Show filters
434 topics marked with the following tags:
Displaying 1-10 of 434
Sort by:
Attacker Value
Moderate
CVE-2019-7548
Disclosure Date: February 06, 2019 (last updated October 06, 2023)
SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.
0
Attacker Value
Moderate
CVE-2023-20178
Disclosure Date: June 07, 2023 (last updated October 08, 2023)
A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM. The client update process is executed after a successful VPN connection is established.
This vulnerability exists because improper permissions are assigned to a temporary directory that is created during the update process. An attacker could exploit this vulnerability by abusing a specific function of the Windows installer process. A successful exploit could allow the attacker to execute code with SYSTEM privileges.
2
Attacker Value
Moderate
CVE-2020-3158
Disclosure Date: February 20, 2020 (last updated October 06, 2023)
A vulnerability in the High Availability (HA) service of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to access a sensitive part of the system with a high-privileged account. The vulnerability is due to a system account that has a default and static password and is not under the control of the system administrator. An attacker could exploit this vulnerability by using this default account to connect to the affected system. A successful exploit could allow the attacker to obtain read and write access to system data, including the configuration of an affected device. The attacker would gain access to a sensitive portion of the system, but the attacker would not have full administrative rights to control the device.
0
Attacker Value
Very Low
CVE-2019-11773
Disclosure Date: September 12, 2019 (last updated October 06, 2023)
Prior to 0.1, AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection and privilege elevation by local users.
1
Attacker Value
Moderate
CVE-2020-10245
Disclosure Date: March 26, 2020 (last updated October 06, 2023)
CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow.
3
Attacker Value
Very Low
CVE-2019-11771
Disclosure Date: July 17, 2019 (last updated October 06, 2023)
AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users.
1
Attacker Value
High
CVE-2016-10225
Disclosure Date: March 27, 2017 (last updated October 05, 2023)
The sunxi-debug driver in Allwinner 3.4 legacy kernel for H3, A83T and H8 devices allows local users to gain root privileges by sending "rootmydevice" to /proc/sunxi_debug/sunxi_debug.
0
Attacker Value
Very High
CVE-2018-8302
Disclosure Date: August 15, 2018 (last updated October 06, 2023)
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka "Microsoft Exchange Memory Corruption Vulnerability." This affects Microsoft Exchange Server.
0
Attacker Value
Moderate
CVE-2020-10204
Disclosure Date: April 01, 2020 (last updated October 06, 2023)
Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.
0
Attacker Value
Very High
CVE-2022-26809
Disclosure Date: April 15, 2022 (last updated October 07, 2023)
Remote Procedure Call Runtime Remote Code Execution Vulnerability
3