Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 11,766

Export CSV
CVE-2023-22779

Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI Protocol

There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 9.8 Critical EPSS 2.1% KEV · Not listed
Vendors
Hp
Products
Arubaos Instantos
CVE-2022-36330

Buffer Overflow Vulnerability in Western Digital My Cloud Home and ibi devices

A buffer overflow vulnerability was discovered on firmware version validation that could lead to an unauthenticated remote code execution in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices. An attacker would require exploitation of another vulnerability to raise their privileges in order to exploit this buffer overflow vulnerability. This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191. 

CVSS 3.1 · 1.9 Low EPSS < 1% KEV · Not listed
Vendors
Westerndigital
Products
My Cloud Home My Cloud Home Duo My Cloud Home Duo Firmware and 3 more
CVE-2023-31587

Tenda AC5 router V15.03.06.28 was discovered to contain a remote code execution (RCE) vulnerability via the Mac parameter at ip/goform/WriteFacMac.

CVSS 3.1 · 9.8 Critical EPSS 2.0% KEV · Not listed
Vendors
Tenda
Products
Ac5 Ac5 Firmware
CVE-2023-30353

Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows unauthenticated remote code execution via an XML document.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed
Vendors
Tenda
Products
Cp3 Cp3 Firmware
CVE-2022-47129

PHPOK v6.3 was discovered to contain a remote code execution (RCE) vulnerability.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed
Vendors
Phpok
Products
Phpok
CVE-2022-4774

Bit Form < 1.9 - RCE via Unauthenticated Arbitrary File Upload

The Bit Form WordPress plugin before 1.9 does not validate the file types uploaded via it's file upload form field, allowing unauthenticated users to upload arbitrary files types such as PHP or HTML files to the server, leading to Remote Code Execution.

CVSS 3.1 · 9.8 Critical EPSS 1.8% KEV · Not listed
Vendors
Bitapps
Products
Bit Form
CVE-2024-28135

PHOENIX CONTACT: command injection vulnerability in the API of the CHARX Series

A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the user-app user due to improper input validation. The confidentiality is partly affected.

CVSS 3.1 · 5 Medium EPSS 1.3% KEV · Not listed
Vendors
Phoenixcontact
Products
Charx Sec-3000 Charx Sec-3000 Firmware Charx Sec-3050 and 9 more
CVE-2023-32073

AVideo command injection vulnerability

WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-30854, which affects WWBN AVideo up to version 12.3. This issue is patched in commit 1df4af01f80d56ff2c4c43b89d0bac151e7fb6e3.

CVSS 3.1 · 8.8 High EPSS 6.5% KEV · Not listed
Vendors
Wwbn
Products
Avideo
CVE-2024-1882

Server-side resource injection in PaperCut NG/MF

This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server.

CVSS 3.1 · 7.2 High EPSS 1.4% KEV · Not listed
Vendors
Apple Linux Microsoft and 1 more
Products
Macos Linux Kernel Windows and 2 more
CVE-2024-1654

Unauthorized write operations in PaperCut NG/MF

This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed
Vendors
Apple Linux Microsoft and 1 more
Products
Macos Linux Kernel Windows and 2 more
CVE-2023-31857

Sourcecodester Online Computer and Laptop Store 1.0 allows unrestricted file upload and can lead to remote code execution. The vulnerability path is /classes/Users.php?f=save.

CVSS 3.1 · 9.8 Critical EPSS 1.5% KEV · Not listed
Vendors
Oretnom23
Products
Online Computer And Laptop Store