CyberSigur / Security Intelligence
Browse CISA's Known Exploited Vulnerabilities catalog. Search by CVE, vendor, or product. Information is published by the US Cybersecurity and Infrastructure Security Agency.
1,766 vulnerabilities · Page 72 of 89
Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. Exploitation can allow for code execution as root.
Apply updates per vendor instructions.
SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution.
Apply updates per vendor instructions.
Apple IOMobileFrameBuffer contains a memory corruption vulnerability which can allow a malicious application to execute arbitrary code with kernel privileges.
Apply updates per vendor instructions.
ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS).
Apply updates per vendor instructions.
The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.
Apply updates per vendor instructions.
Microsoft Windows Win32k contains a vulnerability that allows an attacker to escalate privileges.
Apply updates per vendor instructions.
SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization.
Apply updates per vendor instructions.
A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.
Apply updates per vendor instructions.
Improper sanitization in the extension file names is present in Drupal core.
Apply updates per vendor instructions.
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.
Apply updates per vendor instructions.
Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.
Apply updates per vendor instructions.
In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote.
Apply updates per vendor instructions.
Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.
Apply updates per vendor instructions.
The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.
Apply updates per vendor instructions.
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
Apply updates per vendor instructions.
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
Apply updates per vendor instructions.
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
Apply updates per vendor instructions.
In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.
Apply updates per vendor instructions.
Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.
Apply updates per vendor instructions.
Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
Apply updates per vendor instructions.