Show filters
284 topics marked with the following tags:
Displaying 1-10 of 284
Sort by:
Attacker Value
Moderate

CVE-2020-3158

Disclosure Date: February 20, 2020 (last updated July 24, 2020)
A vulnerability in the High Availability (HA) service of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to access a sensitive part of the system with a high-privileged account. The vulnerability is due to a system account that has a default and static password and is not under the control of the system administrator. An attacker could exploit this vulnerability by using this default account to connect to the affected system. A successful exploit could allow the attacker to obtain read and write access to system data, including the configuration of an affected device. The attacker would gain access to a sensitive portion of the system, but the attacker would not have full administrative rights to control the device.
Attacker Value
Moderate

CVE-2019-7548

Disclosure Date: February 06, 2019 (last updated June 05, 2020)
SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.
Attacker Value
Moderate

CVE-2020-10245

Disclosure Date: March 26, 2020 (last updated June 05, 2020)
CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow.
Attacker Value
High

CVE-2016-10225

Disclosure Date: March 27, 2017 (last updated April 22, 2021)
The sunxi-debug driver in Allwinner 3.4 legacy kernel for H3, A83T and H8 devices allows local users to gain root privileges by sending "rootmydevice" to /proc/sunxi_debug/sunxi_debug.
Attacker Value
Low

CVE-2020-14942

Disclosure Date: June 21, 2020 (last updated June 27, 2020)
Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py.
Attacker Value
Unknown

CVE-2021-34787

Disclosure Date: October 27, 2021 (last updated October 30, 2021)
A vulnerability in the identity-based firewall (IDFW) rule processing feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass security protections. This vulnerability is due to improper handling of network requests by affected devices configured to use object group search. An attacker could exploit this vulnerability by sending a specially crafted network request to an affected device. A successful exploit could allow the attacker to bypass access control list (ACL) rules on the device, bypass security protections, and send network traffic to unauthorized hosts.
Attacker Value
Moderate

CVE-2020-10204

Disclosure Date: April 01, 2020 (last updated September 17, 2020)
Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.
Attacker Value
Very High

CVE-2018-8302

Disclosure Date: August 15, 2018 (last updated July 24, 2020)
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka "Microsoft Exchange Memory Corruption Vulnerability." This affects Microsoft Exchange Server.
Attacker Value
Very Low

CVE-2019-11773

Disclosure Date: September 12, 2019 (last updated October 29, 2021)
Prior to 0.1, AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection and privilege elevation by local users.
Attacker Value
Very Low

CVE-2018-1890

Disclosure Date: March 11, 2019 (last updated July 24, 2020)
IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 152081.