Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (2942 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2014-7863 1 Zohocorp 3 Manageengine Applications Manager, Manageengine It360, Manageengine Opmanager 2024-11-21 7.5 High
The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to (1) read arbitrary files via the fileName parameter in a copyfile operation or (2) obtain sensitive information via a directory listing in a listdirectory operation to servlet/FailOverHelperServlet.
CVE-2014-7862 1 Zohocorp 1 Desktop Central 2024-11-21 N/A
The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action.
CVE-2014-7236 1 Twiki 1 Twiki 2024-11-21 9.1 Critical
Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary Perl code via the debugenableplugins parameter to do/view/Main/WebHome.
CVE-2014-6039 1 Zohocorp 1 Manageengine Eventlog Analyzer 2024-11-21 7.5 High
ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed version 10 Build 10000.
CVE-2014-6038 1 Zohocorp 1 Manageengine Eventlog Analyzer 2024-11-21 7.5 High
Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability. Fixed in EventLog Analyzer 10.0 Build 10000.
CVE-2014-3206 1 Seagate 4 Blackarmor Nas 110, Blackarmor Nas 110 Firmware, Blackarmor Nas 220 and 1 more 2024-11-21 N/A
Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or the auth_name parameter to localhost/backupmgmt/pre_connect_check.php.
CVE-2013-4211 1 Openx 1 Openx 2024-11-21 9.8 Critical
A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, which could let a remote malicious user execute arbitrary PHP code
CVE-2013-3628 1 Zabbix 1 Zabbix 2024-11-21 8.8 High
Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability
CVE-2013-3214 1 Vtiger 1 Vtiger Crm 2024-11-21 9.8 Critical
vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'.
CVE-2013-2010 2 Automattic, Boldgrid 2 Wp Super Cache, W3 Total Cache 2024-11-21 9.8 Critical
WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability
CVE-2013-1599 1 Dlink 34 Dcs-1100, Dcs-1100 Firmware, Dcs-1100l and 31 more 2024-11-21 9.8 Critical
A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100L/1130L 1.04, DCS-1100/1130 1.03, DCS-1100/1130 1.04_US, DCS-2102/2121 1.05_RU, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.00, DCS-7410 1.00, DCS-7510 1.00, and WCS-1100 1.02, which could let a remote malicious user execute arbitrary commands through the camera’s web interface.
CVE-2013-1391 5 Capturecctv, Hachi, Huntcctv and 2 more 40 Cdr 0410ve, Cdr 0410ve Firmware, Cdr 0820vde and 37 more 2024-11-21 7.5 High
Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR systems allows a remote attacker to retrieve the device configuration.
CVE-2013-1359 1 Sonicwall 4 Analyzer, Global Management System, Universal Management Appliance and 1 more 2024-11-21 9.8 Critical
An Authentication Bypass Vulnerability exists in DELL SonicWALL Analyzer 7.0, Global Management System (GMS) 4.1, 5.0, 5.1, 6.0, and 7.0; Universal Management Appliance (UMA) 5.1, 6.0, and 7.0 and ViewPoint 4.1, 5.0, 5.1, and 6.0 via the skipSessionCheck parameter to the UMA interface (/appliance/), which could let a remote malicious user obtain access to the root account.
CVE-2013-0803 1 Polarbear Cms Project 1 Polarbear Cms 2024-11-21 9.8 Critical
A PHP File Upload Vulnerability exists in PolarBear CMS 2.5 via upload.php, which could let a malicious user execute arbitrary code.
CVE-2012-1495 1 Webcalendar Project 1 Webcalendar 2024-11-21 9.8 Critical
install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user_login parameter.
CVE-2012-0694 1 Sugarcrm 1 Sugarcrm 2024-11-21 9.8 Critical
SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary PHP code.
CVE-2011-3923 2 Apache, Redhat 2 Struts, Jboss Enterprise Web Server 2024-11-21 9.8 Critical
Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
CVE-2011-2523 2 Debian, Vsftpd Project 2 Debian Linux, Vsftpd 2024-11-21 9.8 Critical
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
CVE-2024-52433 1 Mindstien 1 My Geo Posts Free 2024-11-20 9.8 Critical
Deserialization of Untrusted Data vulnerability in Mindstien Technologies My Geo Posts Free allows Object Injection.This issue affects My Geo Posts Free: from n/a through 1.2.
CVE-2024-10571 1 Ays-pro 1 Chartify 2024-11-19 9.8 Critical
The Chartify – WordPress Chart Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.5 via the 'source' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.