Show filters
2,133 Total Results
Displaying 1-10 of 2,133
Sort by:
Attacker Value
Very High
CVE-2022-26318
Disclosure Date: March 04, 2022 (last updated October 07, 2023)
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.
5
Attacker Value
High
CVE-2022-2294
Disclosure Date: July 28, 2022 (last updated November 08, 2023)
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
5
Attacker Value
Moderate
CVE-2021-39609
Disclosure Date: August 23, 2021 (last updated November 28, 2024)
Cross Site Scripting (XSS) vulnerability exiss in FlatCore-CMS 2.0.7 via the upload image function.
3
Attacker Value
Very High
CVE-2023-41892
Disclosure Date: September 13, 2023 (last updated October 08, 2023)
Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in Craft CMS 4.4.15.
3
Attacker Value
Very High
CVE-2022-31791
Disclosure Date: September 06, 2022 (last updated October 08, 2023)
WatchGuard Firebox and XTM appliances allow a local attacker (that has already obtained shell access) to elevate their privileges and execute code with root permissions. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4.
3
Attacker Value
High
CVE-2022-26352
Disclosure Date: July 17, 2022 (last updated October 07, 2023)
An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.
3
Attacker Value
High
CVE-2020-9757
Disclosure Date: March 04, 2020 (last updated November 27, 2024)
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.
1
Attacker Value
Unknown
CVE-2024-40395
Disclosure Date: August 27, 2024 (last updated August 31, 2024)
An Insecure Direct Object Reference (IDOR) in PTC ThingWorx v9.5.0 allows attackers to view sensitive information, including PII, regardless of access level.
1
Attacker Value
Unknown
CVE-2023-44487
Disclosure Date: October 10, 2023 (last updated June 28, 2024)
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
1
Attacker Value
Unknown
CVE-2018-20092
Disclosure Date: December 17, 2018 (last updated November 27, 2024)
PTC ThingWorx Platform through 8.3.0 is vulnerable to a directory traversal attack on ZIP files via a POST request.
1
