the ConvertFile() method. An attacker can exploit this vulnerability by supplying crafted input to cause memory corruption and execute arbitrary code within the context of the current process.,2025-07-16,Metasploit,,,
CVE-2025-34141,0.0,,0.01907,CWE-79,"A reflected cross-site scripting (XSS) vulnerability exists in ETQ Reliance CG (legacy) platform within the `SQLConverterServlet` component. This vulnerability requires user interaction, such as clicking a crafted link, and may result in execution of unauthorized scripts in the user's context. The affected servlet was unnecessarily exposed to authenticated users and has since been disabled in version SE.2025.1.",2025-07-22,Nuclei,,,
CVE-2025-34143,0.0,,0.29857,CWE-78,"An authentication bypass vulnerability exists in ETQ Reliance on the CG (legacy) platform. The application allowed login as the privileged internal SYSTEM user by manipulating the username field. The SYSTEM account does not require a password, enabling attackers with network access to the login page to obtain elevated access. Once authenticated, an attacker could achieve remote code execution by modifying Jython scripts within the application. This issue was resolved by introducing stricter validation logic to exclude internal accounts from public authentication workflows in version MP-4583.",2025-07-22,Nuclei,,,
CVE-2025-3415,4.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N,0.0089,CWE-200,"Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. 
Fixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01",2025-07-17,Nuclei,,,
CVE-2025-34152,0.0,,0.60875,CWE-78,"An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint. The input is processed by the internal date '-s' command without rebooting or disrupting HTTP service. Unlike other injection points, this vector allows remote compromise without triggering visible configuration changes.",2025-08-07,Metasploit/Nuclei,,,
CVE-2025-34291,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.7889,CWE-346,Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.,2025-12-05,CISA/Nuclei,cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*,Langflow,Langflow
CVE-2025-34299,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.72667,CWE-434,Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious (S)FTP server.,2025-11-07,Metasploit/Nuclei,cpe:2.3:a:monstaftp:monsta_ftp:*:*:*:*:*:*:*:*,Monstaftp,Monsta Ftp
CVE-2025-34300,0.0,,0.4942,CWE-20,A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the  ciwweb.pl http://ciwweb.pl/  Perl web application. Exploitation allows an unauthenticated attacker can execute arbitrary commands.,2025-07-16,Metasploit/Nuclei,,,
CVE-2025-34433,0.0,,0.01386,CWE-94,"AVideo versions 14.3.1 prior to 20.1 contain an unauthenticated remote code execution vulnerability caused by predictable generation of an installation salt using PHP uniqid(). The installation timestamp is exposed via a public endpoint, and a derived hash identifier is accessible through unauthenticated API responses, allowing attackers to brute-force the remaining entropy. The recovered salt can then be used to encrypt a malicious payload supplied to a notification API endpoint that evaluates attacker-controlled input, resulting in arbitrary code execution as the web server user.",2025-12-19,Metasploit,,,
CVE-2025-34441,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.00744,CWE-359,"AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administrative status, and last login times, enabling user enumeration and privacy violations.",2025-12-17,Metasploit,cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*,Wwbn,Avideo
CVE-2025-34442,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.00744,CWE-497,"AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files, revealing underlying filesystem structure and facilitating more effective attack chains.",2025-12-17,Metasploit,cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*,Wwbn,Avideo
CVE-2025-34509,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.51018,CWE-798,"Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.",2025-06-17,Nuclei,cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:10.4:-:*:*:*:*:*:*;cpe:2.3:a:sitecore:managed_cloud:-:*:*:*:*:*:*:*,Sitecore,Experience Commerce
CVE-2025-34510,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.10913,CWE-23,"Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing path traversal sequences, allowing arbitrary file writes and leading to code execution.",2025-06-17,Metasploit,cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:10.4:-:*:*:*:*:*:*;cpe:2.3:a:sitecore:managed_cloud:-:*:*:*:*:*:*:*,Sitecore,Experience Commerce
CVE-2025-34511,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.09967,CWE-434,"Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue. A remote, authenticated attacker can upload arbitrary files to the server using crafted HTTP requests, resulting in remote code execution.",2025-06-17,Metasploit,cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:10.4:-:*:*:*:*:*:*;cpe:2.3:a:sitecore:managed_cloud:-:*:*:*:*:*:*:*,Sitecore,Experience Commerce
CVE-2025-3472,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.01852,CWE-94,"The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes when WooCommerce is also installed and activated.",2025-04-22,Nuclei,cpe:2.3:a:oceanwp:ocean_extra:*:*:*:*:*:wordpress:*:*,Oceanwp,Ocean Extra
CVE-2025-3515,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0509,CWE-434,"The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers to bypass the plugin's blacklist and upload .phar or other dangerous file types on the affected site's server, which may make remote code execution possible on the servers that are configured to handle .phar files as executable PHP scripts, particularly in default Apache+mod_php configurations where the file extension is not strictly validated before being passed to the PHP interpreter.",2025-06-17,Nuclei,cpe:2.3:a:codedropz:drag_and_drop_multiple_file_upload_-_contact_form_7:*:*:*:*:*:wordpress:*:*,Codedropz,Drag And Drop Multiple File Upload - Contact Form 7
CVE-2025-35939,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.01174,CWE-472,"Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.",2025-05-07,CISA,cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*,Craftcms,Craft Cms
CVE-2025-3605,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06441,CWE-639,"The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.1. This is due to the plugin not properly validating a user's identity prior to updating their details like email via the flr_blocks_user_settings_handle_ajax_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.",2025-05-09,Nuclei,,,
CVE-2025-36604,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.61125,CWE-78,"Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.",2025-08-04,Nuclei,cpe:2.3:a:dell:unity_operating_environment:*:*:*:*:*:*:*:*,Dell,Unity Operating Environment
CVE-2025-36845,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.0158,CWE-918,"An issue was discovered in Eveo URVE Web Manager 27.02.2025. The endpoint /_internal/redirect.php allows for Server-Side Request Forgery (SSRF). The endpoint takes a URL as input, sends a request to this address, and reflects the content in the response. This can be used to request endpoints only reachable by the application server.",2025-07-21,Nuclei,cpe:2.3:a:eveo:urve_web_manager:27.02.2025:*:*:*:*:*:*:*,Eveo,Urve Web Manager
CVE-2025-37164,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.89733,CWE-94,A remote code execution issue exists in HPE OneView.,2025-12-16,CISA/Metasploit/Nuclei,cpe:2.3:a:hpe:oneview:*:*:*:*:*:*:*:*,Hpe,Oneview
CVE-2025-38352,7.4,CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01345,CWE-367,"In the Linux kernel, the following vulnerability has been resolved:

posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()

If an exiting non-autoreaping task has already passed exit_notify() and
calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent
or debugger right after unlock_task_sighand().

If a concurrent posix_cpu_timer_del() runs at that moment, it won't be
able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or
lock_task_sighand() will fail.

Add the tsk->exit_state check into run_posix_cpu_timers() to fix this.

This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because
exit_task_work() is called before exit_notify(). But the check still
makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail
anyway in this case.",2025-07-22,CISA,cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2025-3928,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01997,NVD-CWE-noinfo,"Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: ""Webservers can be compromised through bad actors creating and executing webshells."" Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.",2025-04-25,CISA,cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2025-3935,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03361,CWE-502,"ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. 
It is important to note that to obtain these machine keys, privileged system level access must be obtained. 



If these machine keys are compromised, attackers could create and send a malicious ViewState to the website, potentially leading to remote code execution on the server. 



The risk does not originate from a vulnerability introduced by ScreenConnect, but from platform level behavior.  This had no direct impact to ScreenConnect Client. ScreenConnect 2025.4 patch disables ViewState and removes any dependency on it.",2025-04-25,CISA,cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*,Connectwise,Screenconnect
CVE-2025-4008,8.8,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.95104,CWE-77,"The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C.

This web interface exposes an endpoint that is vulnerable to command injection.

Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.",2025-05-21,CISA/EPSS/Nuclei,cpe:2.3:a:smartbedded:meteobridge_vm:*:*:*:*:*:*:*:*;cpe:2.3:o:smartbedded:meteobridge_firmware:*:*:*:*:*:*:*:*,Smartbedded,Meteobridge Firmware
CVE-2025-4009,0.0,,0.74535,CWE-77,"The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product
features, setup network switching, and register license among other features. The application has been developed in PHP with the webEASY SDK, also named ‘ewb’ by Evertz.

This web interface has two endpoints that are vulnerable to arbitrary command injection (CVE-2025-4009, CVE-2025-10364) and the authentication mechanism has a flaw leading to authentication bypass (CVE-2025-10365).

CVE-2025-4009 covers the command injection in feature-transfer-import.php
CVE-2025-10364 covers the command injection in feature-transfer-export.php

Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.

This level of access could lead to serious business impact such as the interruption of media streaming, modification of media being streamed, alteration of closed captions being generated, among others.",2025-05-28,Nuclei,,,
CVE-2025-40536,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.81624,CWE-693,"SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.",2026-01-28,CISA/Metasploit/Nuclei,cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*,Solarwinds,Web Help Desk
CVE-2025-40551,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.8413,CWE-502,"SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.",2026-01-28,CISA/Metasploit/Nuclei,cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*,Solarwinds,Web Help Desk
CVE-2025-40552,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.49734,CWE-1390,"SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should be protected by authentication.",2026-01-28,Nuclei,cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*,Solarwinds,Web Help Desk
CVE-2025-40554,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.58447,CWE-1390,"SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.",2026-01-28,Nuclei,cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*,Solarwinds,Web Help Desk
CVE-2025-40602,6.6,CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H,0.01944,CWE-250,A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).,2025-12-18,CISA,cpe:2.3:a:sonicwall:sma8200v:*:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma6200:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma6210:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma7200:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma7210:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma6200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma6210_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma7200_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma7210_firmware:*:*:*:*:*:*:*:*,Sonicwall,Sma6200 Firmware
CVE-2025-40630,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00425,CWE-601,"Open redirection vulnerability in IceWarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to redirect a user to any domain by sending a malicious URL to the victim, for example “ https://icewarp.domain.com//<MALICIOUS_DOMAIN>/%2e%2e” https://icewarp.domain.com///%2e%2e” . This vulnerability has been tested in Firefox.",2025-05-16,Nuclei,cpe:2.3:a:icewarp:mail_server:11.4.0:*:*:*:*:*:*:*,Icewarp,Mail Server
CVE-2025-4078,4.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N,0.01025,CWE-22,"A vulnerability, which was classified as problematic, has been found in Wangshen SecGate 3600 2400. This issue affects some unknown processing of the file ?g=log_export_file. The manipulation of the argument file_name leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",2025-04-29,Nuclei,,,
CVE-2025-4123,7.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L,0.98418,CWE-79,"A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF.

The default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.",2025-05-22,EPSS/Nuclei,cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*;cpe:2.3:a:grafana:grafana:10.4.18:-:*:*:*:*:*:*;cpe:2.3:a:grafana:grafana:11.2.9:-:*:*:*:*:*:*;cpe:2.3:a:grafana:grafana:11.3.6:-:*:*:*:*:*:*;cpe:2.3:a:grafana:grafana:11.4.4:-:*:*:*:*:*:*;cpe:2.3:a:grafana:grafana:11.5.4:-:*:*:*:*:*:*;cpe:2.3:a:grafana:grafana:11.6.1:-:*:*:*:*:*:*;cpe:2.3:a:grafana:grafana:12.0.0:-:*:*:*:*:*:*,Grafana,Grafana
CVE-2025-41242,5.9,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02054,CWE-22,"Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.

An application can be vulnerable when all the following are true:

  *  the application is deployed as a WAR or with an embedded Servlet container
  *  the Servlet container  does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization 
  *  the application  serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with Spring resource handling


We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.",2025-08-18,Nuclei,,,
CVE-2025-41243,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.03311,CWE-94,"Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification.

An application should be considered vulnerable when all the following are true:

  *  The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable).
  *  Spring Boot actuator is a dependency.
  *  The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway.
  *  The actuator endpoints are available to attackers.
  *  The actuator endpoints are unsecured.",2025-09-16,Nuclei,,,
CVE-2025-41244,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.0788,CWE-267,VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.,2025-09-29,CISA,cpe:2.3:a:vmware:aria_operations:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation_operations:9.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:open_vm_tools:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:open_vm_tools:13.0.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_infrastructure:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:tools:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2025-41393,0.0,,0.00639,CWE-79,"Reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor. As for the details of affected product names and versions, refer to the information provided by the vendors under [References].",2025-05-12,Nuclei,,,
CVE-2025-41646,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.43286,CWE-704,An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device,2025-06-06,Nuclei,cpe:2.3:a:kunbus:revpi_status:*:*:*:*:*:*:*:*,Kunbus,Revpi Status
CVE-2025-4210,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.01853,CWE-285,A vulnerability classified as critical was found in Casdoor up to 1.811.0. This vulnerability affects the function HandleScim of the file controllers/scim.go of the component SCIM User Creation Endpoint. The manipulation leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 1.812.0 is able to address this issue. The name of the patch is 3d12ac8dc2282369296c3386815c00a06c6a92fe. It is recommended to upgrade the affected component.,2025-05-02,Nuclei,,,
CVE-2025-42599,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03215,CWE-121,Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sent by a remote unauthenticated attacker may lead to arbitrary code execution and/or a denial-of-service (DoS) condition.,2025-04-18,CISA,cpe:2.3:a:qualitia:active\!_mail:*:*:*:*:*:*:*:*,Qualitia,Active! Mail
CVE-2025-42999,9.1,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H,0.12522,CWE-502,"SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.",2025-05-13,CISA,cpe:2.3:a:sap:netweaver:7.5:*:*:*:*:*:*:*,Sap,Netweaver
CVE-2025-4302,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00847,NVD-CWE-noinfo,"The Stop User Enumeration WordPress plugin before version 1.7.3 blocks REST API /wp-json/wp/v2/users/ requests for non-authorized users. However, this can be bypassed by URL-encoding the API path.",2025-07-17,Nuclei,cpe:2.3:a:fullworksplugins:stop_user_enumeration:*:*:*:*:*:wordpress:*:*,Fullworksplugins,Stop User Enumeration
CVE-2025-43200,4.2,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N,0.01059,NVD-CWE-noinfo,"This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, visionOS 2.3.1, watchOS 11.3.1. A logic issue existed when processing a maliciously crafted photo or video shared via an iCloud Link. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.",2025-06-16,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2025-4322,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.18592,CWE-620,"The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account.",2025-05-20,Nuclei,,,
CVE-2025-43300,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.20388,CWE-787,"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, macOS Ventura 13.7.8. Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.",2025-08-21,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2025-4334,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02055,CWE-269,"The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3. This is due to insufficient restrictions on user meta values that can be supplied during registration. This makes it possible for unauthenticated attackers to register as an administrator.",2025-06-26,Nuclei,cpe:2.3:a:najeebmedia:simple_user_registration:*:*:*:*:*:wordpress:*:*,Najeebmedia,Simple User Registration
CVE-2025-43510,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.00355,CWE-667,"A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may cause unexpected changes in memory shared between processes.",2025-12-12,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:26.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:26.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:26.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2025-43520,5.5,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H,0.00408,CWE-120,"A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory.",2025-12-12,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:26.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:26.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:26.0:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2025-43529,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.08585,CWE-416,"A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.",2025-12-17,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2025-4380,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.29404,CWE-98,"The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsa_template' parameter of the `bsa_preview_callback` function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases .php files can can be uploaded and included, or already exist on the site.",2025-07-02,Nuclei,cpe:2.3:a:scripteo:ads_pro:*:*:*:*:*:wordpress:*:*,Scripteo,Ads Pro
CVE-2025-4388,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.03446,CWE-79,"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.",2025-05-06,Nuclei,cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:*:*:*:*:*:*:*;cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*,Liferay,Digital Experience Platform
CVE-2025-4396,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02626,CWE-89,"The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 (Free) and <= 2.27.5 (Premium) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database.",2025-05-13,Nuclei,,,
CVE-2025-44136,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02507,CWE-79,"MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter ""layer"" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser.",2025-07-29,Nuclei,cpe:2.3:a:maptiler:tileserver_php:2.0:*:*:*:*:*:*:*,Maptiler,Tileserver Php
CVE-2025-44137,8.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N,0.0136,CWE-22,"MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is responsible for delivering tiles that are stored as files on the server via web request. Creating the path to a file allows the insertion of ""../"" and thus read any file on the web server. Affected GET parameters are ""TileMatrix"", ""TileRow"", ""TileCol"" and ""Format""",2025-07-29,Nuclei,cpe:2.3:a:maptiler:tileserver_php:2.0:*:*:*:*:*:*:*,Maptiler,Tileserver Php
CVE-2025-44148,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.50752,CWE-79,Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component,2025-06-03,Nuclei,cpe:2.3:a:mailenable:mailenable:*:*:*:*:*:*:*:*,Mailenable,Mailenable
CVE-2025-44177,8.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N,0.04173,CWE-22,"A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenticated attacker can remotely read arbitrary files on the underlying OS using encoded traversal sequences.",2025-07-09,Nuclei,cpe:2.3:a:wss:protop:4.4.2-2024-11-27:*:*:*:*:*:*:*,Wss,Protop
CVE-2025-4427,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.99899,CWE-288,An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.,2025-05-13,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager_mobile:12.5.0.0:*:*:*:*:*:*:*,Ivanti,Endpoint Manager Mobile
CVE-2025-4428,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.84796,CWE-94,Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.,2025-05-13,CISA/Metasploit,cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager_mobile:12.5.0.0:*:*:*:*:*:*:*,Ivanti,Endpoint Manager Mobile
CVE-2025-4524,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09453,CWE-22,"The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.2 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.",2025-05-21,Nuclei,,,
CVE-2025-4576,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00588,CWE-79,"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/blogs/blogs-web/src/main/resources/META-INF/resources/blogs/entry_cover_image_caption.jsp",2025-08-08,Nuclei,cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:*:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update10:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update11:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update12:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update13:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update14:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update15:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update16:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update17:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update18:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update19:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update20:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update22:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update23:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update24:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update25:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update26:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update27:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update28:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update29:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update2:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update30:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update31:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update32:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update33:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update35:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update37:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update38:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update39:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update3:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update40:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update42:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update43:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update44:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update45:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update46:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update47:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update49:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update4:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update50:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update51:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update53:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update54:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update55:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update56:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update57:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update58:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update59:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update5:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update60:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update61:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update62:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update63:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update64:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update65:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update66:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update67:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update68:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update69:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update6:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update70:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update71:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update72:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update73:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update74:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update75:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update77:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update78:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update79:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update7:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update80:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update8:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:*;cpe:2.3:a:liferay:digital_experience_platform:7.4:update9:*:*:*:*:*:*;cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*,Liferay,Digital Experience Platform
CVE-2025-45854,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.02685,CWE-862,/server/executeExec of JEHC-BPM 2.0.1 allows attackers to execute arbitrary code via execParams.,2025-06-03,Nuclei,cpe:2.3:a:jehc:jehc-bpm:*:*:*:*:*:*:*:*,Jehc,Jehc-Bpm
CVE-2025-45985,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0692,CWE-77,"Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain a command injection vulnerability via the bs_SetSSIDHide function.",2025-06-13,Nuclei,cpe:2.3:h:b-link:bl-ac2100_az3:-:*:*:*:*:*:*:*;cpe:2.3:h:b-link:bl-f1200_at1:-:*:*:*:*:*:*:*;cpe:2.3:h:b-link:bl-lte300:-:*:*:*:*:*:*:*;cpe:2.3:h:b-link:bl-wr9000:-:*:*:*:*:*:*:*;cpe:2.3:h:b-link:bl-x10_ac8:-:*:*:*:*:*:*:*;cpe:2.3:h:b-link:bl-x26_ac8:-:*:*:*:*:*:*:*;cpe:2.3:h:b-link:bl-x26_da3:-:*:*:*:*:*:*:*;cpe:2.3:h:b-link:blac450m_ae4:-:*:*:*:*:*:*:*;cpe:2.3:o:b-link:bl-ac2100_az3_firmware:1.0.4:*:*:*:*:*:*:*;cpe:2.3:o:b-link:bl-f1200_at1_firmware:1.0.0:*:*:*:*:*:*:*;cpe:2.3:o:b-link:bl-lte300_firmware:1.2.3:*:*:*:*:*:*:*;cpe:2.3:o:b-link:bl-wr9000_firmware:2.4.9:*:*:*:*:*:*:*;cpe:2.3:o:b-link:bl-x10_ac8_firmware:1.0.5:*:*:*:*:*:*:*;cpe:2.3:o:b-link:bl-x26_ac8_firmware:1.2.8:*:*:*:*:*:*:*;cpe:2.3:o:b-link:bl-x26_da3_firmware:1.2.7:*:*:*:*:*:*:*;cpe:2.3:o:b-link:blac450m_ae4_firmware:4.0.0:*:*:*:*:*:*:*,B-Link,Bl-Wr9000 Firmware
CVE-2025-4632,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.23953,CWE-22,Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.,2025-05-13,CISA/Nuclei,cpe:2.3:a:samsung:magicinfo_9_server:*:*:*:*:*:*:*:*,Samsung,Magicinfo 9 Server
CVE-2025-46349,7.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L,0.00618,CWE-79,"YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been patched in version 4.5.4.",2025-04-29,Nuclei,cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:*,Yeswiki,Yeswiki
CVE-2025-4652,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00464,CWE-79,"The Broadstreet WordPress plugin before 1.51.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",2025-06-09,Nuclei,cpe:2.3:a:broadstreetads:broadstreet:*:*:*:*:*:wordpress:*:*,Broadstreetads,Broadstreet
CVE-2025-4653,0.0,,0.0241,CWE-77,Improper Neutralization of Special Elements in the backup name field may allow OS command injection. This issue affects Pandora ITSM 5.0.105.,2025-06-10,Metasploit,,,
CVE-2025-46549,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N,0.00529,CWE-79,"YesWiki is a wiki system written in PHP. Prior to version 4.5.4, an attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability may also allow attackers to deface the website or embed malicious content. This issue has been patched in version 4.5.4.",2025-04-29,Nuclei,cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:*,Yeswiki,Yeswiki
CVE-2025-46550,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N,0.00529,CWE-79,"YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the `/?BazaR` endpoint and `idformulaire` parameter are vulnerable to cross-site scripting. An attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability may also allow attackers to deface the website or embed malicious content. This issue has been patched in version 4.5.4.",2025-04-29,Nuclei,cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:*,Yeswiki,Yeswiki
CVE-2025-46554,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01047,CWE-862,"XWiki is a generic wiki platform. In versions starting from 1.8.1 to before 14.10.22, from 15.0-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.7.0, anyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint. There is no filtering for the results depending on current user rights, meaning an unauthenticated user could exploit this even in a private wiki. This issue has been patched in versions 14.10.22, 15.10.12, 16.4.3, and 16.7.0.",2025-04-30,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2025-46565,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.01143,CWE-22,"Vite is a frontend tooling framework for javascript. Prior to versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed. `server.fs.deny` can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under `root` by using a combination of slash and dot (/.). This issue has been patched in versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14.",2025-05-01,Nuclei,cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*,Vitejs,Vite
CVE-2025-46817,7.0,CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03692,CWE-190,"Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.",2025-10-03,Nuclei,cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*,Redis,Redis
CVE-2025-46818,6.0,CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N,0.00701,CWE-94,"Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.",2025-10-03,Nuclei,cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*,Redis,Redis
CVE-2025-46819,6.3,CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H,0.01023,CWE-190,"Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.",2025-10-03,Nuclei,cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*,Redis,Redis
CVE-2025-46822,0.0,,0.03847,CWE-36,"OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized access to sensitive internal files. Commit c835c6f7799eacada4c0fc77e0816f250af01ad2 contains a patch for the issue.",2025-05-21,Nuclei,,,
CVE-2025-47188,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.47629,CWE-77,"A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4 (R6.4.0.4006) or version V1 R0.1.0, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit could allow an attacker to execute arbitrary commands within the context of the phone, leading to disclosure or modification of sensitive configuration data or affecting device availability and operation.",2025-08-07,Nuclei,,,
CVE-2025-47204,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00424,CWE-352,"An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting (XSS) vulnerability exploitable through Cross-Site Request Forgery (CSRF).",2025-05-13,Nuclei,cpe:2.3:a:davidstutz:bootstrap_multiselect:1.1.2:*:*:*:*:*:*:*,Davidstutz,Bootstrap Multiselect
CVE-2025-47423,5.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N,0.02114,CWE-24,"Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/_test.php, as demonstrated by reading the server's private SSL key in cleartext.",2025-05-07,Nuclei,,,
CVE-2025-47445,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.0465,CWE-23,Relative Path Traversal vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.This issue affects Eventin: from n/a through <= 4.0.26.,2025-05-14,Nuclei,cpe:2.3:a:themewinter:eventin:*:*:*:*:*:wordpress:*:*,Themewinter,Eventin
CVE-2025-47539,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.31469,CWE-266,Incorrect Privilege Assignment vulnerability in Arraytics Eventin wp-event-solution allows Privilege Escalation.This issue affects Eventin: from n/a through <= 4.0.26.,2025-05-23,Nuclei,cpe:2.3:a:themewinter:eventin:*:*:*:*:*:wordpress:*:*,Themewinter,Eventin
CVE-2025-47577,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.05128,CWE-434,Unrestricted Upload of File with Dangerous Type vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Upload a Web Shell to a Web Server.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.9.2.,2025-05-19,Nuclei,,,
CVE-2025-47608,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L,0.00662,CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sonalsinha21 Recover abandoned cart for WooCommerce recover-wc-abandoned-cart allows SQL Injection.This issue affects Recover abandoned cart for WooCommerce: from n/a through <= 2.5.,2025-06-09,Metasploit,,,
CVE-2025-47646,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.22328,CWE-640,Weak Password Recovery Mechanism for Forgotten Password vulnerability in Gilblas Ngunte Possi PSW Front-end Login & Registration psw-login-and-registration allows Password Recovery Exploitation.This issue affects PSW Front-end Login & Registration: from n/a through <= 1.13.,2025-05-23,Nuclei,,,
CVE-2025-47729,1.9,CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N,0.00407,CWE-912,"The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage ""End-to-End encryption from the mobile phone through to the corporate archive"" documentation, as exploited in the wild in May 2025.",2025-05-08,CISA,cpe:2.3:a:telemessage:text_message_archiver:*:*:*:*:*:*:*:*,Telemessage,Text Message Archiver
CVE-2025-47783,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0054,CWE-79,"Label Studio is a multi-type data labeling and annotation tool. A vulnerability in versions prior to 1.18.0 allows an attacker to inject a malicious script into the context of a web page, which can lead to data theft, session hijacking, unauthorized actions on behalf of the user, and other attacks. The vulnerability is reproducible when sending a properly formatted request to the `POST /projects/upload-example/` endpoint. In the source code, the vulnerability is located at `label_studio/projects/views.py`. Version 1.18.0 contains a patch for the issue.",2025-05-14,Nuclei,cpe:2.3:a:humansignal:label_studio:*:*:*:*:*:*:*:*,Humansignal,Label Studio
CVE-2025-47812,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.95343,CWE-158,"In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.",2025-07-10,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:wftpserver:wing_ftp_server:*:*:*:*:*:*:*:*,Wftpserver,Wing Ftp Server
CVE-2025-47813,4.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N,0.56366,CWE-209,loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.,2025-07-10,CISA/Nuclei,cpe:2.3:a:wftpserver:wing_ftp_server:*:*:*:*:*:*:*:*,Wftpserver,Wing Ftp Server
CVE-2025-47827,4.6,CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.04003,CWE-347,"In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.",2025-06-05,CISA,cpe:2.3:o:igel:igel_os:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Igel,Igel Os
CVE-2025-47916,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.84852,CWE-1336,"Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method; hence it is evaluated by the template engine. Accordingly, this can be exploited by unauthenticated attackers to inject and execute arbitrary PHP code by providing crafted template strings.",2025-05-16,Metasploit/Nuclei,cpe:2.3:a:invisioncommunity:invisioncommunity:*:*:*:*:*:*:*:*,Invisioncommunity,Invisioncommunity
CVE-2025-48157,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02188,CWE-98,Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Michele Giorgi Formality formality allows PHP Local File Inclusion.This issue affects Formality: from n/a through <= 1.5.9.,2025-08-20,Nuclei,,,
CVE-2025-48281,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L,0.01308,CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mystyleplatform MyStyle Custom Product Designer mystyle-custom-product-designer allows Blind SQL Injection.This issue affects MyStyle Custom Product Designer: from n/a through <= 3.21.1.,2025-06-09,Nuclei,,,
CVE-2025-48384,8.0,CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H,0.02775,CWE-59,"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.",2025-07-08,CISA,cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*;cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2025-48543,8.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.00545,CWE-416,"In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",2025-09-04,CISA,cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:16.0:*:*:*:*:*:*:*,Google,Android
CVE-2025-48572,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.00232,CWE-306,"In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",2025-12-08,CISA,cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:16.0:*:*:*:*:*:*:*,Google,Android
CVE-2025-48595,8.4,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01714,CWE-190,"In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",2026-06-01,CISA,cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*;cpe:2.3:o:google:android:16.0:qpr2_beta_1:*:*:*:*:*:*;cpe:2.3:o:google:android:16.0:qpr2_beta_2:*:*:*:*:*:*;cpe:2.3:o:google:android:16.0:qpr2_beta_3:*:*:*:*:*:*,Google,Android
CVE-2025-48633,5.5,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.00249,NVD-CWE-noinfo,"In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",2025-12-08,CISA,cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*;cpe:2.3:o:google:android:16.0:*:*:*:*:*:*:*,Google,Android
CVE-2025-48700,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01761,CWE-79,"An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, specifically involving crafted tag structures and attribute values that include an @import directive and other script injection vectors. The vulnerability is triggered when a user views a crafted e-mail message in the Classic UI, requiring no additional user interaction.",2025-06-23,CISA,cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p10:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p11:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p12:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p13:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p14:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p15:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p16:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p17:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p18:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p19:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p20:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p21:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p22:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p23:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p24:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p25:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p26:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p27:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p28:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p29:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p30:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31.1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p32:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p33:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p34:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p35:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p36:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p37:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p38:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p39:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p40:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p41:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p42:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p43:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p44:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p45:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p46:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p6:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p7:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p8:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p9:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p12:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p15:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p21:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24.1:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p26:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p27:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p28:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p29:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p30:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p31:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p32:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p33:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p34:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p35:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p36:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p37:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p38:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p39:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p40:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p41:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p42:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p5:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p6:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p8:*:*:*:*:*:*;cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p9:*:*:*:*:*:*,Synacor,Zimbra Collaboration Suite
CVE-2025-48703,9.0,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H,0.99589,CWE-78,CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.,2025-09-19,CISA/EPSS/Nuclei,cpe:2.3:a:control-webpanel:webpanel:*:*:*:*:*:*:*:*,Control-Webpanel,Webpanel
CVE-2025-48827,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.77681,CWE-424,"vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.",2025-05-27,Metasploit/Nuclei,cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:*,Vbulletin,Vbulletin
CVE-2025-48828,9.0,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H,0.60786,CWE-424,"Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the ""var_dump""(""test"") syntax, attackers can bypass security checks and execute arbitrary PHP code, as exploited in the wild in May 2025.",2025-05-27,Metasploit/Nuclei,cpe:2.3:a:vbulletin:vbulletin:6.0.3:*:*:*:*:*:*:*,Vbulletin,Vbulletin
CVE-2025-48927,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.08489,CWE-1188,"The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.",2025-05-28,CISA,cpe:2.3:a:smarsh:telemessage:-:*:*:*:*:*:*:*,Smarsh,Telemessage
CVE-2025-48928,4.0,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00366,CWE-528,"The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a ""core dump"" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.",2025-05-28,CISA,cpe:2.3:a:smarsh:telemessage:-:*:*:*:*:*:*:*,Smarsh,Telemessage
CVE-2025-48954,8.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N,0.0063,CWE-79,"Discourse is an open-source discussion platform. Versions prior to 3.5.0.beta6 are vulnerable to cross-site scripting when the content security policy isn't enabled when using social logins. Version 3.5.0.beta6 patches the issue. As a workaround, have the content security policy enabled.",2025-06-25,Nuclei,cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*;cpe:2.3:a:discourse:discourse:3.5.0:beta1:*:*:beta:*:*:*;cpe:2.3:a:discourse:discourse:3.5.0:beta2:*:*:beta:*:*:*;cpe:2.3:a:discourse:discourse:3.5.0:beta3:*:*:beta:*:*:*;cpe:2.3:a:discourse:discourse:3.5.0:beta4:*:*:beta:*:*:*;cpe:2.3:a:discourse:discourse:3.5.0:beta5:*:*:beta:*:*:*,Discourse,Discourse
CVE-2025-49001,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.21265,CWE-287,"DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.10, secret verification does not take effect successfully, so a user can use any secret to forge a JWT token. The vulnerability has been fixed in v2.10.10. No known workarounds are available.",2025-06-03,Nuclei,cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*,Dataease,Dataease
CVE-2025-49002,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.43192,CWE-290,DataEase is an open source business intelligence and data visualization tool. Versions prior to version 2.10.10 have a flaw in the patch for CVE-2025-32966 that allow the patch to be bypassed through case insensitivity because INIT and RUNSCRIPT are prohibited. The vulnerability has been fixed in v2.10.10. No known workarounds are available.,2025-06-03,Nuclei,cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*,Dataease,Dataease
CVE-2025-49029,9.1,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H,0.02122,CWE-94,Improper Control of Generation of Code ('Code Injection') vulnerability in bitto.kazi Custom Login And Signup Widget custom-login-and-signup-widget allows Code Injection.This issue affects Custom Login And Signup Widget: from n/a through <= 1.0.,2025-07-01,Nuclei,,,
CVE-2025-49113,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.91886,CWE-502,"Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.",2025-06-02,CISA/Metasploit/Nuclei,cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2025-49132,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.13105,CWE-94,"Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it could be used to gain access to the Panel's server, read credentials from the Panel's config, extract sensitive information from the database, access files of servers managed by the panel, etc. This issue has been patched in version 1.11.11. There are no software workarounds for this vulnerability, but use of an external Web Application Firewall (WAF) could help mitigate this attack.",2025-06-20,Nuclei,,,
CVE-2025-49136,9.0,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H,0.00907,CWE-1336,"listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the `env` and `expandenv` template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the `{{ env }}` template expression to capture sensitive environment variables. Users should upgrade to v5.0.2 to mitigate the issue.",2025-06-09,Metasploit,cpe:2.3:a:nadh:listmonk:*:*:*:*:*:*:*:*,Nadh,Listmonk
CVE-2025-49493,5.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N,0.03395,CWE-611,Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.,2025-06-30,Nuclei,,,
CVE-2025-49533,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.44894,CWE-502,Adobe Experience Manager (MS) versions 6.5.23.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction. Scope is unchanged.,2025-07-08,Nuclei,cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*,Adobe,Experience Manager
CVE-2025-49596,0.0,,0.38944,CWE-306,"The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities.",2025-06-13,Nuclei,,,
CVE-2025-49619,8.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N,0.13746,CWE-1336,"Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Prompt field of workflow blocks such as the Navigation v2 Block. Improper sanitization of Jinja2 template input allows authenticated users to inject crafted expressions that are evaluated on the server, leading to blind remote code execution (RCE).",2025-06-07,Metasploit,,,
CVE-2025-49704,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.99907,CWE-94,Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.,2025-07-08,CISA/EPSS/Metasploit,cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*,Microsoft,Sharepoint Server
CVE-2025-49706,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.99879,CWE-287,Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.,2025-07-08,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*,Microsoft,Sharepoint Enterprise Server
CVE-2025-49825,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07754,CWE-863,"Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch.",2025-06-17,Nuclei,,,
CVE-2025-49844,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.86767,CWE-416,"Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.",2025-10-03,Nuclei,cpe:2.3:a:lfprojects:valkey:*:*:*:*:*:*:*:*;cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*,Redis,Redis
CVE-2025-50286,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09319,CWE-434,"A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install interface. Once uploaded, the plugin is automatically extracted and loaded, allowing arbitrary PHP code execution and reverse shell access.",2025-08-06,Metasploit,cpe:2.3:a:getgrav:grav:1.7.48:*:*:*:*:*:*:*,Getgrav,Grav
CVE-2025-50578,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02779,CWE-20,"LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically `X-Forwarded-Host` and `Referer`. An unauthenticated remote attacker can manipulate these headers to perform Host Header Injection and Open Redirect attacks. This allows the loading of external resources from attacker-controlled domains and unintended redirection of users, potentially enabling phishing, UI redress, and session theft. The vulnerability exists due to insufficient validation and trust of untrusted input, affecting the integrity and trustworthiness of the application.",2025-07-30,Nuclei,cpe:2.3:a:linuxserver:docker-heimdall:2.6.3-ls307:*:*:*:*:*:*:*,Linuxserver,Docker-Heimdall
CVE-2025-5086,9.0,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H,0.89706,CWE-502,A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.,2025-06-02,CISA/Nuclei,cpe:2.3:a:3ds:delmia_apriso:*:*:*:*:*:*:*:*,3Ds,Delmia Apriso
CVE-2025-51482,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.01862,CWE-94,"Remote Code Execution in letta.server.rest_api.routers.v1.tools.run_tool_from_source in letta-ai Letta 0.7.12 allows remote attackers to execute arbitrary Python code and system commands via crafted payloads to the /v1/tools/run endpoint, bypassing intended sandbox restrictions.",2025-07-22,Nuclei,cpe:2.3:a:letta:letta:0.7.12:*:*:*:*:*:*:*,Letta,Letta
CVE-2025-51501,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00776,CWE-79,Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.,2025-08-01,Nuclei,cpe:2.3:a:microweber:microweber:2.0.0:*:*:*:*:*:*:*,Microweber,Microweber
CVE-2025-51502,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00765,CWE-79,Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of authenticated admin users.,2025-08-01,Nuclei,cpe:2.3:a:microweber:microweber:2.0.0:*:*:*:*:*:*:*,Microweber,Microweber
CVE-2025-51586,3.7,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00755,CWE-359,An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the reset password feature.,2025-09-08,Nuclei,cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:*,Prestashop,Prestashop
CVE-2025-51990,4.8,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N,0.00498,CWE-79,"XWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities in the Administration interface, specifically under the Presentation section of the Global Preferences panel. An authenticated administrator can inject arbitrary JavaScript payloads into the HTTP Meta Info, Footer Copyright, and Footer Version fields. These inputs are stored and subsequently rendered without proper output encoding or sanitization on public-facing pages. As a result, the injected scripts are persistently executed in the browser context of any visitor to the affected instances including both authenticated and unauthenticated users. No user interaction is required beyond visiting a page that includes the malicious content. Successful exploitation can lead to session hijacking, credential theft, unauthorized actions via session riding, or further compromise of the application through client-side attacks. The vulnerability introduces significant risk in any deployment, especially in shared or internet-facing environments where administrator credentials may be compromised.",2025-08-20,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2025-51991,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03605,CWE-79,"XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in the Administration interface, specifically within the HTTP Meta Info field of the Global Preferences Presentation section. An authenticated administrator can inject crafted Apache Velocity template code, which is rendered on the server side without proper validation or sandboxing. This enables the execution of arbitrary template logic, which may expose internal server information or, in specific configurations, lead to further exploitation such as remote code execution or sensitive data leakage. The vulnerability resides in improper handling of dynamic template rendering within user-supplied configuration fields.",2025-08-20,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2025-52207,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L,0.01499,CWE-23,PBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbitrary directory.,2025-06-27,Nuclei,,,
CVE-2025-52367,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.03835,CWE-79,Cross Site Scripting vulnerability in PivotX CMS v.3.0.0 RC 3 allows a remote attacker to execute arbitrary code via the subtitle field.,2025-09-22,Metasploit,cpe:2.3:a:pivotx:pivotx:3.0.0:rc3:*:*:*:*:*:*,Pivotx,Pivotx
CVE-2025-52472,0.0,,0.02207,CWE-89,"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0, the REST search URL is vulnerable to HQL injection via the `orderField` parameter. The specified value is added twice in the query, though, once in the field list for the select and once in the order clause, so it's not that easy to exploit. The part of the query between the two fields can be enclosed in single quotes to effectively remove them, but the query still needs to remain valid with the query two times in it. This has been patched in versions 17.5.0, 17.4.2, and 16.10.9. No known workarounds are available.",2025-10-06,Nuclei,,,
CVE-2025-52488,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.30628,CWE-200,"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.",2025-06-21,Nuclei,cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*,Dnnsoftware,Dotnetnuke
CVE-2025-52665,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.40972,CWE-306,"A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication. This vulnerability was introduced in Version 3.3.22 and was fixed in Version 4.0.21 and later. 
 
Affected Products:
UniFi Access Application (Version 3.3.22 through 3.4.31). 
 

Mitigation:
Update your UniFi Access Application to Version 4.0.21 or later.",2025-10-31,Nuclei,cpe:2.3:a:ui:unifi_access:*:*:*:*:*:*:*:*,Ui,Unifi Access
CVE-2025-52691,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.85457,CWE-434,"Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.",2025-12-29,CISA/Metasploit/Nuclei,cpe:2.3:a:smartertools:smartermail:*:*:*:*:*:*:*:*,Smartertools,Smartermail
CVE-2025-52694,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.37867,CWE-89,"Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet, potentially affecting data confidentiality, integrity, and availability. Users and administrators of affected product versions are advised to update to the latest versions immediately.",2026-01-12,Nuclei,cpe:2.3:a:advantech:iot_edge_linux_docker:*:*:*:*:*:*:*:*;cpe:2.3:a:advantech:iot_edge_windows:*:*:*:*:*:*:*:*;cpe:2.3:a:advantech:iotsuite_growth_linux_docker:*:*:*:*:*:*:*:*;cpe:2.3:a:advantech:iotsuite_saas_composer:*:*:*:*:*:*:*:*;cpe:2.3:a:advantech:iotsuite_starter_linux_docker:*:*:*:*:*:*:*:*,Advantech,Iot Edge Linux Docker
CVE-2025-5287,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02175,CWE-89,"The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2025-05-28,Nuclei,,,
CVE-2025-52970,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09825,CWE-233,"A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.",2025-08-12,Nuclei,cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*,Fortinet,Fortiweb
CVE-2025-5301,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.36118,CWE-79,"ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.",2025-06-12,Nuclei,,,
CVE-2025-5306,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.20712,CWE-77,Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778,2025-06-27,Metasploit,cpe:2.3:a:artica:pandora_fms:*:*:*:*:*:*:*:*,Artica,Pandora Fms
CVE-2025-53118,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.29365,CWE-306,"An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to compromise of passwords, secrets, and application session tokens stored by the Unified PAM.",2025-08-25,Nuclei,,,
CVE-2025-53364,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00814,CWE-497,"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Starting in 5.3.0 and before 7.5.3 and 8.2.2, the Parse Server GraphQL API previously allowed public access to the GraphQL schema without requiring a session token or the master key. While schema introspection reveals only metadata and not actual data, this metadata can still expand the potential attack surface. This vulnerability is fixed in 7.5.3 and 8.2.2.",2025-07-10,Nuclei,,,
CVE-2025-5350,5.9,CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L,0.00574,CWE-79,"SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users. This feature accepted user-supplied URLs without proper validation, leading to server-side request forgery (SSRF). Additionally, the retrieved content was directly reflected in the HTTP response, enabling reflected cross-site scripting (XSS) in the admin user's browser context.

By tricking an administrator into accessing a crafted link, an attacker could force the server to fetch malicious content and reflect it into the admin’s browser, leading to arbitrary JavaScript execution for UI manipulation or data exfiltration. While session cookies are protected with the HttpOnly flag, the XSS still poses a significant security risk.

Furthermore, SSRF can be used by a privileged user to query internal services, potentially aiding in internal network enumeration if the target endpoints are reachable from the affected product.",2025-10-24,Nuclei,cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*;cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:7.1.0:-:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:*,Wso2,Api Control Plane
CVE-2025-53521,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02213,CWE-121,"When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",2025-10-15,CISA,cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*,F5,Big-Ip Access Policy Manager
CVE-2025-53533,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00556,CWE-79,"Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions 6.2.1 and earlier are vulnerable to reflected cross-site scripting (XSS) via a malformed URL path. The 404 error page includes the requested path in the class attribute of the body tag without proper sanitization or escaping. An attacker can craft a URL containing an onload attribute that will execute arbitrary JavaScript code in the browser when a victim visits the malicious link. If an attacker sends a crafted pi-hole link to a victim and the victim visits it, attacker-controlled JavaScript code is executed in the browser of the victim. This has been patched in version 6.3.",2025-10-27,Nuclei,cpe:2.3:a:pi-hole:web_interface:*:*:*:*:*:*:*:*,Pi-Hole,Web Interface
CVE-2025-53558,0.0,,0.0135,CWE-1391,"ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log in to the affected devices.",2025-07-31,Nuclei,,,
CVE-2025-53624,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.01842,CWE-200,"The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for build-time API access only, is inadvertently included in client-side JavaScript bundles, making it accessible to anyone who can view the website's source code. This vulnerability is fixed in 4.0.0.",2025-07-09,Nuclei,,,
CVE-2025-53690,9.0,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H,0.30809,CWE-502,"Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.",2025-09-03,CISA,cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:*;cpe:2.3:a:sitecore:managed_cloud:-:*:*:*:*:*:*:*,Sitecore,Experience Commerce
CVE-2025-53770,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99979,CWE-502,"Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.
Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild.
Microsoft is preparing and fully testing a comprehensive update to address this vulnerability.  In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.",2025-07-20,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*,Microsoft,Sharepoint Server
CVE-2025-53771,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.99911,CWE-287,Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.,2025-07-20,EPSS/Metasploit/Nuclei,cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*,Microsoft,Sharepoint Server
CVE-2025-53833,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.09357,CWE-1336,"LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations. Attackers could execute arbitrary commands on the server, access sensitive environment variables, and/or escalate access depending on server configuration. Users are strongly advised to upgrade to version v2.8.1 or later to receive a patch.",2025-07-14,Nuclei,,,
CVE-2025-5394,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.47809,CWE-862,"The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the alone_import_pack_install_plugin() function in all versions up to, and including, 7.8.3. This makes it possible for unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations to achieve remote code execution. CVE-2025-54019 is likely a duplicate of this.",2025-07-15,Nuclei,,,
CVE-2025-54068,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.95376,CWE-94,"Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.",2025-07-17,CISA/EPSS/Nuclei,cpe:2.3:a:laravel:livewire:*:*:*:*:*:*:*:*,Laravel,Livewire
CVE-2025-54123,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.10543,CWE-20,"Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at `/api/v2/hoverfly/middleware` endpoint due to insufficient validation and sanitization in user input. The vulnerability exists in the middleware management API endpoint `/api/v2/hoverfly/middleware`. This issue is born due to combination of three code level flaws: Insufficient Input Validation in middleware.go line 94-96; Unsafe Command Execution in local_middleware.go line 14-19; and Immediate Execution During Testing in hoverfly_service.go line 173. This allows an attacker to gain remote code execution (RCE) on any system running the vulnerable Hoverfly service. Since the input is directly passed to system commands without proper checks, an attacker can upload a malicious payload or directly execute arbitrary commands (including reverse shells) on the host server with the privileges of the Hoverfly process. Commit 17e60a9bc78826deb4b782dca1c1abd3dbe60d40 in version 1.12.0 disables the set middleware API by default, and subsequent changes to documentation make users aware of the security changes of exposing the set middleware API.",2025-09-10,Nuclei,cpe:2.3:a:hoverfly:hoverfly:*:*:*:*:*:*:*:*,Hoverfly,Hoverfly
CVE-2025-54125,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.01285,CWE-359,"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 1.1 through 16.4.6, 16.5.0-rc-1 through 16.10.4 and 17.0.0-rc-1 through 17.1.0, the XML export of a page in XWiki that can be triggered by any user with view rights on a page by appending ?xpage=xml to the URL includes password and email properties stored on a document that aren't named password or email. This is fixed in versions 16.4.7, 16.10.5 and 17.2.0-rc-1. To work around this issue, the file templates/xml.vm in the deployed WAR can be deleted if the XML isn't needed. There isn't any feature in XWiki itself that depends on the XML export.",2025-08-06,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2025-5419,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.0645,CWE-125,Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High),2025-06-03,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*,Google,Chrome
CVE-2025-54236,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.96742,CWE-20,"Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.",2025-09-09,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.4:p10:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.4:p11:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.4:p12:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.4:p13:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.4:p14:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.4:p15:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.4:p7:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.4:p8:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.4:p9:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.5:p10:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.5:p11:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.5:p12:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.5:p13:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.5:p14:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.5:p4:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.5:p5:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.5:p6:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.5:p7:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.5:p8:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.5:p9:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.6:p10:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.6:p11:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.6:p12:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.6:p2:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.6:p3:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.6:p4:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.6:p5:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.6:p6:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.6:p7:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.6:p8:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.6:p9:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.7:-:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.7:b1:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.7:b2:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.7:beta3:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.7:p1:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.7:p2:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.7:p3:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.7:p4:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.7:p5:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.7:p6:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.7:p7:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.8:-:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.8:beta1:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.8:beta2:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.8:p1:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.8:p2:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.9:alpha1:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce:2.4.9:alpha2:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.3:-:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.3:p10:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.3:p11:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.3:p12:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.3:p13:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.3:p14:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.3:p15:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.3:p1:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.3:p2:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.3:p3:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.3:p4:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.3:p5:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.3:p6:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.3:p7:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.3:p8:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.3:p9:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.4:-:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.4:p10:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.4:p11:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.4:p12:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.4:p13:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.4:p14:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.4:p1:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.4:p2:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.4:p3:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.4:p4:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.4:p5:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.4:p6:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.4:p7:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.4:p8:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.3.4:p9:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.4.2:-:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.4.2:p1:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.4.2:p2:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.4.2:p3:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.4.2:p4:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.4.2:p5:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.4.2:p6:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.4.2:p7:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.5.2:-:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.5.2:p1:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.5.2:p2:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.5.3:alpha1:*:*:*:*:*:*;cpe:2.3:a:adobe:commerce_b2b:1.5.3:alpha2:*:*:*:*:*:*;cpe:2.3:a:adobe:magento:2.4.5:-:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.5:p10:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.5:p11:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.5:p12:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.5:p13:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.5:p14:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.5:p1:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.5:p2:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.5:p3:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.5:p4:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.5:p5:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.5:p6:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.5:p7:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.5:p8:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.5:p9:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.6:-:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.6:p10:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.6:p11:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.6:p12:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.6:p1:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.6:p2:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.6:p3:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.6:p4:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.6:p5:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.6:p6:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.6:p7:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.6:p8:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.6:p9:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.7:-:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.7:b1:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.7:b2:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.7:beta3:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.7:p1:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.7:p2:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.7:p3:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.7:p4:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.7:p5:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.7:p6:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.7:p7:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.8:-:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.8:beta1:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.8:beta2:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.8:p1:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.8:p2:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.9:alpha1:*:*:open_source:*:*:*;cpe:2.3:a:adobe:magento:2.4.9:alpha2:*:*:open_source:*:*:*,Adobe,Commerce
CVE-2025-54249,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.01811,CWE-918,Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate server-side requests and bypass security controls allowing unauthorized read access.,2025-09-09,Nuclei,cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*;cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*;cpe:2.3:a:adobe:experience_manager:6.5:-:*:*:lts:*:*:*;cpe:2.3:a:adobe:experience_manager:6.5:sp1:*:*:lts:*:*:*,Adobe,Experience Manager
CVE-2025-54251,4.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N,0.01609,CWE-91,Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate XML queries and gain limited unauthorized write access.,2025-09-09,Nuclei,cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*;cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*;cpe:2.3:a:adobe:experience_manager:6.5:-:*:*:lts:*:*:*;cpe:2.3:a:adobe:experience_manager:6.5:sp1:*:*:lts:*:*:*,Adobe,Experience Manager
CVE-2025-54253,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.87515,CWE-863,Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.,2025-08-05,CISA,cpe:2.3:a:adobe:experience_manager_forms:*:*:*:*:*:*:*:*,Adobe,Experience Manager Forms
CVE-2025-54309,9.0,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H,0.92034,CWE-420,"CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.",2025-07-18,CISA,cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*,Crushftp,Crushftp
CVE-2025-54313,7.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N,0.04146,CWE-506,"eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.",2025-07-19,CISA,cpe:2.3:a:alexghr:got-fetch:5.1.1:*:*:*:*:node.js:*:*;cpe:2.3:a:alexghr:got-fetch:5.1.2:*:*:*:*:node.js:*:*;cpe:2.3:a:homarr:homarr:*:*:*:*:*:*:*:*;cpe:2.3:a:prettier:eslint-config-prettier:10.1.6:*:*:*:*:node.js:*:*;cpe:2.3:a:prettier:eslint-config-prettier:10.1.7:*:*:*:*:node.js:*:*;cpe:2.3:a:prettier:eslint-config-prettier:8.10.1:*:*:*:*:node.js:*:*;cpe:2.3:a:prettier:eslint-config-prettier:9.1.1:*:*:*:*:node.js:*:*;cpe:2.3:a:prettier:eslint-plugin-prettier:4.2.2:*:*:*:*:node.js:*:*;cpe:2.3:a:prettier:eslint-plugin-prettier:4.2.3:*:*:*:*:node.js:*:*;cpe:2.3:a:un-ts:napi-postinstall:0.3.1:*:*:*:*:node.js:*:*;cpe:2.3:a:un-ts:pkgr\/core:0.2.8:*:*:*:*:node.js:*:*;cpe:2.3:a:un-ts:synckit:0.11.9:*:*:*:*:node.js:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2025-54589,6.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L,0.02393,CWE-79,"Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `<script>` block without proper escaping, allowing for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users. This is fixed in version 1.18.7.",2025-07-31,Nuclei,cpe:2.3:a:9001:copyparty:*:*:*:*:*:*:*:*,9001,Copyparty
CVE-2025-54597,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.00565,CWE-79,LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter.,2025-07-27,Nuclei,cpe:2.3:a:linuxserver:heimdall_application_dashboard:*:*:*:*:*:*:*:*,Linuxserver,Heimdall Application Dashboard
CVE-2025-54726,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L,0.01527,CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget allows SQL Injection.This issue affects JS Archive List: from n/a through < 6.1.6.,2025-08-20,Nuclei,,,
CVE-2025-54782,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.43921,CWE-77,"Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox. This is fixed in version 0.2.1.",2025-08-02,Nuclei,cpe:2.3:a:nestjs:devtools-integration:*:*:*:*:*:node.js:*:*,Nestjs,Devtools-Integration
CVE-2025-54793,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00614,CWE-601,"Astro is a web framework for content-driven websites. In versions 5.2.0 through 5.12.7, there is an Open Redirect vulnerability in the trailing slash redirection logic when handling paths with double slashes. This allows an attacker to redirect users to arbitrary external domains by crafting URLs such as https://mydomain.com//malicious-site.com/. This increases the risk of phishing and other social engineering attacks. This affects sites that use on-demand rendering (SSR) with the Node or Cloudflare adapters. It does not affect static sites, or sites deployed to Netlify or Vercel. This issue is fixed in version 5.12.8. To work around this issue at the network level, block outgoing redirect responses with a Location header value that starts with `//`.",2025-08-08,Nuclei,cpe:2.3:a:astro:astro:*:*:*:*:*:node.js:*:*,Astro,Astro
CVE-2025-54948,9.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H,0.2079,CWE-78,A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.,2025-08-05,CISA,cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:on-premises:windows:*:*,Trendmicro,Apex One
CVE-2025-55150,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L,0.01701,CWE-918,"Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/html/pdf endpoint to convert HTML to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security sanitization which can be bypassed and result in SSRF. This issue has been patched in version 1.1.0.",2025-08-11,Nuclei,cpe:2.3:a:stirlingpdf:stirling_pdf:*:*:*:*:*:*:*:*,Stirlingpdf,Stirling Pdf
CVE-2025-55161,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L,0.01999,CWE-918,"Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security sanitization which can be bypassed and result in SSRF. This issue has been patched in version 1.1.0.",2025-08-11,Nuclei,cpe:2.3:a:stirlingpdf:stirling_pdf:*:*:*:*:*:*:*:*,Stirlingpdf,Stirling Pdf
CVE-2025-55169,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.01552,CWE-22,"WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path traversal vulnerability was discovered in the WeGIA application, html/socio/sistema/download_remessa.php endpoint. This vulnerability could allow an attacker to gain unauthorized access to local files in the server and sensitive information stored in config.php. config.php contains information that could allow direct access to the database. This issue has been patched in version 3.4.8.",2025-08-12,Nuclei,cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*,Wegia,Wegia
CVE-2025-55177,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N,0.04116,CWE-863,"Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.",2025-08-29,CISA,cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:iphone_os:*:*;cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:macos:*:*;cpe:2.3:a:whatsapp:whatsapp_business:*:*:*:*:*:iphone_os:*:*,Whatsapp,Whatsapp
CVE-2025-55182,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.99562,CWE-502,"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.",2025-12-03,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:facebook:react:19.0.0:*:*:*:*:*:*:*;cpe:2.3:a:facebook:react:19.1.0:*:*:*:*:*:*:*;cpe:2.3:a:facebook:react:19.1.1:*:*:*:*:*:*:*;cpe:2.3:a:facebook:react:19.2.0:*:*:*:*:*:*:*;cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:14.3.0:canary77:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:14.3.0:canary78:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:14.3.0:canary79:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:14.3.0:canary80:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:14.3.0:canary81:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:14.3.0:canary82:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:14.3.0:canary83:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:14.3.0:canary84:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:14.3.0:canary85:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:14.3.0:canary86:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:14.3.0:canary87:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary16:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary17:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary18:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary19:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary20:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary21:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary22:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary23:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary24:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary25:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary26:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary27:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary28:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary29:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary2:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary30:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary31:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary32:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary33:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary34:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary35:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary36:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary37:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary38:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary39:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary3:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary40:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary41:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary42:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary43:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary44:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary45:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary46:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary47:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary48:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary49:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary4:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary50:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary51:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary52:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary53:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary54:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary55:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary56:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary57:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary5:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary6:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary7:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary8:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary9:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:16.0.0:-:*:*:*:node.js:*:*,Facebook,React
CVE-2025-55184,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.65592,CWE-502,"A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.",2025-12-11,Nuclei,cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*;cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary16:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary17:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary18:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary19:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary20:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary21:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary22:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary23:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary24:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary25:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary26:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary27:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary28:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary29:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary2:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary30:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary31:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary32:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary33:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary34:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary35:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary36:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary37:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary38:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary39:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary3:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary40:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary41:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary42:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary43:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary44:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary45:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary46:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary47:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary48:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary49:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary4:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary50:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary51:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary52:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary53:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary54:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary55:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary56:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary57:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary58:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary59:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary5:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary6:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary7:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary8:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:15.6.0:canary9:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:16.1.0:-:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:16.1.0:canary0:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:16.1.0:canary10:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:16.1.0:canary11:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:16.1.0:canary12:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:16.1.0:canary13:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:16.1.0:canary14:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:16.1.0:canary15:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:16.1.0:canary16:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:16.1.0:canary17:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:16.1.0:canary18:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:16.1.0:canary1:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:16.1.0:canary2:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:16.1.0:canary3:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:16.1.0:canary4:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:16.1.0:canary5:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:16.1.0:canary6:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:16.1.0:canary7:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:16.1.0:canary8:*:*:*:node.js:*:*;cpe:2.3:a:vercel:next.js:16.1.0:canary9:*:*:*:node.js:*:*,Facebook,React
CVE-2025-55190,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.04518,CWE-200,"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12 and 3.1.0-rc1 through 3.1.1, API tokens with project-level permissions are able to retrieve sensitive repository credentials (usernames, passwords) through the project details API endpoint, even when the token only has standard application management permissions and no explicit access to secrets. This vulnerability does not only affect project-level permissions. Any token with project get permissions is also vulnerable, including global permissions such as: `p, role/user, projects, get, *, allow`. This issue is fixed in versions 2.13.9, 2.14.16, 3.0.14 and 3.1.2.",2025-09-04,Nuclei,cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*,Argoproj,Argo Cd
CVE-2025-55303,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00637,CWE-79,"Astro is a web framework for content-driven websites. In versions of astro before 5.13.2 and 4.16.18, the image optimization endpoint in projects deployed with on-demand rendering allows images from unauthorized third-party domains to be served. On-demand rendered sites built with Astro include an /_image endpoint which returns optimized versions of images. A bug in impacted versions of astro allows an attacker to bypass the third-party domain restrictions by using a protocol-relative URL as the image source, e.g. /_image?href=//example.com/image.png. This vulnerability is fixed in 5.13.2 and 4.16.18.",2025-08-19,Nuclei,cpe:2.3:a:astro:astro:*:*:*:*:*:node.js:*:*,Astro,Astro
CVE-2025-55523,3.5,CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N,0.01049,CWE-22,An issue in the component /api/download_work_dir_file.py of Agent-Zero v0.8.* allows attackers to execute a directory traversal.,2025-08-21,Nuclei,cpe:2.3:a:agent-zero:agent-zero:*:*:*:*:*:*:*:*,Agent-Zero,Agent-Zero
CVE-2025-5569,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.01269,CWE-74,A vulnerability was found in IdeaCMS up to 1.7 and classified as critical. This issue affects the function Article/Goods of the file /api/v1.index.article/getList.html. The manipulation of the argument Field leads to sql injection. The attack may be initiated remotely. Upgrading to version 1.8 is able to address this issue. The patch is named 935aceb4c21338633de6d41e13332f7b9db4fa6a. It is recommended to upgrade the affected component.,2025-06-04,Nuclei,cpe:2.3:a:ideacms:ideacms:*:*:*:*:*:*:*:*,Ideacms,Ideacms
CVE-2025-55746,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L,0.00469,CWE-73,"Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents (without changes being applied to the files' database-resident metadata) and / or upload new files, with arbitrary content and extensions, which won't show up in the Directus UI. This vulnerability is fixed in 11.9.3.",2025-08-20,Nuclei,cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*,Monospace,Directus
CVE-2025-55747,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.01557,CWE-23,"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions  6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. This is fixed in version 16.10.7.",2025-09-03,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:6.1:milestone2:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:6.1:rc1:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2025-55748,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01652,CWE-23,"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false`. This is fixed in version 16.10.7.",2025-09-03,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:4.2:milestone2:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:4.2:milestone3:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2025-55749,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01409,CWE-284,"XWiki is an open-source wiki software platform. From 16.7.0 to 16.10.11, 17.4.4, or 17.7.0, in an instance which is using the XWiki Jetty package (XJetty), a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials. Fixed in 16.10.11, 17.4.4, and 17.7.0.",2025-12-01,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2025-5605,4.3,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00799,CWE-290,"An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure.

The known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details.",2025-10-24,Nuclei,cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*;cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*;cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server:7.1.0:-:*:*:*:*:*:*;cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*;cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:*,Wso2,Api Control Plane
CVE-2025-56132,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.00648,CWE-305,"LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The application returns distinguishable responses for valid and invalid email addresses, allowing unauthenticated attackers to determine the existence of user accounts. Version 4.2 introduces user-based lockout mechanisms to mitigate brute-force attacks, user enumeration remains possible by default. In versions prior to 4.2, no such user-level protection is in place, only basic IP-based rate limiting is enforced. This IP-based protection can be bypassed by distributing requests across multiple IPs (e.g., rotating IP or proxies). Effectively bypassing both login and password reset security controls. Successful exploitation allows an attacker to enumerate valid email addresses registered for the application, increasing the risk of follow-up attacks such as password spraying.",2025-09-30,Nuclei,cpe:2.3:a:liquidfiles:liquidfiles:*:*:*:*:*:*:*:*,Liquidfiles,Liquidfiles
CVE-2025-56266,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02695,CWE-74,A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL.,2025-09-08,Nuclei,cpe:2.3:a:avigilon:access_control_manager:7.10.0.20:*:*:*:*:*:*:*,Avigilon,Access Control Manager
CVE-2025-56520,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00649,CWE-918,Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi. A different vulnerability than CVE-2025-29720.,2025-09-30,Nuclei,cpe:2.3:a:dify:dify:1.6.0:*:*:*:*:*:*:*,Dify,Dify
CVE-2025-56819,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03008,CWE-78,An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute arbitrary code via the INIT connection parameter.,2025-09-24,Nuclei,cpe:2.3:a:running-elephant:datart:1.0.0:rc3:*:*:*:*:*:*,Running-Elephant,Datart
CVE-2025-5701,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01779,CWE-862,"The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hc_request_handler function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.",2025-06-05,Nuclei,,,
CVE-2025-5777,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.99897,CWE-125,"Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server",2025-06-17,CISA/EPSS/Nuclei,cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*;cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*;cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*;cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*,Citrix,Netscaler Application Delivery Controller
CVE-2025-57788,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.02822,CWE-259,A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC helps limit the exposure but does not eliminate risk.,2025-08-20,Metasploit/Nuclei,cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*,Commvault,Commvault
CVE-2025-57789,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N,0.01145,CWE-257,"During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. This is limited to the setup phase, before any jobs have been configured.",2025-08-20,Nuclei,cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*,Commvault,Commvault
CVE-2025-57790,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.16679,CWE-36,A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue. The vulnerability may lead to remote code execution.,2025-08-20,Metasploit,cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*,Commvault,Commvault
CVE-2025-57791,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.21429,CWE-88,A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation. Successful exploitation results in a valid user session for a low privilege role.,2025-08-20,Metasploit,cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*,Commvault,Commvault
CVE-2025-57808,8.1,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.01514,CWE-303,"ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value. This allows access to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or password. This issue has been patched in version 2025.8.1.",2025-09-02,Nuclei,cpe:2.3:o:esphome:esphome_firmware:2025.8.0:*:*:*:*:*:*:*,Esphome,Esphome Firmware
CVE-2025-57819,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.93286,CWE-89,"FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.",2025-08-28,CISA/Metasploit/Nuclei,cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*,Sangoma,Freepbx
CVE-2025-57822,6.5,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N,0.02328,CWE-918,"Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.",2025-08-29,Nuclei,cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*,Vercel,Next.Js
CVE-2025-58034,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.5558,CWE-78,"An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.",2025-11-18,CISA/Metasploit,cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*,Fortinet,Fortiweb
CVE-2025-58044,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00451,CWE-601,"JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability. This vulnerability is fixed in v3.10.19 and v4.10.5.",2025-12-01,Nuclei,cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:*,Fit2Cloud,Jumpserver
CVE-2025-58179,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.00773,CWE-918,"Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URLs it receives, allowing content from unauthorized third-party domains to be served. a A bug in impacted versions of the @astrojs/cloudflare adapter for deployment on Cloudflare’s infrastructure, allows an attacker to bypass the third-party domain restrictions and serve any content from the vulnerable origin. This issue is fixed in version 12.6.6.",2025-09-05,Nuclei,cpe:2.3:a:astro:\@astrojs\/cloudflare:*:*:*:*:*:node.js:*:*,Astro,@Astrojs/Cloudflare
CVE-2025-58226,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00706,CWE-201,"Insertion of Sensitive Information Into Sent Data vulnerability in iberezansky 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery interactive-3d-flipbook-powered-physics-engine allows Retrieve Embedded Sensitive Data.This issue affects 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery: from n/a through <= 1.16.16.",2025-09-22,Nuclei,,,
CVE-2025-58360,8.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L,0.64874,CWE-611,"GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0.",2025-11-25,CISA/Metasploit/Nuclei,cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*,Geoserver,Geoserver
CVE-2025-58434,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.47288,CWE-306,"Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the `forgot-password` endpoint in Flowise returns sensitive information including a valid password reset `tempToken` without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account takeover (ATO). This vulnerability applies to both the cloud service (`cloud.flowiseai.com`) and self-hosted/local Flowise deployments that expose the same API. Commit 9e178d68873eb876073846433a596590d3d9c863 in version 3.0.6 secures password reset endpoints. Several recommended remediation steps are available. Do not return reset tokens or sensitive account details in API responses. Tokens must only be delivered securely via the registered email channel. Ensure `forgot-password` responds with a generic success message regardless of input, to avoid user enumeration. Require strong validation of the `tempToken` (e.g., single-use, short expiry, tied to request origin, validated against email delivery). Apply the same fixes to both cloud and self-hosted/local deployments. Log and monitor password reset requests for suspicious activity. Consider multi-factor verification for sensitive accounts.",2025-09-12,Nuclei,cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*,Flowiseai,Flowise
CVE-2025-58443,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.17647,CWE-287,"FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1673 and below contain an authentication bypass vulnerability. It is possible for an attacker to perform an unauthenticated DB dump where they could pull a full SQL DB without credentials. A fix is expected to be released 9/15/2025. To address this vulnerability immediately, upgrade to the latest version of either the dev-branch or working-1.6 branch. This will patch the issue for users concerned about immediate exposure. See the FOG Project documentation for step-by-step upgrade instructions: https://docs.fogproject.org/en/latest/install-fog-server#choosing-a-fog-version.",2025-09-06,Nuclei,cpe:2.3:a:fogproject:fogproject:*:*:*:*:*:*:*:*,Fogproject,Fogproject
CVE-2025-58751,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.0118,CWE-22,"Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.",2025-09-08,Nuclei,cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*,Vitejs,Vite
CVE-2025-59049,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.0166,CWE-22,"Mockoon provides way to design and run mock APIs. Prior to version 9.2.0, a mock API configuration for static file serving follows the same approach presented in the documentation page, where the server filename is generated via templating features from user input is vulnerable to Path Traversal and LFI, allowing an attacker to get any file in the mock server filesystem.
The issue may be particularly relevant in cloud hosted server instances. Version 9.2.0 fixes the issue.",2025-09-10,Nuclei,,,
CVE-2025-59136,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00626,CWE-201,Insertion of Sensitive Information Into Sent Data vulnerability in Efí Bank Gerencianet Oficial woo-gerencianet-official allows Retrieve Embedded Sensitive Data.This issue affects Gerencianet Oficial: from n/a through <= 3.1.3.,2025-12-31,Nuclei,,,
CVE-2025-59230,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02675,CWE-284,Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.,2025-10-14,CISA,cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1507
CVE-2025-59287,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99962,CWE-502,Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.,2025-10-14,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows Server 2012
CVE-2025-59341,0.0,,0.01527,CWE-23,"esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a Local File Inclusion (LFI) issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem (or other unintended file sources).",2025-09-17,Nuclei,,,
CVE-2025-59342,0.0,,0.02829,CWE-24,"esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a path-traversal flaw in the handling of the X-Zone-Id HTTP header allows an attacker to cause the application to write files outside the intended storage location. The header value is used to build a filesystem path but is not properly canonicalized or restricted to the application’s storage base directory. As a result, supplying ../ sequences in X-Zone-Id causes files to be written to arbitrary directories. Version 136.1 contains a patch.",2025-09-17,Nuclei,,,
CVE-2025-59374,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01104,CWE-506,"""UNSUPPORTED WHEN ASSIGNED"" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that met these conditions and installed the compromised versions were affected. The Live Update client has already reached End-of-Support (EOS) in October 2021, and no currently supported devices or products are affected by this issue.",2025-12-17,CISA,cpe:2.3:a:asus:live_update:*:*:*:*:*:*:*:*,Asus,Live Update
CVE-2025-5946,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.13843,CWE-78,"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Poller reload setup in the configuration modules) allows OS Command Injection.
On the poller parameters page, a user with high privilege is able to concatenate custom instructions into the poller reload command.

This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.",2025-10-14,Metasploit,cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*,Centreon,Centreon Web
CVE-2025-5947,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04469,CWE-639,"The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via authentication bypass in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's cookie value prior to logging them in through the service_finder_switch_back() function. This makes it possible for unauthenticated attackers to login as any user including admins.",2025-08-01,Nuclei,,,
CVE-2025-59474,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.04735,CWE-862,"Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget.",2025-09-17,Nuclei,cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*;cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*,Jenkins,Jenkins
CVE-2025-59528,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.90183,CWE-94,"Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP server. This node parses the user-provided mcpServerConfig string to build the MCP server configuration. However, during this process, it executes JavaScript code without any security validation. Specifically, inside the convertToValidJSONString function, user input is directly passed to the Function() constructor, which evaluates and executes the input as JavaScript code. Since this runs with full Node.js runtime privileges, it can access dangerous modules such as child_process and fs. This issue has been patched in version 3.0.6.",2025-09-22,Metasploit/Nuclei,cpe:2.3:a:flowiseai:flowise:3.0.5:*:*:*:*:*:*:*,Flowiseai,Flowise
CVE-2025-59582,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00661,CWE-497,Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Darren Cooney Ajax Load More ajax-load-more allows Retrieve Embedded Sensitive Data.This issue affects Ajax Load More: from n/a through <= 7.6.0.2.,2025-09-22,Nuclei,,,
CVE-2025-5961,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.06479,CWE-434,"The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: Uploaded files are only accessible on WordPress instances running on the NGINX web server as the existing .htaccess within the target file upload folder prevents access on Apache servers.",2025-07-03,Nuclei,"cpe:2.3:a:wpvivid:migration\,_backup\,_staging:*:*:*:*:*:wordpress:*:*",Wpvivid,"Migration, Backup, Staging"
CVE-2025-59689,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.01913,CWE-77,Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For ESG 5.5. a fix has been released in 5.5.7.,2025-09-19,CISA,cpe:2.3:a:libraesva:email_security_gateway:*:*:*:*:*:*:*:*,Libraesva,Email Security Gateway
CVE-2025-59716,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00908,CWE-200,"ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint. Because of insufficient validation of the supplied token in showPasswordForm, the server responds differently when an e-mail address corresponds to a valid pending guest user rather than a non-existent user.",2025-11-05,Nuclei,cpe:2.3:a:owncloud:guests:*:*:*:*:*:*:*:*,Owncloud,Guests
CVE-2025-59718,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.66322,CWE-347,"A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.",2025-12-09,CISA,cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*;cpe:2.3:h:siemens:ruggedcom_ape1808:-:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*,Siemens,Ruggedcom Ape1808 Firmware
CVE-2025-60188,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02882,CWE-201,Insertion of Sensitive Information Into Sent Data vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Retrieve Embedded Sensitive Data.This issue affects Atarim: from n/a through <= 4.2.1.,2025-11-06,Nuclei,,,
CVE-2025-6058,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05649,CWE-434,"The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_booking_type' route in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.",2025-07-12,Nuclei,cpe:2.3:a:iqonic:wpbookit:*:*:*:*:free:wordpress:*:*,Iqonic,Wpbookit
CVE-2025-60710,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.04666,CWE-59,Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.,2025-11-11,CISA,cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 11 24H2
CVE-2025-60787,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.18993,CWE-20,"MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted.",2025-10-03,Metasploit,cpe:2.3:a:motioneye_project:motioneye:0.42.1:*:*:*:*:*:*:*;cpe:2.3:a:motioneye_project:motioneye:0.43.1:beta1:*:*:*:*:*:*;cpe:2.3:a:motioneye_project:motioneye:0.43.1:beta2:*:*:*:*:*:*;cpe:2.3:a:motioneye_project:motioneye:0.43.1:beta3:*:*:*:*:*:*;cpe:2.3:a:motioneye_project:motioneye:0.43.1:beta4:*:*:*:*:*:*,Motioneye Project,Motioneye
CVE-2025-6095,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.01532,CWE-74,"A vulnerability, which was classified as critical, was found in codesiddhant Jasmin Ransomware 1.0.1. Affected is an unknown function of the file /checklogin.php. The manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",2025-06-15,Metasploit,cpe:2.3:a:codesiddhant:jasmin-ransomware:1.0.1:*:*:*:*:*:*:*,Codesiddhant,Jasmin-Ransomware
CVE-2025-61224,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N,0.01272,CWE-79,Cross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'[56.1] allows a remote attacker to execute arbitrary code via the q parameter,2025-10-06,Nuclei,,,
CVE-2025-61666,0.0,,0.01196,CWE-22,Traccar is an open source GPS tracking system. Default installs of Traccar on Windows between versions 6.1-  6.8.1 and non default installs between versions 5.8 - 6.0 are vulnerable to unauthenticated local file inclusion attacks which can lead to leakage of passwords or any file on the file system including the Traccar configuration file. Versions 5.8 - 6.0 are only vulnerable if <entry key='web.override'>./override</entry> is set in the configuration file. Versions 6.1 - 6.8.1 are vulnerable by default as the web override is enabled by default. The vulnerable code is removed in version 6.9.0.,2025-10-02,Nuclei,,,
CVE-2025-61675,0.0,,0.3896,CWE-89,"FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains authenticated SQL injection vulnerabilities affecting multiple parameters in the basestation, model, firmware, and custom extension configuration functionality areas. Authentication with a known username is required to exploit these vulnerabilities. Successful exploitation allows authenticated users to execute arbitrary SQL queries against the database, potentially enabling access to sensitive data or modification of database contents. This issue has been patched in version 16.0.92 for FreePBX 16 and version 17.0.6 for FreePBX 17.",2025-10-14,Metasploit,,,
CVE-2025-61678,0.0,,0.50159,CWE-434,"FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains an authenticated arbitrary file upload vulnerability affecting the fwbrand parameter. The fwbrand parameter allows an attacker to change the file path. Combined, these issues can result in a webshell being uploaded. Authentication with a known username is required to exploit this vulnerability. Successful exploitation allows authenticated users to upload arbitrary files to attacker-controlled paths on the server, potentially leading to remote code execution. This issue has been patched in version 16.0.92 for FreePBX 16 and version 17.0.6 for FreePBX 17.",2025-10-14,Metasploit,,,
CVE-2025-6174,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0046,Missing_Data,"The Qwizcards | online quizzes and flashcards WordPress plugin through 3.9.4 does not sanitise and escape the ""_stylesheet"" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or any other user.",2025-07-23,Nuclei,,,
CVE-2025-61757,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.88312,CWE-306,"Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager.  Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",2025-10-21,CISA/Nuclei,cpe:2.3:a:oracle:identity_manager:12.2.1.4.0:*:*:*:*:*:*:*;cpe:2.3:a:oracle:identity_manager:14.1.2.1.0:*:*:*:*:*:*:*,Oracle,Identity Manager
CVE-2025-61882,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.99722,CWE-287,"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",2025-10-05,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:oracle:concurrent_processing:*:*:*:*:*:*:*:*,Oracle,Concurrent Processing
CVE-2025-61884,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.97788,CWE-22,Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI).  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).,2025-10-12,CISA/EPSS/Nuclei,cpe:2.3:a:oracle:configurator:*:*:*:*:*:*:*:*,Oracle,Configurator
CVE-2025-61932,0.0,,0.0265,CWE-940,"Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets.",2025-10-20,CISA,cpe:2.3:a:motex:lanscope_endpoint_manager:*:*:*:*:on-premise:*:*:*,Motex,Lanscope Endpoint Manager
CVE-2025-6197,4.2,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N,0.03711,CWE-601,"An open redirect vulnerability has been identified in Grafana OSS organization switching functionality.


Prerequisites for exploitation:

- Multiple organizations must exist in the Grafana instance

- Victim must be on a different organization than the one specified in the URL",2025-07-18,Nuclei,,,
CVE-2025-62039,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01273,CWE-201,Insertion of Sensitive Information Into Sent Data vulnerability in Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS ays-chatgpt-assistant allows Retrieve Embedded Sensitive Data.This issue affects AI ChatBot with ChatGPT and Content Generator by AYS: from n/a through <= 2.6.6.,2025-11-06,Nuclei,,,
CVE-2025-6204,8.0,CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H,0.76148,CWE-94,An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.,2025-08-04,CISA/Nuclei,cpe:2.3:a:3ds:delmia_apriso:*:*:*:*:*:*:*:*,3Ds,Delmia Apriso
CVE-2025-6205,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.71059,CWE-862,A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the application.,2025-08-04,CISA/Nuclei,cpe:2.3:a:3ds:delmia_apriso:*:*:*:*:*:*:*:*,3Ds,Delmia Apriso
CVE-2025-62126,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.00659,CWE-201,Insertion of Sensitive Information Into Sent Data vulnerability in Razvan Stanga Varnish/Nginx Proxy Caching vcaching allows Retrieve Embedded Sensitive Data.This issue affects Varnish/Nginx Proxy Caching: from n/a through <= 1.8.3.,2025-12-31,Nuclei,,,
CVE-2025-62168,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N,0.62871,CWE-209,"Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the credentials a trusted client uses to authenticate. This potentially allows a remote client to identify security tokens or credentials used internally by a web application using Squid for backend load balancing. These attacks do not require Squid to be configured with HTTP authentication. The vulnerability is fixed in version 7.2. As a workaround, disable debug information in administrator mailto links generated by Squid by configuring squid.conf with email_err_data off.",2025-10-17,Nuclei,cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*,Squid-Cache,Squid
CVE-2025-6218,0.0,,0.86192,CWE-22,"RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of file paths within archive files. A crafted file path can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27198.",2025-06-21,CISA,cpe:2.3:a:rarlab:winrar:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2025-62215,7.0,CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.06073,CWE-362,Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.,2025-11-11,CISA,cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1809
CVE-2025-62221,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02383,CWE-416,Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.,2025-12-09,CISA,cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1809
CVE-2025-62368,9.0,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H,0.01405,CWE-502,"Taiga is an open source project management platform. In versions 6.8.3 and earlier, a remote code execution vulnerability exists in the Taiga API due to unsafe deserialization of untrusted data. This issue is fixed in version 6.9.0.",2025-10-28,Metasploit,,,
CVE-2025-62512,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00766,CWE-204,"Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo allows an unauthenticated attacker to determine whether a given username or email address exists in the system. The endpoint at password.php?action=lost returns distinct messages for valid vs. invalid accounts, enabling user enumeration. As of time of publication, no known patches are available.",2026-02-24,Nuclei,cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*,Piwigo,Piwigo
CVE-2025-62521,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.04224,CWE-94,"ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The vulnerability exists in `setup/routes/setup.php` where user input from the setup form is directly concatenated into a PHP configuration template without any validation or sanitization. Any parameter in the setup form can be used to inject PHP code that gets written to `Include/Config.php`, which is then executed on every page load. This is more severe than typical authenticated RCE vulnerabilities because it requires no credentials and affects the installation process that administrators must complete. Version 5.21.0 patches the issue.",2025-12-17,Metasploit,cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*,Churchcrm,Churchcrm
CVE-2025-62522,0.0,,0.01016,CWE-22,"Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.",2025-10-20,Nuclei,,,
CVE-2025-62613,0.0,,0.01083,CWE-79,"VDO.Ninja is a tool that brings remote video feeds into OBS or other studio software via WebRTC. From versions 28.0 to before 28.4, a reflected Cross-Site Scripting (XSS) vulnerability exists on examples/control.html through the room parameter, which is improperly sanitized before being rendered in the DOM. The application fails to validate and encode user input, allowing malicious scripts to be injected and executed. This issue has been patched in version 28.4.",2025-10-22,Nuclei,,,
CVE-2025-62780,3.5,CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N,0.00441,CWE-79,"changedetection.io is a free open source web page change detection tool. A Stored Cross Site Scripting is present in changedetection.io Watch update API in versions prior to 0.50.34 due to insufficient security checks. Two scenarios are possible. In the first, an attacker can insert a new watch with an arbitrary URL which really points to a web page. Once the HTML content is retrieved, the attacker updates the URL with a JavaScript payload. In the second, an attacker substitutes the URL in an existing watch with a new URL that is in reality a JavaScript payload. When the user clicks on *Preview* and then on the malicious link, the JavaScript malicious code is executed. Version 0.50.34 fixes the issue.",2025-11-10,Nuclei,cpe:2.3:a:changedetection:changedetection:*:*:*:*:*:*:*:*,Changedetection,Changedetection
CVE-2025-63387,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.28042,CWE-284,"Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials or session tokens. The endpoint fails to implement proper authorization checks, allowing anonymous access to sensitive system configuration data. NOTE: The maintainer states that the endpoint is unauthenticated by design and serves as a bootstrap mechanism required for the dashboard initialization. They also state that the description inaccurately classifies the returned data as sensitive system configuration, stating that the data is non-sensitive and required for client-side rendering. No PII, credentials, or secrets are exposed.",2025-12-18,Nuclei,cpe:2.3:a:langgenius:dify:1.9.1:*:*:*:*:node.js:*:*,Langgenius,Dify
CVE-2025-6403,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.017,CWE-74,A vulnerability was found in code-projects School Fees Payment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.,2025-06-21,Nuclei,cpe:2.3:a:fabian:school_fees_payment_system:1.0:*:*:*:*:*:*:*,Fabian,School Fees Payment System
CVE-2025-64095,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.44656,CWE-434,"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads. This vulnerability is fixed in 10.1.1.",2025-10-28,Nuclei,cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*,Dnnsoftware,Dotnetnuke
CVE-2025-64328,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.84618,CWE-78,"FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3.",2025-11-07,CISA/Metasploit/Nuclei,cpe:2.3:a:sangoma:filestore:*:*:*:*:*:freepbx:*:*,Sangoma,Filestore
CVE-2025-64446,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.8936,CWE-23,"A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.",2025-11-14,CISA/Metasploit/Nuclei,cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*,Fortinet,Fortiweb
CVE-2025-64500,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.01344,CWE-647,"Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`.",2025-11-12,Nuclei,cpe:2.3:a:sensiolabs:httpfoundation:*:*:*:*:*:*:*:*;cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*,Sensiolabs,Httpfoundation
CVE-2025-64525,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L,0.01189,CWE-918,"Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers `x-forwarded-proto` and `x-forwarded-port` are insecurely used, without sanitization, to build the URL. This has several consequences, the most important of which are: middleware-based protected route bypass (only via `x-forwarded-proto`), DoS via cache poisoning (if a CDN is present), SSRF (only via `x-forwarded-proto`), URL pollution (potential SXSS, if a CDN is present), and WAF bypass. Version 5.15.5 contains a patch.",2025-11-13,Nuclei,cpe:2.3:a:astro:astro:*:*:*:*:*:node.js:*:*,Astro,Astro
CVE-2025-64764,7.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N,0.005,CWE-80,"Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the targeted application, regardless of what was intended by the component template(s). This issue has been patched in version 5.15.8.",2025-11-19,Nuclei,cpe:2.3:a:astro:astro:*:*:*:*:*:node.js:*:*,Astro,Astro
CVE-2025-6543,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09756,CWE-119,"Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server",2025-06-25,CISA,cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*;cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*;cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*;cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*,Citrix,Netscaler Application Delivery Controller
CVE-2025-6554,8.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N,0.06887,CWE-843,Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High),2025-06-30,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2025-6558,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.09038,CWE-20,Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High),2025-07-15,CISA,cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*;cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:*;cpe:2.3:a:wpewebkit:wpe_webkit:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2025-66039,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03029,CWE-287,"FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to ""webserver."" When providing an Authorization header with an arbitrary value, a session is associated with the target user regardless of valid credentials. This issue is fixed in versions 16.0.44 and 17.0.23.",2025-12-09,Metasploit,cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*,Sangoma,Freepbx
CVE-2025-66294,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02698,CWE-94,"Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by unauthenticated attackers. This vulnerability stems from weak regex validation in the cleanDangerousTwig method. This vulnerability is fixed in 1.8.0-beta.27.",2025-12-01,Metasploit,cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta10:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta11:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta12:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta13:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta14:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta15:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta16:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta17:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta18:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta19:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta1:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta20:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta21:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta22:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta23:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta24:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta25:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta26:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta2:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta3:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta4:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta5:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta6:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta7:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta8:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta9:*:*:*:*:*:*,Getgrav,Grav
CVE-2025-66301,9.6,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N,0.0128,CWE-285,"Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical fields on a POST request to /admin/pages/{page_name}, an editor with only permissions to change basic content on the form is now able to change the functioning of the form through modifying the content of the data[_json][header][form] which is the YAML frontmatter which includes the process section which dictates what happens after a user submits the form which include some important actions that could lead to further vulnerabilities. This vulnerability is fixed in 1.8.0-beta.27.",2025-12-01,Metasploit,cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta10:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta11:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta12:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta13:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta14:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta15:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta16:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta17:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta18:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta19:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta1:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta20:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta21:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta22:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta23:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta24:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta25:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta26:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta2:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta3:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta4:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta5:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta6:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta7:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta8:*:*:*:*:*:*;cpe:2.3:a:getgrav:grav:1.8.0:beta9:*:*:*:*:*:*,Getgrav,Grav
CVE-2025-66376,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.12009,CWE-79,Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.,2026-01-05,CISA,cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*,Synacor,Zimbra Collaboration Suite
CVE-2025-66472,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00463,CWE-79,"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through  17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack through a deletion confirmation message. The attacker-supplied script is executed when the victim clicks the ""No"" button. This issue is fixed in versions 16.10.10 and 17.4.2 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates.",2025-12-10,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2025-66516,8.4,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.79807,CWE-611,"Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. 

This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. 

First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. 

Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the ""org.apache.tika:tika-parsers"" module.",2025-12-04,Nuclei,cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:*,Apache,Tika
CVE-2025-66644,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.031,CWE-78,"Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.",2025-12-05,CISA,cpe:2.3:h:arraynetworks:ag1000:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:ag1000t:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:ag1000v5:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:ag1100:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:ag1100v5:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:ag1150:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:ag1200:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:ag1200v5:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:ag1500:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:ag1500fips:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:ag1500v5:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:ag1600:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:ag1600v5:-:*:*:*:*:*:*:*;cpe:2.3:h:arraynetworks:vxag:-:*:*:*:*:*:*:*;cpe:2.3:o:arraynetworks:arrayos_ag:*:*:*:*:*:*:*:*,Arraynetworks,Arrayos Ag
CVE-2025-66744,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01446,CWE-22,"In Yonyou YonBIP v3 and before, the LoginWithV8 interface in the series data application service system is vulnerable to path traversal, allowing unauthorized access to sensitive information within the system",2026-01-09,Nuclei,,,
CVE-2025-67038,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.00889,CWE-94,An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authantication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.,2026-03-11,CISA,cpe:2.3:h:lantronix:eds5008:-:*:*:*:*:*:*:*;cpe:2.3:h:lantronix:eds5016:-:*:*:*:*:*:*:*;cpe:2.3:h:lantronix:eds5032:-:*:*:*:*:*:*:*;cpe:2.3:o:lantronix:eds5008_firmware:2.1.0.0r3:*:*:*:*:*:*:*;cpe:2.3:o:lantronix:eds5016_firmware:2.1.0.0r3:*:*:*:*:*:*:*;cpe:2.3:o:lantronix:eds5032_firmware:2.1.0.0r3:*:*:*:*:*:*:*,Lantronix,Eds5032 Firmware
CVE-2025-67303,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N,0.01361,CWE-420,An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the application storing its files in an insufficiently protected location that was accessible via the web interface,2026-01-05,Nuclei,cpe:2.3:a:comfy:comfyui-manager:*:*:*:*:*:*:*:*,Comfy,Comfyui-Manager
CVE-2025-67888,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.01186,CWE-78,"An issue was discovered in Control Web Panel (CWP) before 0.9.8.1209. User input passed via the ""key"" GET parameter to /admin/index.php (when the ""api"" parameter is set) is not properly sanitized before being used to execute OS commands. This can be exploited by unauthenticated attackers to inject and execute arbitrary OS commands with the privileges of root on the web server. Softaculous or SitePad must be present.",2026-05-08,Metasploit,,,
CVE-2025-6793,0.0,,0.12281,CWE-22,"Marvell QConvergeConsole QLogicDownloadImpl Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability. This vulnerability allows remote attackers to delete arbitrary files and disclose sensitive information on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the QLogicDownloadImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files and disclose information in the context of SYSTEM. Was ZDI-CAN-24912.",2025-07-07,Metasploit,cpe:2.3:a:marvell:qconvergeconsole:*:*:*:*:*:*:*:*,Marvell,Qconvergeconsole
CVE-2025-68043,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.00588,CWE-862,Missing Authorization vulnerability in LottieFiles LottieFiles lottiefiles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LottieFiles: from n/a through <= 3.0.0.,2026-02-20,Nuclei,,,
CVE-2025-68109,9.1,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H,0.01402,CWE-78,"ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access to it. Once accessed, the uploaded web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.",2025-12-17,Metasploit,cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*,Churchcrm,Churchcrm
CVE-2025-68461,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.20094,CWE-79,Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.,2025-12-18,CISA,cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*,Roundcube,Webmail
CVE-2025-68509,4.7,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N,0.00475,CWE-601,URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Jeff Starr User Submitted Posts user-submitted-posts allows Phishing.This issue affects User Submitted Posts: from n/a through <= 20251121.,2025-12-24,Nuclei,,,
CVE-2025-6851,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.00623,CWE-918,"The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",2025-07-11,Nuclei,cpe:2.3:a:pluginrx:broken_link_notifier:*:*:*:*:*:wordpress:*:*,Pluginrx,Broken Link Notifier
CVE-2025-68602,4.7,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N,0.00448,CWE-601,URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Scott Paterson Accept Donations with PayPal & Stripe easy-paypal-donation allows Phishing.This issue affects Accept Donations with PayPal & Stripe: from n/a through <= 1.5.2.,2025-12-24,Nuclei,,,
CVE-2025-68613,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.97875,CWE-913,"n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. This issue has been fixed in versions 1.120.4, 1.121.1, and 1.122.0. Users are strongly advised to upgrade to a patched version, which introduces additional safeguards to restrict expression evaluation. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only; and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully eliminate the risk and should only be used as short-term measures.",2025-12-19,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*;cpe:2.3:a:n8n:n8n:1.121.0:*:*:*:*:node.js:*:*,N8N,N8N
CVE-2025-68645,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.31769,CWE-98,"A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.",2025-12-22,CISA/Nuclei,cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*,Synacor,Zimbra Collaboration Suite
CVE-2025-69200,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02005,CWE-202,"phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise. Version 4.0.16 fixes the issue.",2025-12-29,Nuclei,cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*;cpe:2.3:a:phpmyfaq:phpmyfaq:4.1.0:rc:*:*:*:*:*:*,Phpmyfaq,Phpmyfaq
CVE-2025-6934,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.23359,CWE-269,"The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to privilege escalation via in all versions up to, and including, 1.7.5. This is due to a lack of role restriction during registration in the 'on_regiser_user' function. This makes it possible for unauthenticated attackers to arbitrarily choose the role, including the Administrator role, assigned when registering.",2025-07-01,Nuclei,,,
CVE-2025-69411,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01609,CWE-22,Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Robert Seyfriedsberger ionCube tester plus ioncube-tester-plus allows Path Traversal.This issue affects ionCube tester plus: from n/a through <= 1.3.,2026-03-05,Nuclei,,,
CVE-2025-69516,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.021,CWE-1336,"A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, allows low-privileged users with Report Viewer or Report Manager permissions to achieve remote command execution on the server. This occurs due to improper sanitization of the template_md parameter, enabling direct injection of Jinja2 templates. This occurs due to misuse of the generate_html() function, the user-controlled value is inserted into `env.from_string`, a function that processes Jinja2 templates arbitrarily, making an SSTI possible.",2026-01-29,Metasploit,cpe:2.3:a:amidaware:tactical_rmm:*:*:*:*:*:*:*:*,Amidaware,Tactical Rmm
CVE-2025-6970,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.55683,CWE-89,"The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2025-07-09,Nuclei,cpe:2.3:a:pixelite:events_manager:*:*:*:*:*:wordpress:*:*,Pixelite,Events Manager
CVE-2025-69971,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02036,CWE-798,FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.,2026-02-03,Nuclei,cpe:2.3:a:frangoteam:fuxa:1.2.7:*:*:*:*:*:*:*,Frangoteam,Fuxa
CVE-2025-71243,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05126,CWE-94,The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulnerability. An attacker can exploit this vulnerability to execute arbitrary code on the server. Users should immediately update to version 5.11.1 or later.,2026-02-19,Metasploit/Nuclei,cpe:2.3:a:spip:saisies:*:*:*:*:*:spip:*:*,Spip,Saisies
CVE-2025-71257,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.044,CWE-306,"BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on restricted REST API endpoints and servlets. Unauthenticated remote attackers can bypass access controls to invoke restricted functionality and gain unauthorized access to application data and modify system resources. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.",2026-03-19,Nuclei,cpe:2.3:a:bmc:footprints_itsm:*:*:*:*:*:*:*:*,Bmc,Footprints Itsm
CVE-2025-71258,4.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N,0.1743,CWE-918,"BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API component that allows authenticated attackers to cause the server to initiate arbitrary outbound requests. Attackers can exploit improper URL validation to perform internal network scanning or interact with internal services, impacting system availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.",2026-03-19,Nuclei,cpe:2.3:a:bmc:footprints_itsm:*:*:*:*:*:*:*:*,Bmc,Footprints Itsm
CVE-2025-71259,4.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N,0.12916,CWE-918,"BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the externalfeed/RSS API component that allows authenticated attackers to trigger arbitrary outbound requests from the server. Attackers can exploit insufficient validation of externally supplied resource references to interact with internal services or cause resource exhaustion impacting availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.",2026-03-19,Nuclei,cpe:2.3:a:bmc:footprints_itsm:*:*:*:*:*:*:*:*,Bmc,Footprints Itsm
CVE-2025-7160,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.01721,CWE-74,A vulnerability classified as critical has been found in PHPGurukul Zoo Management System 2.1. This affects an unknown part of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.,2025-07-08,Nuclei,cpe:2.3:a:phpgurukul:zoo_management_system:2.1:*:*:*:*:*:*:*,Phpgurukul,Zoo Management System
CVE-2025-7441,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.39494,CWE-434,"The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API endpoint that does not have sufficient filetype validation. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.",2025-08-16,Metasploit,,,
CVE-2025-7775,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.18973,CWE-119,"Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server

(OR)

NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with IPv6 services or servicegroups bound with IPv6 servers 

(OR)

NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with DBS IPv6 services or servicegroups bound with IPv6 DBS servers

(OR)

CR virtual server with type HDX",2025-08-26,CISA,cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*;cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*;cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*;cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*,Citrix,Netscaler Application Delivery Controller
CVE-2025-8085,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.16399,CWE-918,"The Ditty  WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.",2025-09-08,Nuclei,cpe:2.3:a:metaphorcreations:ditty:*:*:*:*:*:wordpress:*:*,Metaphorcreations,Ditty
CVE-2025-8088,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.80906,CWE-35,"A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček
     from ESET.",2025-08-08,CISA,cpe:2.3:a:dtsearch:dtsearch:*:*:*:*:*:*:*:*;cpe:2.3:a:rarlab:winrar:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2025-8110,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.7654,CWE-22,Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.,2025-12-10,CISA/Nuclei,cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*,Gogs,Gogs
CVE-2025-8266,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.00971,CWE-20,A vulnerability has been found in yanyutao0402 ChanCMS up to 3.1.2 and classified as critical. Affected by this vulnerability is the function getArticle of the file app/modules/cms/controller/collect.js. The manipulation of the argument targetUrl leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.3 is able to address this issue. It is recommended to upgrade the affected component.,2025-07-28,Nuclei,cpe:2.3:a:chancms:chancms:*:*:*:*:*:*:*:*,Chancms,Chancms
CVE-2025-8286,0.0,,0.01217,CWE-306,"The affected products expose an unauthenticated Telnet-based command line interface that could allow an attacker to modify hardware configurations, manipulate data, or factory reset the device.",2025-07-31,Nuclei,,,
CVE-2025-8489,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09142,CWE-269,"The King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor plugin for WordPress is vulnerable to privilege escalation in versions 24.12.92 to 51.1.14 . This is due to the plugin not properly restricting the roles that users can register with. This makes it possible for unauthenticated attackers to register with administrator-level user accounts.",2025-10-31,Metasploit,,,
CVE-2025-8518,4.7,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L,0.01406,CWE-74,A vulnerability was found in givanz Vvveb 1.0.5. It has been rated as critical. Affected by this issue is the function Save of the file admin/controller/editor/code.php of the component Code Editor. The manipulation leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.6 is able to address this issue. The name of the patch is f684f3e374d04db715730fc4796e102f5ebcacb2. It is recommended to upgrade the affected component.,2025-08-04,Metasploit,cpe:2.3:a:vvveb:vvveb:1.0.5:*:*:*:*:*:*:*,Vvveb,Vvveb
CVE-2025-8848,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N,0.00417,CWE-94,"A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP GET request with a crafted Accept-Language header, arbitrary HTML can be injected into the <html lang=""""> tag of the response. This can lead to potential security risks such as cross-site scripting (XSS) attacks.",2025-10-22,Nuclei,cpe:2.3:a:librechat:librechat:0.7.9:-:*:*:*:*:*:*,Librechat,Librechat
CVE-2025-8868,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.22827,CWE-89,"In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via 

improperly neutralized inputs used in an SQL command using a well-known token.",2025-09-29,Nuclei,cpe:2.3:a:chef:automate:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2025-8875,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01588,CWE-502,Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.,2025-08-14,CISA,cpe:2.3:a:n-able:n-central:*:*:*:*:*:*:*:*,N-Able,N-Central
CVE-2025-8876,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03092,CWE-20,Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.,2025-08-14,CISA,cpe:2.3:a:n-able:n-central:*:*:*:*:*:*:*:*,N-Able,N-Central
CVE-2025-8943,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.7231,CWE-306,"The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.",2025-08-14,Metasploit/Nuclei,cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*,Flowiseai,Flowise
CVE-2025-9196,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00937,CWE-200,"The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the ~/admin/inc/phpinfo.php file that gets created on install. This makes it possible for unauthenticated attackers to extract sensitive data including configuration data.",2025-10-11,Nuclei,,,
CVE-2025-9209,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02196,CWE-200,"The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plugin exposing user private tokens and API data via the /wp-json/wp/v2/users REST API endpoint. This makes it possible for unauthenticated attackers to forge JWT tokens for other users, including administrators, and authenticate as them.",2025-10-03,Nuclei,,,
CVE-2025-9242,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.8637,CWE-787,"An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.3 and 2025.1.",2025-09-17,CISA,cpe:2.3:h:watchguard:firebox_m270:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m290:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m370:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m390:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m440:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m4600:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m470:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m4800:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m5600:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m570:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m5800:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m590:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m670:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_m690:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_nv5:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t115-w:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t125-w:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t125:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t145-w:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t145:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t15:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t185:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t20:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t25:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t35:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t40:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t45:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t55:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t70:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t80:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:firebox_t85:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:fireboxcloud:*:*:*:*:*:*:*:*;cpe:2.3:h:watchguard:fireboxv:*:*:*:*:*:*:*:*;cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*;cpe:2.3:o:watchguard:fireware:2025.1:*:*:*:*:*:*:*,Watchguard,Fireware
CVE-2025-9316,0.0,,0.36287,CWE-1284,"N-central < 2025.4 can generate sessionIDs for unauthenticated users





This issue affects N-central: before 2025.4.",2025-11-12,Metasploit/Nuclei,,,
CVE-2025-9377,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.11747,CWE-78,"The authenticated remote command execution (RCE) vulnerability exists  in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9.

This issue affects Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108.

Both products have reached the status of EOL (end-of-life).
It's recommending to 

purchase the new 
product to ensure better performance and security. If replacement is not
 an option in the short term, please use the second reference link to 
download and install the patch(es).",2025-08-29,CISA,cpe:2.3:h:tp-link:archer_c7:2.0:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:tl-wr841n:v9:*:*:*:*:*:*:*;cpe:2.3:h:tp-link:tl-wr841nd:9:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:archer_c7_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:tl-wr841n_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tp-link:tl-wr841nd_firmware:*:*:*:*:*:*:*:*,TP-Link,Tl-Wr841N Firmware
CVE-2025-9744,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.01664,CWE-74,A weakness has been identified in Campcodes Online Loan Management System 1.0. The affected element is an unknown function of the file /ajax.php?action=login. Executing manipulation of the argument Username can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited.,2025-08-31,Nuclei,cpe:2.3:a:campcodes:online_loan_management_system:1.0:*:*:*:*:*:*:*,Campcodes,Online Loan Management System
CVE-2025-9808,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00771,CWE-200,"The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST endpoint. This makes it possible for unauthenticated attackers to extract information about password-protected vendors or venues.",2025-09-16,Nuclei,,,
CVE-2025-9985,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.1107,CWE-532,"The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.",2025-09-26,Nuclei,,,
CVE-2026-0257,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.86678,CWE-565,"Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.

Panorama and Cloud NGFW are not impacted by these issues.",2026-05-13,CISA/Nuclei,cpe:2.3:a:paloaltonetworks:prisma_access:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:ruggedcom_ape1808:-:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h12:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h14:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h17:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h18:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h21:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h27:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h30:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h31:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h7:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h9:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h16:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h18:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h7:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.14:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.15:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.17:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h12:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h16:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h18:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h19:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h21:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h24:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h32:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h8:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.0:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h12:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h21:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h7:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h9:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.11:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.12:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.14:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.1:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h13:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h15:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h16:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h17:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h18:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h25:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h27:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h32:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h7:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h9:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.5:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h14:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h17:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h19:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h20:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h21:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h22:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h23:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h25:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h29:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h7:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.8:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.9:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.0:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.11:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.1:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.2:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.3:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h11:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h12:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h14:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h15:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h7:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h8:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h9:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.5:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.6:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h11:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h12:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h13:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h7:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h8:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.8:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.9:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:12.1.2:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:12.1.3:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:12.1.5:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:12.1.6:*:*:*:*:*:*:*;cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*,Siemens,Ruggedcom Ape1808 Firmware
CVE-2026-0300,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.32074,CWE-787,"A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. 

The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the  best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail  by restricting access to only trusted internal IP addresses.

Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.",2026-05-06,CISA,cpe:2.3:h:paloaltonetworks:pa-1410:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-1420:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-3410:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-3420:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-3430:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-3440:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-410:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-410r-5g:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-410r:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-415-5g:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-415:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-440:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-445:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-450:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-450r-5g:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-450r:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-455-5g:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-455:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-455r-5g:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-460:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-501:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-505:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-510:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-520:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-540:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-5410:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-5420:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-5430:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-5440:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-5445:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-545-poe:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-5450:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-550:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-5540:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-555-poe:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-5550:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-5560:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-5570:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-5580:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-560:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-7500-dpc-a:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:pa-7500:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:vm-100:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:vm-300:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:vm-500:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:vm-50:-:*:*:*:*:*:*:*;cpe:2.3:h:paloaltonetworks:vm-700:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:ruggedcom_ape1808:-:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h12:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h14:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h17:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h18:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h21:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h27:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h30:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h31:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h7:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h9:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h16:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h18:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h7:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.14:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.15:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.17:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.1:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.5:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.6:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h12:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h16:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h19:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h21:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h24:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h32:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h8:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.0:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h12:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h21:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h7:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h9:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.11:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.12:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.14:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.1:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h13:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h15:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h16:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h17:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h18:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h25:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h27:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h32:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h7:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h9:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.5:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h14:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h17:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h19:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h20:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h21:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h22:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h23:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h25:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h29:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h7:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.8:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.1.9:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.0:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.11:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.1:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.2:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.3:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h11:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h12:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h14:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h15:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h5:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h6:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h7:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h8:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h9:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.5:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.6:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h10:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h11:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h12:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h1:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h4:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h7:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h8:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.8:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:11.2.9:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:12.1.2:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:12.1.3:*:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h2:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h3:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:12.1.5:-:*:*:*:*:*:*;cpe:2.3:o:paloaltonetworks:pan-os:12.1.6:-:*:*:*:*:*:*;cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*,Siemens,Ruggedcom Ape1808 Firmware
CVE-2026-0545,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04392,CWE-306,"In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. This vulnerability affects the latest version of the repository. If job execution is enabled (`MLFLOW_SERVER_ENABLE_JOB_EXECUTION=true`) and any job function is allowlisted, any network client can submit, read, search, and cancel jobs without credentials, bypassing basic-auth entirely. This can lead to unauthenticated remote code execution if allowed jobs perform privileged actions such as shell execution or filesystem changes. Even if jobs are deemed safe, this still constitutes an authentication bypass, potentially resulting in job spam, denial of service (DoS), or data exposure in job results.",2026-04-03,Nuclei,cpe:2.3:a:lfprojects:mlflow:-:*:*:*:*:*:*:*,Lfprojects,Mlflow
CVE-2026-0560,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01765,CWE-918,"A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` function in `backend/routers/files.py` fails to validate user-controlled URLs, allowing attackers to make arbitrary HTTP requests to internal services and cloud metadata endpoints. This vulnerability can lead to internal network access, cloud metadata access, information disclosure, port scanning, and potentially remote code execution.",2026-03-29,Nuclei,cpe:2.3:a:lollms:lollms:*:*:*:*:*:*:*:*,Lollms,Lollms
CVE-2026-0594,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00693,CWE-79,"The List Site Contributors plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'alpha' parameter in versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",2026-01-14,Nuclei,,,
CVE-2026-0740,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.54254,CWE-434,"The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NF_FU_AJAX_Controllers_Uploads::handle_upload' function in all versions up to, and including, 3.3.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability was partially patched in version 3.3.25 and fully patched in version 3.3.27.",2026-04-07,Nuclei,,,
CVE-2026-0770,0.0,,0.54503,CWE-829,"Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27325.",2026-01-23,CISA/Nuclei,cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*,Langflow,Langflow
CVE-2026-0826,0.0,,0.24469,CWE-121,"In certain scenarios when the admin has enabled Interactive Connectivity Establishment (ICE), a buffer overflow could enable
               remote code execution on Poly Voice products on the Linux platform.",2026-06-01,Metasploit,,,
CVE-2026-0829,5.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N,0.00682,CWE-862,"The Frontend File Manager Plugin WordPress plugin through 23.5 allows unauthenticated users to send emails through the site without any security checks. This lets attackers use the WordPress site as an open relay for spam or phishing emails to anyone. Attackers can also guess file IDs to access and share uploaded files without permission, exposing sensitive information.",2026-02-17,Nuclei,,,
CVE-2026-0926,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09396,CWE-98,"The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'parameters[template_name]' parameter. This makes it possible for unauthenticated attackers to include and read arbitrary files or execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.",2026-02-19,Nuclei,,,
CVE-2026-10520,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.99041,CWE-78,"An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution",2026-06-09,CISA/EPSS/Nuclei,cpe:2.3:a:ivanti:standalone_sentry:*:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:standalone_sentry:10.7.0:*:*:*:*:*:*:*,Ivanti,Standalone Sentry
CVE-2026-10580,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02841,CWE-285,"The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::get_user_permissions(), which returns the same null sentinel for both administrators and unauthenticated visitors — a value that HippooPermissions::has_role_access() unconditionally interprets as full administrator access — causing override_extension_permission_callback() to assign __return_true as the permission callback for every WordPress and WooCommerce REST route cloned under /wc-hippoo/v1/ext/ by HippooControllerWithAuth::re_register_external_routes(), while the block_unauthorized_access() pre-dispatch guard fails to block unauthenticated users for the same reason. This makes it possible for unauthenticated attackers to invoke any core REST endpoint without credentials — most critically, sending a POST request to /wc-hippoo/v1/ext/wp/v2/users/<id> with a {""password"":""<new_password>""} body to reset the password of any WordPress user, including the site administrator, and gain full administrative control of the site.",2026-06-05,Nuclei,,,
CVE-2026-10823,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.00921,Missing_Data,"The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST API endpoints and does not validate a user-supplied query parameter, allowing unauthenticated attackers to retrieve the titles and content of private, draft, and other non-public posts.",2026-06-26,Nuclei,,,
CVE-2026-11645,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.01654,CWE-125,Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High),2026-06-09,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Apple,Macos
CVE-2026-1207,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N,0.09436,CWE-89,"An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Tarek Nakkouch for reporting this issue.",2026-02-03,Nuclei,cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*,Djangoproject,Django
CVE-2026-12569,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01247,CWE-20,"A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.   *  This advisory also applies to all CPS versions
  *  The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030",2026-06-18,CISA,cpe:2.3:a:ptc:flexplm:*:*:*:*:*:*:*:*;cpe:2.3:a:ptc:flexplm:11.1m020:*:*:*:*:*:*:*;cpe:2.3:a:ptc:flexplm:11.2.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ptc:flexplm:12.0.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ptc:flexplm:12.0.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ptc:flexplm:12.1.3.0:*:*:*:*:*:*:*;cpe:2.3:a:ptc:flexplm:13.0.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ptc:flexplm:13.0.3.0:*:*:*:*:*:*:*;cpe:2.3:a:ptc:windchill_pdmlink:*:*:*:*:*:*:*:*;cpe:2.3:a:ptc:windchill_pdmlink:11.0m030:-:*:*:*:*:*:*;cpe:2.3:a:ptc:windchill_pdmlink:11.1m020:-:*:*:*:*:*:*;cpe:2.3:a:ptc:windchill_pdmlink:11.2.1.0:-:*:*:*:*:*:*;cpe:2.3:a:ptc:windchill_pdmlink:12.0.2.0:-:*:*:*:*:*:*;cpe:2.3:a:ptc:windchill_pdmlink:12.1.2.0:-:*:*:*:*:*:*;cpe:2.3:a:ptc:windchill_pdmlink:13.0.2.0:-:*:*:*:*:*:*;cpe:2.3:a:ptc:windchill_pdmlink:13.1.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ptc:windchill_pdmlink:13.1.1.0:-:*:*:*:*:*:*;cpe:2.3:a:ptc:windchill_pdmlink:13.1.2.0:*:*:*:*:*:*:*;cpe:2.3:a:ptc:windchill_pdmlink:13.1.3.0:*:*:*:*:*:*:*,Ptc,Flexplm
CVE-2026-1277,4.7,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N,0.00592,CWE-601,"The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter in the promotional dismissal handler. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites via a crafted link.",2026-02-18,Nuclei,,,
CVE-2026-1281,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.81231,CWE-94,A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.,2026-01-29,CISA/Metasploit,cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager_mobile:12.5.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager_mobile:12.6.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager_mobile:12.6.1.0:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager_mobile:12.7.0.0:*:*:*:*:*:*:*,Ivanti,Endpoint Manager Mobile
CVE-2026-1296,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.0046,CWE-601,"The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'requested_page' POST parameter in the verify_username_password function. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action such as clicking on a link.",2026-02-18,Nuclei,,,
CVE-2026-1306,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04458,CWE-434,"The midi-Synth plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type and file extension validation in the 'export' AJAX action in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible granted the attacker can obtain a valid nonce. The nonce is exposed in frontend JavaScript making it trivially accessible to unauthenticated attackers.",2026-02-14,Nuclei,,,
CVE-2026-1314,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00892,CWE-862,"The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the send_post_pages_json() function in all versions up to, and including, 1.16.17. This makes it possible for unauthenticated attackers to retrieve flipbook page metadata for draft, private and password-protected flipbooks.",2026-04-15,Nuclei,,,
CVE-2026-1340,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.8404,CWE-94,A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.,2026-01-29,CISA/Metasploit,cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:*,Ivanti,Endpoint Manager Mobile
CVE-2026-1357,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.32714,CWE-434,"The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Upload in versions up to and including 0.9.123. This is due to improper error handling in the RSA decryption process combined with a lack of path sanitization when writing uploaded files. When the plugin fails to decrypt a session key using openssl_private_decrypt(), it does not terminate execution and instead passes the boolean false value to the phpseclib library's AES cipher initialization. The library treats this false value as a string of null bytes, allowing an attacker to encrypt a malicious payload using a predictable null-byte key. Additionally, the plugin accepts filenames from the decrypted payload without sanitization, enabling directory traversal to escape the protected backup directory. This makes it possible for unauthenticated attackers to upload arbitrary PHP files to publicly accessible directories and achieve Remote Code Execution via the wpvivid_action=send_to_site parameter.",2026-02-11,Nuclei,,,
CVE-2026-1368,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01211,CWE-287,"The Video Conferencing with Zoom WordPress plugin before 4.6.6 contains an AJAX handler that has its nonce verification commented out, allowing unauthenticated attackers to generate valid Zoom SDK signatures for any meeting ID and retrieve the site's Zoom SDK key.",2026-02-18,Nuclei,,,
CVE-2026-13731,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.00524,CWE-79,"The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.4.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The AJAX nonce required to authenticate the save request is publicly emitted on every frontend page via wp_localize_script, making it freely obtainable by any anonymous visitor and removing any practical barrier to exploitation.",2026-07-01,Nuclei,,,
CVE-2026-1405,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03177,CWE-434,"The Slider Future plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'slider_future_handle_image_upload' function in all versions up to, and including, 1.0.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.",2026-02-19,Nuclei,,,
CVE-2026-1492,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.25532,CWE-269,"The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to improper privilege management in all versions up to, and including, 5.1.2. This is due to the plugin accepting a user-supplied role during membership registration without properly enforcing a server-side allowlist. This makes it possible for unauthenticated attackers to create administrator accounts by supplying a role value during membership registration.",2026-03-03,Nuclei,,,
CVE-2026-15094,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00398,CWE-79,"The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",2026-07-17,Nuclei,,,
CVE-2026-15409,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.16271,CWE-918,A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.,2026-07-14,CISA/Nuclei,cpe:2.3:a:sonicwall:sma8200v:-:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:sma8200v:12.4.3-03245:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:sma8200v:12.4.3-03387:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:sma8200v:12.4.3-03434:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:sma8200v:12.5.0-02283:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:sma8200v:12.5.0-02624:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:sma8200v:12.5.0-02800:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma6210:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma7210:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03245:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03387:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03434:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02283:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02624:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02800:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03245:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03387:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03434:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02283:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02624:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02800:*:*:*:*:*:*:*,Sonicwall,Sma6210 Firmware
CVE-2026-15410,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.18287,CWE-94,Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.,2026-07-14,CISA,cpe:2.3:a:sonicwall:sma8200v:-:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:sma8200v:12.4.3-03245:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:sma8200v:12.4.3-03387:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:sma8200v:12.4.3-03434:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:sma8200v:12.5.0-02283:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:sma8200v:12.5.0-02624:*:*:*:*:*:*:*;cpe:2.3:a:sonicwall:sma8200v:12.5.0-02800:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma6210:-:*:*:*:*:*:*:*;cpe:2.3:h:sonicwall:sma7210:-:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03245:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03387:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03434:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02283:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02624:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02800:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03245:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03387:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03434:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02283:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02624:*:*:*:*:*:*:*;cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02800:*:*:*:*:*:*:*,Sonicwall,Sma6210 Firmware
CVE-2026-1557,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01722,CWE-22,"The WP Responsive Images plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0 via the 'src' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.",2026-02-26,Nuclei,,,
CVE-2026-1581,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01727,CWE-89,"The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'wpfob' parameter in all versions up to, and including, 2.4.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2026-02-19,Nuclei,,,
CVE-2026-1603,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.8056,CWE-288,An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.,2026-02-10,CISA/Nuclei,cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2024:-:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2024:su1:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2024:su2:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2024:su3:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2024:su3_security_release_1:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2024:su4:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager:2024:su4_security_release_1:*:*:*:*:*:*,Ivanti,Endpoint Manager
CVE-2026-16232,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.01074,CWE-287,An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.,2026-07-22,CISA,,Check Point,SmartConsole
CVE-2026-1731,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.88115,CWE-78,"BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.",2026-02-06,CISA/Metasploit/Nuclei,cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*;cpe:2.3:a:beyondtrust:remote_support:*:*:*:*:*:*:*:*,Beyondtrust,Privileged Remote Access
CVE-2026-1890,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.00645,Missing_Data,"The LeadConnector WordPress plugin before 3.0.22 does not have authorization in a REST route, allowing unauthenticated users to call it and overwrite existing data",2026-03-26,Nuclei,,,
CVE-2026-1980,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00768,CWE-200,"The WPBookit plugin for WordPress is vulnerable to unauthorized data disclosure due to a missing authorization check on the 'get_customer_list' route in all versions up to, and including, 1.0.8. This makes it possible for unauthenticated attackers to retrieve sensitive customer information including names, emails, phone numbers, dates of birth, and gender.",2026-03-04,Nuclei,,,
CVE-2026-20045,8.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N,0.04307,CWE-94,"A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device.&nbsp;

This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.&nbsp;
Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.",2026-01-21,CISA,cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:-:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:session_management:*:*:*;cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*,Cisco,Unified Communications Manager
CVE-2026-20079,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.387,CWE-288,"A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.

 This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device.",2026-03-04,Nuclei,,,
CVE-2026-20122,5.4,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N,0.07016,CWE-648,"A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system.

This vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system&nbsp;and gain vmanage user privileges.",2026-02-25,CISA,cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.6:*:*:*:*:*:*:*,Cisco,Catalyst Sd-Wan Manager
CVE-2026-20127,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.57793,CWE-287,"A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.

This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root&nbsp;user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.&nbsp;",2026-02-25,CISA/Metasploit,cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:20.12.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan_vsmart_controller:20.12.6:*:*:*:*:*:*:*,Cisco,Catalyst Sd-Wan Manager
CVE-2026-20128,7.5,CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H,0.05269,CWE-257,"A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system.

This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges.
Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.",2026-02-25,CISA,cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.6:*:*:*:*:*:*:*,Cisco,Catalyst Sd-Wan Manager
CVE-2026-20131,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.27551,CWE-502,"A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root&nbsp;on an affected device.

This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root.
Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.",2026-03-04,CISA,cpe:2.3:a:cisco:secure_firewall_management_center:10.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.13:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.14:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.15:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.16:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.17:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.18:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.0.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.0.1.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.0.2.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.0.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.0.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.0.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.0.6.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.0.6.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.0.6.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.0.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.0.7:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.0.8.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.0.8:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.1.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.1.0.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.1.0.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.1.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.2.0.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.2.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.2.10.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.2.10.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.2.10:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.2.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.2.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.2.3.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.2.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.2.4.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.2.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.2.5.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.2.5.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.2.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.2.6:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.2.7:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.2.8.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.2.8:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.2.9:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.3.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.3.1.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.3.1.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.3.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.4.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.4.1.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.4.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.4.2.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.4.2.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.4.2.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.4.2.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.4.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.4.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.4.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.4.5:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.6.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.6.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.6.2.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.6.2:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.6.3:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.6.4:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.7.0:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.7.10.1:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.7.10:*:*:*:*:*:*:*;cpe:2.3:a:cisco:secure_firewall_management_center:7.7.11:*:*:*:*:*:*:*,Cisco,Secure Firewall Management Center
CVE-2026-20133,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.10245,CWE-200,"A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system.

 This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.",2026-02-25,CISA,cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.6:*:*:*:*:*:*:*,Cisco,Catalyst Sd-Wan Manager
CVE-2026-20182,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.88496,CWE-287,"May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the  was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The  section of this advisory includes Show Control Connections guidance to help with system checks.&nbsp;

A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.
This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.",2026-05-14,CISA/Metasploit,cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.7:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:20.12.7:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan_vsmart_controller:20.12.7:*:*:*:*:*:*:*,Cisco,Catalyst Sd-Wan Manager
CVE-2026-20230,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N,0.41694,CWE-918,"A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device.

This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root.
Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.
Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default.",2026-06-03,CISA,cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:-:*:*:*;cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:session_management:*:*:*,Cisco,Unified Communications Manager
CVE-2026-20245,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.25323,CWE-116,"A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.

This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user.
To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of  or . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices.
Cisco recommends that customers upgrade to the fixed software that is documented in the  that was published on May 14, 2026, and verify the configuration of the edge devices.",2026-06-04,CISA,cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.7:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:*;cpe:2.3:a:cisco:sd-wan_vsmart_controller:20.12.7:*:*:*:*:*:*:*,Cisco,Catalyst Sd-Wan Manager
CVE-2026-2025,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01379,CWE-200,"The Mail Mint  WordPress plugin before 1.19.5 does not have authorization in one of its REST API endpoint, allowing unauthenticated users to call it and retrieve the email addresses of users on the blog",2026-03-04,Nuclei,,,
CVE-2026-20253,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.88171,CWE-306,"In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service.",2026-06-10,CISA/Nuclei,cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*,Splunk,Splunk
CVE-2026-20262,6.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N,0.07683,CWE-22,"A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.

This vulnerability exists because the affected software does not properly validate user-supplied input during a file upload process. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected API endpoint of the affected system. A successful exploit could allow the attacker to create or overwrite any file on the underlying operating system. This file could later be used to elevate to root. To exploit this vulnerability, the attacker must have valid credentials with at least a lower-privileged, single-task user account.",2026-06-15,CISA,cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*,Cisco,Catalyst Sd-Wan Manager
CVE-2026-20700,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01319,CWE-119,"A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report.",2026-02-11,CISA,cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*,Apple,Ipados
CVE-2026-20805,5.5,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,0.05028,CWE-200,Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.,2026-01-13,CISA,cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1607
CVE-2026-20963,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.2943,CWE-502,Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.,2026-01-13,CISA,cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*,Microsoft,Sharepoint Server
CVE-2026-21385,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01068,CWE-190,Memory corruption while using alignments for memory allocation.,2026-03-02,CISA,cpe:2.3:h:qualcomm:5g_fixed_wireless_access_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:apq8098:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ar8031:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:ar8035:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:c-v2x_9150:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:csra6620:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:csra6640:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_6200:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_6700:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_6800:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_6900:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:flight_rb5_5g_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:fsm100_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:g1_gen_1:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:g2_gen_1:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:iq-615:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:iq-8275:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:iq-8300:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:iq-9075:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:iq-9100:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:lemans_au_lgit:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:lemansau:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:mdm9250:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:mdm9628:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:milos:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:monaco_iot:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:netrani:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:orne:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:palawan25:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:pandeiro:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qam8255p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qam8295p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qamsrv1h:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qamsrv1m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca2066:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6174a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6564a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6564au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574a:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6574au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6584au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6595:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6595au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6678aq:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6688aq:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6696:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6698aq:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6698au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca6797aq:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca8081:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca8337:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca8695au:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca9367:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qca9377:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm2290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm4325:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm4490:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm5430:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm6125:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcm6490:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn6024:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn9011:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn9012:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcn9024:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs2290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs4290:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs4490:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qcs8550:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln1083bd:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qln1086bd:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qmp1000:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa1083bd:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qpa1086bd:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qrb5165m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qrb5165n:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qualcomm_215_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qxm1083:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qxm1086:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qxm1093:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qxm1094:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qxm1095:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:qxm1096:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:robotics_rb2_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:robotics_rb5_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa4150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa4155p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6145p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6155:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa6155p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa7255p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa7775p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8145p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8150p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8155:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8155p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8195p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8255p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8295p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8620p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa8770p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sa9000p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sar1165p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sar1250p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sar2130p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sar2230p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sc8380xp:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd626:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd662:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sd865_5g:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sda660:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdm429w:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sdx61:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6225p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm6650p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7325p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7435:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7550:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7550p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7635p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7675:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm7675p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8475p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8550p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8635:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8635p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8650q:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sm8750p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smart_audio_400_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:smart_display_200_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_429_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_460_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_480\+_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_480_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_4_gen_1_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_4_gen_2_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_625_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_626_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_660_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_662_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_680_4g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_685_4g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_690_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_695_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_6_gen_1_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_6_gen_3_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_6_gen_4_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_778g\+_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_778g_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_782g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_7\+_gen_2_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_7_gen_1_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_7c\+_gen_3_compute:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_7s_gen_3_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_820_automotive_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_820am:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_865\+_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_865_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_870_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_888\+_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_888_5g_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8\+_gen_1_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8\+_gen_2_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8_elite:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8_elite_gen_5:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8_gen_1:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8_gen_1_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8_gen_2_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_8_gen_3_mobile_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_ar1\+_gen_1_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_ar1_gen_1_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_auto_5g_modem-rf:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_w5\+_gen_1_wearable_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_x12_lte_modem:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_x53_5g_modem-rf_system:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_x55_5g_modem-rf_system:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_x5_lte_modem:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_x65_5g_modem-rf_system:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_xr2\+_gen_1_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:snapdragon_xr2_5g_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:srv1h:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:srv1m:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sw5100:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sw5100p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sw6100:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sw6100p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sxr2230p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sxr2250p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sxr2330p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:sxr2350p:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:themisto:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:video_collaboration_vc1_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:video_collaboration_vc3_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:video_collaboration_vc5_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:vision_intelligence_100_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:vision_intelligence_200_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:vision_intelligence_400_platform:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9326:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9330:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9335:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9341:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9360:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9371:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9378:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9390:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcd9395:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3615:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3620:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3660b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3680b:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3910:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3980:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3988:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn3990:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6450:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6650:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn6755:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn7860:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn7861:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn7880:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wcn7881:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8832:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8840:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8845:-:*:*:*:*:*:*:*;cpe:2.3:h:qualcomm:wsa8845h:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:5g_fixed_wireless_access_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:apq8098_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ar8031_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:ar8035_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:c-v2x_9150_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:csra6620_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:csra6640_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_6200_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_6700_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_6800_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:flight_rb5_5g_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:fsm100_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:g1_gen_1_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:g2_gen_1_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:iq-615_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:iq-8275_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:iq-8300_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:iq-9075_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:iq-9100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:lemans_au_lgit_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:lemansau_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:mdm9250_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:mdm9628_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:milos_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:monaco_iot_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:netrani_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:orne_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:palawan25_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:pandeiro_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qam8255p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qam8295p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qamsrv1h_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qamsrv1m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca2066_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6174a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6564a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6564au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574a_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6584au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6595_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6595au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6678aq_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6688aq_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6696_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6698aq_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6698au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca6797aq_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca8081_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca8337_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca8695au_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca9367_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qca9377_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm2290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm4325_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm4490_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm5430_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm6125_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcm6490_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn6024_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn9011_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn9012_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcn9024_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs2290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs4290_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs4490_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qcs8550_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln1083bd_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qln1086bd_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qmp1000_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa1083bd_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qpa1086bd_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qrb5165m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qrb5165n_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qualcomm_215_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qxm1083_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qxm1086_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qxm1093_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qxm1094_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qxm1095_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:qxm1096_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:robotics_rb2_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:robotics_rb5_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa4150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa4155p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6145p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6155_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa6155p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa7255p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa7775p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8145p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8150p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8155_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8155p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8195p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8255p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8295p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8620p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa8770p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sa9000p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sar1165p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sar1250p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sar2130p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sar2230p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sc8380xp_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd626_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd662_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sd865_5g_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sda660_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdm429w_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sdx61_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6225p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm6650p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7325p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7435_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7550_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7550p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7635p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7675_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm7675p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8475p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8550p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8635_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8635p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8650q_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sm8750p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smart_audio_400_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:smart_display_200_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_429_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_460_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_480\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_480_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_4_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_4_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_625_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_626_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_660_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_662_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_680_4g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_685_4g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_690_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_695_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_6_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_6_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_6_gen_4_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_778g\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_778g_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_782g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_7\+_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_7_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_7c\+_gen_3_compute_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_7s_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_820_automotive_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_820am_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_865\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_865_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_870_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_888\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_888_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8\+_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8\+_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8_elite_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8_elite_gen_5_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8_gen_1_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_8_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_ar1\+_gen_1_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_ar1_gen_1_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_auto_5g_modem-rf_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_w5\+_gen_1_wearable_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_x12_lte_modem_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_x53_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_x55_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_x5_lte_modem_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_x65_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_xr2\+_gen_1_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:snapdragon_xr2_5g_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:srv1h_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:srv1m_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sw5100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sw5100p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sw6100_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sw6100p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sxr2230p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sxr2250p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sxr2330p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:sxr2350p_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:themisto_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:video_collaboration_vc1_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:video_collaboration_vc3_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:video_collaboration_vc5_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:vision_intelligence_100_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:vision_intelligence_200_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:vision_intelligence_400_platform_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9326_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9330_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9335_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9341_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9360_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9371_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9378_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9390_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcd9395_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3615_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3620_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3660b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3680b_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3910_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3980_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn3990_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6450_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6650_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn6755_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn7860_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn7861_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn7880_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wcn7881_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8832_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8840_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8845_firmware:-:*:*:*:*:*:*:*;cpe:2.3:o:qualcomm:wsa8845h_firmware:-:*:*:*:*:*:*:*,Qualcomm,Sm7675P Firmware
CVE-2026-21445,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.20655,CWE-306,"Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization. Version 1.7.0.dev45 contains a patch.",2026-01-02,Nuclei,cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*,Langflow,Langflow
CVE-2026-21484,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00713,CWE-203,"AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313, the password recovery endpoint returns different error messages depending on whether a username exists, so enabling username enumeration. Commit e287fab56089cf8fcea9ba579a3ecdeca0daa313 fixes this issue.",2026-01-03,Nuclei,cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:*,Mintplexlabs,Anythingllm
CVE-2026-21509,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.72152,CWE-807,Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.,2026-01-26,CISA,cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*;cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*;cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x64:*;cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x86:*;cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:*;cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x86:*;cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x64:*;cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x86:*;cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x64:*;cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x86:*,Microsoft,365 Apps
CVE-2026-21510,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.25835,CWE-693,Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.,2026-02-10,CISA,cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1607
CVE-2026-21513,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.15384,CWE-693,Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.,2026-02-10,CISA,cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:-:*:x64:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:-:*:x64:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:-:*:x64:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:-:*:x64:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*,Microsoft,Windows 10 1607
CVE-2026-21514,7.8,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.01517,CWE-807,Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.,2026-02-10,CISA,cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*;cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*;cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x64:*;cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x86:*;cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:macos:*:*;cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x64:*;cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x86:*;cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:macos:*:*,Microsoft,365 Apps
CVE-2026-21519,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.0242,CWE-843,Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.,2026-02-10,CISA,cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1607
CVE-2026-21525,6.2,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.04956,CWE-476,Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.,2026-02-10,CISA,cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1607
CVE-2026-21533,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03846,CWE-269,Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.,2026-02-10,CISA,cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x96:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1607
CVE-2026-21643,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.94085,CWE-89,An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.,2026-02-06,CISA/Nuclei,cpe:2.3:a:fortinet:forticlientems:7.4.4:*:*:*:*:*:*:*,Fortinet,Forticlientems
CVE-2026-21858,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N,0.71647,CWE-20,"n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker, resulting in exposure of sensitive information stored on the system and may enable further compromise depending on deployment configuration and workflow usage. This issue is fixed in version 1.121.0.",2026-01-08,Nuclei,cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*,N8N,N8N
CVE-2026-21859,5.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N,0.00755,CWE-918,"Mailpit is an email testing tool and API for developers. Versions 1.28.0 and below have a Server-Side Request Forgery (SSRF) vulnerability in the /proxy endpoint, allowing attackers to make requests to internal network resources. The /proxy endpoint validates http:// and https:// schemes, but it does not block internal IP addresses, enabling attackers to access internal services and APIs. This vulnerability is limited to HTTP GET requests with minimal headers. The issue is fixed in version 1.28.1.",2026-01-08,Nuclei,cpe:2.3:a:axllent:mailpit:*:*:*:*:*:*:*:*,Axllent,Mailpit
CVE-2026-21877,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.05258,CWE-94,"n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able to execute malicious code using the n8n service. This could result in full compromise and can impact both self-hosted and n8n Cloud instances. This issue is fixed in version 1.121.3. Administrators can reduce exposure by disabling the Git node and limiting access for untrusted users, but upgrading to the latest version is recommended.",2026-01-08,Nuclei,cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*,N8N,N8N
CVE-2026-21891,9.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L,0.02169,CWE-287,"ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions up to and including 1.5.0, the application checks the validity of the username but appears to skip, misinterpret, or incorrectly validate the password when the provided username matches a known system service account. The application's login function fails to properly handle the password validation result for these users, effectively granting authenticated access to anyone who knows one of these common usernames and provides any password. As of time of publication, no known patched versions are available.",2026-01-08,Nuclei,cpe:2.3:o:zimaspace:zimaos:*:*:*:*:*:*:*:*,Zimaspace,Zimaos
CVE-2026-22200,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.73125,CWE-74,"Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficiently sanitized before being processed by the mPDF PDF generator during export. When the attacker exports the ticket to PDF, the generated PDF can embed the contents of attacker-selected files from the server filesystem as bitmap images, allowing disclosure of sensitive local files in the context of the osTicket application user. This issue is exploitable in default configurations where guests may create tickets and access ticket status, or where self-registration is enabled.",2026-01-12,Metasploit/Nuclei,cpe:2.3:a:enhancesoft:osticket:*:*:*:*:*:*:*:*,Enhancesoft,Osticket
CVE-2026-22557,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.15601,CWE-22,A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the underlying system that could be manipulated to access an underlying account.,2026-03-19,Nuclei,,,
CVE-2026-2262,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.0239,CWE-200,"The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via the `/wp-json/wp/v2/eablocks/ea_appointments/` REST API endpoint. This is due to the endpoint being registered with `'permission_callback' => '__return_true'`, which allows access without any authentication or authorization checks. This makes it possible for unauthenticated attackers to extract sensitive customer appointment data including full names, email addresses, phone numbers, IP addresses, appointment descriptions, and pricing information.",2026-04-18,Nuclei,,,
CVE-2026-22683,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.00678,CWE-862,"Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities, the API does not enforce the Operator restriction on workspace endpoints, allowing an Operator to create and update scripts, flows, apps, and raw_apps. Since Operators can also execute scripts via the jobs API, this allows direct privilege escalation to remote code execution within the Windmill deployment. This vulnerability has existed since the introduction of the Operator role in version 1.56.0.",2026-04-07,Nuclei,cpe:2.3:a:nextcloud:flow:*:*:*:*:*:*:*:*;cpe:2.3:a:windmill:windmill:*:*:*:*:*:*:*:*,Nextcloud,Flow
CVE-2026-22719,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.17424,CWE-77,"VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. 

To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001 

Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001",2026-02-25,CISA,cpe:2.3:a:vmware:aria_operations:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_infrastructure:*:*:*:*:*:*:*:*;cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:*,Vmware,Aria Operations
CVE-2026-22739,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L,0.0122,CWE-22,"Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.",2026-03-24,Nuclei,,,
CVE-2026-22769,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.13122,CWE-798,"Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible.",2026-02-17,CISA,cpe:2.3:a:dell:recoverpoint_for_virtual_machines:*:*:*:*:*:*:*:*;cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:-:*:*:*:*:*:*;cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:sp1:*:*:*:*:*:*;cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:sp1_p1:*:*:*:*:*:*;cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:sp1_p2:*:*:*:*:*:*;cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:sp2:*:*:*:*:*:*;cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:sp2_p1:*:*:*:*:*:*;cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:sp3:*:*:*:*:*:*;cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:sp3_p1:*:*:*:*:*:*,Dell,Recoverpoint For Virtual Machines
CVE-2026-22778,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03816,CWE-532,"vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap address. With this leak, we reduce ASLR from 4 billion guesses to ~8 guesses. This vulnerability can be chained a heap overflow with JPEG2000 decoder in OpenCV/FFmpeg to achieve remote code execution. This vulnerability is fixed in 0.14.1.",2026-02-02,Nuclei,cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*,Vllm,Vllm
CVE-2026-22812,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.16955,CWE-306,"OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This vulnerability is fixed in 1.0.216.",2026-01-12,Nuclei,cpe:2.3:a:anoma:opencode:*:*:*:*:*:-:*:*,Anoma,Opencode
CVE-2026-2329,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.40014,CWE-121,"An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target device. The vulnerability affects all six device models in the series: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630.",2026-02-18,Metasploit,cpe:2.3:h:grandstream:gxp1610:-:*:*:*:*:*:*:*;cpe:2.3:h:grandstream:gxp1615:-:*:*:*:*:*:*:*;cpe:2.3:h:grandstream:gxp1620:-:*:*:*:*:*:*:*;cpe:2.3:h:grandstream:gxp1625:-:*:*:*:*:*:*:*;cpe:2.3:h:grandstream:gxp1628:-:*:*:*:*:*:*:*;cpe:2.3:h:grandstream:gxp1630:-:*:*:*:*:*:*:*;cpe:2.3:o:grandstream:gxp1610_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:grandstream:gxp1615_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:grandstream:gxp1620_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:grandstream:gxp1625_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:grandstream:gxp1628_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:grandstream:gxp1630_firmware:*:*:*:*:*:*:*:*,Grandstream,Gxp1610 Firmware
CVE-2026-23482,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01523,CWE-22,"Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the file server endpoint does not perform permission checks on the temp/ path and does not filter path traversal sequences, allowing unauthorized attackers to read arbitrary files on the server. When scheduled backup tasks are enabled, attackers can read backup files to obtain all user notes and user TOKENS. This issue has been patched in version 1.8.4.",2026-03-23,Nuclei,cpe:2.3:a:blinko:blinko:*:*:*:*:*:*:*:*,Blinko,Blinko
CVE-2026-23483,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00771,CWE-22,"Blinko is an AI-powered card note-taking project. In versions from 1.8.3 and prior, the plugin file server endpoint uses join() to concatenate paths but does not verify if the final path is within the plugins directory, leading to path traversal. At time of publication, there are no publicly available patches.",2026-03-23,Nuclei,cpe:2.3:a:blinko:blinko:*:*:*:*:*:*:*:*,Blinko,Blinko
CVE-2026-23486,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00711,CWE-200,"Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, a publicly accessible endpoint exposes all user information, including usernames, roles, and account creation dates. This issue has been patched in version 1.8.4.",2026-03-23,Nuclei,cpe:2.3:a:blinko:blinko:*:*:*:*:*:*:*:*,Blinko,Blinko
CVE-2026-23550,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.20631,CWE-266,Incorrect Privilege Assignment vulnerability in Modular DS Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from n/a through <= 2.5.1.,2026-01-14,Nuclei,,,
CVE-2026-23696,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.05064,CWE-89,"Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality that allows authenticated attackers to inject SQL through the owner parameter. An attacker can use the injection to read sensitive data such as the JWT signing secret and administrative user identifiers, forge an administrative token, and then execute arbitrary code via the workflow execution endpoints.",2026-04-07,Nuclei,,,
CVE-2026-23744,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.43671,CWE-306,"MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 and earlier are vulnerable to remote code execution (RCE) vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE. Since MCPJam inspector by default listens on 0.0.0.0 instead of 127.0.0.1, an attacker can trigger the RCE remotely via a simple HTTP request. Version 1.4.3 contains a patch.",2026-01-16,Nuclei,cpe:2.3:a:mcpjam:inspector:*:*:*:*:*:*:*:*,Mcpjam,Inspector
CVE-2026-23760,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.96268,CWE-288,"SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.",2026-01-22,CISA/EPSS/Nuclei,cpe:2.3:a:smartertools:smartermail:*:*:*:*:*:*:*:*,Smartertools,Smartermail
CVE-2026-23829,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.01441,CWE-93,"Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by including carriage return characters (`\r`) in the email address. This header injection occurs because the regex intended to filter control characters fails to exclude `\r` and `\n` when used inside a character class. Version 1.28.3 fixes this issue.",2026-01-19,Nuclei,cpe:2.3:a:axllent:mailpit:*:*:*:*:*:*:*:*,Axllent,Mailpit
CVE-2026-24061,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98871,CWE-88,"telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a ""-f root"" value for the USER environment variable.",2026-01-21,CISA/EPSS/Metasploit,cpe:2.3:a:gnu:inetutils:*:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*,Debian,Debian Linux
CVE-2026-24128,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00503,CWE-79,"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 7.0-milestone-2 through 16.10.11, 17.0.0-rc-1 through 17.4.4, and 17.5.0-rc-1 through 17.7.0 contain a reflected Cross-site Scripting (XSS) vulnerability, which allows an attacker to craft a malicious URL and execute arbitrary actions with the same privileges as the victim. If the victim has administrative or programming rights, those rights can be exploited to gain full access to the XWiki installation. This issue has been patched in versions 17.8.0-rc-1, 17.4.5 and 16.10.12. To workaround, the patch can be applied manually, only a single line in templates/logging_macros.vm needs to be changed, no restart is required.",2026-01-24,Nuclei,cpe:2.3:a:xwiki:xwiki-rendering:17.5.0:rc1:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:17.0.0:rc1:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:7.0:milestone2:*:*:*:*:*:*;cpe:2.3:a:xwiki:xwiki:7.0:rc1:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2026-2413,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02289,CWE-89,"The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user-supplied URL parameter in the `get_global_remediations()` method, where it is directly concatenated into an SQL JOIN clause without proper sanitization for SQL context. While `esc_url_raw()` is applied for URL safety, it does not prevent SQL metacharacters (single quotes, parentheses) from being injected. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via time-based blind SQL injection techniques. The Remediation module must be active, which requires the plugin to be connected to an Elementor account.",2026-03-11,Nuclei,,,
CVE-2026-2416,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01392,CWE-89,"The Geo Mashup plugin for WordPress is vulnerable to SQL Injection via the 'sort' parameter in all versions up to, and including, 1.13.17. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2026-02-25,Nuclei,,,
CVE-2026-24207,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02166,CWE-288,"NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, or information disclosure.",2026-05-20,Nuclei,cpe:2.3:a:nvidia:triton_inference_server:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2026-2441,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.2202,CWE-416,Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High),2026-02-13,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2026-24423,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.87693,CWE-306,"SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.",2026-01-23,CISA/Nuclei,cpe:2.3:a:smartertools:smartermail:*:*:*:*:*:*:*:*,Smartertools,Smartermail
CVE-2026-24477,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01566,CWE-201,"AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. If AnythingLLM prior to version 1.10.0 is configured to use Qdrant as the vector database with an API key, this QdrantApiKey could be exposed in plain text to unauthenticated users via the `/api/setup-complete` endpoint. Leakage of QdrantApiKey allows an unauthenticated attacker full read/write access to the Qdrant vector database instance used by AnythingLLM. Since Qdrant often stores the core knowledge base for RAG in AnythingLLM, this can lead to complete compromise of the semantic search / retrieval functionality and indirect leakage of confidential uploaded documents. Version 1.10.0 patches the issue.",2026-01-27,Nuclei,cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:*,Mintplexlabs,Anythingllm
CVE-2026-24479,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07895,CWE-22,"HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.01.24, the problem_import_qduoj.php and problem_import_hoj.php modules fail to properly sanitize filenames within uploaded ZIP archives. Attackers can craft a malicious ZIP file containing files with path traversal sequences (e.g., ../../shell.php). When extracted by the server, this allows writing files to arbitrary locations in the web root, leading to Remote Code Execution (RCE). Version 26.01.24 contains a fix for the issue.",2026-01-27,Metasploit,cpe:2.3:a:hustoj:hustoj:*:*:*:*:*:*:*:*,Hustoj,Hustoj
CVE-2026-24858,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.85844,CWE-288,"An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.",2026-01-27,CISA,cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortinac-f:*:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*;cpe:2.3:h:siemens:ruggedcom_ape1808:-:*:*:*:*:*:*:*;cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*,Siemens,Ruggedcom Ape1808 Firmware
CVE-2026-25089,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.36135,CWE-78,"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests",2026-06-09,CISA,cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortisandbox_cloud:*:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:fortisandbox_paas:*:*:*:*:*:*:*:*,Fortinet,Fortisandbox
CVE-2026-25108,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.04974,CWE-78,"FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arbitrary OS command.",2026-02-13,CISA,cpe:2.3:a:soliton:filezen:*:*:*:*:*:*:*:*,Soliton,Filezen
CVE-2026-25512,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.18536,CWE-78,"Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, there is a remote code execution (RCE) vulnerability in Group-Office. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmp_file into an exec() call. By injecting shell metacharacters into tmp_file, an authenticated attacker can execute arbitrary system commands on the server. This issue has been patched in versions 6.8.150, 25.0.82, and 26.0.5.",2026-02-04,Nuclei,cpe:2.3:a:group-office:group_office:*:*:*:*:*:*:*:*,Group-Office,Group Office
CVE-2026-25527,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00917,CWE-22,"changedetection.io is a free open source web page change detection tool. In versions prior to 0.53.2, the `/static/<group>/<filename>` route accepts `group=""..""`, which causes `send_from_directory(""static/.."", filename)` to execute. This moves the base directory up to `/app/changedetectionio`, enabling unauthenticated local file read of application source files (e.g., `flask_app.py`). Version 0.53.2 fixes the issue.",2026-02-19,Nuclei,cpe:2.3:a:webtechnologies:changedetection:*:*:*:*:*:*:*:*,Webtechnologies,Changedetection
CVE-2026-25545,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.01414,CWE-918,"Astro is a web framework. Prior to version 9.5.4, Server-Side Rendered pages that return an error with a prerendered custom error page (eg. `404.astro` or `500.astro`) are vulnerable to SSRF. If the `Host:` header is changed to an attacker's server, it will be fetched on `/500.html` and they can redirect this to any internal URL to read the response body through the first request. An attacker who can access the application without `Host:` header validation (eg. through finding the origin IP behind a proxy, or just by default) can fetch their own server to redirect to any internal IP. With this they can fetch cloud metadata IPs and interact with services in the internal network or localhost. For this to be vulnerable, a common feature needs to be used, with direct access to the server (no proxies). Version 9.5.4 fixes the issue.",2026-02-24,Nuclei,cpe:2.3:a:astro:\@astrojs\/node:*:*:*:*:*:node.js:*:*,Astro,@Astrojs/Node
CVE-2026-25555,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01509,CWE-305,OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middleware that allows unauthenticated attackers to gain admin access by supplying an empty X-Api-Key header value. Attackers can exploit the middleware's comparison of the supplied header against an empty AdminApiKey default string to access the admin console and all API endpoints without valid credentials.,2026-06-08,Nuclei,,,
CVE-2026-25616,4.7,CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00383,CWE-79,"Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665.",2026-02-03,Nuclei,cpe:2.3:a:phillipsdata:blesta:*:*:*:*:*:*:*:*,Phillipsdata,Blesta
CVE-2026-25892,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.01586,CWE-20,"Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed version info via JavaScript postMessage, which the browser then POSTs to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version[] parameter which PHP converts to an array. On next page load, openssl_verify() receives this array instead of string and throws TypeError, returning HTTP 500 to all users. Upgrade to Adminer 5.4.2.",2026-02-09,Nuclei,cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:*,Adminer,Adminer
CVE-2026-26190,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.34346,CWE-306,"Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication token derived from etcd.rootPath (default: by-dev), enabling arbitrary expression evaluation. The full REST API (/api/v1/*) is registered on the metrics/management port without any authentication, allowing unauthenticated access to all business operations including data manipulation and credential management. This vulnerability is fixed in 2.5.27 and 2.6.10.",2026-02-13,Nuclei,cpe:2.3:a:milvus:milvus:*:*:*:*:*:*:*:*,Milvus,Milvus
CVE-2026-26341,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02663,CWE-1392,"Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior ship with default credentials that are not forced to be changed during installation or commissioning. An attacker who can reach the management interface can authenticate using the default credentials and gain administrative access, enabling unauthorized access to device configuration and data.",2026-02-24,Nuclei,cpe:2.3:h:tattile:anpr_mobile:-:*:*:*:*:*:*:*;cpe:2.3:h:tattile:axle_counter:-:*:*:*:*:*:*:*;cpe:2.3:h:tattile:basic_mk2:-:*:*:*:*:*:*:*;cpe:2.3:h:tattile:smart\+:-:*:*:*:*:*:*:*;cpe:2.3:h:tattile:smart\+_speed:-:*:*:*:*:*:*:*;cpe:2.3:h:tattile:smart\+_traffic_light:-:*:*:*:*:*:*:*;cpe:2.3:h:tattile:tolling\+:-:*:*:*:*:*:*:*;cpe:2.3:h:tattile:vega11:-:*:*:*:*:*:*:*;cpe:2.3:h:tattile:vega33:-:*:*:*:*:*:*:*;cpe:2.3:h:tattile:vega53:-:*:*:*:*:*:*:*;cpe:2.3:o:tattile:anpr_mobile_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tattile:axle_counter_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tattile:basic_mk2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tattile:smart\+_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tattile:smart\+_speed_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tattile:smart\+_traffic_light_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tattile:tolling\+_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tattile:vega11_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tattile:vega33_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:tattile:vega53_firmware:*:*:*:*:*:*:*:*,Tattile,Smart+ Firmware
CVE-2026-2652,0.0,,0.01502,CWE-305,"A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI). The FastAPI permission middleware only enforces authentication on `/gateway/` routes, leaving other routes such as the Job API (`/ajax-api/3.0/jobs/*`) and the OpenTelemetry trace ingestion API (`/v1/traces`) unprotected. This allows unauthenticated remote attackers to submit jobs, read job results, cancel running jobs, and inject arbitrary trace data into experiments. The issue arises from an architectural mismatch between Flask and FastAPI authentication mechanisms, where the `_find_fastapi_validator()` function fails to handle non-`/gateway/` paths, resulting in a complete authentication bypass. This vulnerability is fixed in version 3.10.0.",2026-05-15,Nuclei,cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*,Lfprojects,Mlflow
CVE-2026-26980,9.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L,0.69996,CWE-89,Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.,2026-02-20,Nuclei,cpe:2.3:a:ghost:ghost:*:*:*:*:*:node.js:*:*,Ghost,Ghost
CVE-2026-2699,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.59506,CWE-284,Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.,2026-04-02,Nuclei,cpe:2.3:a:progress:sharefile_storage_zones_controller:*:*:*:*:*:*:*:*,Progress,Sharefile Storage Zones Controller
CVE-2026-27174,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06996,CWE-94,"MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to reach the ajax handler in inc_panel_ajax.php. The console handler within that file passes user-supplied input from GET parameters (via register_globals) directly to eval() without any authentication check. An attacker can execute arbitrary PHP code by sending a crafted GET request to /admin.php with ajax_panel, op, and command parameters.",2026-02-18,Metasploit/Nuclei,cpe:2.3:a:mjdm:majordomo:-:*:*:*:*:*:*:*,Mjdm,Majordomo
CVE-2026-27175,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.06872,CWE-78,"MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg(). The command is inserted into a database queue by safe_exec(), which performs no sanitization. The cycle_execs.php script, which is web-accessible without authentication, retrieves queued commands and passes them directly to exec(). An attacker can exploit a race condition by first triggering cycle_execs.php (which purges the queue and enters a polling loop), then injecting a malicious command via the rc endpoint while the worker is polling. The injected shell metacharacters expand inside double quotes, achieving remote code execution within one second.",2026-02-18,Metasploit,cpe:2.3:a:mjdm:majordomo:-:*:*:*:*:*:*:*,Mjdm,Majordomo
CVE-2026-27176,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00449,CWE-79,"MajorDoMo (aka Major Domestic Module) contains a reflected cross-site scripting (XSS) vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars(), both in an input field value attribute and in a paragraph element. An attacker can inject arbitrary JavaScript by crafting a URL with malicious content in the qry parameter.",2026-02-18,Nuclei,cpe:2.3:a:mjdm:majordomo:-:*:*:*:*:*:*:*,Mjdm,Majordomo
CVE-2026-27180,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01086,CWE-494,"MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method through the /objects/?module=saverestore endpoint without authentication because it uses gr('mode') (which reads directly from $_REQUEST) instead of the framework's $this->mode. An attacker can poison the system update URL via the auto_update_settings mode handler, then trigger the force_update handler to initiate the update chain. The autoUpdateSystem() method fetches an Atom feed from the attacker-controlled URL with trivial validation, downloads a tarball via curl with TLS verification disabled (CURLOPT_SSL_VERIFYPEER set to FALSE), extracts it using exec('tar xzvf ...'), and copies all extracted files to the document root using copyTree(). This allows an attacker to deploy arbitrary PHP files, including webshells, to the webroot with two GET requests.",2026-02-18,Metasploit,cpe:2.3:a:mjdm:majordomo:-:*:*:*:*:*:*:*,Mjdm,Majordomo
CVE-2026-27483,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.11113,CWE-22,"MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution. The vulnerability exists in the ""Upload File"" module, which corresponds to the API endpoint /api/files. Since the multipart file upload does not perform security checks on the uploaded file path, an attacker can perform path traversal by using `../` sequences in the filename field. The file write operation occurs before calling clear_filename and save_file, meaning there is no filtering of filenames or file types, allowing arbitrary content to be written to any path on the server. Version 25.9.1.1 patches the issue.",2026-02-24,Nuclei,cpe:2.3:a:mindsdb:mindsdb:*:*:*:*:*:*:*:*,Mindsdb,Mindsdb
CVE-2026-27636,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.02121,CWE-434,"FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's file upload restriction list in `app/Misc/Helper.php` does not include `.htaccess` or `.user.ini` files. On Apache servers with `AllowOverride All` (a common configuration), an authenticated user can upload a `.htaccess` file to redefine how files are processed, enabling Remote Code Execution. This vulnerability can be exploited on its own or in combination with CVE-2026-27637. Version 1.8.206 fixes both vulnerabilities.",2026-02-25,Metasploit,cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:*,Freescout,Freescout
CVE-2026-27645,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00445,CWE-79,"changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, the RSS single-watch endpoint reflects the UUID path parameter directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. Version 0.54.1 contains a fix for the issue.",2026-02-25,Nuclei,cpe:2.3:a:webtechnologies:changedetection:*:*:*:*:*:*:*:*,Webtechnologies,Changedetection
CVE-2026-27760,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.22189,CWE-94,OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter. Attackers can break out of the define() string context in config.php using a single quote and statement separator to inject malicious PHP code that persists and executes on every subsequent page load when the installation wizard remains incomplete.,2026-04-28,Nuclei,,,
CVE-2026-27771,0.0,,0.40738,CWE-862,"Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.",2026-07-03,Nuclei,,,
CVE-2026-27826,8.2,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N,0.14958,CWE-918,"MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to version 0.17.0, an unauthenticated attacker who can reach the mcp-atlassian HTTP endpoint can force the server process to make outbound HTTP requests to an arbitrary attacker-controlled URL by supplying two custom HTTP headers without an `Authorization` header. No authentication is required. The vulnerability exists in the HTTP middleware and dependency injection layer — not in any MCP tool handler - making it invisible to tool-level code analysis. In cloud deployments, this could enable theft of IAM role credentials via the instance metadata endpoint (`169[.]254[.]169[.]254`). In any HTTP deployment it enables internal network reconnaissance and injection of attacker-controlled content into LLM tool results. Version 0.17.0 fixes the issue.",2026-03-10,Nuclei,cpe:2.3:a:sooperset:mcp_atlassian:*:*:*:*:*:*:*:*,Sooperset,Mcp Atlassian
CVE-2026-27833,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01522,CWE-862,"Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the admin_only option, allowing unauthenticated users to access the full browsing history of all gallery visitors. This issue has been patched in version 16.3.0.",2026-04-03,Nuclei,cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*,Piwigo,Piwigo
CVE-2026-27944,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.22162,CWE-306,"Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data (user credentials, session tokens, SSL private keys, Nginx configurations) and decrypt it immediately. This issue has been patched in version 2.3.3.",2026-03-05,Nuclei,cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:*,Nginxui,Nginx Ui
CVE-2026-27966,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.33694,CWE-94,"Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.8.0, the CSV Agent node in Langflow hardcodes `allow_dangerous_code=True`, which automatically exposes LangChain’s Python REPL tool (`python_repl_ast`). As a result, an attacker can execute arbitrary Python and OS commands on the server via prompt injection, leading to full Remote Code Execution (RCE). Version 1.8.0 fixes the issue.",2026-02-26,Metasploit,cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*,Langflow,Langflow
CVE-2026-27971,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04632,CWE-502,Qwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where require() is available at runtime. This vulnerability is fixed in 1.19.1.,2026-03-03,Nuclei,cpe:2.3:a:qwik:qwik:*:*:*:*:*:node.js:*:*,Qwik,Qwik
CVE-2026-28288,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00635,CWE-204,"Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue.",2026-02-27,Nuclei,cpe:2.3:a:dify:dify:*:*:*:*:*:*:*:*,Dify,Dify
CVE-2026-28289,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.3114,CWE-434,FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user with file upload permissions to achieve Remote Code Execution (RCE) on the server by uploading a malicious .htaccess file using a zero-width space character prefix to bypass the security check. The vulnerability exists in the sanitizeUploadedFileName() function in app/Http/Helper.php. The function contains a Time-of-Check to Time-of-Use (TOCTOU) flaw where the dot-prefix check occurs before sanitization removes invisible characters. This vulnerability is fixed in 1.8.207.,2026-03-03,Metasploit,cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:*,Freescout,Freescout
CVE-2026-28318,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.10659,CWE-400,SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update,2026-06-04,CISA,cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*;cpe:2.3:a:solarwinds:serv-u:15.5.4:-:*:*:*:*:*:*,Solarwinds,Serv-U
CVE-2026-28358,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00601,CWE-204,"NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3.",2026-03-02,Nuclei,cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*,Nocodb,Nocodb
CVE-2026-28409,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.03315,CWE-78,"WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, a critical Remote Code Execution (RCE) vulnerability exists in the WeGIA application's database restoration functionality. An attacker with administrative access (which can be obtained via the previously reported Authentication Bypass) can execute arbitrary OS commands on the server by uploading a backup file with a specifically crafted filename. Version 3.6.5 fixes the issue.",2026-02-27,Nuclei,cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*,Wegia,Wegia
CVE-2026-28414,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03095,CWE-36,"Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with Python 3.13+ are vulnerable to an absolute path traversal issue that enables unauthenticated attackers to read arbitrary files from the file system. Python 3.13+ changed the definition of `os.path.isabs` so that root-relative paths like `/windows/win.ini` on Windows are no longer considered absolute paths, resulting in a vulnerability in Gradio's logic for joining paths safely. This can be exploited by unauthenticated attackers to read arbitrary files from the Gradio server, even when Gradio is set up with authentication. Version 6.7 fixes the issue.",2026-02-27,Nuclei,cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*,Gradio Project,Gradio
CVE-2026-28496,0.0,,0.01892,CWE-1336,"FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 have a Server-Side Template Injection (SSTI) vulnerability in the template rendering system. Administrators with access to features that render Twig templates (email templates, mass mail campaigns, custom payment adapters, and the `string_render` API endpoint) can inject arbitrary Twig expressions, leading to information disclosure and remote code execution. The vulnerability exists because Twig templates are rendered without a sandbox, allowing access to the full Twig environment, API context, and the application's dependency injection container. Version 0.8.0 patches the issue. Some workarounds are available. Audit existing email templates for suspicious Twig expressions, rotate all admin and client API tokens, and/or block external access to /api/system/* at reverse proxy/WAF to mitigate chaining with GHSA-78x5-c8gw-8279.",2026-06-23,Nuclei,,,
CVE-2026-28501,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0151,CWE-89,"WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos.json.php and objects/video.php components. The application fails to properly sanitize the catName parameter when it is supplied via a JSON-formatted POST request body. Because JSON input is parsed and merged into $_REQUEST after global security checks are executed, the payload bypasses the existing sanitization mechanisms. This issue has been patched in version 24.0.",2026-03-06,Metasploit,cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*,Wwbn,Avideo
CVE-2026-28515,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01157,CWE-862,"openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functionality regardless of assigned privileges. In deployments where REMOTE_USER is set without authentication enforcement, the endpoint may be accessible without credentials. This allows unauthorized modification of application configuration.",2026-02-27,Metasploit,cpe:2.3:a:opendcim:opendcim:23.04:*:*:*:*:*:*:*,Opendcim,Opendcim
CVE-2026-28516,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.0097,CWE-89,"openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or proper input sanitation. An authenticated user can execute arbitrary SQL statements against the underlying database.",2026-02-27,Metasploit,cpe:2.3:a:opendcim:opendcim:23.04:*:*:*:*:*:*:*,Opendcim,Opendcim
CVE-2026-28517,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05648,CWE-78,"openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or sanitization. If an attacker can modify the fac_Config.dot value, arbitrary commands may be executed in the context of the web server process.",2026-02-27,Metasploit,cpe:2.3:a:opendcim:opendcim:23.04:*:*:*:*:*:*:*,Opendcim,Opendcim
CVE-2026-29014,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.39688,CWE-94,"MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.",2026-04-01,Nuclei,cpe:2.3:a:metinfo:metinfo:7.9:*:*:*:*:*:*:*;cpe:2.3:a:metinfo:metinfo:8.0.0:*:*:*:*:*:*:*;cpe:2.3:a:metinfo:metinfo:8.1:*:*:*:*:*:*:*,Metinfo,Metinfo
CVE-2026-29058,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02132,CWE-78,"AVideo is a video-sharing Platform software. Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS commands on the server by injecting shell command substitution into the base64Url GET parameter. This can lead to full server compromise, data exfiltration (e.g., configuration secrets, internal keys, credentials), and service disruption. This issue has been patched in version 7.0.",2026-03-06,Metasploit,cpe:2.3:a:wwbn:avideo-encoder:*:*:*:*:*:*:*:*,Wwbn,Avideo-Encoder
CVE-2026-29059,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02584,CWE-22,"Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to version 1.603.3, an unauthenticated path traversal vulnerability exists in Windmill's get_log_file endpoint ""(/api/w/{workspace}/jobs_u/get_log_file/{filename})"". The filename parameter is concatenated into a file path without sanitization, allowing an attacker to read arbitrary files on the server using ../ sequences. This issue has been patched in version 1.603.3.",2026-03-06,Nuclei,cpe:2.3:a:windmill:windmill:*:*:*:*:*:*:*:*,Windmill,Windmill
CVE-2026-29066,6.2,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01025,CWE-200,"Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite's built-in filesystem access restriction. This allows any unauthenticated attacker who can reach the dev server to read arbitrary files on the host system. This vulnerability is fixed in 2.1.8.",2026-03-12,Nuclei,cpe:2.3:a:ssw:tinacms\/cli:*:*:*:*:*:node.js:*:*,Ssw,Tinacms/Cli
CVE-2026-29183,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N,0.00625,CWE-79,"SiYuan is a personal knowledge management system. Prior to version 3.5.9, an unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint ""GET /api/icon/getDynamicIcon"" when type=8, attacker-controlled content is embedded into SVG output without escaping. Because the endpoint is unauthenticated and returns image/svg+xml, a crafted URL can inject executable SVG/HTML event handlers (for example onerror) and run JavaScript in the SiYuan web origin. This can be chained to perform authenticated API actions and exfiltrate sensitive data when a logged-in user opens the malicious link. This issue has been patched in version 3.5.9.",2026-03-06,Nuclei,cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*,B3Log,Siyuan
CVE-2026-3018,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01382,CWE-89,"The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in all versions up to, and including, 4.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2026-06-10,Nuclei,,,
CVE-2026-3055,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.83996,CWE-125,Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread,2026-03-23,CISA/Metasploit/Nuclei,cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*;cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*;cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*;cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*,Citrix,Netscaler Application Delivery Controller
CVE-2026-30824,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.3625,CWE-306,"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints. This issue has been patched in version 3.0.13.",2026-03-07,Nuclei,cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*,Flowiseai,Flowise
CVE-2026-30928,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01657,CWE-200,"Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.",2026-03-10,Nuclei,cpe:2.3:a:nicolargo:glances:*:*:*:*:*:*:*:*,Nicolargo,Glances
CVE-2026-30958,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.01102,CWE-22,"OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, an unauthenticated path traversal in the /workflow/docs/:componentName endpoint allows reading arbitrary files from the server filesystem. The componentName route parameter is concatenated directly into a file path passed to res.sendFile() in orker/FeatureSet/Workflow/Index.ts with no sanitization or authentication middleware. This vulnerability is fixed in 10.0.21.",2026-03-10,Nuclei,cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:*,Hackerbay,Oneuptime
CVE-2026-31431,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.96267,CWE-669,"In the Linux kernel, the following vulnerability has been resolved:

crypto: algif_aead - Revert to operating out-of-place

This mostly reverts commit 72548b093ee3 except for the copying of
the associated data.

There is no benefit in operating in-place in algif_aead since the
source and destination come from different mappings.  Get rid of
all the complexity added for in-place operation and just copy the
AD directly.",2026-04-22,CISA/EPSS/Metasploit,cpe:2.3:a:arista:cloudvision_agni:*:*:*:*:*:-:*:*;cpe:2.3:a:arista:cloudvision_portal:*:*:*:*:*:*:*:*;cpe:2.3:a:arista:velocloud_edge:*:*:*:*:*:*:*:*;cpe:2.3:a:arista:velocloud_gateway:-:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*;cpe:2.3:a:suse:caas_platform:4.0:*:*:*:*:*:*:*;cpe:2.3:a:suse:enterprise_storage:6.0:*:*:*:*:*:*:*;cpe:2.3:a:suse:enterprise_storage:7.0:*:*:*:*:*:*:*;cpe:2.3:a:suse:enterprise_storage:7.1:*:*:*:*:*:*:*;cpe:2.3:a:suse:manager_proxy:4.0:*:*:*:*:*:*:*;cpe:2.3:a:suse:manager_proxy:4.1:*:*:*:*:*:*:*;cpe:2.3:a:suse:manager_proxy:4.2:*:*:*:*:*:*:*;cpe:2.3:a:suse:manager_proxy:4.3:*:*:*:*:*:*:*;cpe:2.3:a:suse:manager_retail_branch_server:4.0:*:*:*:*:*:*:*;cpe:2.3:a:suse:manager_retail_branch_server:4.1:*:*:*:*:*:*:*;cpe:2.3:a:suse:manager_retail_branch_server:4.2:*:*:*:*:*:*:*;cpe:2.3:a:suse:manager_retail_branch_server:4.3:*:*:*:*:*:*:*;cpe:2.3:a:suse:manager_server:4.0:*:*:*:*:*:*:*;cpe:2.3:a:suse:manager_server:4.1:*:*:*:*:*:*:*;cpe:2.3:a:suse:manager_server:4.2:*:*:*:*:*:*:*;cpe:2.3:a:suse:manager_server:4.3:*:*:*:*:*:*:*;cpe:2.3:a:suse:openstack_cloud:9.0:*:*:*:*:*:*:*;cpe:2.3:a:suse:openstack_cloud_crowbar:9.0:*:*:*:*:*:*:*;cpe:2.3:a:vmware:velocloud_orchestrator:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518-4_pn\/dp_mfp:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:simatic_s7-1500_tm_mfp:-:*:*:*:*:*:*:*;cpe:2.3:h:siemens:siplus_s7-1500_cpu_1518-4_pn\/dp_mfp:-:*:*:*:*:*:*:*;cpe:2.3:o:amazon:amazon_linux:-:*:*:*:*:*:*:*;cpe:2.3:o:arista:netvisor_os:*:*:*:*:*:*:*:*;cpe:2.3:o:arista:netvisor_os:7.1.0:-:*:*:*:*:*:*;cpe:2.3:o:arista:netvisor_os:7.1.0:hotfix7:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:-:*:*:*:*:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:*;cpe:2.3:o:canonical:ubuntu_linux:25.10:*:*:*:-:*:*:*;cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*;cpe:2.3:o:debian:debian_linux:13.0:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*;cpe:2.3:o:nixos:nixos:*:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.3:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.4:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.5:*:*:*:*:*:*:*;cpe:2.3:o:opensuse:leap:15.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_aus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_aus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:10.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_tus:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_tus:8.8:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:simatic_s7-1500_tm_mfp_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:siemens:siplus_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:suse:basesystem_module:15:sp1:*:*:*:suse_linux_enterprise:*:*;cpe:2.3:o:suse:basesystem_module:15:sp2:*:*:*:suse_linux_enterprise:*:*;cpe:2.3:o:suse:basesystem_module:15:sp3:*:*:*:suse_linux_enterprise:*:*;cpe:2.3:o:suse:basesystem_module:15:sp4:*:*:*:suse_linux_enterprise:*:*;cpe:2.3:o:suse:basesystem_module:15:sp5:*:*:*:suse_linux_enterprise:*:*;cpe:2.3:o:suse:basesystem_module:15:sp6:*:*:*:suse_linux_enterprise:*:*;cpe:2.3:o:suse:basesystem_module:15:sp7:*:*:*:suse_linux_enterprise:*:*;cpe:2.3:o:suse:development_tools_module:15:sp1:*:*:*:suse_linux_enterprise:*:*;cpe:2.3:o:suse:development_tools_module:15:sp2:*:*:*:suse_linux_enterprise:*:*;cpe:2.3:o:suse:development_tools_module:15:sp3:*:*:*:suse_linux_enterprise:*:*;cpe:2.3:o:suse:development_tools_module:15:sp4:*:*:*:suse_linux_enterprise:*:*;cpe:2.3:o:suse:development_tools_module:15:sp5:*:*:*:suse_linux_enterprise:*:*;cpe:2.3:o:suse:development_tools_module:15:sp6:*:*:*:suse_linux_enterprise:*:*;cpe:2.3:o:suse:development_tools_module:15:sp7:*:*:*:suse_linux_enterprise:*:*;cpe:2.3:o:suse:legacy_module:15:sp7:*:*:*:suse_linux_enterprise:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:12:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:15:sp1:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:15:sp2:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:15:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:15:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:15:sp5:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:15:sp6:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_desktop:15:sp7:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_high_availability_extension:15:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_high_availability_extension:15:sp6:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_high_availability_extension:15:sp7:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_high_availability_extension:16.0:-:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp1:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp1:*:*:espos:*:*:*;cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp1:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp2:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp2:*:*:espos:*:*:*;cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp2:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp3:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp3:*:*:espos:*:*:*;cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp3:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp4:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp4:*:*:espos:*:*:*;cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp4:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp5:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp5:*:*:espos:*:*:*;cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp5:*:*:ltss:*:*:*;cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp6:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp7:*:*:-:*:*:*;cpe:2.3:o:suse:linux_enterprise_live_patching:12:sp5:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_live_patching:15:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_live_patching:15:sp5:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_live_patching:15:sp6:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_live_patching:15:sp7:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_micro:5.0:*:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_micro:5.1:*:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_micro:5.2:*:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_micro:5.2:*:*:*:*:rancher:*:*;cpe:2.3:o:suse:linux_enterprise_micro:5.3:*:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_micro:5.3:*:*:*:*:rancher:*:*;cpe:2.3:o:suse:linux_enterprise_micro:5.4:*:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_micro:5.4:*:*:*:*:rancher:*:*;cpe:2.3:o:suse:linux_enterprise_micro:5.5:*:*:*:*:-:*:*;cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp2:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp3:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp4:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp5:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp6:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp7:*:*:*:*:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:-:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:ltss:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:ltss_extreme_core:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:-:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:-:sap:*:*;cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:espos:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:ltss:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:-:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:ltss:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:ltss_extended_security:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp1:*:*:-:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp1:*:*:-:sap:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp1:*:*:business_critical_linux:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp1:*:*:ltss:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp2:*:*:-:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp2:*:*:-:sap:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp2:*:*:business_critical_linux:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp2:*:*:ltss:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp3:*:*:-:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp3:*:*:-:sap:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp3:*:*:business_critical_linux:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp3:*:*:ltss:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp4:*:*:-:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp4:*:*:-:sap:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp4:*:*:ltss:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp5:*:*:-:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp5:*:*:-:sap:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp5:*:*:ltss:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp6:*:*:-:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp6:*:*:-:sap:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp6:*:*:ltss:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp7:*:*:-:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:15:sp7:*:*:-:sap:*:*;cpe:2.3:o:suse:linux_enterprise_server:16.0:-:*:*:-:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:16.0:-:*:*:-:sap:*:*;cpe:2.3:o:suse:linux_enterprise_server:16.1:-:*:*:-:-:*:*;cpe:2.3:o:suse:linux_enterprise_server:16.1:-:*:*:-:sap:*:*;cpe:2.3:o:suse:linux_enterprise_workstation_extension:15:sp7:*:*:*:*:*:*;cpe:2.3:o:suse:linux_micro:6.0:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_micro:6.1:*:*:*:*:*:*:*;cpe:2.3:o:suse:linux_micro:6.2:*:*:*:*:*:*:*;cpe:2.3:o:suse:public_cloud_module:15:sp6:*:*:*:suse_linux_enterprise:*:*;cpe:2.3:o:suse:public_cloud_module:15:sp7:*:*:*:suse_linux_enterprise:*:*;cpe:2.3:o:suse:realtime_module:15:sp3:*:*:*:suse_linux_enterprise:*:*;cpe:2.3:o:suse:realtime_module:15:sp4:*:*:*:suse_linux_enterprise:*:*;cpe:2.3:o:suse:realtime_module:15:sp5:*:*:*:suse_linux_enterprise:*:*;cpe:2.3:o:suse:realtime_module:15:sp6:*:*:*:suse_linux_enterprise:*:*;cpe:2.3:o:suse:realtime_module:15:sp7:*:*:*:suse_linux_enterprise:*:*,Siemens,Simatic S7-1500 Cpu 1518-4 Pn/Dp Mfp Firmware
CVE-2026-31807,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00445,CWE-79,"SiYuan is a personal knowledge management system. Prior to 3.5.10, SiYuan's SVG sanitizer (SanitizeSVG) blocks dangerous elements (<script>, <iframe>, <foreignobject>) and removes on* event handlers and javascript: in href attributes. However, it does NOT block SVG animation elements (<animate>, <set>) which can dynamically set attributes to dangerous values at runtime, bypassing the static sanitization. This allows an attacker to inject executable JavaScript into the unauthenticated /api/icon/getDynamicIcon endpoint (type=8), creating a reflected XSS. This is a bypass of the fix for CVE-2026-29183 (fixed in v3.5.9). This vulnerability is fixed in v3.5.10.",2026-03-10,Nuclei,cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*,B3Log,Siyuan
CVE-2026-31809,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00505,CWE-79,"SiYuan is a personal knowledge management system. Prior to 3.5.10, SiYuan's SVG sanitizer (SanitizeSVG) checks href attributes for the javascript: prefix using strings.HasPrefix(). However, inserting ASCII tab (&#9;), newline (&#10;), or carriage return (&#13;) characters inside the javascript: string bypasses this prefix check. Browsers strip these characters per the WHATWG URL specification before parsing the URL scheme, so the JavaScript still executes. This allows an attacker to inject executable JavaScript into the unauthenticated /api/icon/getDynamicIcon endpoint, creating a reflected XSS. This is a second bypass of the fix for CVE-2026-29183 (fixed in v3.5.9). This vulnerability is fixed in 3.5.10.",2026-03-10,Nuclei,cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*,B3Log,Siyuan
CVE-2026-31816,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.15339,CWE-74,"Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.4 and earlier, the Budibase server's authorized() middleware that protects every server-side API endpoint can be completely bypassed by appending a webhook path pattern to the query string of any request. The isWebhookEndpoint() function uses an unanchored regex that tests against ctx.request.url, which in Koa includes the full URL with query parameters. When the regex matches, the authorized() middleware immediately calls return next(), skipping all authentication, authorization, role checks, and CSRF protection. This means a completely unauthenticated, remote attacker can access any server-side API endpoint by simply appending ?/webhooks/trigger (or any webhook pattern variant) to the URL.",2026-03-09,Nuclei,cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:*,Budibase,Budibase
CVE-2026-31831,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.00477,CWE-23,"Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. This issue has been patched in version 2.17.0.",2026-03-30,Nuclei,cpe:2.3:a:tautulli:tautulli:*:*:*:*:*:*:*:*,Tautulli,Tautulli
CVE-2026-32201,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.21476,CWE-20,Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.,2026-04-14,CISA,cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*,Microsoft,Sharepoint Server
CVE-2026-32202,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N,0.64095,CWE-693,Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.,2026-04-14,CISA,cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:*;cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1607
CVE-2026-32230,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00905,CWE-862,"Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query before returning data. The ping endpoint skips this check entirely, allowing unauthenticated users to extract average ping/response time data for private monitors. This vulnerability is fixed in 2.2.0.",2026-03-12,Nuclei,cpe:2.3:a:uptime.kuma:uptime_kuma:*:*:*:*:*:*:*:*,Uptime.Kuma,Uptime Kuma
CVE-2026-32583,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.007,CWE-862,Missing Authorization vulnerability in Webnus Inc. Modern Events Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Modern Events Calendar: from n/a through 7.29.0.,2026-03-16,Nuclei,,,
CVE-2026-32596,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.0155,CWE-200,"Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.2, Glances web server runs without authentication by default when started with `glances -w`, exposing REST API with sensitive system information including process command-lines containing credentials (passwords, API keys, tokens) to any network client. Version 4.5.2 fixes the issue.",2026-03-18,Nuclei,cpe:2.3:a:nicolargo:glances:*:*:*:*:*:*:*:*,Nicolargo,Glances
CVE-2026-3296,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03469,CWE-502,"The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize() on stored entry meta values without passing the allowed_classes parameter. This makes it possible for unauthenticated attackers to inject a serialized PHP object payload through any public Everest Forms form field. The payload survives sanitize_text_field() sanitization (serialization control characters are not stripped) and is stored in the wp_evf_entrymeta database table. When an administrator views entries or views an individual entry, the unsafe unserialize() call processes the stored data without class restrictions.",2026-04-08,Nuclei,,,
CVE-2026-32985,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01479,CWE-306,"Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality that allows remote attackers to execute arbitrary code by uploading a crafted ZIP archive containing malicious PHP payloads. Attackers can bypass authentication checks in the import.php file to upload a template archive with PHP code in the media directory, which gets extracted to a web-accessible path where the malicious PHP can be directly accessed and executed under the web server context.",2026-03-20,Metasploit,cpe:2.3:a:apereo:xerte_online_toolkits:*:*:*:*:*:*:*:*,Apereo,Xerte Online Toolkits
CVE-2026-3300,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.40992,CWE-94,"The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's process_filter() function concatenating user-submitted form field values into a PHP code string without proper escaping before passing it to eval(). The sanitize_text_field() function applied to input does not escape single quotes or other PHP code context characters. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code on the server by submitting a crafted value in any string-type form field (text, email, URL, select, radio) when a form uses the ""Complex Calculation"" feature.",2026-03-31,Nuclei,,,
CVE-2026-33017,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.98191,CWE-94,"Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.",2026-03-20,CISA/EPSS/Nuclei,cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*,Langflow,Langflow
CVE-2026-33032,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.38477,CWE-306,"Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integration exposes two HTTP endpoints: /mcp and /mcp_message. While /mcp requires both IP whitelisting and authentication (AuthRequired() middleware), the /mcp_message endpoint only applies IP whitelisting - and the default IP whitelist is empty, which the middleware treats as ""allow all"". This means any network attacker can invoke all MCP tools without authentication, including restarting nginx, creating/modifying/deleting nginx configuration files, and triggering automatic config reloads - achieving complete nginx service takeover. At time of publication, there are no publicly available patches.",2026-03-30,Nuclei,cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:*,Nginxui,Nginx Ui
CVE-2026-33057,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05289,CWE-94,"Mesop is a Python-based UI framework that allows users to build web applications. In versions 1.2.2 and below, an explicit web endpoint inside the ai/ testing module infrastructure directly ingests untrusted Python code strings unconditionally without authentication measures, yielding standard Unrestricted Remote Code Execution. Any individual capable of routing HTTP logic to this server block will gain explicit host-machine command rights. The AI codebase package includes a lightweight debugging Flask server inside ai/sandbox/wsgi_app.py. The /exec-py route accepts base_64 encoded raw string payloads inside the code parameter natively evaluated by a basic POST web request. It saves it rapidly to the operating system logic path and injects it recursively using execute_module(module_path...). This issue has been fixed in version 1.2.3.",2026-03-20,Nuclei,cpe:2.3:a:mesop-dev:mesop:*:*:*:*:*:*:*:*,Mesop-Dev,Mesop
CVE-2026-3326,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.00969,CWE-89,"The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection",2026-06-10,Nuclei,,,
CVE-2026-33340,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.21629,CWE-306,"LoLLMs WEBUI provides the Web user interface for Lord of Large Language and Multi modal Systems. A critical Server-Side Request Forgery (SSRF) vulnerability has been identified in all known existing versions of `lollms-webui`. The `@router.post(""/api/proxy"")` endpoint allows unauthenticated attackers to force the server into making arbitrary GET requests. This can be exploited to access internal services, scan local networks, or exfiltrate sensitive cloud metadata (e.g., AWS/GCP IAM tokens). As of time of publication, no known patched versions are available.",2026-03-24,Nuclei,cpe:2.3:a:lollms:lollms_web_ui:-:*:*:*:*:*:*:*,Lollms,Lollms Web Ui
CVE-2026-33439,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.1049,CWE-502,"Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains <jato:form> tags (e.g., the Password Reset pages). This vulnerability is fixed in 16.0.6.",2026-04-07,Nuclei,cpe:2.3:a:openidentityplatform:openam:*:*:*:*:*:*:*:*,Openidentityplatform,Openam
CVE-2026-33453,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.06157,CWE-915,"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap component.

Apache Camel's camel-coap component is vulnerable to Camel message header injection, leading to remote code execution when routes forward CoAP requests to header-sensitive producers (e.g. camel-exec)

The camel-coap component maps incoming CoAP request URI query parameters directly into Camel Exchange In message headers without applying any HeaderFilterStrategy.    
Specifically, CamelCoapResource.handleRequest() iterates over OptionSet.getUriQuery() and calls camelExchange.getIn().setHeader(...) for every query parameter. CoAPEndpoint extends DefaultEndpoint rather than DefaultHeaderFilterStrategyEndpoint, and CoAPComponent does not implement HeaderFilterStrategyComponent; the component contains no references to HeaderFilterStrategy at all.

As a result, an unauthenticated attacker who can send a single CoAP UDP packet to a Camel route consuming from coap:// can inject arbitrary Camel internal headers (those prefixed with Camel*) into the Exchange. When the route delivers the message to a header-sensitive producer such as camel-exec, camel-sql, camel-bean, camel-file, or template components (camel-freemarker, camel-velocity), the injected headers can alter the producer's behavior. In the case of camel-exec, the CamelExecCommandExecutable and CamelExecCommandArgs headers override the executable and arguments configured on the endpoint, resulting in arbitrary OS command execution under the privileges of the Camel process.

The producer's output is written back to the Exchange body and returned in the CoAP response payload by CamelCoapResource, giving the attacker an interactive RCE channel without any need for out-of-band exfiltration.
                                                                                                                                                                         
Exploitation prerequisites are minimal: a single unauthenticated UDP datagram to the CoAP port (default 5683). CoAP (RFC 7252) has no built-in authentication, and DTLS is optional and disabled by default. Because the protocol is UDP-based, HTTP-layer WAF/IDS controls do not apply.
This issue affects Apache Camel: from 4.14.0 through 4.14.5, from 4.18.0 before 4.18.1, 4.19.0.

Users are recommended to upgrade to version 4.18.1 or 4.19.0, fixing the issue.",2026-04-27,Nuclei,cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:camel:4.18.0:*:*:*:*:*:*:*;cpe:2.3:a:apache:camel:4.19.0:*:*:*:*:*:*:*,Apache,Camel
CVE-2026-33476,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.03256,CWE-22,"SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated file-serving endpoint under `/appearance/*filepath.` Due to improper path sanitization, attackers can perform directory traversal and read arbitrary files accessible to the server process. Authentication checks explicitly exclude this endpoint, allowing exploitation without valid credentials. Version 3.6.2 fixes this issue.",2026-03-20,Nuclei,cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*,B3Log,Siyuan
CVE-2026-33478,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.13266,CWE-78,"WWBN AVideo is an open source video platform. In versions up to and including 26.0, multiple vulnerabilities in AVideo's CloneSite plugin chain together to allow a completely unauthenticated attacker to achieve remote code execution. The `clones.json.php` endpoint exposes clone secret keys without authentication, which can be used to trigger a full database dump via `cloneServer.json.php`. The dump contains admin password hashes stored as MD5, which are trivially crackable. With admin access, the attacker exploits an OS command injection in the rsync command construction in `cloneClient.json.php` to execute arbitrary system commands. Commit c85d076375fab095a14170df7ddb27058134d38c contains a patch.",2026-03-23,Nuclei,cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*,Wwbn,Avideo
CVE-2026-33497,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.19584,CWE-22,"Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.1, in the download_profile_picture function of the /profile_pictures/{folder_name}/{file_name} endpoint, the folder_name and file_name parameters are not strictly filtered, which allows the secret_key to be read across directories. Version 1.7.1 contains a patch.",2026-03-24,Nuclei,cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*,Langflow,Langflow
CVE-2026-33534,4.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N,0.01978,CWE-918,"EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated Server-Side Request Forgery (SSRF) vulnerability that allows bypassing the internal-host validation logic by using alternative IPv4 representations such as octal notation (e.g., 0177.0.0.1 instead of 127.0.0.1). This is caused by HostCheck::isNotInternalHost() function relying on PHP's filter_var(..., FILTER_VALIDATE_IP), which does not recognize alternative IP formats, causing the validation to fall through to a DNS lookup that returns no records and incorrectly treats the host as safe, however the cURL subsequently normalizes the address and connects to the loopback destination. Through the confirmed /api/v1/Attachment/fromImageUrl endpoint, an authenticated user can force the server to make requests to loopback-only services and store the fetched response as an attachment. This vulnerability is distinct from CVE-2023-46736 (which involved redirect-based SSRF) and may allow access to internal resources reachable from the application runtime. This issue has been fixed in version 9.3.4.",2026-04-13,Nuclei,cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*,Espocrm,Espocrm
CVE-2026-33626,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.4525,CWE-918,"LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in LMDeploy's vision-language module. The `load_image()` function in `lmdeploy/vl/utils.py` fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and sensitive resources. Version 0.12.3 patches the issue.",2026-04-20,Nuclei,cpe:2.3:a:internlm:lmdeploy:*:*:*:*:*:*:*:*,Internlm,Lmdeploy
CVE-2026-33634,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.60368,CWE-506,"Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in `aquasecurity/setup-trivy` with malicious commits. This incident is a continuation of the supply chain attack that began in late February 2026. Following the initial disclosure on March 1, credential rotation was performed but was not atomic (not all credentials were revoked simultaneously). The attacker could have use a valid token to exfiltrate newly rotated secrets during the rotation window (which lasted a few days). This could have allowed the attacker to retain access and execute the March 19 attack. Affected components include the `aquasecurity/trivy` Go / Container image version 0.69.4, the `aquasecurity/trivy-action` GitHub Action versions 0.0.1 – 0.34.2 (76/77), and the`aquasecurity/setup-trivy` GitHub Action versions 0.2.0 – 0.2.6, prior to the recreation of 0.2.6 with a safe commit. Known safe versions include versions 0.69.2 and 0.69.3 of the Trivy binary, version 0.35.0 of trivy-action, and version 0.2.6 of setup-trivy. Additionally, take other mitigations to ensure the safety of secrets. If there is any possibility that a compromised version ran in one's environment, all secrets accessible to affected pipelines must be treated as exposed and rotated immediately. Check whether one's organization pulled or executed Trivy v0.69.4 from any source. Remove any affected artifacts immediately. Review all workflows using `aquasecurity/trivy-action` or `aquasecurity/setup-trivy`. Those who referenced a version tag rather than a full commit SHA should check workflow run logs from March 19–20, 2026 for signs of compromise. Look for repositories named `tpcp-docs` in one's GitHub organization. The presence of such a repository may indicate that the fallback exfiltration mechanism was triggered and secrets were successfully stolen. Pin GitHub Actions to full, immutable commit SHA hashes, don't use mutable version tags.",2026-03-23,CISA,cpe:2.3:a:aquasec:setup-trivy:*:*:*:*:*:*:*:*;cpe:2.3:a:aquasec:trivy:0.69.4:*:*:*:*:go:*:*;cpe:2.3:a:aquasec:trivy_action:*:*:*:*:*:*:*:*;cpe:2.3:a:litellm:litellm:1.82.7:*:*:*:*:*:*:*;cpe:2.3:a:litellm:litellm:1.82.8:*:*:*:*:*:*:*;cpe:2.3:a:telnyx:telnyx:4.87.1:*:*:*:*:python:*:*;cpe:2.3:a:telnyx:telnyx:4.87.2:*:*:*:*:python:*:*,Aquasec,Setup-Trivy
CVE-2026-33825,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.06749,CWE-1220,Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.,2026-04-14,CISA,cpe:2.3:a:microsoft:defender_antimalware_platform:*:*:*:*:*:*:*:*,Microsoft,Defender Antimalware Platform
CVE-2026-33868,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N,0.00515,CWE-601,"Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability (CWE-601) exists in the `/web/*` route due to improper handling of URL-encoded path segments. An attacker can craft a specially encoded URL that causes the application to redirect users to an arbitrary external domain, enabling phishing attacks and potential OAuth credential theft. The issue occurs because URL-encoded slashes (`%2F`) bypass Rails path normalization and are interpreted as host-relative redirects. Versions 4.5.8, 4.4.15, and 4.3.21 patch the issue.",2026-03-27,Nuclei,cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*,Joinmastodon,Mastodon
CVE-2026-3396,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01473,CWE-89,"WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable to time-based SQL Injection via the 'post-author' parameter in all versions up to, and including, 4.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2026-04-08,Nuclei,,,
CVE-2026-34156,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.36503,CWE-913,"NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist (controlled by WORKFLOW_SCRIPT_MODULES env var). However, the console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console._stdout and console._stderr. An authenticated attacker can traverse the prototype chain to escape the sandbox and achieve Remote Code Execution as root. This issue has been patched in version 2.0.28.",2026-03-31,Nuclei,cpe:2.3:a:nocobase:nocobase:*:*:*:*:*:*:*:*,Nocobase,Nocobase
CVE-2026-34197,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.96666,CWE-20,"Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.

Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including
BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).

An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.
Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().



This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3.



Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue",2026-04-07,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*,Apache,Activemq
CVE-2026-34413,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L,0.02804,CWE-497,"Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit() or die(), allowing PHP execution to continue and process the full request server-side. Unauthenticated attackers can perform file operations on project media directories including creating directories, uploading files, renaming files, duplicating files, overwriting files, and deleting files, which can be chained with path traversal and extension blocklist vulnerabilities to achieve remote code execution and arbitrary file read.",2026-04-22,Metasploit/Nuclei,,,
CVE-2026-34414,7.1,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N,0.02826,CWE-22,"Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversal vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where the name parameter in rename commands is not sanitized for path traversal sequences. Attackers can supply a name value containing directory traversal sequences to move files from project media directories to arbitrary locations on the filesystem, potentially overwriting application files, achieving stored cross-site scripting, or combining with other vulnerabilities to achieve unauthenticated remote code execution by moving PHP code files to the application root.",2026-04-22,Metasploit,,,
CVE-2026-34415,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03575,CWE-184,"Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attackers can exploit this flaw combined with authentication bypass and path traversal vulnerabilities to upload malicious PHP code, rename it with a .php4 extension, and execute arbitrary operating system commands on the server.",2026-04-22,Metasploit,,,
CVE-2026-34453,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01227,CWE-863,"SiYuan is a personal knowledge management system. Prior to version 3.6.2, the publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitors. In publish/read-only mode, /api/bookmark/getBookmark filters bookmark results by calling FilterBlocksByPublishAccess(nil, ...). Because the filter treats a nil context as authorized, it skips the publish password check and returns bookmarked blocks from documents configured as Protected. As a result, anyone who can access the publish service can retrieve content from protected documents without providing the required password, as long as at least one block in the document is bookmarked. This issue has been patched in version 3.6.2.",2026-03-31,Nuclei,cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*,B3Log,Siyuan
CVE-2026-34486,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.21691,CWE-311,"Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.

This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.",2026-04-09,Nuclei,cpe:2.3:a:apache:tomcat:10.1.53:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:11.0.20:*:*:*:*:*:*:*;cpe:2.3:a:apache:tomcat:9.0.116:*:*:*:*:*:*:*,Apache,Tomcat
CVE-2026-34605,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00469,CWE-79,"SiYuan is a personal knowledge management system. From version 3.6.0 to before version 3.6.2, the SanitizeSVG function introduced in version 3.6.0 to fix XSS in the unauthenticated /api/icon/getDynamicIcon endpoint can be bypassed by using namespace-prefixed element names such as <x:script xmlns:x=""http://www.w3.org/2000/svg"">. The Go HTML5 parser records the element's tag as ""x:script"" rather than ""script"", so the tag check passes it through. The SVG is served with Content-Type: image/svg+xml and no Content Security Policy; when a browser opens the response directly, its XML parser resolves the prefix to the SVG namespace and executes the embedded script. This issue has been patched in version 3.6.2.",2026-03-31,Nuclei,cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*,B3Log,Siyuan
CVE-2026-34621,8.6,CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.07086,CWE-1321,"Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",2026-04-11,CISA,cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:*;cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*;cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Apple,Macos
CVE-2026-34847,4.7,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N,0.00401,CWE-601,"hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, the /enter page contains a DOM-based open redirect vulnerability. The redirect query parameter is directly used to construct a URL and redirect the user without proper validation. This issue has been patched in version 2026.3.0.",2026-04-02,Nuclei,cpe:2.3:a:hoppscotch:hoppscotch:*:*:*:*:*:*:*:*,Hoppscotch,Hoppscotch
CVE-2026-34885,8.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L,0.01668,CWE-89,Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant allows SQL Injection.This issue affects Media LIbrary Assistant: from n/a through 3.34.,2026-04-06,Nuclei,,,
CVE-2026-34908,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.02452,CWE-284,A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.,2026-05-22,CISA,cpe:2.3:a:ui:unifi_os_server:*:*:*:*:*:*:*:*;cpe:2.3:h:ui:enterprise_fortress_gateway:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:enterprise_network_video_recorder:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:enterprise_network_video_recorder_core:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unas_2:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unas_4:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unas_pro:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unas_pro_4:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unas_pro_8:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_cloud_gateway_fiber:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_cloud_gateway_industrial:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_cloud_gateway_max:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_cloud_gateway_ultra:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_cloud_key_plus:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_cloudkey:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_cloudkey_enterprise:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_machine:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_machine_beast:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_machine_pro:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_machine_pro_max:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_machine_special_edition:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_router:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_router_5g_max:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_router_7:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_wall:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_express_7:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_network_video_recorder:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_network_video_recorder_g2:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_network_video_recorder_g2_pro:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_network_video_recorder_instant:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_network_video_recorder_pro:-:*:*:*:*:*:*:*;cpe:2.3:o:ui:enterprise_fortress_gateway_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:enterprise_network_video_recorder_core_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:enterprise_network_video_recorder_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unas_2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unas_4_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unas_pro_4_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unas_pro_8_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unas_pro_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_cloud_gateway_fiber_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_cloud_gateway_industrial_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_cloud_gateway_max_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_cloud_gateway_ultra_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_cloud_key_plus_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_cloudkey_enterprise_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_cloudkey_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_machine_beast_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_machine_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_machine_pro_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_machine_pro_max_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_machine_special_edition_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_router_5g_max_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_router_7_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_router_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_wall_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_express_7_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_network_video_recorder_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_network_video_recorder_g2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_network_video_recorder_g2_pro_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_network_video_recorder_instant_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_network_video_recorder_pro_firmware:*:*:*:*:*:*:*:*,Ui,Unifi Cloud Gateway Industrial Firmware
CVE-2026-34909,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.02269,CWE-22,A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.,2026-05-22,CISA,cpe:2.3:a:ui:unifi_os_server:*:*:*:*:*:*:*:*;cpe:2.3:h:ui:enterprise_fortress_gateway:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:enterprise_network_video_recorder:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:enterprise_network_video_recorder_core:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unas_2:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unas_4:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unas_pro:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unas_pro_4:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unas_pro_8:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_cloud_gateway_fiber:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_cloud_gateway_industrial:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_cloud_gateway_max:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_cloud_gateway_ultra:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_cloud_key_plus:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_cloudkey:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_cloudkey_enterprise:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_machine:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_machine_beast:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_machine_pro:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_machine_pro_max:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_machine_special_edition:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_router:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_router_5g_max:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_router_7:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_wall:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_express:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_express_7:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_network_video_recorder:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_network_video_recorder_g2:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_network_video_recorder_g2_pro:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_network_video_recorder_instant:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_network_video_recorder_pro:-:*:*:*:*:*:*:*;cpe:2.3:o:ui:enterprise_fortress_gateway_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:enterprise_network_video_recorder_core_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:enterprise_network_video_recorder_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unas_2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unas_4_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unas_pro_4_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unas_pro_8_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unas_pro_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_cloud_gateway_fiber_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_cloud_gateway_industrial_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_cloud_gateway_max_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_cloud_gateway_ultra_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_cloud_key_plus_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_cloudkey_enterprise_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_cloudkey_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_machine_beast_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_machine_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_machine_pro_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_machine_pro_max_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_machine_special_edition_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_router_5g_max_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_router_7_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_router_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_wall_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_express_7_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_express_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_network_video_recorder_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_network_video_recorder_g2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_network_video_recorder_g2_pro_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_network_video_recorder_instant_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_network_video_recorder_pro_firmware:*:*:*:*:*:*:*:*,Ui,Unifi Cloud Gateway Industrial Firmware
CVE-2026-34910,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.78555,CWE-20,A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.,2026-05-22,CISA/Nuclei,cpe:2.3:a:ui:unifi_os_server:*:*:*:*:*:*:*:*;cpe:2.3:h:ui:enterprise_fortress_gateway:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:enterprise_network_video_recorder:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:enterprise_network_video_recorder_core:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unas_2:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unas_4:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unas_pro:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unas_pro_4:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unas_pro_8:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_cloud_gateway_fiber:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_cloud_gateway_industrial:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_cloud_gateway_max:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_cloud_gateway_ultra:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_cloud_key_plus:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_cloudkey:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_cloudkey_enterprise:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_machine:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_machine_beast:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_machine_pro:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_machine_pro_max:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_machine_special_edition:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_router:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_router_5g_max:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_router_7:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_dream_wall:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_express_7:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_network_video_recorder:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_network_video_recorder_g2:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_network_video_recorder_g2_pro:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_network_video_recorder_instant:-:*:*:*:*:*:*:*;cpe:2.3:h:ui:unifi_network_video_recorder_pro:-:*:*:*:*:*:*:*;cpe:2.3:o:ui:enterprise_fortress_gateway_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:enterprise_network_video_recorder_core_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:enterprise_network_video_recorder_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unas_2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unas_4_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unas_pro_4_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unas_pro_8_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unas_pro_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_cloud_gateway_fiber_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_cloud_gateway_industrial_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_cloud_gateway_max_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_cloud_gateway_ultra_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_cloud_key_plus_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_cloudkey_enterprise_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_cloudkey_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_machine_beast_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_machine_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_machine_pro_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_machine_pro_max_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_machine_special_edition_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_router_5g_max_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_router_7_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_router_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_dream_wall_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_express_7_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_network_video_recorder_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_network_video_recorder_g2_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_network_video_recorder_g2_pro_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_network_video_recorder_instant_firmware:*:*:*:*:*:*:*:*;cpe:2.3:o:ui:unifi_network_video_recorder_pro_firmware:*:*:*:*:*:*:*:*,Ui,Unifi Cloud Gateway Industrial Firmware
CVE-2026-34926,6.7,CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L,0.12682,CWE-23,"A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.


This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.",2026-05-21,CISA,cpe:2.3:a:trendmicro:apex_one:*:*:*:*:on-premises:windows:*:*;cpe:2.3:a:trendmicro:apex_one:*:*:*:*:saas:windows:*:*,Trendmicro,Apex One
CVE-2026-3502,7.8,CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L,0.0575,CWE-494,"TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.",2026-03-30,CISA,cpe:2.3:a:trueconf:trueconf:*:*:*:*:*:windows:*:*,Trueconf,Trueconf
CVE-2026-35029,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.26409,CWE-863,"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to modify proxy configuration and environment variables, register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution, read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image, and take over other privileged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables. Fixed in v1.83.0.",2026-04-06,Nuclei,cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*,Litellm,Litellm
CVE-2026-35273,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.94015,CWE-306,"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",2026-06-11,CISA/Nuclei,cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:*;cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.62:*:*:*:*:*:*:*,Oracle,Peoplesoft Enterprise Peopletools
CVE-2026-35616,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.88505,CWE-284,A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.,2026-04-04,CISA/Nuclei,cpe:2.3:a:fortinet:forticlientems:7.4.5:*:*:*:*:*:*:*;cpe:2.3:a:fortinet:forticlientems:7.4.6:*:*:*:*:*:*:*,Fortinet,Forticlientems
CVE-2026-3584,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.07239,CWE-94,"The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 via the 'form_process' function. This is due to the 'prepare_post_data' function mapping user-supplied keys directly into internal placeholder storage, combined with the use of 'call_user_func' on these placeholder values. This makes it possible for unauthenticated attackers to execute code on the server.",2026-03-20,Nuclei,,,
CVE-2026-38360,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.05982,CWE-22,"Directory Traversal vulnerability in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code via the dash_uploader/httprequesthandler.py, BaseHttpRequestHandler.get_temp_root(), BaseHttpRequestHandler._post() components.",2026-05-08,Nuclei,,,
CVE-2026-38361,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H,0.02643,NVD-CWE-noinfo,"Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-upload handler (dash_uploader/httprequesthandler.py, dash_uploader/upload.py) trusts unsanitized, attacker-controlled upload parameters (e.g. flowTotalChunks) and does not enforce the documented max_file_size limit, allowing a remote, unauthenticated attacker to cause an out-of-memory (OOM) process crash (unbounded range(1, flowTotalChunks + 1) allocation), truncation of the target file to zero bytes (flowTotalChunks=0, where the all([]) == True quirk runs the file-assembly branch on zero chunks), permanent disk exhaustion (never-cleaned-up temporary directories per flowIdentifier), and a complete bypass of the documented max_file_size limit.",2026-05-08,Nuclei,cpe:2.3:a:fohrloop:dash-uploader:*:*:*:*:*:python:*:*;cpe:2.3:a:fohrloop:dash-uploader:0.7.0:alpha1:*:*:*:python:*:*;cpe:2.3:a:fohrloop:dash-uploader:0.7.0:alpha2:*:*:*:python:*:*,Fohrloop,Dash-Uploader
CVE-2026-3844,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.36512,CWE-434,"The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if ""Host Files Locally - Gravatars"" is enabled, which is disabled by default.",2026-04-23,Nuclei,,,
CVE-2026-3891,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02775,CWE-434,"The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.",2026-03-13,Nuclei,,,
CVE-2026-3909,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.01629,CWE-787,Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High),2026-03-13,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Apple,Macos
CVE-2026-3910,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.02,CWE-94,Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High),2026-03-13,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Apple,Macos
CVE-2026-39339,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.01351,CWE-284,"ChurchCRM is an open-source church management system. Prior to 7.1.0, a  critical authentication bypass vulnerability in ChurchCRM's API middleware (ChurchCRM/Slim/Middleware/AuthMiddleware.php) allows unauthenticated attackers to access all protected API endpoints by including ""api/public"" anywhere in the request URL, leading to complete exposure of church member data and system information. This vulnerability is fixed in 7.1.0.",2026-04-07,Nuclei,cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*,Churchcrm,Churchcrm
CVE-2026-39352,0.0,,0.01279,CWE-22,"Frappe is a full-stack web application framework. Versions prior to 15.105.0 and 16.15.0 contain a possible Arbitrary File Read vulnerability via Path Traversal. The issue is resolved in versions 16.15.0, 15.105.0 and above.",2026-05-20,Nuclei,,,
CVE-2026-39363,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02907,CWE-200,"Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default ""...""). The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.",2026-04-07,Nuclei,cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*;cpe:2.3:a:voidzero:vite\+:*:*:*:*:*:node.js:*:*,Vitejs,Vite
CVE-2026-39364,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02095,CWE-180,"Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.",2026-04-07,Nuclei,cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*;cpe:2.3:a:voidzero:vite\+:*:*:*:*:*:node.js:*:*,Vitejs,Vite
CVE-2026-39365,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00914,CWE-22,"Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.",2026-04-07,Nuclei,cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*;cpe:2.3:a:voidzero:vite\+:*:*:*:*:*:node.js:*:*,Vitejs,Vite
CVE-2026-39808,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.84158,CWE-78,A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>,2026-04-14,CISA/Nuclei,cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*,Fortinet,Fortisandbox
CVE-2026-39987,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.95645,CWE-306,"marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.",2026-04-09,CISA/EPSS/Nuclei,cpe:2.3:a:coreweave:marimo:*:*:*:*:*:python:*:*,Coreweave,Marimo
CVE-2026-40105,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00549,CWE-80,"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 10.4-rc-1, through  16.10.15, 17.0.0-rc-1, through 17.4.7 and 17.5.0-rc-1 through 17.10.0 contain a reflected cross-site scripting vulnerability (XSS) in the comparison view between revisions of a page allows executing JavaScript code in the user's browser. If the current user is an admin, this can not only affect the current user but also the confidentiality, integrity and availability of the whole XWiki instance. If developers are unable to update immediately, they can apply the patch manually to templates/changesdoc.vm in the deployed WAR.",2026-04-15,Nuclei,cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*,Xwiki,Xwiki
CVE-2026-40151,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00758,CWE-200,"PraisonAI is a multi-agent teams system. Prior to 4.5.128, the AgentOS deployment platform exposes a GET /api/agents endpoint that returns agent names, roles, and the first 100 characters of agent system instructions to any unauthenticated caller. The AgentOS FastAPI application has no authentication middleware, no API key validation, and defaults to CORS allow_origins=[""*""] with host=""0.0.0.0"", making every deployment network-accessible and queryable from any origin by default. This vulnerability is fixed in 4.5.128.",2026-04-09,Nuclei,cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*,Praison,Praisonai
CVE-2026-4020,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.39704,CWE-200,"The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4. This is due to a REST API endpoint registered at /wp-json/gravitysmtp/v1/tests/mock-data with a permission_callback that unconditionally returns true, allowing any unauthenticated visitor to access it. When the ?page=gravitysmtp-settings query parameter is appended, the plugin's register_connector_data() method populates internal connector data, causing the endpoint to return approximately 365 KB of JSON containing the full System Report. This makes it possible for unauthenticated attackers to retrieve detailed system configuration data including PHP version, loaded extensions, web server version, document root path, database server type and version, WordPress version, all active plugins with versions, active theme, WordPress configuration details, database table names, and any API keys/tokens configured in the plugin.",2026-03-31,Nuclei,,,
CVE-2026-40242,7.2,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N,0.00621,CWE-918,"Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.17.3, the /api/templates/fetch endpoint accepts a caller-supplied url parameter and performs a server-side HTTP GET request to that URL without authentication and without URL scheme or host validation. The server's response is returned directly to the caller. type. This constitutes an unauthenticated SSRF vulnerability affecting any publicly reachable Arcane instance. This vulnerability is fixed in 1.17.3.",2026-04-10,Nuclei,cpe:2.3:a:getarcane:arcane:*:*:*:*:*:*:*:*,Getarcane,Arcane
CVE-2026-40308,0.0,,0.00932,CWE-639,"My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJAX endpoint, registered for unauthenticated users, passes user-supplied arguments through parse_str() without validation, allowing injection of arbitrary parameters including a site value. On WordPress Multisite installations, this enables an unauthenticated attacker to call switch_to_blog() with an arbitrary site ID and extract calendar events from any sub-site on the network, including private or hidden events. On standard Single Site installations, switch_to_blog() does not exist, causing an uncaught PHP fatal error and crashing the worker thread, creating an unauthenticated denial of service vector. This issue has been fixed in version 3.7.7.",2026-04-16,Nuclei,,,
CVE-2026-40466,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.04783,CWE-20,"Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.



An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the classpath.
A malicious HTTP endpoint can return a VM transport through the HTTP URI which will bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.
Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().


This issue affects Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5.

Users are recommended to upgrade to version 5.19.6 or 6.2.5, which fixes the issue.",2026-04-24,Nuclei,cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*;cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*,Apache,Activemq
CVE-2026-40878,0.0,,0.00805,CWE-79,"mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the mailcow web interface passes the raw `$_SERVER['REQUEST_URI']` to Twig as a global template variable and renders it inside a JavaScript string literal in the `setLang()` helper of `base.twig`, relying on Twig's default HTML auto-escaping instead of the context-appropriate `js` escaping strategy. In addition, the `query_string()` Twig helper merges all current `$_GET` parameters into the language-switching links on the login page, so attacker-supplied parameters are reflected and preserved across navigation. Version 2026-03b fixes the vulnerability.",2026-04-21,Nuclei,,,
CVE-2026-40887,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H,0.01762,CWE-89,"Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior to versions 2.3.4, 3.5.7, and 3.6.2, an unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query string parameter is interpolated directly into a raw SQL expression without parameterization or validation, allowing an attacker to execute arbitrary SQL against the database. This affects all supported database backends (PostgreSQL, MySQL/MariaDB, SQLite). The Admin API is also affected, though exploitation there requires authentication. Versions 2.3.4, 3.5.7, and 3.6.2 contain a patch. For those who are unable to upgrade immediately, Vendure has made a hotfix available that uses `RequestContextService.getLanguageCode` to validate the `languageCode` input at the boundary. This blocks injection payloads before they can reach any query. The hotfix replaces the existing `getLanguageCode` method in `packages/core/src/service/helpers/request-context/request-context.service.ts`. Invalid values are silently dropped and the channel's default language is used instead. The patched versions additionally convert the vulnerable SQL interpolation to a parameterized query as defense in depth.",2026-04-21,Nuclei,,,
CVE-2026-4106,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00742,CWE-200,"The HT Mega Addons for Elementor  WordPress plugin before 3.0.7 contains an unauthenticated AJAX action returning some PII (such as full name, city, state and country) of customers who placed orders in the last 7 days",2026-04-23,Nuclei,,,
CVE-2026-41091,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.08371,CWE-59,Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.,2026-05-20,CISA,cpe:2.3:a:microsoft:malware_protection_engine:*:*:*:*:*:*:*:*,Microsoft,Malware Protection Engine
CVE-2026-41176,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.34734,CWE-306,"Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.",2026-04-23,Nuclei,cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*,Rclone,Rclone
CVE-2026-41179,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.09199,CWE-78,"Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.",2026-04-23,Nuclei,cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*,Rclone,Rclone
CVE-2026-41264,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01028,CWE-184,"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the specific flaw exists within the run method of the CSV_Agents class. The issue results from the lack of proper sandboxing when evaluating an LLM generated python script. An attacker can leverage this vulnerability to execute code in the context of the user running the server. Using prompt injection techniques, an unauthenticated attacker with the ability to send prompts to a chatflow using the CSV Agent node may convince an LLM to respond with a malicious python script that executes attacker controlled commands on the Flowise server. This vulnerability is fixed in 3.1.0.",2026-04-23,Metasploit,cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*,Flowiseai,Flowise
CVE-2026-41459,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00801,CWE-497,"Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page to access the exposed root_path value rendered in the HTML response, which enables exploitation of path-dependent vulnerabilities such as relative path traversal in connector.php.",2026-04-22,Metasploit,,,
CVE-2026-41492,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.02187,CWE-200,"Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security ""token=..."" startup flag, an unauthenticated attacker can retrieve that token and replay it in the X-Dgraph-AuthToken header to access admin-only endpoints. This is a variant of the previously fixed /debug/pprof/cmdline issue, but the current fix is incomplete because it blocks only /debug/pprof/cmdline and still serves http.DefaultServeMux, which includes expvar's /debug/vars handler. This vulnerability is fixed in 25.3.3.",2026-04-24,Nuclei,cpe:2.3:a:dgraph:dgraph:*:*:*:*:*:go:*:*,Dgraph,Dgraph
CVE-2026-41640,7.5,CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,0.01875,CWE-89,"NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the queryParentSQL() function in the core database package constructs a recursive CTE query by joining nodeIds with string concatenation instead of using parameterized queries. The nodeIds array contains primary key values read from database rows. An attacker who can create a record with a malicious string primary key can inject arbitrary SQL when any subsequent request triggers recursive eager loading on that collection. This issue has been patched in version 2.0.39.",2026-05-07,Nuclei,cpe:2.3:a:nocobase:nocobase:*:*:*:*:*:*:*:*,Nocobase,Nocobase
CVE-2026-41641,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.01833,CWE-89,"NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the checkSQL() validation function that blocks dangerous SQL keywords (e.g., pg_read_file, LOAD_FILE, dblink) is applied on the collections:create and sqlCollection:execute endpoints but is entirely missing on the sqlCollection:update endpoint. An attacker with collection management permissions can create a SQL collection with benign SQL, then update it with arbitrary SQL that bypasses all validation, and query the collection to execute the injected SQL and exfiltrate data. This issue has been patched in version 2.0.39.",2026-05-07,Nuclei,cpe:2.3:a:nocobase:nocobase:*:*:*:*:*:*:*:*,Nocobase,Nocobase
CVE-2026-41679,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.01972,CWE-287,"Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authenticated` mode with default configuration. No user interaction, no credentials, just the target's address. The chain consists of six API calls. The attack is fully automated, requires no user interaction, and works against the default deployment configuration. Version 2026.416.0 patches the issue.",2026-04-23,Metasploit,cpe:2.3:a:paperclip:paperclipai:*:*:*:*:*:node.js:*:*;cpe:2.3:a:paperclip:paperclipai\/server:*:*:*:*:*:node.js:*:*,Paperclip,Paperclipai
CVE-2026-41940,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.981,CWE-306,cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.,2026-04-29,CISA/EPSS/Metasploit/Nuclei,cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*;cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*;cpe:2.3:a:cpanel:wp_squared:*:*:*:*:*:wordpress:*:*,Cpanel,Cpanel
CVE-2026-42031,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01815,CWE-89,"CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information This vulnerability is fixed in 2.10.10 and 2.11.5.",2026-05-13,Nuclei,cpe:2.3:a:okfn:ckan:*:*:*:*:*:*:*:*,Okfn,Ckan
CVE-2026-42167,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04438,CWE-89,"mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).",2026-04-28,Nuclei,cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*,Proftpd,Proftpd
CVE-2026-42208,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.86607,CWE-89,"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages. This issue has been patched in version 1.83.7.",2026-05-08,CISA/Metasploit/Nuclei,cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*,Litellm,Litellm
CVE-2026-42271,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.80188,CWE-77,"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7.",2026-05-08,CISA/Nuclei,cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_ai:*:*:*:*:*:*:*:*;cpe:2.3:a:redhat:openshift_ai:3.4:*:*:*:*:*:*:*,Litellm,Litellm
CVE-2026-42281,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.01623,CWE-918,"MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment variable placeholders (**VAR_NAME**), enabling exfiltration of server-side secrets. This vulnerability is fixed in 2.36.0.",2026-05-14,Nuclei,cpe:2.3:a:magicmirror:magicmirror:*:*:*:*:*:node.js:*:*,Magicmirror,Magicmirror
CVE-2026-42569,9.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H,0.01173,CWE-284,"phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6.",2026-05-09,Nuclei,,,
CVE-2026-4257,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.41475,CWE-94,"The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in all versions up to, and including, 1.7.36. This is due to the plugin using the Twig `Twig_Loader_String` template engine without sandboxing, combined with the `cfsPreFill` prefill functionality that allows unauthenticated users to inject arbitrary Twig expressions into form field values via GET parameters. This makes it possible for unauthenticated attackers to execute arbitrary PHP functions and OS commands on the server by leveraging Twig's `registerUndefinedFilterCallback()` method to register arbitrary PHP callbacks.",2026-03-30,Metasploit/Nuclei,,,
CVE-2026-42589,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0295,CWE-78,"Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg's /forms/pdfengines/metadata/write HTTP endpoint accepts a JSON metadata object and passes its keys directly to ExifTool via the go-exiftool library. No validation is performed on key characters. A \n embedded in a JSON key splits the ExifTool stdin stream into a new argument line, allowing an attacker to inject arbitrary ExifTool flags — including -if, which evaluates Perl expressions. This achieves unauthenticated OS command execution in a single HTTP request. The response is HTTP 200 with a valid PDF, making the attack transparent to basic monitoring. This vulnerability is fixed in 8.31.0.",2026-05-14,Nuclei,cpe:2.3:a:thecodingmachine:gotenberg:*:*:*:*:*:*:*:*,Thecodingmachine,Gotenberg
CVE-2026-42647,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L,0.01323,CWE-89,"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beardev JoomSport allows Blind SQL Injection.

This issue affects JoomSport: from n/a through 5.7.7.",2026-06-11,Nuclei,,,
CVE-2026-42796,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.00732,CWE-306,"Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the /rest/configure REST endpoint that accepts a plugins query parameter and forwards it to the plugin manager without authentication or authorization. Attackers can supply a URL to a malicious Python file through the plugins parameter, causing the Arelle webserver to download and execute the attacker-controlled code within the Arelle process with its privileges.",2026-05-04,Nuclei,cpe:2.3:a:workiva:arelle:*:*:*:*:*:*:*:*,Workiva,Arelle
CVE-2026-42897,8.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N,0.0564,CWE-79,Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.,2026-05-14,CISA,cpe:2.3:a:microsoft:exchange_server:2016:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_1:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_20:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_2:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_3:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_4:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_5:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_6:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_7:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_13:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_14:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_9:*:*:*:*:*:*;cpe:2.3:a:microsoft:exchange_server_subscription_edition:*:*:*:*:*:*:*:*,Microsoft,Exchange Server
CVE-2026-43284,8.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.93235,CWE-123,"In the Linux kernel, the following vulnerability has been resolved:

xfrm: esp: avoid in-place decrypt on shared skb frags

MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP
marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(),
so later paths that may modify packet data can first make a private
copy. The IPv4/IPv6 datagram append paths did not set this flag when
splicing pages into UDP skbs.

That leaves an ESP-in-UDP packet made from shared pipe pages looking
like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW
fast path for uncloned skbs without a frag_list and decrypts in place
over data that is not owned privately by the skb.

Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching
TCP. Also make ESP input fall back to skb_cow_data() when the flag is
present, so ESP does not decrypt externally backed frags in place.
Private nonlinear skb frags still use the existing fast path.

This intentionally does not change ESP output. In esp_output_head(),
the path that appends the ESP trailer to existing skb tailroom without
calling skb_cow_data() is not reachable for nonlinear skbs:
skb_tailroom() returns zero when skb->data_len is nonzero, while ESP
tailen is positive. Thus ESP output will either use the separate
destination-frag path or fall back to skb_cow_data().",2026-05-08,Metasploit,cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2026-43500,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.92766,CWE-787,"In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE
handler in rxrpc_verify_response() copy the skb to a linear one before
calling into the security ops only when skb_cloned() is true.  An skb
that is not cloned but still carries externally-owned paged fragments
(e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via
__ip_append_data, or a chained skb_has_frag_list()) falls through to
the in-place decryption path, which binds the frag pages directly into
the AEAD/skcipher SGL via skb_to_sgvec().

Extend the gate to also unshare when skb_has_frag_list() or
skb_has_shared_frag() is true.  This catches the splice-loopback vector
and other externally-shared frag sources while preserving the
zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC
page_pool RX, GRO).  The OOM/trace handling already in place is reused.",2026-05-11,Metasploit,cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:5.3:-:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:5.3:rc7:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:5.3:rc8:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2026-44262,9.4,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L,0.0586,CWE-94,"Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. This vulnerability is fixed in 0.13.22.",2026-05-12,Nuclei,,,
CVE-2026-44338,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.26799,CWE-306,"PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the configured agents.yaml workflow through /chat without providing a token. This issue has been patched in version 4.6.34.",2026-05-08,Nuclei,cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*,Praison,Praisonai
CVE-2026-44381,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.0054,CWE-89,"MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, a SQL injection vulnerability existed in the handling of user-controlled ordering parameters in the event and shadow attribute listing endpoints. The affected code accepted order or sort values from request parameters and incorporated them into database query ordering clauses without sufficient validation of the requested field name. An attacker with access to the affected endpoints could craft a malicious ordering parameter to manipulate the generated SQL query. Depending on database permissions and query context, this could potentially allow unauthorized access to data, modification of query behavior, or other database-level impact. This vulnerability is fixed in 2.5.37.",2026-05-13,Nuclei,cpe:2.3:a:misp-project:misp:*:*:*:*:*:*:*:*,Misp-Project,Misp
CVE-2026-44551,9.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N,0.01461,CWE-287,"Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accepts password: str with no minimum length constraint, so an empty string passes validation. The subsequent Connection.bind() call succeeds on vulnerable LDAP servers, and the application issues a full session token for the target user. This vulnerability is fixed in 0.9.0.",2026-05-15,Nuclei,cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*,Openwebui,Open Webui
CVE-2026-44578,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.38872,CWE-918,"Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.",2026-05-13,Nuclei,cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*,Vercel,Next.Js
CVE-2026-4480,9.0,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H,0.12797,CWE-78,"A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the ""print command"" setting via the ""%J""
substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.",2026-05-26,Nuclei,cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*;cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*;cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*,Redhat,Enterprise Linux
CVE-2026-45087,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.01051,CWE-15,"Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode (dalfox server), the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options — including FoundAction and FoundActionShell — is deserialized directly from attacker-supplied JSON in POST /scan, and because dalfox.Initialize explicitly propagates those two fields into the final scan options without stripping them, any unauthenticated caller who can reach the server port can supply an arbitrary shell command that the dalfox process will execute on the host whenever a scan finding is triggered. This vulnerability is fixed in 2.13.0.",2026-05-27,Metasploit,,,
CVE-2026-45247,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.27546,CWE-502,Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.,2026-05-26,CISA,cpe:2.3:a:mirasvit:full_page_cache_warmer:*:*:*:*:*:magento:*:*,Mirasvit,Full Page Cache Warmer
CVE-2026-45298,8.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N,0.01491,CWE-918,"Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy (the documented quickstart, no DOZZLE_AUTH_PROVIDER set), POST /api/notifications/test-webhook is reachable without authentication and forwards an attacker-controlled URL into a WebhookDispatcher that sends an HTTP POST to the supplied URL with attacker-controlled request headers, and returns the response status code AND up to 1MB of the response body to the caller, when the target replies non-2xx. This vulnerability is fixed in 10.5.2.",2026-05-26,Nuclei,cpe:2.3:a:amirraminfar:dozzle:*:*:*:*:*:docker:*:*,Amirraminfar,Dozzle
CVE-2026-45321,9.6,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H,0.02342,CWE-506,"On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target ""Pwn Request"" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.",2026-05-12,CISA,cpe:2.3:a:abhishake1:supersurkhet\/cli:0.0.2:*:*:*:*:node.js:*:*;cpe:2.3:a:abhishake1:supersurkhet\/cli:0.0.3:*:*:*:*:node.js:*:*;cpe:2.3:a:abhishake1:supersurkhet\/cli:0.0.4:*:*:*:*:node.js:*:*;cpe:2.3:a:abhishake1:supersurkhet\/cli:0.0.5:*:*:*:*:node.js:*:*;cpe:2.3:a:abhishake1:supersurkhet\/cli:0.0.6:*:*:*:*:node.js:*:*;cpe:2.3:a:abhishake1:supersurkhet\/cli:0.0.7:*:*:*:*:node.js:*:*;cpe:2.3:a:abhishake1:supersurkhet\/sdk:0.0.2:*:*:*:*:node.js:*:*;cpe:2.3:a:abhishake1:supersurkhet\/sdk:0.0.3:*:*:*:*:node.js:*:*;cpe:2.3:a:abhishake1:supersurkhet\/sdk:0.0.4:*:*:*:*:node.js:*:*;cpe:2.3:a:abhishake1:supersurkhet\/sdk:0.0.5:*:*:*:*:node.js:*:*;cpe:2.3:a:abhishake1:supersurkhet\/sdk:0.0.6:*:*:*:*:node.js:*:*;cpe:2.3:a:abhishake1:supersurkhet\/sdk:0.0.7:*:*:*:*:node.js:*:*;cpe:2.3:a:abhishake1:taskflow-corp\/cli:0.1.24:*:*:*:*:node.js:*:*;cpe:2.3:a:abhishake1:taskflow-corp\/cli:0.1.25:*:*:*:*:node.js:*:*;cpe:2.3:a:abhishake1:taskflow-corp\/cli:0.1.26:*:*:*:*:node.js:*:*;cpe:2.3:a:abhishake1:taskflow-corp\/cli:0.1.27:*:*:*:*:node.js:*:*;cpe:2.3:a:abhishake1:taskflow-corp\/cli:0.1.28:*:*:*:*:node.js:*:*;cpe:2.3:a:abhishake1:taskflow-corp\/cli:0.1.29:*:*:*:*:node.js:*:*;cpe:2.3:a:agentworkhq:agentwork-cli:0.1.4:*:*:*:*:node.js:*:*;cpe:2.3:a:agentworkhq:agentwork-cli:0.1.5:*:*:*:*:node.js:*:*;cpe:2.3:a:antoinebcx:ml-toolkit-ts:1.0.4:*:*:*:*:node.js:*:*;cpe:2.3:a:antoinebcx:ml-toolkit-ts:1.0.5:*:*:*:*:node.js:*:*;cpe:2.3:a:antoinebcx:ml-toolkit-ts\/preprocessing:1.0.2:*:*:*:*:node.js:*:*;cpe:2.3:a:antoinebcx:ml-toolkit-ts\/preprocessing:1.0.3:*:*:*:*:node.js:*:*;cpe:2.3:a:antoinebcx:ml-toolkit-ts\/xgboost:1.0.3:*:*:*:*:node.js:*:*;cpe:2.3:a:antoinebcx:ml-toolkit-ts\/xgboost:1.0.4:*:*:*:*:node.js:*:*;cpe:2.3:a:beproduct:beproduct\/nestjs-auth:0.1.10:*:*:*:*:node.js:*:*;cpe:2.3:a:beproduct:beproduct\/nestjs-auth:0.1.11:*:*:*:*:node.js:*:*;cpe:2.3:a:beproduct:beproduct\/nestjs-auth:0.1.12:*:*:*:*:node.js:*:*;cpe:2.3:a:beproduct:beproduct\/nestjs-auth:0.1.13:*:*:*:*:node.js:*:*;cpe:2.3:a:beproduct:beproduct\/nestjs-auth:0.1.14:*:*:*:*:node.js:*:*;cpe:2.3:a:beproduct:beproduct\/nestjs-auth:0.1.15:*:*:*:*:node.js:*:*;cpe:2.3:a:beproduct:beproduct\/nestjs-auth:0.1.16:*:*:*:*:node.js:*:*;cpe:2.3:a:beproduct:beproduct\/nestjs-auth:0.1.17:*:*:*:*:node.js:*:*;cpe:2.3:a:beproduct:beproduct\/nestjs-auth:0.1.19:*:*:*:*:node.js:*:*;cpe:2.3:a:beproduct:beproduct\/nestjs-auth:0.1.2:*:*:*:*:node.js:*:*;cpe:2.3:a:beproduct:beproduct\/nestjs-auth:0.1.3:*:*:*:*:node.js:*:*;cpe:2.3:a:beproduct:beproduct\/nestjs-auth:0.1.4:*:*:*:*:node.js:*:*;cpe:2.3:a:beproduct:beproduct\/nestjs-auth:0.1.5:*:*:*:*:node.js:*:*;cpe:2.3:a:beproduct:beproduct\/nestjs-auth:0.1.6:*:*:*:*:node.js:*:*;cpe:2.3:a:beproduct:beproduct\/nestjs-auth:0.1.7:*:*:*:*:node.js:*:*;cpe:2.3:a:beproduct:beproduct\/nestjs-auth:0.1.8:*:*:*:*:node.js:*:*;cpe:2.3:a:beproduct:beproduct\/nestjs-auth:0.1.9:*:*:*:*:node.js:*:*;cpe:2.3:a:christianalares:git-git-git:1.0.10:*:*:*:*:node.js:*:*;cpe:2.3:a:christianalares:git-git-git:1.0.12:*:*:*:*:node.js:*:*;cpe:2.3:a:christianalares:git-git-git:1.0.8:*:*:*:*:node.js:*:*;cpe:2.3:a:christianalares:git-git-git:1.0.9:*:*:*:*:node.js:*:*;cpe:2.3:a:christianalares:git_branch_selector:1.3.3:*:*:*:*:node.js:*:*;cpe:2.3:a:christianalares:git_branch_selector:1.3.4:*:*:*:*:node.js:*:*;cpe:2.3:a:christianalares:git_branch_selector:1.3.5:*:*:*:*:node.js:*:*;cpe:2.3:a:christianalares:git_branch_selector:1.3.7:*:*:*:*:node.js:*:*;cpe:2.3:a:christianalares:nextmove-mcp:0.1.3:*:*:*:*:node.js:*:*;cpe:2.3:a:christianalares:nextmove-mcp:0.1.4:*:*:*:*:node.js:*:*;cpe:2.3:a:christianalares:nextmove-mcp:0.1.5:*:*:*:*:node.js:*:*;cpe:2.3:a:christianalares:nextmove-mcp:0.1.7:*:*:*:*:node.js:*:*;cpe:2.3:a:christianalares:tolka\/cli:1.0.2:*:*:*:*:node.js:*:*;cpe:2.3:a:christianalares:tolka\/cli:1.0.3:*:*:*:*:node.js:*:*;cpe:2.3:a:christianalares:tolka\/cli:1.0.4:*:*:*:*:node.js:*:*;cpe:2.3:a:christianalares:tolka\/cli:1.0.6:*:*:*:*:node.js:*:*;cpe:2.3:a:dirigible:dirigible-ai\/sdk:0.6.2:*:*:*:*:node.js:*:*;cpe:2.3:a:dirigible:dirigible-ai\/sdk:0.6.3:*:*:*:*:node.js:*:*;cpe:2.3:a:guardrailsai:guardrails_ai:0.10.1:*:*:*:*:python:*:*;cpe:2.3:a:kilbot:tallyui\/components:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/components:1.0.2:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/components:1.0.3:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/connector-medusa:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/connector-medusa:1.0.2:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/connector-medusa:1.0.3:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/connector-shopify:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/connector-shopify:1.0.2:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/connector-shopify:1.0.3:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/connector-vendure:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/connector-vendure:1.0.2:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/connector-vendure:1.0.3:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/connector-woocommerce:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/connector-woocommerce:1.0.2:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/connector-woocommerce:1.0.3:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/core:0.2.1:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/core:0.2.2:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/core:0.2.3:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/database:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/database:1.0.2:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/database:1.0.3:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/pos:0.1.1:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/pos:0.1.2:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/pos:0.1.3:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/storage-sqlite:0.2.1:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/storage-sqlite:0.2.2:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/storage-sqlite:0.2.3:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/theme:0.2.1:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/theme:0.2.2:*:*:*:*:node.js:*:*;cpe:2.3:a:kilbot:tallyui\/theme:0.2.3:*:*:*:*:node.js:*:*;cpe:2.3:a:linuxfoundation:opensearch:3.6.2:*:*:*:*:node.js:*:*;cpe:2.3:a:matheuspergoli:draftauth\/client:0.2.1:*:*:*:*:node.js:*:*;cpe:2.3:a:matheuspergoli:draftauth\/client:0.2.2:*:*:*:*:node.js:*:*;cpe:2.3:a:matheuspergoli:draftauth\/core:0.13.1:*:*:*:*:node.js:*:*;cpe:2.3:a:matheuspergoli:draftauth\/core:0.13.2:*:*:*:*:node.js:*:*;cpe:2.3:a:matheuspergoli:draftlab\/auth-router:0.5.1:*:*:*:*:node.js:*:*;cpe:2.3:a:matheuspergoli:draftlab\/auth-router:0.5.2:*:*:*:*:node.js:*:*;cpe:2.3:a:matheuspergoli:draftlab\/auth:0.24.1:*:*:*:*:node.js:*:*;cpe:2.3:a:matheuspergoli:draftlab\/auth:0.24.2:*:*:*:*:node.js:*:*;cpe:2.3:a:matheuspergoli:draftlab\/db:0.16.1:*:*:*:*:node.js:*:*;cpe:2.3:a:matheuspergoli:draftlab\/db:0.16.2:*:*:*:*:node.js:*:*;cpe:2.3:a:matheuspergoli:simple_type-safe_actions:0.8.3:*:*:*:*:node.js:*:*;cpe:2.3:a:matheuspergoli:simple_type-safe_actions:0.8.4:*:*:*:*:node.js:*:*;cpe:2.3:a:mesa:mesadev\/rest:0.28.3:*:*:*:*:node.js:*:*;cpe:2.3:a:mesa:mesadev\/saguaro:0.4.22:*:*:*:*:node.js:*:*;cpe:2.3:a:mesa:mesadev\/sdk:0.28.3:*:*:*:*:node.js:*:*;cpe:2.3:a:mistral:mistralai:2.4.6:*:*:*:*:python:*:*;cpe:2.3:a:mistral:mistralai\/mistralai-azure:1.7.2:*:*:*:*:node.js:*:*;cpe:2.3:a:mistral:mistralai\/mistralai-azure:1.7.3:*:*:*:*:node.js:*:*;cpe:2.3:a:mistral:mistralai\/mistralai-gcp:1.7.2:*:*:*:*:node.js:*:*;cpe:2.3:a:mistral:mistralai\/mistralai-gcp:1.7.3:*:*:*:*:node.js:*:*;cpe:2.3:a:mistral:mistralai\/mistralai:2.2.3:*:*:*:*:node.js:*:*;cpe:2.3:a:mistral:mistralai\/mistralai:2.2.4:*:*:*:*:node.js:*:*;cpe:2.3:a:multiagentcognition:cmux-agent-mcp:0.1.3:*:*:*:*:node.js:*:*;cpe:2.3:a:multiagentcognition:cmux-agent-mcp:0.1.4:*:*:*:*:node.js:*:*;cpe:2.3:a:multiagentcognition:cmux-agent-mcp:0.1.5:*:*:*:*:node.js:*:*;cpe:2.3:a:multiagentcognition:cmux-agent-mcp:0.1.6:*:*:*:*:node.js:*:*;cpe:2.3:a:multiagentcognition:cmux-agent-mcp:0.1.7:*:*:*:*:node.js:*:*;cpe:2.3:a:multiagentcognition:cmux-agent-mcp:0.1.8:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:cross-stitch:1.1.3:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:cross-stitch:1.1.4:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:cross-stitch:1.1.6:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/airports:0.6.2:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/airports:0.6.3:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/airports:0.6.5:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/airspace-data:0.5.3:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/airspace-data:0.5.4:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/airspace-data:0.5.6:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/airspace:0.8.1:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/airspace:0.8.2:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/airspace:0.8.4:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/airway-data:0.5.4:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/airway-data:0.5.5:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/airway-data:0.5.7:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/airways:0.4.2:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/airways:0.4.3:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/airways:0.4.5:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/fix-data:0.6.4:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/fix-data:0.6.5:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/fix-data:0.6.7:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/fixes:0.3.2:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/fixes:0.3.3:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/fixes:0.3.5:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/flight-math:0.5.4:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/flight-math:0.5.5:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/flight-math:0.5.7:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/flightplan:0.5.2:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/flightplan:0.5.3:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/flightplan:0.5.5:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/geo:0.4.4:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/geo:0.4.5:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/geo:0.4.7:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/icao-registry-data:0.8.4:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/icao-registry-data:0.8.5:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/icao-registry-data:0.8.7:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/icao-registry:0.5.2:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/icao-registry:0.5.3:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/icao-registry:0.5.5:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/mcp:0.9.1:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/mcp:0.9.2:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/mcp:0.9.4:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/navaid-data:0.6.4:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/navaid-data:0.6.5:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/navaid-data:0.6.7:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/navaids:0.4.2:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/navaids:0.4.3:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/navaids:0.4.5:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/notams:0.3.6:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/notams:0.3.7:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/notams:0.3.9:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/procedure-data:0.7.3:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/procedure-data:0.7.4:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/procedure-data:0.7.6:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/procedures:0.5.2:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/procedures:0.5.3:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/procedures:0.5.5:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/types:0.8.1:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/types:0.8.2:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/types:0.8.4:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/units:0.4.3:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/units:0.4.4:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/units:0.4.6:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/weather:0.5.6:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/weather:0.5.7:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:squawk\/weather:0.5.9:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:ts-dna:3.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:ts-dna:3.0.2:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:ts-dna:3.0.4:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:wot-api:0.8.1:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:wot-api:0.8.2:*:*:*:*:node.js:*:*;cpe:2.3:a:neilcochran:wot-api:0.8.4:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/arktype-adapter:1.166.12:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/arktype-adapter:1.166.15:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/eslint-plugin-router:1.161.12:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/eslint-plugin-router:1.161.9:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/eslint-plugin-start:0.0.4:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/eslint-plugin-start:0.0.7:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/history:1.161.12:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/history:1.161.9:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/nitro-v2-vite-plugin:1.154.12:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/nitro-v2-vite-plugin:1.154.15:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/react-router-devtools:1.166.16:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/react-router-devtools:1.166.19:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/react-router-ssr-query:1.166.15:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/react-router-ssr-query:1.166.18:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/react-router:1.169.5:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/react-router:1.169.8:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/react-start-client:1.166.51:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/react-start-client:1.166.54:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/react-start-rsc:0.0.47:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/react-start-rsc:0.0.50:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/react-start-server:1.166.55:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/react-start-server:1.166.58:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/react-start:1.167.68:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/react-start:1.167.71:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/router-cli:1.166.46:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/router-cli:1.166.49:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/router-core:1.169.5:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/router-core:1.169.8:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/router-devtools-core:1.167.6:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/router-devtools-core:1.167.9:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/router-devtools:1.166.16:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/router-devtools:1.166.19:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/router-generator:1.166.45:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/router-generator:1.166.48:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/router-plugin:1.167.38:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/router-plugin:1.167.41:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/router-ssr-query-core:1.168.3:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/router-ssr-query-core:1.168.6:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/router-utils:1.161.11:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/router-utils:1.161.14:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/router-vite-plugin:1.166.53:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/router-vite-plugin:1.166.56:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/solid-router-devtools:1.166.16:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/solid-router-devtools:1.166.19:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/solid-router-ssr-query:1.166.15:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/solid-router-ssr-query:1.166.18:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/solid-router:1.169.5:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/solid-router:1.169.8:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/solid-start-client:1.166.50:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/solid-start-client:1.166.53:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/solid-start-server:1.166.54:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/solid-start-server:1.166.57:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/solid-start:1.167.65:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/solid-start:1.167.68:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/start-client-core:1.168.5:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/start-client-core:1.168.8:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/start-fn-stubs:1.161.12:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/start-fn-stubs:1.161.9:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/start-plugin-core:1.169.23:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/start-plugin-core:1.169.26:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/start-server-core:1.167.33:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/start-server-core:1.167.36:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/start-static-server-functions:1.166.44:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/start-static-server-functions:1.166.47:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/start-storage-context:1.166.38:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/start-storage-context:1.166.41:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/valibot-adapter:1.166.12:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/valibot-adapter:1.166.15:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/virtual-file-routes:1.161.10:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/virtual-file-routes:1.161.13:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/vue-router-devtools:1.166.16:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/vue-router-devtools:1.166.19:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/vue-router-ssr-query:1.166.15:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/vue-router-ssr-query:1.166.18:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/vue-router:1.169.5:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/vue-router:1.169.8:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/vue-start-client:1.166.46:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/vue-start-client:1.166.49:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/vue-start-server:1.166.50:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/vue-start-server:1.166.53:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/vue-start:1.167.61:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/vue-start:1.167.64:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/zod-adapter:1.166.12:*:*:*:*:node.js:*:*;cpe:2.3:a:tanstack:tanstack\/zod-adapter:1.166.15:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/access-policy-sdk:0.3.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/access-policy-tool:0.3.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/admin-tool:0.1.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/agent-sdk:1.0.2:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/agent-tool:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/agent.sdk:0.0.18:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/aops-policy-tool:0.3.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/ap-chat:1.5.7:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/api-workflow-tool:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/apollo-core:5.9.2:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/apollo-react:4.24.5:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/apollo-wind:2.16.2:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/auth:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/case-tool:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/cli:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/codedagent-tool:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/codedagents-tool:0.1.12:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/codedapp-tool:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/common:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/context-grounding-tool:0.1.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/data-fabric-tool:1.0.2:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/docsai-tool:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/filesystem:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/flow-tool:1.0.2:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/functions-tool:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/gov-tool:0.3.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/identity-tool:0.1.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/insights-sdk:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/insights-tool:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/integrationservice-sdk:1.0.2:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/integrationservice-tool:1.0.2:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/llmgw-tool:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/maestro-sdk:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/maestro-tool:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/orchestrator-tool:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/packager-tool-apiworkflow:0.0.19:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/packager-tool-bpmn:0.0.9:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/packager-tool-case:0.0.9:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/packager-tool-connector:0.0.19:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/packager-tool-flow:0.0.19:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/packager-tool-functions:0.1.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/packager-tool-webapp:1.0.6:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/packager-tool-workflowcompiler-browser:0.0.34:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/packager-tool-workflowcompiler:0.0.16:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/platform-tool:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/project-packager:1.1.16:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/resource-tool:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/resourcecatalog-tool:0.1.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/resources-tool:0.1.11:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/robot:1.3.4:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/rpa-legacy-tool:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/rpa-tool:0.9.5:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/solution-packager:0.0.35:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/solution-tool:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/solutionpackager-sdk:1.0.11:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/solutionpackager-tool-core:0.0.34:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/tasks-tool:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/telemetry:0.0.7:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/test-manager-tool:1.0.2:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/tool-workflowcompiler:0.0.12:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/traces-tool:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/ui-widgets-multi-file-upload:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/uipath-python-bridge:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/vertical-solutions-tool:1.0.1:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/vss:0.1.6:*:*:*:*:node.js:*:*;cpe:2.3:a:uipath:uipath\/widget.sdk:1.2.3:*:*:*:*:node.js:*:*,Tanstack,Tanstack/Arktype-Adapter
CVE-2026-45397,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.0072,CWE-306,"Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, GET /api/v1/retrieval/ returns live RAG pipeline configuration to any unauthenticated HTTP client. No Authorization header, cookie, or API key is required. Every adjacent endpoint on the same router (/embedding, /config) is correctly guarded by get_admin_user making this a targeted omission. This vulnerability is fixed in 0.9.5.",2026-05-15,Nuclei,cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*,Openwebui,Open Webui
CVE-2026-45498,4.0,CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L,0.63076,CWE-400,Microsoft Defender Denial of Service Vulnerability,2026-05-20,CISA,cpe:2.3:a:microsoft:defender_antimalware_platform:*:*:*:*:*:*:*:*,Microsoft,Defender Antimalware Platform
CVE-2026-45659,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.03219,CWE-502,Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.,2026-05-22,CISA,cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*,Microsoft,Sharepoint Server
CVE-2026-4631,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.142,CWE-78,"Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.",2026-04-07,Nuclei,,,
CVE-2026-46333,7.1,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N,0.0138,CWE-269,"In the Linux kernel, the following vulnerability has been resolved:

ptrace: slightly saner 'get_dumpable()' logic

The 'dumpability' of a task is fundamentally about the memory image of
the task - the concept comes from whether it can core dump or not - and
makes no sense when you don't have an associated mm.

And almost all users do in fact use it only for the case where the task
has a mm pointer.

But we have one odd special case: ptrace_may_access() uses 'dumpable' to
check various other things entirely independently of the MM (typically
explicitly using flags like PTRACE_MODE_READ_FSCREDS).  Including for
threads that no longer have a VM (and maybe never did, like most kernel
threads).

It's not what this flag was designed for, but it is what it is.

The ptrace code does check that the uid/gid matches, so you do have to
be uid-0 to see kernel thread details, but this means that the
traditional ""drop capabilities"" model doesn't make any difference for
this all.

Make it all make a *bit* more sense by saying that if you don't have a
MM pointer, we'll use a cached ""last dumpability"" flag if the thread
ever had a MM (it will be zero for kernel threads since it is never
set), and require a proper CAP_SYS_PTRACE capability to override.",2026-05-15,Metasploit,cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*,Linux,Linux Kernel
CVE-2026-46339,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.04572,CWE-78,"9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-settings/route.js and command execution through the MCP bridge. This vulnerability is fixed in 0.4.37.",2026-07-15,Nuclei,,,
CVE-2026-46364,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01709,CWE-89,"phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.",2026-05-15,Nuclei,,,
CVE-2026-46372,8.5,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N,0.00866,CWE-918,"SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern exposes /api/search/searxng, which accepts attacker-controlled baseUrl and uses it directly to build outbound server-side fetches. An authenticated low-privilege user can point baseUrl at an internal or loopback HTTP service and receive the /search response body. This vulnerability is fixed in 1.18.0.",2026-05-29,Nuclei,,,
CVE-2026-46442,9.9,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H,0.02957,CWE-94,"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When E2B_APIKEY is not configured — the common deployment case — Flowise executes this code inside a NodeVM sandbox. This sandbox can be escaped, allowing an attacker to reach the host process object and execute system commands via child_process. The result is authenticated remote code execution on the Flowise server host. This issue has been patched in version 3.1.2.",2026-06-08,Nuclei,cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*,Flowiseai,Flowise
CVE-2026-46725,0.0,,0.02306,CWE-502,"The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with ""Persistent Mode: Static"" in the plugin settings.",2026-05-19,Nuclei,,,
CVE-2026-46817,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01045,CWE-269,"Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments.  Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",2026-05-28,CISA,cpe:2.3:a:oracle:e-business_suite:*:*:*:*:*:*:*:*,Oracle,E-Business Suite
CVE-2026-48027,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0185,CWE-506,"Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.",2026-05-27,CISA,cpe:2.3:a:nx:nx_console:18.95.0:*:*:*:*:visual_studio_code:*:*,Nx,Nx Console
CVE-2026-4810,0.0,,0.01816,CWE-306,"A Code Injection and Missing Authentication vulnerability in Google Agent Development Kit (ADK) versions 1.7.0 (and 2.0.0a1) through 1.28.1 (and 2.0.0a2) on Python (OSS), Cloud Run, and GKE allows an unauthenticated remote attacker to execute arbitrary code on the server hosting the ADK instance.

This vulnerability was patched in versions 1.28.1 and 2.0.0a2.


Customers need to redeploy the upgraded ADK to their production environments. In addition, if they are running ADK Web locally, they also need to upgrade their local instance.",2026-04-13,Nuclei,,,
CVE-2026-48172,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.18914,CWE-266,"LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE ""cpanel_jsonapi_func=redisAble"" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.",2026-05-21,CISA,cpe:2.3:a:litespeedtech:litespeed_cpanel_plugin:*:*:*:*:*:*:*:*;cpe:2.3:a:litespeedtech:litespeed_whm_plugin:*:*:*:*:*:*:*:*,Litespeedtech,Litespeed Cpanel Plugin
CVE-2026-48282,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.28583,CWE-22,"ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.",2026-06-30,CISA/Nuclei,cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update10:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update11:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update12:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update13:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update14:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update15:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update16:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update17:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update18:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update19:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update20:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update7:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update8:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update9:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2025:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2025:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2025:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2025:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2025:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2025:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2025:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2025:update7:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2025:update8:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2025:update9:*:*:*:*:*:*,Adobe,Coldfusion
CVE-2026-48313,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N,0.01577,CWE-22,"ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read and limited write access. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.",2026-06-30,Nuclei,cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update10:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update11:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update12:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update13:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update14:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update15:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update16:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update17:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update18:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update19:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update20:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update7:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update8:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2023:update9:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2025:-:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2025:update1:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2025:update2:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2025:update3:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2025:update4:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2025:update5:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2025:update6:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2025:update7:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2025:update8:*:*:*:*:*:*;cpe:2.3:a:adobe:coldfusion:2025:update9:*:*:*:*:*:*,Adobe,Coldfusion
CVE-2026-48558,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.0116,CWE-347,"SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.",2026-06-12,CISA,cpe:2.3:a:simple-help:simplehelp:*:*:*:*:*:*:*:*;cpe:2.3:a:simple-help:simplehelp:6.0:pre-release:*:*:*:*:*:*,Simple-Help,Simplehelp
CVE-2026-48611,0.0,,0.02865,CWE-287,Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations.,2026-06-12,Nuclei,,,
CVE-2026-48710,6.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N,0.01438,CWE-444,"Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope[""server""]` for malformed values.",2026-05-26,Nuclei,cpe:2.3:a:encode:starlette:*:*:*:*:*:python:*:*,Encode,Starlette
CVE-2026-48907,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.80425,CWE-284,"A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.",2026-06-05,CISA/Nuclei,cpe:2.3:a:widgetfactorylimited:jce:*:*:*:*:*:joomla\!:*:*,Widgetfactorylimited,Jce
CVE-2026-48908,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01569,CWE-434,"A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.",2026-06-20,CISA/Nuclei,cpe:2.3:a:ollyo:sp_page_builder:*:*:*:*:-:joomla\!:*:*,Ollyo,Sp Page Builder
CVE-2026-48909,0.0,,0.02726,CWE-502,"SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server.",2026-06-20,Nuclei,,,
CVE-2026-48939,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01505,CWE-434,"A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.",2026-06-20,CISA,cpe:2.3:a:joomlic:icagenda:*:*:*:*:-:joomla\!:*:*,Joomlic,Icagenda
CVE-2026-49777,10.0,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.01656,CWE-1284,"Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted.

This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4.",2026-06-05,Nuclei,,,
CVE-2026-50229,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.02569,CWE-80,"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.",2026-06-29,Nuclei,cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*,Apache,Tomcat
CVE-2026-50230,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00324,CWE-79,Lyrion Music Server 9.2.0 contains an unauthenticated reflected cross-site scripting vulnerability in the server.log endpoint that allows attackers to inject arbitrary HTML and JavaScript code through the search parameter. Attackers can craft malicious URLs with JavaScript payloads in the search parameter to execute code in users' browsers within the context of the affected application.,2026-06-05,Nuclei,,,
CVE-2026-5027,8.8,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.31405,CWE-22,"The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../').",2026-03-27,Nuclei,,,
CVE-2026-50522,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.21044,CWE-502,Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.,2026-07-14,CISA,cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*,Microsoft,Sharepoint Server
CVE-2026-5073,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01383,CWE-89,"The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'arm_directory_paging_action' AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied 'order' and 'orderby' parameters and the lack of sufficient preparation on the existing SQL query in the `arm_get_directory_members()` function. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",2026-06-02,Nuclei,,,
CVE-2026-50751,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N,0.70099,CWE-287,A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.,2026-06-08,CISA/Nuclei,cpe:2.3:h:checkpoint:quantum_spark_1530:-:*:*:*:*:*:*:*;cpe:2.3:h:checkpoint:quantum_spark_1535:-:*:*:*:*:*:*:*;cpe:2.3:h:checkpoint:quantum_spark_1550:-:*:*:*:*:*:*:*;cpe:2.3:h:checkpoint:quantum_spark_1555:-:*:*:*:*:*:*:*;cpe:2.3:h:checkpoint:quantum_spark_1570:-:*:*:*:*:*:*:*;cpe:2.3:h:checkpoint:quantum_spark_1570r:-:*:*:*:*:*:*:*;cpe:2.3:h:checkpoint:quantum_spark_1575:-:*:*:*:*:*:*:*;cpe:2.3:h:checkpoint:quantum_spark_1575r:-:*:*:*:*:*:*:*;cpe:2.3:h:checkpoint:quantum_spark_1590:-:*:*:*:*:*:*:*;cpe:2.3:h:checkpoint:quantum_spark_1595r:-:*:*:*:*:*:*:*;cpe:2.3:h:checkpoint:quantum_spark_1600:-:*:*:*:*:*:*:*;cpe:2.3:h:checkpoint:quantum_spark_1800:-:*:*:*:*:*:*:*;cpe:2.3:h:checkpoint:quantum_spark_1900:-:*:*:*:*:*:*:*;cpe:2.3:h:checkpoint:quantum_spark_2000:-:*:*:*:*:*:*:*;cpe:2.3:h:checkpoint:quantum_spark_2530:-:*:*:*:*:*:*:*;cpe:2.3:h:checkpoint:quantum_spark_2550:-:*:*:*:*:*:*:*;cpe:2.3:h:checkpoint:quantum_spark_2560:-:*:*:*:*:*:*:*;cpe:2.3:h:checkpoint:quantum_spark_2570:-:*:*:*:*:*:*:*;cpe:2.3:h:checkpoint:quantum_spark_2580:-:*:*:*:*:*:*:*;cpe:2.3:h:checkpoint:quantum_spark_2590:-:*:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_embedded:*:*:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:-:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004508:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004620:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004653:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004721:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004892:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:-:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998001559:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998001562:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002110:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002112:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002133:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002203:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:*:*:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:-:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_101:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_103:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_105:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_10:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_111:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_113:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_115:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_118:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_119:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_120:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_122:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_126:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_127:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_141:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_14:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_24:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_26:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_38:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_41:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_43:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_45:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_53:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_54:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_65:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_70:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_76:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_79:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_84:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_89:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_8:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_90:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_92:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_96:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_98:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r81.20:take_99:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r82.10:-:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r82.10:take_19:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r82.10:take_6:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r82:-:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r82:take_103:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r82:take_10:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r82:take_12:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r82:take_14:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r82:take_18:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r82:take_19:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r82:take_25:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r82:take_33:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r82:take_34:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r82:take_36:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r82:take_39:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r82:take_41:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r82:take_43:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r82:take_44:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r82:take_60:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r82:take_73:*:*:*:*:*:*;cpe:2.3:o:checkpoint:gaia_os:r82:take_91:*:*:*:*:*:*,Checkpoint,Gaia Os
CVE-2026-5281,8.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H,0.05036,CWE-416,Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High),2026-04-01,CISA,cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*;cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*;cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Apple,Macos
CVE-2026-52815,0.0,,0.01553,CWE-200,"Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs has an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint at internal/route/api/v1/org_team.go:8 returns all teams for any organization without requiring authentication. The route group at internal/route/api/v1/api.go:380-385 lacks the reqToken() middleware, and the listTeams() handler performs no authentication check, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller. This vulnerability is fixed in 0.14.3.",2026-06-24,Nuclei,,,
CVE-2026-53787,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04591,CWE-434,"Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows unauthenticated attackers to write arbitrary files to the store's media directory by submitting files of any type or name to the upload endpoint without authentication, session validation, or cart context. Attackers can upload PHP files to achieve remote code execution on servers where the media directory permits PHP execution, or alternatively enable malware hosting, stored cross-site scripting via HTML or SVG uploads, and path traversal to write files outside the intended upload directory.",2026-06-12,Nuclei,,,
CVE-2026-54066,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01892,CWE-22,"SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 (""Path Traversal via Double URL Encoding"") sanitized the /export/ route but the identical root cause remains in the /assets/*path route. In publish mode (anonymous read-only HTTP endpoint, default port 6808), an unauthenticated remote attacker can read arbitrary files inside WorkspaceDir — including conf/conf.json (which contains the AccessAuthCode SHA256 hash, API token, and sync keys), temp/siyuan.db, temp/blocktree.db, and siyuan.log — by double-URL-encoding .. segments. This vulnerability is fixed in 3.7.0.",2026-06-24,Nuclei,,,
CVE-2026-54069,0.0,,0.00607,CWE-346,"SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan Note's kernel HTTP server unconditionally trusts all chrome-extension:// origins, granting RoleAdministrator access to every installed browser extension without any authentication. Combined with the default empty AccessAuthCode on desktop installs, any Chrome/Chromium extension -- including a compromised legitimate extension via supply chain attack -- can make fully authenticated admin API calls to the SiYuan kernel at 127.0.0.1:6806, enabling data exfiltration, stored XSS injection, and configuration tampering. This vulnerability is fixed in 3.7.0.",2026-06-24,Nuclei,,,
CVE-2026-54157,9.0,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H,0.0178,CWE-918,"LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.57, the /webapi/proxy endpoint on app.lobehub.com accepts a URL in the POST body and fetches it server-side without any authentication. An attacker can use this to make arbitrary outbound requests from LobeHub's infrastructure, leak Vercel deployment details, and inject cookies on the lobehub.com domain through reflected Set-Cookie headers. This vulnerability is fixed in 2.1.57.",2026-06-23,Nuclei,,,
CVE-2026-54236,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00796,CWE-532,"vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, the fix for CVE-2026-22778, which introduced a sanitize_message helper that strips object-repr memory addresses from error messages before they reach the client, is incomplete: several response paths echo str(exc) directly to clients without calling sanitize_message. The unsanitized sites include the Anthropic API router in vllm/entrypoints/anthropic/api_router.py (the POST /v1/messages and POST /v1/messages/count_tokens handlers), the Server-Sent Events streaming converter in vllm/entrypoints/anthropic/serving.py, and the realtime speech-to-text WebSocket in vllm/entrypoints/speech_to_text/realtime/connection.py. These paths catch the exception inside the route coroutine and construct the JSONResponse themselves, bypassing the sanitizing global FastAPI exception handler, and WebSocket frames do not traverse that handler chain at all. Using the same primitive as the parent issue, an unauthenticated attacker can send malformed image bytes through the Anthropic Messages API image content parts so that PIL.Image.open raises an UnidentifiedImageError whose message contains the BytesIO object repr, leaking the heap memory address verbatim in the error.message field of the response body. This vulnerability is fixed in 0.23.1rc0.",2026-06-22,Nuclei,cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*,Vllm,Vllm
CVE-2026-54420,8.5,CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H,0.01261,CWE-61,"LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.",2026-06-14,CISA,cpe:2.3:a:litespeedtech:litespeed_cpanel_plugin:*:*:*:*:*:*:*:*;cpe:2.3:a:litespeedtech:litespeed_whm_plugin:*:*:*:*:*:*:*:*,Litespeedtech,Litespeed Cpanel Plugin
CVE-2026-54836,9.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L,0.00789,CWE-89,"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows SQL Injection.

This issue affects YMC Filter: from n/a through 3.11.5.",2026-06-25,Nuclei,,,
CVE-2026-55255,8.4,CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L,0.0056,CWE-639,"Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.",2026-06-23,CISA,cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*,Langflow,Langflow
CVE-2026-55592,3.9,CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N,0.00255,CWE-79,"Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy origin and can read same-origin browser data, interact with the Dashy DOM, and send requests as the victim. This issue is fixed in version 4.3.7.",2026-07-07,Nuclei,,,
CVE-2026-5615,4.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N,0.00773,CWE-79,"A weakness has been identified in givanz Vvvebjs up to 2.0.5. The affected element is an unknown function of the file upload.php of the component File Upload Endpoint. This manipulation of the argument uploadAllowExtensions causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Patch name: 8cac22cff99b8bc701c408aa8e887fa702755336. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.",2026-04-06,Nuclei,,,
CVE-2026-56155,7.8,CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H,0.00379,CWE-1220,Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.,2026-07-14,CISA,cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*;cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*;cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*;cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*,Microsoft,Windows 10 1607
CVE-2026-56164,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.05601,CWE-306,Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.,2026-07-14,CISA,cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*,Microsoft,Sharepoint Server
CVE-2026-56290,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.18707,CWE-434,The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.,2026-06-29,CISA/Nuclei,cpe:2.3:a:joomlack:page_builder_ck:*:*:*:*:*:joomla\!:*:*,Joomlack,Page Builder Ck
CVE-2026-56291,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.08635,CWE-434,The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.,2026-07-09,CISA/Nuclei,cpe:2.3:a:balbooa:forms:*:*:*:*:*:joomla\!:*:*,Balbooa,Forms
CVE-2026-56782,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.03016,CWE-306,"Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when admin_api_key is empty, which is the default configuration. Remote attackers can exfiltrate the entire database including user records, items, and feedback data containing personally identifiable information, or completely overwrite the dataset without authentication.",2026-06-29,Nuclei,,,
CVE-2026-5718,8.1,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,0.04175,CWE-434,"The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.3.9.7. This is due to insufficient file type validation that occurs when custom blacklist types are configured, which replaces the default dangerous extension denylist instead of merging with it, and the wpcf7_antiscript_file_name() sanitization function being bypassed for filenames containing non-ASCII characters. This makes it possible for unauthenticated attackers to upload arbitrary files, such as PHP files, to the server, which can be leveraged to achieve remote code execution. The vulnerability was originally reported by Leonid Semenenko (lsemenenko) and partially patched in version 1.3.9.7. A bypass for the patch was separately discovered and reported by Nguyen Hung (Mitchell).",2026-04-17,Nuclei,,,
CVE-2026-58455,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.0119,CWE-78,"Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands by exploiting a missing exit() after an authentication redirect in loader.php combined with unsanitized input passed to shell_exec() in ajax/compose.php. Attackers can seed the required session flag through the incomplete auth check, then inject arbitrary commands via the composePath POST parameter in the composePull action to achieve full host compromise, facilitated by the standard deployment mounting of the Docker socket.",2026-07-02,Nuclei,,,
CVE-2026-58644,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01465,CWE-502,Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.,2026-07-14,CISA,cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*;cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*,Microsoft,Sharepoint Server
CVE-2026-59801,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01905,CWE-306,"9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under src/app/api/providers/*. Attackers can enumerate, create, modify, or delete provider connections to expose partial credentials, OAuth tokens, and API keys, redirect AI traffic to attacker-controlled servers, or cause complete denial of service by deleting all provider connections.",2026-07-13,Nuclei,,,
CVE-2026-60137,5.9,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N,0.20395,CWE-89,"WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.",2026-07-17,CISA,cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*,Wordpress,Wordpress
CVE-2026-6118,6.3,CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L,0.02304,CWE-74,A vulnerability was determined in AstrBotDevs AstrBot up to 4.22.1. Impacted is the function add_mcp_server of the file astrbot/dashboard/routes/tools.py of the component MCP Endpoint. This manipulation of the argument command causes command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.,2026-04-12,Nuclei,,,
CVE-2026-6203,6.1,CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N,0.00663,CWE-601,"The User Registration & Membership plugin for WordPress is vulnerable to Open Redirect in versions up to and including 5.1.4. This is due to insufficient validation of user-supplied URLs passed via the 'redirect_to_on_logout' GET parameter before redirecting users. The `redirect_to_on_logout` GET parameter is passed directly to WordPress's `wp_redirect()` function instead of the domain-restricted `wp_safe_redirect()`. While `esc_url_raw()` is applied to sanitize malformed URLs, it does not restrict the redirect destination to the local domain, allowing an attacker to craft a specially formed link that redirects users to potentially malicious external URLs after logout, which could be used to facilitate phishing attacks.",2026-04-13,Nuclei,,,
CVE-2026-63030,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.38599,CWE-436,"WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.",2026-07-17,CISA/Nuclei,cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*,Wordpress,Wordpress
CVE-2026-6433,7.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L,0.00753,Missing_Data,"The Custom css-js-php WordPress plugin through 2.0.7 does not properly sanitize user input before using it in a SQL query, and the result is passed to eval(), allowing unauthenticated users to execute arbitrary PHP code on the server.",2026-05-11,Nuclei,,,
CVE-2026-6875,0.0,,0.01081,CWE-94,"ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform.


ServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceNow self-hosted customers and partners.




Further, the vulnerability is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. We are not currently aware of exploitation against ServiceNow instances.




We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.",2026-07-13,Nuclei,,,
CVE-2026-6973,7.2,CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H,0.34454,CWE-20,"An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.",2026-05-07,CISA,cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager_mobile:12.7.0.0:*:*:*:*:*:*:*;cpe:2.3:a:ivanti:endpoint_manager_mobile:12.8.0.0:*:*:*:*:*:*:*,Ivanti,Endpoint Manager Mobile
CVE-2026-7473,5.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N,0.00836,CWE-1023,"On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic.



This issue has been reported as being exploited in the wild.",2026-06-05,CISA,cpe:2.3:h:arista:7020sr-24c2:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7020sr-32c2:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7020srg-24c2:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7020tr-48:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7020tra-48:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280cr-48:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280cr2-60:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280cr2a-30:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280cr2a-60:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280cr2k-30:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280cr2k-60:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280cr2m-30:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280cr3-32d4:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280cr3-32p4:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280cr3-36s:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280cr3-96:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280cr3a-24d12:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280cr3a-48d6:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280cr3a-72:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280cr3ak-24d12:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280cr3ak-48d6:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280cr3ak-72:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280cr3am-24d12:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280cr3am-48d6:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280cr3am-72:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280cr3mk-32d4s:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280cr3mk-32p4s:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280dr3-24:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280dr3a-36:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280dr3a-54:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280dr3ak-36:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280dr3ak-54:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280dr3am-36:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280dr3am-54:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280pr3-24:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280qr-c36-m:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280qr-c36:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280qr-c72:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280qra-c36s:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280qra-c36sm:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280sr-48c6:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280sr2-48yc6-m:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280sr2-48yc6:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280sr2a-48yc6-m:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280sr2a-48yc6:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280sr2k-48c6-m:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280sr3-40yc6:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280sr3-48yc8:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280sr3m-48yc8:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280sra-48c6-m:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280sra-48c6:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280sram-48c6:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280srm-40cx2:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280tr-48c6:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280tr3-40c6:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280tra-48c6-m:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7280tra-48c6:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7289r3a-sc:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7289r3ak-sc:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7289r3am-sc:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7500r-36cq-lc:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7500r-36q-lc:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7500r-48s2cq-lc:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7500r-8cfpx-lc:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7500r2-36cq-lc:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7500r2a-36cq-lc:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7500r2ak-36cq-lc:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7500r2ak-48ycq-lc:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7500r2am-36cq-lc:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7500r2m-36cq-lc:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7500r3-24d:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7500r3-24p:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7500r3-36cq:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7500r3k-36cq:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7500r3k-48y4d:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7500rm-36cq-lc:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7504r-fm:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7504r3:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7508r-fm:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7508r3:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7512r-fm:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7512r3:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7516-sup2:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7516n-ch:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7516r-fm:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7800r3-36d:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7800r3-48cq:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7800r3a-36d:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7800r3a-36dm:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7800r3a-36p:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7800r3a-36pm:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7800r3ak-36dm:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7800r3ak-36pm:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7800r3k-48cq:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7800r3k-48cqms:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7800r3k-72y:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7804r3:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7808r3:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7812r3:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7816lr3:-:*:*:*:*:*:*:*;cpe:2.3:h:arista:7816r3:-:*:*:*:*:*:*:*;cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*,Arista,Eos
CVE-2026-7798,5.4,CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N,0.00645,CWE-918,"The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.9.87 via the 'SubscribeURL' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Exploitation requires that the SES bounce handling key ('_fc_bounce_key') has never been stored (i.e., the site is in its default/unconfigured state with respect to SES bounce handling) as visiting the bounce configuration page auto-generates and stores a random key that causes the authentication check to evaluate correctly and reject unauthenticated requests.",2026-05-22,Nuclei,,,
CVE-2026-8037,9.6,CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H,0.4343,CWE-77,OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints,2026-06-04,Nuclei,cpe:2.3:a:progress:connection_manager_for_objectscale:*:*:*:*:*:*:*:*;cpe:2.3:a:progress:ecs_connection_manager:*:*:*:*:*:*:*:*;cpe:2.3:o:progress:loadmaster:*:*:*:*:*:*:*:*,Progress,Loadmaster
CVE-2026-8054,0.0,,0.01584,CWE-89,"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll) in dotCMS Core 25.11.04-1 through 26.04.28-02 allows remote unauthenticated attackers to read, modify, or destroy arbitrary database content. The endpoints did not enforce authentication and accepted unsanitized input used in dynamically constructed SQL. The fix in dotCMS Core 26.04.28-03 requires an authenticated backend user with the publishing-queue portlet permission. LTS releases are not affected as the vulnerable code path was never backported.",2026-05-27,Nuclei,,,
CVE-2026-8181,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.14608,CWE-287,"The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Authentication Bypass in versions 3.4.0 to 3.4.1.1. This is due to incorrect return-value handling in the `is_mainwp_authenticated()` function when validating application passwords from the Authorization header. This makes it possible for unauthenticated attackers, with knowledge of an administrator username, to impersonate that administrator for the duration of the request by supplying any random Basic Authentication password achieving privilege escalation.",2026-05-14,Nuclei,,,
CVE-2026-8383,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00424,CWE-862,"The LearnPress  WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing unauthenticated visitors to retrieve each returned user's roles, full capabilities map, extra capabilities, locale, and registration date via a crafted request",2026-06-17,Nuclei,,,
CVE-2026-8385,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00192,CWE-200,"The WP Go Maps  WordPress plugin before 10.0.10 does not properly enforce the marker approval filter on the admin-ajax fallback for its datatables route, allowing unauthenticated visitors to retrieve marker records that the site owner has not approved for public display, including their title, category, address and description fields.",2026-06-15,Nuclei,,,
CVE-2026-8386,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,0.00489,Missing_Data,"The WP Go Maps  WordPress plugin before 10.0.10 does not perform any approval-state filtering on its public single-marker REST endpoint, allowing unauthenticated users to retrieve marker records that an administrator has not yet approved for public display, including any PII placed in the address and description fields and the marker's geographic coordinates.",2026-06-15,Nuclei,,,
CVE-2026-8398,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.01456,CWE-506,"A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.",2026-05-15,CISA,cpe:2.3:a:disc-soft:daemon_tools:12.5.1:*:*:*:lite:*:*:*;cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*,Microsoft,Windows
CVE-2026-8679,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.01508,CWE-639,"The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the handle_playlist_endpoint() function (hooked to template_redirect) accepting a user-controlled playlist ID via the audioigniter_playlist_id query var or the /audioigniter/playlist/{id}/ rewrite rule and returning playlist track data without performing any authentication, capability, or post_status check — only the post_type is validated. This makes it possible for unauthenticated attackers to view track metadata (titles, artists, audio URLs, buy links, download URLs, and cover images) of any playlist on the site, including those in draft, private, pending, or trash status.",2026-05-22,Nuclei,,,
CVE-2026-8732,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.19272,CWE-306,"The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, rendering the check ineffective as an access control mechanism. This makes it possible for unauthenticated attackers to invoke the wpgmp_temp_access_support handler with check_temp=false, which unconditionally creates a new WordPress user with the hardcoded role of administrator via wp_insert_user() and returns a magic login URL that, when visited, calls wp_set_auth_cookie() to fully authenticate the attacker as the newly created administrator, resulting in complete site takeover.",2026-05-29,Nuclei,,,
CVE-2026-8839,5.3,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N,0.00813,CWE-639,"The MapPress Maps for WordPress plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 2.96.6. This is due to missing ownership verification in the REST API routes registered via `Mappress_Api::rest_api_init()`, where the GET `/wp-json/mapp/v1/maps/{mapid}` endpoint uses `'permission_callback' => '__return_true'` and the write endpoints (POST update, DELETE, PATCH mutate, POST clone, POST empty_trash) only check the generic `edit_posts` capability without confirming that the requester owns the targeted map — a gap that is not compensated at the model layer, as `Mappress_Map::get()`, `save()`, `delete()`, `mutate()`, and `empty_trash()` all operate on any caller-supplied map ID without an ownership check. This makes it possible for unauthenticated attackers to read sensitive map data — including POI titles, addresses, coordinates, and body content — for any map on the site by enumerating map IDs, and for authenticated attackers with Contributor-level access and above to modify, delete, trash/restore, or clone any map regardless of its author.",2026-06-06,Nuclei,,,
CVE-2026-9082,9.8,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H,0.84631,CWE-89,"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection.

This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.",2026-05-20,CISA/Nuclei,cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*,Drupal,Drupal
CVE-2026-9282,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02168,CWE-22,"The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires enabling manual minify mode and supplying a manual-format minify filename so that the hash is empty and the f_array[] entries are not overwritten before reaching setupSources().",2026-07-11,Nuclei,,,
CVE-2026-9290,7.5,CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N,0.02403,CWE-22,"The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the (profile template scope) function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.",2026-06-06,Nuclei,,,