Skip to content
COOEY
LIVE FEED
1828 events · 4 sources · newest first
Events in view
1828
all sources
Critical
1828
severity
Active sources
4
collectors
Last sync
2026-08-27 00:00
UTC
All data Vulns · 3595Regulatory · 144News · 426 LIVE · UPDATES ON COLLECT
All sources NVD CVE · 1777CISA KEV · 1683CISA advisory · 116DC3 DCISE · 19
Any severity Critical High ⊙ SUBSCRIBE (RSS)
2023-08-16 NVD CVE
CVE-2023-38894: A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remo CRITICAL
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function.
2023-08-16 NVD CVE
CVE-2020-26037: Directory Traversal vulnerability in Server functionalty in Even Balance Punkbus CRITICAL
Directory Traversal vulnerability in Server functionalty in Even Balance Punkbuster version 1.902 before 1.905 allows remote attackers to execute arbitrary code.
2023-08-14 NVD CVE
CVE-2023-30187: An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 CRITICAL
An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.
2023-08-14 NVD CVE
CVE-2023-30186: A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3 CRITICAL
A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.
2023-08-14 NVD CVE
CVE-2023-37847: novel-plus v3.6.2 was discovered to contain a SQL injection vulnerability. CRITICAL
novel-plus v3.6.2 was discovered to contain a SQL injection vulnerability.
2023-08-10 NVD CVE
CVE-2023-39805: iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the whe CRITICAL
iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the where parameter at admincp.php.
2023-08-10 NVD CVE
CVE-2023-39806: iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the bak CRITICAL
iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the bakupdata function.
2023-08-09 NVD CVE
CVE-2023-33468: KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1.13 CRITICAL
KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1.1326 exhibit a vulnerability that enables remote manipulation of the device. This vulnerability involves extracting the connection...
2023-08-09 NVD CVE
CVE-2023-39004: Insecure permissions in the configuration directory (/conf/) of OPNsense Communi CRITICAL
Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed root password)...
2023-08-05 NVD CVE
CVE-2023-36095: An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arb CRITICAL
An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include from_math_prompt and from_colored_object_prompt.
2023-08-03 NVD CVE
CVE-2023-38951: ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authentica CRITICAL
ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to /base/sftpsetting/ endpoints that abuse a...
2023-08-03 NVD CVE
CVE-2023-36082: An isssue in GatesAIr Flexiva FM Transmitter/Exiter Fax 150W allows a remote att CRITICAL
An isssue in GatesAIr Flexiva FM Transmitter/Exiter Fax 150W allows a remote attacker to gain privileges via the LDAP and SMTP credentials.
2023-08-03 NVD CVE
CVE-2023-38954: ZKTeco BioAccess IVS v3.3.1 was discovered to contain a SQL injection vulnerabil CRITICAL
ZKTeco BioAccess IVS v3.3.1 was discovered to contain a SQL injection vulnerability.
2023-08-03 NVD CVE
CVE-2023-37679: A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 a CRITICAL
A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server.
2023-08-01 NVD CVE
CVE-2023-34960: A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11 CRITICAL
A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.
2023-07-31 NVD CVE
CVE-2023-34842: Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote att CRITICAL
Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote attackers to run arbitrary code via crafted POST request to /dede/tpl.php.
2023-07-31 NVD CVE
CVE-2023-37647: SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id p CRITICAL
SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id parameter at /Ant_Suxin.php.
2023-07-25 CISA KEV
Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability CRITICAL ◈ 2 sources · orig. NVD CVE
Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API...
2023-07-25 NVD CVE
CVE-2023-35078: An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users CRITICAL ◈ 2 sources · orig. NVD CVE
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.
2023-07-19 NVD CVE
CVE-2023-3519: Unauthenticated remote code execution CRITICAL ◈ 2 sources · orig. NVD CVE
Unauthenticated remote code execution
2023-07-19 CISA KEV
Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability CRITICAL ◈ 2 sources · orig. NVD CVE
Citrix NetScaler ADC and NetScaler Gateway contains a code injection vulnerability that allows for unauthenticated remote code execution.
2023-07-17 CISA KEV
Microsoft Windows Search Remote Code Execution Vulnerability CRITICAL
Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution.
2023-07-12 NVD CVE
CVE-2023-33668: DigiExam up to v14.0.2 lacks integrity checks for native modules, allowing attac CRITICAL
DigiExam up to v14.0.2 lacks integrity checks for native modules, allowing attackers to access PII and takeover accounts on shared computers.
2023-07-11 CISA KEV
Netwrix Auditor Insecure Object Deserialization Vulnerability CRITICAL
Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\SYSTEM user....
2023-06-19 NVD CVE
CVE-2023-29534: Different techniques existed to obscure the fullscreen notification in Firefox a CRITICAL
Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. These could have led to potential user confusion and spoofing attacks. *This bug only affects Firefox and Focus...
2023-06-16 NVD CVE
CVE-2023-34832: TP-Link Archer AX10(EU)_V1.2_230220 was discovered to contain a buffer overflow CRITICAL
TP-Link Archer AX10(EU)_V1.2_230220 was discovered to contain a buffer overflow via the function FUN_131e8 - 0x132B4.
2023-06-14 NVD CVE
CVE-2023-34752: bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the CRITICAL
bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/index.php?mode=settings&page=lang&action=edit.
2023-06-13 NVD CVE
CVE-2023-27997: A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 an CRITICAL ◈ 2 sources · orig. NVD CVE
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version...
2023-06-13 NVD CVE
CVE-2023-31541: A unrestricted file upload vulnerability was discovered in the ‘Browse and uploa CRITICAL
A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be uploaded to the server.
2023-06-13 NVD CVE
CVE-2023-34944: An arbitrary file upload vulnerability in the /fileUpload.lib.php component of C CRITICAL
An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via uploading a crafted SVG file.
2023-06-13 CISA KEV
Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability CRITICAL ◈ 2 sources · orig. NVD CVE
Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.
2023-06-06 NVD CVE
CVE-2023-33532: There is a command injection vulnerability in the Netgear R6250 router with Firm CRITICAL
There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48. If an attacker gains web management privileges, they can inject commands into the post request parameters,...
2023-06-06 NVD CVE
CVE-2023-31569: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command inje CRITICAL
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection via the setWanCfg function.
2023-06-02 CISA KEV
Progress MOVEit Transfer SQL Injection Vulnerability CRITICAL
Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used...
2023-05-18 NVD CVE
CVE-2023-31729: TOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command Injection via /cgi-bin/cs CRITICAL
TOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command Injection via /cgi-bin/cstecgi.cgi.
2023-05-12 NVD CVE
CVE-2023-27823: An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the CRITICAL
An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials.
2023-05-11 NVD CVE
CVE-2023-29863: Medical Systems Co. Medisys Weblab Products v19.4.03 was discovered to contain a CRITICAL
Medical Systems Co. Medisys Weblab Products v19.4.03 was discovered to contain a SQL injection vulnerability via the tem:statement parameter in the WSDL files.
2023-05-08 NVD CVE
CVE-2023-30185: CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerabil CRITICAL
CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.php.
2023-05-05 NVD CVE
CVE-2023-30242: NS-ASG v6.3 was discovered to contain a SQL injection vulnerability via the comp CRITICAL
NS-ASG v6.3 was discovered to contain a SQL injection vulnerability via the component /admin/add_ikev2.php.
2023-05-04 NVD CVE
CVE-2023-23059: An issue was discovered in GeoVision GV-Edge Recording Manager 2.2.3.0 for windo CRITICAL
An issue was discovered in GeoVision GV-Edge Recording Manager 2.2.3.0 for windows, which contains improper permissions within the default installation and allows attackers to execute arbitrary code and gain...
◀ PREV PAGE 35 / 46 NEXT ▶