WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product server✕
Overview 1,882 matches · 52 in Waratek scope · 14 protected · 0 exploited · 0 CISA KEV · 280 EPSS ≥ 0.5
1,882matches 52in Waratek scope2.8% 14protected0.7% 0exploited0.0% 0CISA KEV0.0% 280EPSS ≥ 0.514.9%
Protected by Waratek 14 0.7% Rule in development 1 0.1% Mitigation candidate 37 2.0% No exploit published 0 0.0% Outside Waratek scope 58 3.1% Not applicable 1,772 94.2% Withdrawn CVE 0 0.0%
Critical 79 4.2% High 856 45.5% Medium 885 47.0% Low 62 3.3% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 14 0.7% partly blocked 0 0.0% not blocked 1,868 99.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1,882 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 159 / year
Not applicable: 1,772Outside Waratek scope: 58Mitigation candidate: 37Rule in development: 1Protected by Waratek: 14 Low: 62Medium: 885High: 856Critical: 79 not blocked: 1,868blocked by ARMR today: 14 Working exploit published: 1,882
19951 Not applicable1 High1 not blocked1 Working exploit published1 19965 Not applicable5 High2 Medium3 not blocked5 Working exploit published5 19976 Not applicable6 High2 Medium4 not blocked6 Working exploit published6 199811 Not applicable11 High6 Medium5 not blocked11 Working exploit published11 199950 Outside Waratek scope1 Not applicable49 High19 Medium27 Low4 not blocked50 Working exploit published50 200070 Mitigation candidate4 Outside Waratek scope1 Not applicable65 High25 Medium41 Low4 not blocked70 Working exploit published70 200177 Mitigation candidate1 Outside Waratek scope4 Not applicable72 Critical1 High27 Medium43 Low6 not blocked77 Working exploit published77 200297 Mitigation candidate2 Outside Waratek scope4 Not applicable91 Critical1 High49 Medium45 Low2 not blocked97 Working exploit published97 200362 Mitigation candidate1 Outside Waratek scope2 Not applicable59 Critical1 High30 Medium27 Low4 not blocked62 Working exploit published62 2004121 Mitigation candidate1 Outside Waratek scope1 Not applicable119 High43 Medium73 Low5 not blocked121 Working exploit published121 2005115 Mitigation candidate2 Outside Waratek scope3 Not applicable110 High54 Medium57 Low4 not blocked115 Working exploit published115 2006115 Mitigation candidate1 Outside Waratek scope6 Not applicable108 High52 Medium58 Low5 not blocked115 Working exploit published115 2007109 Mitigation candidate1 Outside Waratek scope6 Not applicable102 Critical1 High53 Medium55 not blocked109 Working exploit published109 200887 Mitigation candidate2 Outside Waratek scope3 Not applicable82 High44 Medium42 Low1 not blocked87 Working exploit published87 200978 Protected by Waratek1 Mitigation candidate2 Outside Waratek scope7 Not applicable68 High34 Medium42 Low2 blocked by ARMR today1 not blocked77 Working exploit published78 201092 Protected by Waratek1 Mitigation candidate1 Outside Waratek scope2 Not applicable88 Critical2 High48 Medium39 Low3 blocked by ARMR today1 not blocked91 Working exploit published92 201148 Mitigation candidate2 Outside Waratek scope2 Not applicable44 Critical1 High22 Medium23 Low2 not blocked48 Working exploit published48 201239 Mitigation candidate2 Outside Waratek scope3 Not applicable34 Critical1 High10 Medium27 Low1 not blocked39 Working exploit published39 201335 Not applicable35 High15 Medium18 Low2 not blocked35 Working exploit published35 201433 Mitigation candidate4 Outside Waratek scope1 Not applicable28 High16 Medium16 Low1 not blocked33 Working exploit published33 201573 Not applicable73 High50 Medium12 Low11 not blocked73 Working exploit published73 201686 Protected by Waratek2 Mitigation candidate2 Not applicable82 Critical5 High49 Medium30 Low2 blocked by ARMR today2 not blocked84 Working exploit published86 2017159 Protected by Waratek3 Mitigation candidate1 Outside Waratek scope2 Not applicable153 Critical16 High44 Medium99 blocked by ARMR today3 not blocked156 Working exploit published159 2018100 Protected by Waratek2 Outside Waratek scope3 Not applicable95 Critical16 High44 Medium37 Low3 blocked by ARMR today2 not blocked98 Working exploit published100 201982 Protected by Waratek2 Outside Waratek scope4 Not applicable76 Critical4 High55 Medium23 blocked by ARMR today2 not blocked80 Working exploit published82 202027 Protected by Waratek2 Mitigation candidate2 Not applicable23 Critical8 High11 Medium8 blocked by ARMR today2 not blocked25 Working exploit published27 202121 Protected by Waratek1 Mitigation candidate1 Outside Waratek scope2 Not applicable17 Critical5 High7 Medium9 blocked by ARMR today1 not blocked20 Working exploit published21 202215 Mitigation candidate1 Not applicable14 Critical2 High9 Medium4 not blocked15 Working exploit published15 202313 Not applicable13 Critical2 High7 Medium4 not blocked13 Working exploit published13 202418 Mitigation candidate3 Not applicable15 Critical5 High10 Medium3 not blocked18 Working exploit published18 202522 Rule in development1 Not applicable21 Critical4 High10 Medium8 not blocked22 Working exploit published22 202615 Mitigation candidate1 Outside Waratek scope1 Not applicable13 Critical4 High8 Medium3 not blocked15 Working exploit published15
19961999200220052008201120142017202020232026
1,882 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 19 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-54617 Critical 2026-09-17 Outside Waratek scope Working exploit published GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leading slash to the default LaunchServer file server on port 9274. FileServerHandler.channelRead0 in components/launchserver/src/main/java/pro/gravit/launchserver/socket/handlers/fileserver/FileServerHandler.java strips the first request-target character and resolves the remaining path against updatesDir without re-normalizing and verifying containment. This leaves parent-directory components in a no-leading-slash request and allows reading any file accessible to the LaunchServer process, including .keys/ecdsa_id, .keys/legacySalt, and LaunchServer.json. Disclosure of those files can expose signing keys, refresh-token material, and database credentials, enabling forged administrative access tokens and full authentication bypass. A normalizing L7 proxy may block the primary request form, but direct exposure and L4/TCP proxies remain affected, and netty.fileServerEnabled is enabled by default. This issue is fixed in 5.7.12.
CVE-2026-61459 Critical 2026-07-10 Not applicable Working exploit published MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can inject the --server flag to redirect kubectl commands to an attacker-controlled API server, causing the operator's bearer token to be transmitted externally and enabling full cluster compromise.
CVE-2026-57219 High 2026-07-10 Not applicable Working exploit published RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
CVE-2026-14620 Medium 2026-07-03 Not applicable Working exploit published webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.
CVE-2026-24207 Critical 2026-05-20 Not applicable Working exploit published NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, or information disclosure.
CVE-2026-44403 High 2026-05-12 Not applicable Working exploit published Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe serialization of session values into Lua source code without proper escaping of closing delimiters, causing the injected code to be executed when the poisoned session is loaded via loadfile().
CVE-2026-23918 High 2026-05-04 Not applicable Working exploit published Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
CVE-2026-33829 Medium 2026-04-14 Not applicable Working exploit published Exposure of sensitive information to an unauthorized actor in Windows Snipping Tool allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-22739 High 2026-03-24 Mitigation candidate Working exploit published Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.
CVE-2026-30965 Critical 2026-03-10 Not applicable Working exploit published Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.8 and 8.6.21, a vulnerability in Parse Server's query handling allows an authenticated or unauthenticated attacker to exfiltrate session tokens of other users by exploiting the redirectClassNameForKey query parameter. Exfiltrated session tokens can be used to take over user accounts. The vulnerability requires the attacker to be able to create or update an object with a new relation field, which depends on the Class-Level Permissions of at least one class. This vulnerability is fixed in 9.5.2-alpha.8 and 8.6.21.
CVE-2026-26235 High 2026-02-12 Not applicable Working exploit published JUNG Smart Visu Server 1.1.1050 contains a denial of service vulnerability that allows unauthenticated attackers to remotely shutdown or reboot the server. Attackers can send a single POST request to trigger the server reboot without requiring any authentication.
CVE-2026-21250 High 2026-02-10 Not applicable Working exploit published Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
CVE-2026-21248 High 2026-02-10 Not applicable Working exploit published Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
CVE-2026-21244 High 2026-02-10 Not applicable Working exploit published Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
CVE-2025-68273 Medium 2026-01-01 Not applicable Working exploit published Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in versions prior to 2.19.0 allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. This exposure facilitates reconnaissance for further attacks. Version 2.19.0 patches the issue.
CVE-2025-58044 Medium 2025-12-01 Not applicable Working exploit published JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability. This vulnerability is fixed in v3.10.19 and v4.10.5.
CVE-2025-5350 Medium 2025-10-24 Rule in development Working exploit published SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users. This feature accepted user-supplied URLs without proper validation, leading to server-side request forgery (SSRF). Additionally, the retrieved content was directly reflected in the HTTP response, enabling reflected cross-site scripting (XSS) in the admin user's browser context. By tricking an administrator into accessing a crafted link, an attacker could force the server to fetch malicious content and reflect it into the admin’s browser, leading to arbitrary JavaScript execution for UI manipulation or data exfiltration. While session cookies are protected with the HttpOnly flag, the XSS still poses a significant security risk. Furthermore, SSRF can be used by a privileged user to query internal services, potentially aiding in internal network enumeration if the target endpoints are reachable from the affected product.
CVE-2025-59254 High 2025-10-14 Not applicable Working exploit published Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVE-2010-20121 Critical 2025-08-21 Not applicable Working exploit published EasyFTP Server versions up to 1.7.0.11 contain a stack-based buffer overflow vulnerability in the FTP command parser. When processing the CWD (Change Working Directory) command, the server fails to properly validate the length of the input string, allowing attackers to overwrite memory on the stack. This flaw enables remote code execution without authentication, as EasyFTP allows anonymous access by default. The vulnerability was resolved in version 1.7.0.12, after which the product was renamed “UplusFtp.”
CVE-2010-20113 Critical 2025-08-21 Not applicable Working exploit published EasyFTP Server 1.7.0.11 and earlier contains a stack-based buffer overflow vulnerability in its HTTP interface. When processing a GET request to list.html, the server fails to properly validate the length of the path parameter. Supplying an excessively long value causes a buffer overflow on the stack, potentially corrupting control flow structures. The vulnerability is exposed through the embedded web server and does not require authentication due to default anonymous access. The issue was resolved in version 1.7.0.12, after which the product was renamed to UplusFtp.
CVE-2012-10060 Critical 2025-08-13 Not applicable Working exploit published Sysax Multi Server versions prior to 5.55 contain a stack-based buffer overflow in its SSH service. When a remote attacker supplies an overly long username during authentication, the server copies the input to a fixed-size stack buffer without proper bounds checking. This allows remote code execution under the context of the service.
CVE-2025-50154 Medium 2025-08-12 Not applicable Working exploit published Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.
CVE-2012-10030 Critical 2025-08-05 Not applicable Working exploit published FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbitrary files to sensitive system directories. The server accepts empty credentials, defaults user access to the root of the C:\ drive, and imposes no restrictions on file type or destination path. These conditions enable attackers to upload executable payloads and .mof files to locations such as system32 and wbem\mof, where Windows Management Instrumentation (WMI) automatically processes and executes them. This results in remote code execution with SYSTEM-level privileges, without requiring user interaction.
CVE-2012-10023 Medium 2025-08-05 Not applicable Working exploit published A stack-based buffer overflow vulnerability exists in FreeFloat FTP Server version 1.0.0. The server fails to properly validate input passed to the USER command, allowing remote attackers to overwrite memory and potentially execute arbitrary code. The flaw is triggered by sending an overly long username string, which overflows the buffer allocated for user authentication.
CVE-2025-49744 High 2025-07-08 Not applicable Working exploit published Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
CVE-2025-49730 High 2025-07-08 Not applicable Working exploit published Time-of-check time-of-use (toctou) race condition in Microsoft Windows QoS scheduler allows an authorized attacker to elevate privileges locally.
CVE-2025-49683 High 2025-07-08 Not applicable Working exploit published Integer overflow or wraparound in Virtual Hard Disk (VHDX) allows an unauthorized attacker to execute code locally.
CVE-2025-47987 High 2025-07-08 Not applicable Working exploit published Heap-based buffer overflow in Windows Cred SSProvider Protocol allows an authorized attacker to elevate privileges locally.
CVE-2025-47166 High 2025-06-10 Not applicable Working exploit published Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2025-5548 Medium 2025-06-04 Not applicable Working exploit published A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. Affected is an unknown function of the component NOOP Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-4871 Medium 2025-05-18 Not applicable Working exploit published A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component REST Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-40630 Medium 2025-05-16 Not applicable Working exploit published Open redirection vulnerability in IceWarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to redirect a user to any domain by sending a malicious URL to the victim, for example “ https://icewarp.domain.com//<MALICIOUS_DOMAIN>/%2e%2e” https://icewarp.domain.com///%2e%2e” . This vulnerability has been tested in Firefox.
CVE-2025-4255 Medium 2025-05-05 Not applicable Working exploit published A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component RMD Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-29471 High 2025-04-15 Not applicable Working exploit published Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field.
CVE-2025-27751 High 2025-04-08 Not applicable Working exploit published Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2025-24076 High 2025-03-11 Not applicable Working exploit published Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.
CVE-2025-21293 High 2025-01-14 Not applicable Working exploit published Active Directory Domain Services Elevation of Privilege Vulnerability
CVE-2024-43441 Critical 2024-12-24 Mitigation candidate Working exploit published Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue.
CVE-2024-9487 Critical 2024-10-10 Not applicable Working exploit published An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed resulting in unauthorized provisioning of users and access to the instance. Exploitation required the encrypted assertions feature to be enabled, and the attacker would require direct network access as well as a signed SAML response or metadata document. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.15 and was fixed in versions 3.11.16, 3.12.10, 3.13.5, and 3.14.2. This vulnerability was reported via the GitHub Bug Bounty program.
CVE-2024-45591 Medium 2024-09-10 Mitigation candidate Working exploit published XWiki Platform is a generic wiki platform. The REST API exposes the history of any page in XWiki of which the attacker knows the name. The exposed information includes for each modification of the page the time of the modification, the version number, the author of the modification (both username and displayed name) and the version comment. This information is exposed regardless of the rights setup, and even when the wiki is configured to be fully private. On a private wiki, this can be tested by accessing /xwiki/rest/wikis/xwiki/spaces/Main/pages/WebHome/history, if this shows the history of the main page then the installation is vulnerable. This has been patched in XWiki 15.10.9 and XWiki 16.3.0RC1.
CVE-2024-38473 High 2024-07-01 Not applicable Working exploit published Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue.
CVE-2024-38472 High 2024-07-01 Not applicable Working exploit published SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue.  Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.
CVE-2024-37081 High 2024-06-18 Not applicable Working exploit published The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.
CVE-2024-30085 High 2024-06-11 Not applicable Working exploit published Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
CVE-2024-30038 High 2024-05-14 Not applicable Working exploit published Win32k Elevation of Privilege Vulnerability
CVE-2024-29882 High 2024-03-28 Not applicable Working exploit published SRS is a simple, high-efficiency, real-time video server. SRS's `/api/v1/vhosts/vid-<id>?callback=<payload>` endpoint didn't filter the callback function name which led to injecting malicious javascript payloads and executing XSS ( Cross-Site Scripting). This vulnerability is fixed in 5.0.210 and 6.0.121.
CVE-2024-25420 High 2024-03-26 Mitigation candidate Working exploit published An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component.
CVE-2024-1800 Critical 2024-03-20 Not applicable Working exploit published In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability.
CVE-2024-24763 Medium 2024-02-20 Not applicable Working exploit published JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exploit this vulnerability to construct malicious links, leading users to click on them, thereby facilitating phishing attacks or cross-site scripting attacks. Version 3.10.0 contains a patch for this issue. No known workarounds are available.
CVE-2023-48974 Critical 2024-02-08 Not applicable Working exploit published Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script to the serverName_input parameter.
CVE-2024-23985 High 2024-01-25 Not applicable Working exploit published EzServer 6.4.017 allows a denial of service (daemon crash) via a long string, such as one for the RNTO command.
CVE-2024-0737 High 2024-01-19 Not applicable Working exploit published A vulnerability classified as problematic was found in Xlightftpd Xlight FTP Server 1.1. This vulnerability affects unknown code of the component Login. The manipulation of the argument user leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251560.
CVE-2024-0200 Critical 2024-01-16 Not applicable Working exploit published An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the organization owner role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.13, 3.9.8, 3.10.5, and 3.11.3. This vulnerability was reported via the GitHub Bug Bounty program.
CVE-2011-10005 High 2024-01-16 Not applicable Working exploit published A vulnerability, which was classified as critical, was found in EasyFTP 1.7.0.2. Affected is an unknown function of the component MKD Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250716.
CVE-2024-21320 Medium 2024-01-09 Not applicable Working exploit published Windows Themes Spoofing Vulnerability
CVE-2022-34267 Critical 2023-12-25 Not applicable Working exploit published An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Java code can be uploaded and executed via a .jar archive to the ws-api/v2/customizations/api endpoint.
CVE-2023-43662 High 2023-09-28 Not applicable Working exploit published ShokoServer is a media server which specializes in organizing anime. In affected versions the `/api/Image/WithPath` endpoint is accessible without authentication and is supposed to return default server images. The endpoint accepts the parameter `serverImagePath`, which is not sanitized in any way before being passed to `System.IO.File.OpenRead`, which results in an arbitrary file read. This issue may lead to an arbitrary file read which is exacerbated in the windows installer which installs the ShokoServer as administrator. Any unauthenticated attacker may be able to access sensitive information and read files stored on the server. The `/api/Image/WithPath` endpoint has been removed in commit `6c57ba0f0` which will be included in subsequent releases. Users should limit access to the `/api/Image/WithPath` endpoint or manually patch their installations until a patched release is made. This issue was discovered by the GitHub Security lab and is also indexed as GHSL-2023-191.
CVE-2023-38040 Medium 2023-09-17 Not applicable Working exploit published A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions..
CVE-2023-39700 Medium 2023-08-25 Not applicable Working exploit published IceWarp Mail Server v10.4.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the color parameter.
CVE-2023-38357 Medium 2023-08-01 Not applicable Working exploit published Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized access to user sessions.
CVE-2023-33137 High 2023-06-14 Not applicable Working exploit published Microsoft Excel Remote Code Execution Vulnerability
CVE-2023-28293 High 2023-04-11 Not applicable Working exploit published Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-28288 High 2023-04-11 Not applicable Working exploit published Microsoft SharePoint Server Spoofing Vulnerability
CVE-2023-26482 Critical 2023-03-30 Not applicable Working exploit published Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are designed to be only available for administrators. Some workflows are designed to be RCE by invoking defined scripts, in order to generate PDFs, invoking webhooks or running scripts on the server. Due to this combination depending on the available apps the issue can result in a RCE at the end. It is recommended that the Nextcloud Server is upgraded to 24.0.10 or 25.0.4. Users unable to upgrade should disable app `workflow_scripts` and `workflow_pdf_converter` as a mitigation.
CVE-2023-23399 High 2023-03-14 Not applicable Working exploit published Microsoft Excel Remote Code Execution Vulnerability
CVE-2023-22629 High 2023-02-14 Not applicable Working exploit published An issue was discovered in TitanFTP through 1.94.1205. The move-file function has a path traversal vulnerability in the newPath parameter. An authenticated attacker can upload any file and then move it anywhere on the server's filesystem.
CVE-2023-23286 Medium 2023-02-10 Not applicable Working exploit published Cross Site Scripting (XSS) vulnerability in Provide server 14.4 allows attackers to execute arbitrary code through the server-log via username field from the login form.
CVE-2023-0493 High 2023-01-26 Not applicable Working exploit published Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.
CVE-2022-35507 High 2022-12-04 Not applicable Working exploit published A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than the server expects, causing a client-side DoS. This affects Chromium-based browsers because they allow injection of response headers with %0d. This is fixed in pve-http-server 4.1-3.
CVE-2022-3218 Critical 2022-09-19 Not applicable Working exploit published Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution.
CVE-2022-2334 High 2022-08-17 Not applicable Working exploit published The application searches for a library dll that is not found. If an attacker can place a dll with this name, then the attacker can leverage it to execute arbitrary code on the targeted Softing Secure Integration Server V1.22.
CVE-2022-1373 High 2022-08-17 Not applicable Working exploit published The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vulnerability when processing zip files. An attacker can craft a zip file to load an arbitrary dll and execute code. Using the "restore configuration" feature to upload a zip file containing a path traversal file may cause a file to be created and executed upon touching the disk.
CVE-2022-34534 High 2022-07-19 Not applicable Working exploit published Digital Watchdog DW Spectrum Server 4.2.0.32842 allows attackers to access sensitive infromation via a crafted API call.
CVE-2022-29548 Medium 2022-04-21 Not applicable Working exploit published A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0, 6.5.0, and 6.6.0; IS as Key Manager 5.5.0, 5.6.0, 5.7.0, 5.9.0, and 5.10.0; Identity Server 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0, and 5.11.0; Identity Server Analytics 5.5.0 and 5.6.0; and WSO2 Micro Integrator 1.0.0.
CVE-2022-28108 High 2022-04-19 Mitigation candidate Working exploit published Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.
CVE-2022-28381 Critical 2022-04-03 Not applicable Working exploit published Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long string to TCP port 888, a related issue to CVE-2017-17932.
CVE-2022-23348 Medium 2022-03-21 Not applicable Working exploit published BigAnt Software BigAnt Server v5.6.06 was discovered to utilize weak password hashes.
CVE-2022-23277 High 2022-03-09 Not applicable Working exploit published Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2022-25323 Medium 2022-02-18 Not applicable Working exploit published ZEROF Web Server 2.0 allows /admin.back XSS.
CVE-2021-35380 High 2022-02-15 Not applicable Working exploit published A Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious user gain access to the files on the remote system by gaining access to the relative path of the file they want to download (http://url:port/file?valore).
CVE-2022-23102 Medium 2022-02-09 Not applicable Working exploit published A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Affected products contain an open redirect vulnerability. An attacker could trick a valid authenticated user to the device into clicking a malicious link there by leading to phishing attacks.
CVE-2021-34805 High 2022-01-31 Not applicable Working exploit published An issue was discovered in FAUST iServer before 9.0.019.019.7. For each URL request, it accesses the corresponding .fau file on the operating system without preventing %2e%2e%5c directory traversal.
CVE-2021-46104 High 2022-01-19 Not applicable Working exploit published An issue was discovered in webp_server_go 0.4.0. There is a directory traversal vulnerability that can read arbitrary file information on the server.
CVE-2021-44790 Critical 2021-12-20 Outside Waratek scope Working exploit published A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.
CVE-2021-42697 High 2021-11-02 Mitigation candidate Working exploit published Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.
CVE-2021-22015 High 2021-09-23 Not applicable Working exploit published The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance.
CVE-2021-37425 Critical 2021-08-10 Not applicable Working exploit published Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reading mobiletogetherserver.cfg and then reading the certificate and private key.
CVE-2021-37573 Medium 2021-08-09 Not applicable Working exploit published A reflected cross-site scripting (XSS) vulnerability in the web server TTiny Java Web Server and Servlet Container (TJWS) <=1.115 allows an adversary to inject malicious code on the server's "404 Page not Found" error page
CVE-2019-25046 Medium 2021-06-10 Not applicable Working exploit published The Web Client in Cerberus FTP Server Enterprise before 10.0.19 and 11.x before 11.0.4 allows XSS via an SVG document.
CVE-2021-31950 High 2021-06-08 Not applicable Working exploit published Microsoft SharePoint Server Spoofing Vulnerability
CVE-2021-26078 Medium 2021-06-07 Not applicable Working exploit published The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and from version 8.14.0 before version 8.16.1 allows remote attackers inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability.
CVE-2020-36289 Medium 2021-05-12 Not applicable Working exploit published Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.
CVE-2021-31195 High 2021-05-11 Not applicable Working exploit published Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-31181 High 2021-05-11 Not applicable Working exploit published Microsoft SharePoint Remote Code Execution Vulnerability
CVE-2021-30175 Critical 2021-04-13 Not applicable Working exploit published ZEROF Web Server 1.0 (April 2021) allows SQL Injection via the /HandleEvent endpoint for the login page.
CVE-2021-28480 Critical 2021-04-13 Not applicable Working exploit published Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-3374 Medium 2021-04-02 Not applicable Working exploit published Directory traversal in RStudio Shiny Server before 1.5.16 allows attackers to read the application source code, involving an encoded slash.
CVE-2021-28164 Medium 2021-04-01 Protected by Waratek Working exploit published In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
CVE-2021-21351 Critical 2021-03-23 Outside Waratek scope Working exploit published XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
CVE-2021-27928 High 2021-03-19 Not applicable Working exploit published A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product.
‹ prev page 1 of 19 next ›