Show filters
688 topics marked with the following tags:
Displaying 41-50 of 688
Sort by:
Attacker Value
Very Low
CVE-2020-14932
Disclosure Date: June 20, 2020 (last updated October 06, 2023)
compose.php in SquirrelMail 1.4.22 calls unserialize for the $mailtodata value, which originates from an HTTP GET request. This is related to mailto.php.
0
Attacker Value
Very High
CVE-2021-37928
Disclosure Date: October 07, 2021 (last updated October 07, 2023)
Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
1
Attacker Value
Moderate
CVE-2019-1436
Disclosure Date: November 12, 2019 (last updated October 06, 2023)
An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1440.
0
Attacker Value
Very High
CVE-2017-15889
Disclosure Date: December 04, 2017 (last updated October 05, 2023)
Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authenticated users to execute arbitrary commands via disk field.
0
Attacker Value
Very High
CVE-2020-26352
Disclosure Date: December 02, 2022 (last updated November 08, 2023)
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
1
Attacker Value
High
CVE-2022-46689
Disclosure Date: December 15, 2022 (last updated October 08, 2023)
A race condition was addressed with additional validation. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. An app may be able to execute arbitrary code with kernel privileges.
1
Attacker Value
Moderate
CVE-2021-22652
Disclosure Date: February 11, 2021 (last updated October 07, 2023)
Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attacker to change the configuration and obtain code execution.
0
Attacker Value
Very High
CVE-2020-11108
Disclosure Date: May 11, 2020 (last updated October 06, 2023)
The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abused for Remote Code Execution by writing to a PHP file in the web directory. (Also, it can be used in conjunction with the sudo rule for the www-data user to escalate privileges to root.) The code error is in gravity_DownloadBlocklistFromUrl in gravity.sh.
1
Attacker Value
Very High
CVE-2020-10224
Disclosure Date: March 08, 2020 (last updated November 14, 2023)
An unauthenticated file upload vulnerability has been identified in admin_add.php in PHPGurukul Online Book Store 1.0. The vulnerability could be exploited by an unauthenticated remote attacker to upload content to the server, including PHP files, which could result in command execution.
0
Attacker Value
Very High
CVE-2013-3018
Disclosure Date: May 24, 2018 (last updated October 06, 2023)
The AXIS webapp in deploy-tomcat/axis in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2 and 7.2.0 through 7.2.1.4 allows remote attackers to obtain sensitive configuration information via a direct request, as demonstrated by happyaxis.jsp. IBM X-Force ID: 84354.
0
