Overview 857 matches · 84 in Waratek scope · 20 protected · 0 exploited · 0 CISA KEV · 0 public PoC
Protected by Waratek
20
2.3%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
64
7.5%
Outside Waratek scope
46
5.4%
Not applicable
727
84.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
20
2.3%
partly blocked
0
0.0%
not blocked
837
97.7%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
857
100.0%
No public exploit
0
0.0%
split by
peak 167 / year
19961
Not applicable1
High1
not blocked1
Forecast only1
19972
Not applicable2
Low2
not blocked2
Forecast only2
19980
19990
20001
Outside Waratek scope1
High1
not blocked1
Forecast only1
20012
Not applicable2
Medium2
not blocked2
Forecast only2
20029
No exploit published2
Not applicable7
Critical1
High3
Medium3
Low2
not blocked9
Forecast only9
20031
Not applicable1
Critical1
not blocked1
Forecast only1
20041
Not applicable1
Medium1
not blocked1
Forecast only1
200511
Not applicable11
High5
Medium6
not blocked11
Forecast only11
20066
Not applicable6
High4
Medium2
not blocked6
Forecast only6
20075
Not applicable5
High4
Medium1
not blocked5
Forecast only5
20089
Outside Waratek scope1
Not applicable8
High8
Medium1
not blocked9
Forecast only9
20093
Not applicable3
Medium3
not blocked3
Forecast only3
20109
No exploit published1
Not applicable8
Critical1
High6
Medium2
not blocked9
Forecast only9
20114
Not applicable4
Critical1
High2
Medium1
not blocked4
Forecast only4
201246
Not applicable46
High4
Medium42
not blocked46
Forecast only46
201321
No exploit published1
Outside Waratek scope1
Not applicable19
High15
Medium6
not blocked21
Forecast only21
201416
Protected by Waratek2
Not applicable14
High4
Medium12
blocked by ARMR today2
not blocked14
Forecast only16
201519
Outside Waratek scope2
Not applicable17
High10
Medium8
Low1
not blocked19
Forecast only19
201632
Protected by Waratek4
No exploit published1
Outside Waratek scope2
Not applicable25
Critical5
High16
Medium9
Low2
blocked by ARMR today4
not blocked28
Forecast only32
201723
No exploit published1
Outside Waratek scope1
Not applicable21
Critical8
High13
Medium2
not blocked23
Forecast only23
201833
Protected by Waratek1
Outside Waratek scope1
Not applicable31
Critical9
High17
Medium7
blocked by ARMR today1
not blocked32
Forecast only33
201952
Protected by Waratek1
No exploit published2
Outside Waratek scope7
Not applicable42
Critical17
High26
Medium9
blocked by ARMR today1
not blocked51
Forecast only52
202066
No exploit published8
Outside Waratek scope10
Not applicable48
Critical21
High35
Medium10
not blocked66
Forecast only66
2021167
Protected by Waratek2
No exploit published22
Outside Waratek scope15
Not applicable128
Critical37
High86
Medium44
blocked by ARMR today2
not blocked165
Forecast only167
202297
Protected by Waratek5
No exploit published11
Outside Waratek scope1
Not applicable80
Critical22
High41
Medium34
blocked by ARMR today5
not blocked92
Forecast only97
2023114
Protected by Waratek3
No exploit published9
Not applicable102
Critical26
High60
Medium28
blocked by ARMR today3
not blocked111
Forecast only114
202485
Protected by Waratek1
No exploit published6
Outside Waratek scope3
Not applicable75
Critical16
High59
Medium10
blocked by ARMR today1
not blocked84
Forecast only85
202517
Protected by Waratek1
Outside Waratek scope1
Not applicable15
Critical5
High7
Medium5
blocked by ARMR today1
not blocked16
Forecast only17
20265
Not applicable5
Critical3
High2
not blocked5
Forecast only5
19961999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-26594 | Critical | 2024-02-23 | Not applicable | Forecast only | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate mech token in session setup If client send invalid mech token in session setup request, ksmbd validate and make the error if it is invalid. |
| CVE-2024-1451 | High | 2024-02-22 | Not applicable | Forecast only | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.1. A crafted payload added to the user profile page could lead to a stored XSS on the client side, allowing attackers to perform arbitrary actions on behalf of victims." |
| CVE-2024-23478 | High | 2024-02-15 | Not applicable | Forecast only | SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability allows an authenticated user to abuse a SolarWinds service, resulting in remote code execution. |
| CVE-2024-25617 | High | 2024-02-14 | Outside Waratek scope | Forecast only | Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header parsing. This problem allows a remote client or a remote server to perform Denial of Service when sending oversized headers in HTTP messages. In versions of Squid prior to 6.5 this can be achieved if the request_header_max_size or reply_header_max_size settings are unchanged from the default. In Squid version 6.5 and later, the default setting of these parameters is safe. Squid will emit a critical warning in cache.log if the administrator is setting these parameters to unsafe values. Squid will not at this time prevent these settings from being changed to unsafe values. Users are advised to upgrade to version 6.5. There are no known workarounds for this vulnerability. This issue is also tracked as SQUID-2024:2 |
| CVE-2024-23898 | High | 2024-01-24 | No exploit published | Forecast only | Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller. |
| CVE-2024-0507 | High | 2024-01-16 | Not applicable | Forecast only | An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Management Console. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in versions 3.11.3, 3.10.5, 3.9.8, and 3.8.13 This vulnerability was reported via the GitHub Bug Bounty program. |
| CVE-2024-20697 | High | 2024-01-09 | Not applicable | Forecast only | Windows libarchive Remote Code Execution Vulnerability |
| CVE-2023-51448 | High | 2023-12-22 | Not applicable | Forecast only | Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `‘managers.php’`. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint `‘/cacti/managers.php’` with an SQLi payload in the `‘selected_graphs_array’` HTTP GET parameter. As of time of publication, no patched versions exist. |
| CVE-2023-46264 | Critical | 2023-12-19 | Not applicable | Forecast only | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution. |
| CVE-2023-46263 | Critical | 2023-12-19 | Not applicable | Forecast only | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remote code execution. |
| CVE-2023-46262 | High | 2023-12-19 | Not applicable | Forecast only | An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche Remote Control server. |
| CVE-2023-38126 | High | 2023-12-19 | Not applicable | Forecast only | Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Softing edgeAggregator. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of backup zip files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this to execute code in the context of root. Was ZDI-CAN-20543. |
| CVE-2021-22962 | Critical | 2023-12-19 | Not applicable | Forecast only | An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. |
| CVE-2023-6893 | High | 2023-12-17 | Not applicable | Forecast only | A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK) and classified as problematic. Affected by this issue is some unknown functionality of the file /php/exportrecord.php. The manipulation of the argument downname with the input C:\ICPAS\Wnmp\WWW\php\conversion.php leads to path traversal. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248252. |
| CVE-2023-50721 | Critical | 2023-12-15 | No exploit published | Forecast only | XWiki Platform is a generic wiki platform. Starting in 4.5-rc-1 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the search administration interface doesn't properly escape the id and label of search user interface extensions, allowing the injection of XWiki syntax containing script macros including Groovy macros that allow remote code execution, impacting the confidentiality, integrity and availability of the whole XWiki instance. This attack can be executed by any user who can edit some wiki page like the user's profile (editable by default) as user interface extensions that will be displayed in the search administration can be added on any document by any user. The necessary escaping has been added in XWiki 14.10.15, 15.5.2 and 15.7RC1. As a workaround, the patch can be applied manually applied to the page `XWiki.SearchAdmin`. |
| CVE-2023-50269 | High | 2023-12-14 | Not applicable | Forecast only | Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. |
| CVE-2023-48085 | Critical | 2023-12-14 | Not applicable | Forecast only | Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component command_test.php. |
| CVE-2023-46727 | Critical | 2023-12-13 | Not applicable | Forecast only | GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, GLPI inventory endpoint can be used to drive a SQL injection attack. Version 10.0.11 contains a patch for the issue. As a workaround, disable native inventory. |
| CVE-2023-35628 | High | 2023-12-12 | Not applicable | Forecast only | Windows MSHTML Platform Remote Code Execution Vulnerability |
| CVE-2023-48123 | High | 2023-12-06 | Not applicable | Forecast only | An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the packet_capture.php file. |
| CVE-2023-49285 | High | 2023-12-04 | Not applicable | Forecast only | Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
| CVE-2023-37928 | High | 2023-11-30 | Not applicable | Forecast only | A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device. |
| CVE-2023-48646 | High | 2023-11-22 | Not applicable | Forecast only | Zoho ManageEngine RecoveryManager Plus before 6070 allows admin users to execute arbitrary commands via proxy settings. |
| CVE-2023-6187 | High | 2023-11-18 | Not applicable | Forecast only | The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'pmpro_paypalexpress_session_vars_for_user_fields' function in versions up to, and including, 2.12.3. This makes it possible for authenticated attackers with subscriber privileges or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This can be exploited if 2Checkout (deprecated since version 2.6) or PayPal Express is set as the payment method and a custom user field is added that is only visible at profile, and not visible at checkout according to its settings. |
| CVE-2023-44351 | Critical | 2023-11-17 | Not applicable | Forecast only | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. |
| CVE-2023-44350 | Critical | 2023-11-17 | Not applicable | Forecast only | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. |
| CVE-2023-42327 | Medium | 2023-11-14 | Not applicable | Forecast only | Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the getserviceproviders.php page. |
| CVE-2023-42326 | High | 2023-11-14 | Not applicable | Forecast only | An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components. |
| CVE-2023-42325 | Medium | 2023-11-14 | Not applicable | Forecast only | Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the status_logs_filter_dynamic.php page. |
| CVE-2023-36041 | High | 2023-11-14 | Not applicable | Forecast only | Microsoft Excel Remote Code Execution Vulnerability |
| CVE-2023-36039 | High | 2023-11-14 | Not applicable | Forecast only | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2023-36035 | High | 2023-11-14 | Not applicable | Forecast only | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2023-46847 | High | 2023-11-03 | Not applicable | Forecast only | Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication. |
| CVE-2023-46695 | High | 2023-11-02 | Not applicable | Forecast only | An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters. |
| CVE-2023-5044 | High | 2023-10-25 | Not applicable | Forecast only | Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation. |
| CVE-2023-39456 | High | 2023-10-17 | Not applicable | Forecast only | Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 9.2.3, which fixes the issue. |
| CVE-2023-45138 | Critical | 2023-10-12 | No exploit published | Forecast only | Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly. Starting in version 0.11 and prior to version 1.9.2, it's possible for a user without any specific right to perform script injection and remote code execution just by inserting an appropriate title when creating a new Change Request. This vulnerability is particularly critical as Change Request aims at being created by user without any particular rights. The vulnerability has been fixed in Change Request 1.9.2. It's possible to workaround the issue without upgrading by editing the document `ChangeRequest.Code.ChangeRequestSheet` and by performing the same change as in the fix commit. |
| CVE-2023-38171 | High | 2023-10-10 | Not applicable | Forecast only | Microsoft QUIC Denial of Service Vulnerability |
| CVE-2023-36606 | High | 2023-10-10 | Not applicable | Forecast only | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
| CVE-2023-36777 | Medium | 2023-09-12 | Not applicable | Forecast only | Microsoft Exchange Server Information Disclosure Vulnerability |
| CVE-2023-36744 | High | 2023-09-12 | Not applicable | Forecast only | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-41249 | Medium | 2023-08-25 | Not applicable | Forecast only | In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step |
| CVE-2023-40176 | Critical | 2023-08-23 | No exploit published | Forecast only | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can exploit a stored XSS through their user profile by setting the payload as the value of the time zone user preference. Even though the time zone is selected from a drop down (no free text value) it can still be set from JavaScript (using the browser developer tools) or by calling the save URL on the user profile with the right query string. Once the time zone is set it is displayed without escaping which means the payload gets executed for any user that visits the malicious user profile, allowing the attacker to steal information and even gain more access rights (escalation to programming rights). This issue is present since version 4.1M2 when the time zone user preference was introduced. The issue has been fixed in XWiki 14.10.5 and 15.1RC1. |
| CVE-2023-2917 | Critical | 2023-08-17 | Not applicable | Forecast only | The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability. Due to an improper input validation, a path traversal vulnerability exists, via the filename field, when the ThinManager processes a certain function. If exploited, an unauthenticated remote attacker can upload arbitrary files to any directory on the disk drive where ThinServer.exe is installed. A malicious user could exploit this vulnerability by sending a crafted synchronization protocol message and potentially gain remote code execution abilities. |
| CVE-2023-2915 | Critical | 2023-08-17 | Not applicable | Forecast only | The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability, Due to improper input validation, a path traversal vulnerability exists when the ThinManager software processes a certain function. If exploited, an unauthenticated remote threat actor can delete arbitrary files with system privileges. A malicious user could exploit this vulnerability by sending a specifically crafted synchronization protocol message resulting in a denial-of-service condition. |
| CVE-2023-32782 | High | 2023-08-09 | Not applicable | Forecast only | A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor. The severity of this vulnerability is high and received a score of 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| CVE-2023-34967 | Medium | 2023-07-20 | Not applicable | Forecast only | A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker process, affecting all other clients this worker serves. |
| CVE-2023-34966 | High | 2023-07-20 | Not applicable | Forecast only | An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not validate a field in the network packet that contains the count of elements in an array-like structure. By passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a denial of service condition. |
| CVE-2023-29452 | Medium | 2023-07-13 | Not applicable | Forecast only | Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider. |
| CVE-2023-36824 | High | 2023-07-11 | Not applicable | Forecast only | Redis is an in-memory database that persists on disk. In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution. Several scenarios that may lead to authenticated users executing a specially crafted `COMMAND GETKEYS` or `COMMAND GETKEYSANDFLAGS`and authenticated users who were set with ACL rules that match key names, executing a specially crafted command that refers to a variadic list of key names. The vulnerability is patched in Redis 7.0.12. |
| CVE-2023-1183 | Medium | 2023-07-10 | Not applicable | Forecast only | A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a SCRIPT command where the contents of the file could be written to a new file whose location was determined by the attacker. |
| CVE-2023-36933 | High | 2023-07-05 | Not applicable | Forecast only | In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is possible for an attacker to invoke a method that results in an unhandled exception. Triggering this workflow can cause the MOVEit Transfer application to terminate unexpectedly. |
| CVE-2023-36932 | High | 2023-07-05 | Not applicable | Forecast only | In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), multiple SQL injection vulnerabilities have been identified in the MOVEit Transfer web application that could allow an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content. |
| CVE-2023-35924 | Critical | 2023-07-05 | Not applicable | Forecast only | GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.8, GLPI inventory endpoint can be used to drive a SQL injection attack. By default, GLPI inventory endpoint requires no authentication. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native inventory. |
| CVE-2023-3420 | High | 2023-06-26 | Not applicable | Forecast only | Type Confusion in V8 in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
| CVE-2023-29711 | Critical | 2023-06-22 | Not applicable | Forecast only | An incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbitrary code via crafted GET request. |
| CVE-2023-35166 | Critical | 2023-06-20 | No exploit published | Forecast only | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension. This has been patched in XWiki 15.1-rc-1 and 14.10.5. |
| CVE-2023-32029 | High | 2023-06-14 | Not applicable | Forecast only | Microsoft Excel Remote Code Execution Vulnerability |
| CVE-2023-2249 | High | 2023-06-09 | Not applicable | Forecast only | The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions up to, and including, 2.1.7. This is due to the insecure use of file_get_contents without appropriate verification of the data being supplied to the function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to retrieve the contents of files like wp-config.php hosted on the system, perform a deserialization attack and possibly achieve remote code execution, and make requests to internal services. |
| CVE-2023-0992 | High | 2023-06-09 | Not applicable | Forecast only | The Shield Security plugin for WordPress is vulnerable to stored Cross-Site Scripting in versions up to, and including, 17.0.17 via the 'User-Agent' header. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2023-0921 | Medium | 2023-06-06 | Not applicable | Forecast only | A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage. |
| CVE-2023-28651 | Medium | 2023-06-01 | Not applicable | Forecast only | Cross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. If a user who can access the affected product with an administrative privilege configures specially crafted settings, an arbitrary script may be executed on the web browser of the other user who is accessing the affected product with an administrative privilege. |
| CVE-2023-34225 | Medium | 2023-05-31 | Not applicable | Forecast only | In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible |
| CVE-2023-34220 | Medium | 2023-05-31 | Not applicable | Forecast only | In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible |
| CVE-2023-2650 | Medium | 2023-05-30 | Not applicable | Forecast only | Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit. OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods. When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time. The time complexity is O(n^2) with 'n' being the size of the sub-identifiers in bytes (*). With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms. Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data. Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low. In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 certificates, including simple things like verifying its signature. The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer's certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client authentication. In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low. |
| CVE-2023-2928 | High | 2023-05-27 | Not applicable | Forecast only | A vulnerability was found in DedeCMS up to 5.7.106. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file uploads/dede/article_allowurl_edit.php. The manipulation of the argument allurls leads to code injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230083. |
| CVE-2023-32986 | High | 2023-05-16 | No exploit published | Forecast only | Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content. |
| CVE-2023-32985 | Medium | 2023-05-16 | Protected by Waratek | Forecast only | Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. |
| CVE-2023-32071 | Critical | 2023-05-09 | No exploit published | Forecast only | XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page which contains an attachment. This has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8. The easiest possible workaround is to edit file `<xwiki app>/templates/importinline.vm` and apply the modification described in commit 28905f7f518cc6f21ea61fe37e9e1ed97ef36f01. |
| CVE-2023-29325 | High | 2023-05-09 | Not applicable | Forecast only | Windows OLE Remote Code Execution Vulnerability |
| CVE-2023-28127 | High | 2023-05-09 | Not applicable | Forecast only | A path traversal vulnerability exists in Avalanche version 6.3.x and below that when exploited could result in possible information disclosure. |
| CVE-2023-28126 | Medium | 2023-05-09 | Not applicable | Forecast only | An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploiting the SetUser method or can exploit the Race Condition in the authentication message. |
| CVE-2023-24950 | Medium | 2023-05-09 | Not applicable | Forecast only | Microsoft SharePoint Server Spoofing Vulnerability |
| CVE-2023-24941 | Critical | 2023-05-09 | Not applicable | Forecast only | Windows Network File System Remote Code Execution Vulnerability |
| CVE-2023-31099 | High | 2023-05-04 | Not applicable | Forecast only | Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers. |
| CVE-2023-32007 | High | 2023-05-02 | Protected by Waratek | Forecast only | ** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This issue was disclosed earlier as CVE-2022-33891, but incorrectly claimed version 3.1.3 (which has since gone EOL) would not be affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Users are recommended to upgrade to a supported version of Apache Spark, such as version 3.4.0. |
| CVE-2023-25652 | High | 2023-04-25 | Not applicable | Forecast only | Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file exists. |
| CVE-2023-21931 | High | 2023-04-18 | Protected by Waratek | Forecast only | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). |
| CVE-2023-28341 | Medium | 2023-04-11 | Not applicable | Forecast only | Stored Cross site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager through 16340 allows an unauthenticated user to inject malicious javascript on the incorrect login details page. |
| CVE-2023-28302 | High | 2023-04-11 | Not applicable | Forecast only | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
| CVE-2023-21769 | High | 2023-04-11 | Not applicable | Forecast only | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
| CVE-2023-28342 | High | 2023-04-05 | Not applicable | Forecast only | Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API. |
| CVE-2022-42429 | High | 2023-03-29 | Not applicable | Forecast only | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of requests to modify poller broker configuration. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to the level of an administrator. Was ZDI-CAN-18557. |
| CVE-2022-42427 | High | 2023-03-29 | Not applicable | Forecast only | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the contact groups configuration page. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to the level of an administrator. Was ZDI-CAN-18541. |
| CVE-2022-42425 | High | 2023-03-29 | Not applicable | Forecast only | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of requests to modify poller broker configuration. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to the level of an administrator. Was ZDI-CAN-18555. |
| CVE-2022-42424 | High | 2023-03-29 | Not applicable | Forecast only | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of requests to modify poller broker configuration. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to the level of an administrator. Was ZDI-CAN-18556. |
| CVE-2022-36982 | High | 2023-03-29 | Not applicable | Forecast only | This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the AgentTaskHandler class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose stored session cookies, leading to further compromise. Was ZDI-CAN-15967. |
| CVE-2022-36981 | Critical | 2023-03-29 | Not applicable | Forecast only | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the DeviceLogResource class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15966. |
| CVE-2022-36980 | High | 2023-03-29 | Not applicable | Forecast only | This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the EnterpriseServer service. The issue results from the lack of proper locking when performing operations during authentication. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15528. |
| CVE-2022-36974 | Critical | 2023-03-29 | Not applicable | Forecast only | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Web File Server service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15330. |
| CVE-2022-2560 | Critical | 2023-03-29 | Not applicable | Forecast only | This vulnerability allows remote attackers to delete arbitrary files on affected installations of EnterpriseDT CompleteFTP 22.1.0 Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HttpFile class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM. Was ZDI-CAN-17481. |
| CVE-2023-22249 | Medium | 2023-03-27 | Not applicable | Forecast only | Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. |
| CVE-2023-0210 | High | 2023-03-27 | Not applicable | Forecast only | A bug affects the Linux kernel’s ksmbd NTLMv2 authentication and is known to crash the OS immediately in Linux-based systems. |
| CVE-2022-48428 | Medium | 2023-03-27 | Not applicable | Forecast only | In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible |
| CVE-2023-26361 | Medium | 2023-03-23 | Not applicable | Forecast only | Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in Arbitrary file system read. Exploitation of this issue does not require user interaction, but does require administrator privileges. |
| CVE-2023-27856 | High | 2023-03-22 | Not applicable | Forecast only | In affected versions, path traversal exists when processing a message of type 8 in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.exe is installed. |
| CVE-2023-28425 | Medium | 2023-03-20 | Not applicable | Forecast only | Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10. |
| CVE-2022-44574 | High | 2023-03-10 | Not applicable | Forecast only | An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties on specific port. |
| CVE-2023-0050 | High | 2023-03-09 | Not applicable | Forecast only | An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A specially crafted Kroki diagram could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims. |
| CVE-2021-36393 | Critical | 2023-03-06 | Not applicable | Forecast only | In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses. |