LIVE FEED
3620 events · 4 sources · newest first
Events in view
3620
all sources
Critical
1842
severity
Active sources
4
collectors
Last sync
2026-08-28 00:00
UTC
2023-02-13
NVD CVE
CVE-2023-24188: ureport v2.2.9 was discovered to contain a directory traversal vulnerability via
CRITICAL
ureport v2.2.9 was discovered to contain a directory traversal vulnerability via the deletion function which allows for arbitrary files to be deleted.
2023-02-10
CISA KEV
Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.
2023-02-10
CISA KEV
TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.
2023-02-10
CISA KEV
Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service (DoS).
2023-02-02
CISA KEV
Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.
2023-02-02
CISA KEV
Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.
2023-02-01
NVD CVE
CVE-2022-47769: An arbitrary file write vulnerability in Serenissima Informatica Fast Checkin v1
CRITICAL
An arbitrary file write vulnerability in Serenissima Informatica Fast Checkin v1.0 allows unauthenticated attackers to upload malicious files in the web root of the application to gain access to the server via the web shell.
2023-02-01
NVD CVE
CVE-2022-47770: Serenissima Informatica Fast Checkin version v1.0 is vulnerable to Unauthenticat
CRITICAL
Serenissima Informatica Fast Checkin version v1.0 is vulnerable to Unauthenticated SQL Injection.
2023-02-01
NVD CVE
CVE-2022-47003: A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows
CRITICAL
A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a crafted web request.
2023-01-30
NVD CVE
CVE-2022-23334: The Robot application in Ip-label Newtest before v8.5R0 was discovered to use we
CRITICAL
The Robot application in Ip-label Newtest before v8.5R0 was discovered to use weak signature checks on executed binaries, allowing attackers to have write access and escalate privileges via replacing NEWTESTREMOTEMANAGER.EXE.
2023-01-26
NVD CVE
CVE-2020-22452: SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.
CRITICAL
SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the tbl_storage_engine or tbl_collation parameters to tbl_create.php.
2023-01-26
CISA KEV
Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability
CRITICAL
◈ 2 sources · orig. NVD CVE
Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.
2023-01-23
CISA KEV
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
CRITICAL
◈ 2 sources · orig. NVD CVE
Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.
2023-01-18
NVD CVE
CVE-2022-47966: Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through
CRITICAL
◈ 2 sources · orig. NVD CVE
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT...
2023-01-17
CISA KEV
CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.
2023-01-10
CISA KEV
Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation.
2023-01-10
CISA KEV
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.
2022-12-29
CISA KEV
TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.
2022-12-29
CISA KEV
TIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system.
2022-12-22
NVD CVE
CVE-2022-26486: An unexpected message in the WebGPU IPC framework could lead to a use-after-free
CRITICAL
◈ 2 sources · orig. NVD CVE
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox <...
2022-12-19
NVD CVE
CVE-2022-40434: Softr v2.0 was discovered to be vulnerable to HTML injection via the Name field
CRITICAL
Softr v2.0 was discovered to be vulnerable to HTML injection via the Name field of the Account page.
2022-12-14
CISA KEV
Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution.
2022-12-14
NVD CVE
CVE-2022-31358: A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environm
CRITICAL
A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbitrary web scripts or HTML via non-existent endpoints under path /api2/html/.
2022-12-13
CISA KEV
Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.
2022-12-13
CISA KEV
Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.
2022-12-13
CISA KEV
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading...
2022-12-13
CISA KEV
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading...
2022-12-13
CISA KEV
Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.
2022-12-05
CISA KEV
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers...
2022-12-02
NVD CVE
CVE-2022-44291: webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the
CRITICAL
webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php.
2022-12-02
NVD CVE
CVE-2022-44290: webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the
CRITICAL
webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in deleteapprovalstages.php.
2022-12-02
NVD CVE
CVE-2022-44945: Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via t
CRITICAL
Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the heading_field_id parameter.
2022-11-28
CISA KEV
Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This...
2022-11-28
CISA KEV
Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.
2022-11-25
NVD CVE
CVE-2022-45207: Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via th
CRITICAL
Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component updateNullByEmptyString.
2022-11-25
NVD CVE
CVE-2022-37720: Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting (XSS). W
CRITICAL
Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting (XSS). When a low privileged user such as an author or publisher, injects a crafted html and javascript payload in a blog post, leading to full...
2022-11-25
NVD CVE
CVE-2022-37721: PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low priv
CRITICAL
PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged user such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or...
2022-11-25
NVD CVE
CVE-2022-45206: Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via th
CRITICAL
Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/duplicate/check.
2022-11-22
NVD CVE
CVE-2022-36180: Fusiondirectory 1.3 is vulnerable to Cross Site Scripting (XSS) via /fusiondirec
CRITICAL
Fusiondirectory 1.3 is vulnerable to Cross Site Scripting (XSS) via /fusiondirectory/index.php?message=[injection], /fusiondirectory/index.php?message=invalidparameter&plug={Injection],...
2022-11-22
NVD CVE
CVE-2022-40842: ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Server-side req
CRITICAL
ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Server-side request forgery (SSRF) via rotateimg.php.