WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product fusion✕
Overview 1,190 matches · 311 in Waratek scope · 18 protected · 49 exploited · 22 CISA KEV · 152 public PoC · 44 EPSS ≥ 0.5
1,190matches 311in Waratek scope26.1% 18protected1.5% 49exploited4.1% 22CISA KEV1.8% 152public PoC12.8% 44EPSS ≥ 0.53.7%
Protected by Waratek 18 1.5% Rule in development 0 0.0% Mitigation candidate 23 1.9% No exploit published 270 22.7% Outside Waratek scope 26 2.2% Not applicable 853 71.7% Withdrawn CVE 0 0.0%
Critical 133 11.2% High 405 34.0% Medium 561 47.1% Low 91 7.6% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 18 1.5% partly blocked 0 0.0% not blocked 1,170 98.3% not established 2 0.2% unrecorded 0 0.0%
Exploited 49 4.1% Working exploit published 111 9.3% Proof of concept only 36 3.0% Forecast only 10 0.8% No public exploit 984 82.7%
split by peak 121 / year
Not applicable: 853Outside Waratek scope: 26No exploit published: 270Mitigation candidate: 23Protected by Waratek: 18 Low: 91Medium: 561High: 405Critical: 133 not established: 2not blocked: 1,170blocked by ARMR today: 18 No public exploit: 984Forecast only: 10Proof of concept only: 36Working exploit published: 111Exploited: 49
19993 Not applicable3 High3 not blocked3 Working exploit published2 No public exploit1 20004 Not applicable4 High1 Medium3 not blocked4 Working exploit published2 No public exploit2 200110 Not applicable10 High5 Medium4 Low1 not blocked10 Working exploit published1 No public exploit9 20024 Not applicable4 High1 Medium3 not blocked4 Working exploit published1 No public exploit3 20031 Not applicable1 Medium1 not blocked1 Working exploit published1 200414 Not applicable14 High6 Medium7 Low1 not blocked14 Working exploit published3 No public exploit11 200528 Not applicable28 High11 Medium15 Low2 not blocked28 Working exploit published9 No public exploit19 200620 Not applicable20 High3 Medium14 Low3 not blocked20 Working exploit published7 No public exploit13 20079 Not applicable9 High2 Medium6 Low1 not blocked9 Working exploit published1 No public exploit8 200812 Not applicable12 High6 Medium6 not blocked12 Working exploit published5 No public exploit7 200922 Not applicable22 High6 Medium15 Low1 not blocked22 Exploited2 Working exploit published11 No public exploit9 201033 Protected by Waratek1 Mitigation candidate2 No exploit published13 Outside Waratek scope3 Not applicable14 Critical1 High8 Medium19 Low5 blocked by ARMR today1 not blocked32 Exploited2 Working exploit published5 No public exploit26 201155 Mitigation candidate2 No exploit published26 Outside Waratek scope8 Not applicable19 High8 Medium37 Low10 not blocked55 Working exploit published5 No public exploit50 201280 Protected by Waratek2 Mitigation candidate9 No exploit published49 Outside Waratek scope3 Not applicable17 Critical2 High11 Medium42 Low25 blocked by ARMR today2 not blocked76 not established2 Exploited4 Working exploit published10 No public exploit66 201358 Protected by Waratek1 Mitigation candidate3 No exploit published34 Outside Waratek scope1 Not applicable19 Critical2 High13 Medium36 Low7 blocked by ARMR today1 not blocked57 Exploited8 Working exploit published7 No public exploit43 201475 Mitigation candidate3 No exploit published54 Not applicable18 High7 Medium61 Low7 not blocked75 Working exploit published11 No public exploit64 201589 Protected by Waratek1 Mitigation candidate4 No exploit published60 Outside Waratek scope2 Not applicable22 High17 Medium57 Low15 blocked by ARMR today1 not blocked88 Working exploit published4 Proof of concept only1 No public exploit84 201634 No exploit published14 Not applicable20 Critical1 High7 Medium23 Low3 not blocked34 Working exploit published3 No public exploit31 201756 Protected by Waratek1 No exploit published1 Not applicable54 Critical6 High35 Medium14 Low1 blocked by ARMR today1 not blocked55 Exploited1 Working exploit published9 Proof of concept only1 No public exploit45 201856 Protected by Waratek2 No exploit published4 Outside Waratek scope5 Not applicable45 Critical9 High25 Medium21 Low1 blocked by ARMR today2 not blocked54 Exploited4 Working exploit published1 Proof of concept only1 No public exploit50 201984 Protected by Waratek2 Outside Waratek scope3 Not applicable79 Critical17 High23 Medium44 blocked by ARMR today2 not blocked82 Exploited2 Working exploit published6 Proof of concept only1 No public exploit75 202070 Protected by Waratek2 No exploit published4 Not applicable64 Critical8 High31 Medium28 Low3 blocked by ARMR today2 not blocked68 Exploited2 Working exploit published1 No public exploit67 202158 Protected by Waratek2 No exploit published3 Outside Waratek scope1 Not applicable52 Critical9 High23 Medium26 blocked by ARMR today2 not blocked56 Exploited2 Working exploit published2 No public exploit54 202240 Protected by Waratek1 Not applicable39 Critical11 High21 Medium8 blocked by ARMR today1 not blocked39 Exploited1 Proof of concept only4 Forecast only5 No public exploit30 202336 No exploit published1 Not applicable35 Critical8 High18 Medium10 not blocked36 Exploited10 Working exploit published1 Proof of concept only4 Forecast only3 No public exploit18 202438 No exploit published5 Not applicable33 Critical7 High22 Medium9 not blocked38 Exploited5 Working exploit published1 Proof of concept only3 No public exploit29 202580 Protected by Waratek3 Not applicable77 Critical19 High26 Medium33 Low2 blocked by ARMR today3 not blocked77 Exploited3 Working exploit published2 Proof of concept only14 Forecast only2 No public exploit59 2026121 No exploit published2 Not applicable119 Critical33 High66 Medium19 Low3 not blocked121 Exploited3 Proof of concept only7 No public exploit111
1999200220052008201120142017202020232026
1,190 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 12 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2024-22315 Medium 2025-01-28 Not applicable No public exploit IBM Fusion and IBM Fusion HCI 2.3.0 through 2.8.2 is vulnerable to insecure network connection by allowing an attacker who gains access to a Fusion container to establish an external network connection.
CVE-2020-9236 High 2024-12-27 Not applicable No public exploit There is an improper interface design vulnerability in Huawei product. A module interface of the impated product does not deal with some operations properly. Attackers can exploit this vulnerability to perform malicious operatation to compromise module service. (Vulnerability ID: HWPSIRT-2020-05010) This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2020-9236.
CVE-2020-9222 High 2024-12-27 Not applicable No public exploit There is a privilege escalation vulnerability in Huawei FusionCompute product. Due to insufficient verification on specific files that need to be deserialized, local attackers can exploit this vulnerability to elevate permissions. (Vulnerability ID: HWPSIRT-2020-05241) This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2020-9222.
CVE-2024-53961 High 2024-12-23 Not applicable Proof of concept only ColdFusion versions 2023.11, 2021.17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access files or directories that are outside of the restricted directory set by the application. This could lead to the disclosure of sensitive information or the manipulation of system data. Exploitation of this issue requires the admin panel be exposed to the internet.
CVE-2024-21215 High 2024-10-15 No exploit published No public exploit Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVE-2024-21205 Medium 2024-10-15 No exploit published No public exploit Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: OSB Core Functionality). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Service Bus accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVE-2024-21192 Medium 2024-10-15 No exploit published No public exploit Vulnerability in the Oracle Enterprise Manager for Fusion Middleware product of Oracle Fusion Middleware (component: WebLogic Mgmt). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Enterprise Manager for Fusion Middleware executes to compromise Oracle Enterprise Manager for Fusion Middleware. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Manager for Fusion Middleware accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).
CVE-2024-21191 High 2024-10-15 No exploit published No public exploit Vulnerability in the Oracle Enterprise Manager Fusion Middleware Control product of Oracle Fusion Middleware (component: FMW Control Plugin). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager Fusion Middleware Control. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Manager Fusion Middleware Control, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Manager Fusion Middleware Control accessible data as well as unauthorized update, insert or delete access to some of Oracle Enterprise Manager Fusion Middleware Control accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).
CVE-2024-21190 High 2024-10-15 No exploit published No public exploit Vulnerability in the Oracle Global Lifecycle Management FMW Installer product of Oracle Fusion Middleware (component: Cloning). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SFTP to compromise Oracle Global Lifecycle Management FMW Installer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management FMW Installer accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
CVE-2024-45113 High 2024-09-13 Not applicable No public exploit ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access and affect the integrity of the application. Exploitation of this issue does not require user interaction.
CVE-2024-41874 Critical 2024-09-13 Not applicable No public exploit ColdFusion versions 2023.9, 2021.15 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability by providing crafted input to the application, which when deserialized, leads to execution of malicious code. Exploitation of this issue does not require user interaction.
CVE-2024-41629 Medium 2024-09-12 Not applicable Proof of concept only An issue in Texas Instruments Fusion Digital Power Designer v.7.10.1 allows a local attacker to obtain sensitive information via the plaintext storage of credentials
CVE-2024-42495 High 2024-09-05 Not applicable No public exploit Credentials to access device configuration were transmitted using an unencrypted protocol. These credentials would allow read-only access to network configuration information and terminal configuration data.
CVE-2024-39278 Medium 2024-09-05 Not applicable No public exploit Credentials to access device configuration information stored unencrypted in flash memory. These credentials would allow read-only access to network configuration information and terminal configuration data.
CVE-2024-38811 High 2024-09-03 Not applicable No public exploit VMware Fusion (13.x before 13.6) contains a code-execution vulnerability due to the usage of an insecure environment variable. A malicious actor with standard user privileges may exploit this vulnerability to execute code in the context of the Fusion application.
CVE-2024-38773 Critical 2024-07-22 Not applicable Working exploit published Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adrian Tobey FormLift for Infusionsoft Web Forms allows Blind SQL Injection.This issue affects FormLift for Infusionsoft Web Forms: from n/a through 7.5.17.
CVE-2024-34113 Medium 2024-06-13 Not applicable No public exploit ColdFusion versions 2023u7, 2021u13 and earlier are affected by a Weak Cryptography for Passwords vulnerability that could result in a security feature bypass. This vulnerability arises due to the use of insufficiently strong cryptographic algorithms or flawed implementation that compromises the confidentiality of password data. An attacker could exploit this weakness to decrypt or guess passwords, potentially gaining unauthorized access to protected resources. Exploitation of this issue does not require user interaction.
CVE-2024-34112 High 2024-06-13 Not applicable No public exploit ColdFusion versions 2023u7, 2021u13 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could exploit this vulnerability to gain unauthorized access to sensitive files or data. Exploitation of this issue does not require user interaction.
CVE-2024-22273 High 2024-05-21 Not applicable No public exploit The storage controllers on VMware ESXi, Workstation, and Fusion have out-of-bounds read/write vulnerability. A malicious actor with access to a virtual machine with storage controllers enabled may exploit this issue to create a denial of service condition or execute code on the hypervisor from a virtual machine in conjunction with other issues.
CVE-2024-22270 High 2024-05-14 Not applicable No public exploit VMware Workstation and Fusion contain an information disclosure vulnerability in the Host Guest File Sharing (HGFS) functionality. A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.
CVE-2024-22269 High 2024-05-14 Not applicable No public exploit VMware Workstation and Fusion contain an information disclosure vulnerability in the vbluetooth device. A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.
CVE-2024-22268 High 2024-05-14 Not applicable No public exploit VMware Workstation and Fusion contain a heap buffer-overflow vulnerability in the Shader functionality. A malicious actor with non-administrative access to a virtual machine with 3D graphics enabled may be able to exploit this vulnerability to create a denial of service condition.
CVE-2024-22267 Critical 2024-05-14 Not applicable No public exploit VMware Workstation and Fusion contain a use-after-free vulnerability in the vbluetooth device. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
CVE-2023-43040 Critical 2024-05-14 Not applicable No public exploit IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807.
CVE-2023-39309 High 2024-03-28 Not applicable Exploited Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1.
CVE-2023-39311 High 2024-03-27 Not applicable No public exploit Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1.
CVE-2024-24539 Medium 2024-03-18 Not applicable No public exploit FusionPBX before 5.2.0 does not validate a session.
CVE-2024-20767 High 2024-03-18 Not applicable Exploited ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet.
CVE-2024-22255 High 2024-03-05 Not applicable Exploited VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller. A malicious actor with administrative access to a virtual machine may be able to exploit this issue to leak memory from the vmx process.  
CVE-2024-22253 Critical 2024-03-05 Not applicable Exploited VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.
CVE-2024-22252 Critical 2024-03-05 Not applicable Exploited VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.
CVE-2024-22251 Medium 2024-02-29 Not applicable No public exploit VMware Workstation and Fusion contain an out-of-bounds read vulnerability in the USB CCID (chip card interface device). A malicious actor with local administrative privileges on a virtual machine may trigger an out-of-bounds read leading to information disclosure.
CVE-2024-23387 Medium 2024-01-19 Not applicable No public exploit FusionPBX prior to 5.1.0 contains a cross-site scripting vulnerability. If this vulnerability is exploited by a remote authenticated attacker with an administrative privilege, an arbitrary script may be executed on the web browser of the user who is logging in to the product.
CVE-2023-51751 High 2024-01-11 Not applicable No public exploit ScaleFusion 10.5.2 does not properly limit users to the Edge application because Alt-F4 can be used. This is fixed in 10.5.7 by preventing the launching of the file explorer in Agent-based Multi-App and Single App Kiosk mode.
CVE-2023-51750 Medium 2024-01-11 Not applicable No public exploit ScaleFusion 10.5.2 does not properly limit users to the Edge application because file downloads can occur. NOTE: the vendor's position is "Not vulnerable if the default Windows device profile configuration is used which utilizes modern management with website allow-listing rules."
CVE-2023-51749 High 2024-01-11 Not applicable No public exploit ScaleFusion 10.5.2 does not properly limit users to the Edge application because a search can be made from a tooltip. NOTE: the vendor's position is "Not vulnerable if the default Windows device profile configuration is used which utilizes modern management with website allow-listing rules."
CVE-2023-51748 High 2024-01-11 Not applicable Proof of concept only ScaleFusion 10.5.2 does not properly limit users to the Edge application because Ctrl-O and Ctrl-S can be used. This is fixed in 10.5.7 by preventing the launching of the file explorer in Agent-based Multi-App and Single App Kiosk mode.
CVE-2023-50159 High 2024-01-11 Not applicable No public exploit In ScaleFusion (Windows Desktop App) agent 10.5.2, Kiosk mode application restrictions can be bypassed allowing arbitrary code to be executed. This is fixed in 10.5.7 by preventing the launching of the file explorer in Agent-based Multi-App and Single App Kiosk mode.
CVE-2023-50948 Critical 2024-01-08 Not applicable No public exploit IBM Storage Fusion HCI 2.1.0 through 2.6.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 275671.
CVE-2023-44355 Medium 2023-11-17 Not applicable Proof of concept only Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to impact a minor integrity feature. Exploitation of this issue does require user interaction.
CVE-2023-44353 Critical 2023-11-17 Not applicable Exploited Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
CVE-2023-44352 Medium 2023-11-17 Not applicable Exploited Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVE-2023-44351 Critical 2023-11-17 Not applicable Forecast only Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
CVE-2023-44350 Critical 2023-11-17 Not applicable Forecast only Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
CVE-2023-26347 High 2023-11-17 Not applicable Exploited Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
CVE-2023-46315 High 2023-10-22 Not applicable No public exploit The zanllp sd-webui-infinite-image-browsing (aka Infinite Image Browsing) extension before 977815a for stable-diffusion-webui (aka Stable Diffusion web UI), if Gradio authentication is enabled without secret key configuration, allows remote attackers to read any local file via /file?path= in the URL, as demonstrated by reading /proc/self/environ to discover credentials.
CVE-2023-34046 High 2023-10-20 Not applicable No public exploit VMware Fusion(13.x prior to 13.5) contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during installation for the first time (the user needs to drag or copy the application to a folder from the '.dmg' volume) or when installing an upgrade. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed or being installed for the first time.
CVE-2023-34045 High 2023-10-20 Not applicable No public exploit VMware Fusion(13.x prior to 13.5) contains a local privilege escalation vulnerability that occurs during installation for the first time (the user needs to drag or copy the application to a folder from the '.dmg' volume) or when installing an upgrade. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed or being installed for the first time.
CVE-2023-34044 High 2023-10-20 Not applicable No public exploit VMware Workstation( 17.x prior to 17.5) and Fusion(13.x prior to 13.5) contain an out-of-bounds read vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine. A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.
CVE-2023-38206 Medium 2023-09-14 Not applicable No public exploit Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints resulting in a low-confidentiality impact. Exploitation of this issue does not require user interaction.
CVE-2023-38205 High 2023-09-14 Not applicable Exploited Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
CVE-2023-38204 Critical 2023-09-14 Not applicable Exploited Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
CVE-2021-40699 High 2023-09-07 Not applicable No public exploit ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an improper access control vulnerability when checking permissions in the CFIDE path. An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environment.
CVE-2021-40698 High 2023-09-07 Not applicable No public exploit ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an Use of Inherently Dangerous Function vulnerability that can lead to a security feature bypass  . An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environment.
CVE-2023-4480 Medium 2023-09-05 Not applicable No public exploit Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows them to read the contents of files on the system accessible within the privileges of the running process. Additionally, they may write files to arbitrary locations, provided the files pass the application’s mime-type and file extension validation. 
CVE-2023-2453 High 2023-09-05 Not applicable No public exploit There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘require_once’ statement. This allows arbitrary files with the ‘.php’ extension for which the absolute path is known to be included and executed. There are no known means in PHPFusion through which an attacker can upload and target a ‘.php’ file payload.
CVE-2023-4534 Medium 2023-08-25 Not applicable Proof of concept only A vulnerability, which was classified as problematic, was found in NeoMind Fusion Platform up to 20230731. Affected is an unknown function of the file /fusion/portal/action/Link. The manipulation of the argument link leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-238026 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2023-38203 Critical 2023-07-20 Not applicable Exploited Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
CVE-2023-21994 Medium 2023-07-18 No exploit published No public exploit Vulnerability in the Oracle Mobile Security Suite product of Oracle Fusion Middleware (component: Android Mobile Authenticator App). Supported versions that are affected are Prior to 11.1.2.3.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Mobile Security Suite executes to compromise Oracle Mobile Security Suite. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Mobile Security Suite accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVE-2023-29301 High 2023-07-12 Not applicable No public exploit Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the confidentiality of the user. Exploitation of this issue does not require user interaction.
CVE-2023-29300 Critical 2023-07-12 Not applicable Exploited Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
CVE-2023-29298 High 2023-07-12 Not applicable Exploited Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
CVE-2022-47376 High 2023-06-13 Not applicable No public exploit The Alaris Infusion Central software, versions 1.1 to 1.3.2, may contain a recoverable password after the installation. No patient health data is stored in the database, although some site installations may choose to store personal data.
CVE-2023-25439 Medium 2023-05-25 Not applicable Working exploit published Stored Cross Site Scripting (XSS) vulnerability in Square Pig FusionInvoice 2023-1.0, allows attackers to execute arbitrary code via the description or content fields to the expenses, tasks, and customer details.
CVE-2023-20872 High 2023-04-25 Not applicable Proof of concept only VMware Workstation and Fusion contain an out-of-bounds read/write vulnerability in SCSI CD/DVD device emulation.
CVE-2023-20871 High 2023-04-25 Not applicable No public exploit VMware Fusion contains a local privilege escalation vulnerability. A malicious actor with read/write access to the host operating system can elevate privileges to gain root access to the host operating system.
CVE-2023-20870 Medium 2023-04-25 Not applicable No public exploit VMware Workstation and Fusion contain an out-of-bounds read vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine.
CVE-2023-20869 High 2023-04-25 Not applicable No public exploit VMware Workstation (17.x) and VMware Fusion (13.x) contain a stack-based buffer-overflow vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine.
CVE-2023-26559 Medium 2023-04-14 Not applicable No public exploit A directory traversal vulnerability in Oxygen XML Web Author before 25.0.0.3 build 2023021715 and Oxygen Content Fusion before 5.0.3 build 2023022015 allows an attacker to read files from a WEB-INF directory via a crafted HTTP request. (XML Web Author 24.1.0.3 build 2023021714 and 23.1.1.4 build 2023021715 are also fixed versions.)
CVE-2023-26361 Medium 2023-03-23 Not applicable Forecast only Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in Arbitrary file system read. Exploitation of this issue does not require user interaction, but does require administrator privileges.
CVE-2023-26360 Critical 2023-03-23 Not applicable Exploited Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
CVE-2023-26359 Critical 2023-03-23 Not applicable Exploited Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
CVE-2021-3172 High 2023-02-17 Not applicable Proof of concept only An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature.
CVE-2022-25027 High 2023-01-12 Not applicable No public exploit The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authentication and access restricted pages by validating the user's session token when the "Password forgotten?" button is clicked.
CVE-2022-25026 High 2023-01-12 Not applicable No public exploit A Server-Side Request Forgery (SSRF) in Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to gain access to sensitive resources on the internal network via a crafted HTTP request to /trufusionPortal/upDwModuleProxy.
CVE-2022-31705 High 2022-12-14 Not applicable Proof of concept only VMware ESXi, Workstation, and Fusion contain a heap out-of-bounds write vulnerability in the USB 2.0 controller (EHCI). A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.
CVE-2022-38395 High 2022-12-12 Not applicable No public exploit HP Support Assistant uses HP Performance Tune-up as a diagnostic tool. HP Support Assistant uses Fusion to launch HP Performance Tune-up. It is possible for an attacker to exploit the DLL hijacking vulnerability and elevate privileges when Fusion launches the HP Performance Tune-up.
CVE-2022-36431 Critical 2022-12-01 Not applicable Proof of concept only An arbitrary file upload vulnerability in Rocket TRUfusion Enterprise before 7.9.6.1 allows unauthenticated attackers to execute arbitrary code via a crafted JSP file. Issue fixed in version 7.9.6.1.
CVE-2022-45921 High 2022-11-28 Protected by Waratek No public exploit FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process.
CVE-2022-36180 Critical 2022-11-22 Not applicable Proof of concept only Fusiondirectory 1.3 is vulnerable to Cross Site Scripting (XSS) via /fusiondirectory/index.php?message=[injection], /fusiondirectory/index.php?message=invalidparameter&plug={Injection], /fusiondirectory/index.php?signout=1&message=[injection]&plug=106.
CVE-2022-36179 Critical 2022-11-22 Not applicable Proof of concept only Fusiondirectory 1.3 suffers from Improper Session Handling.
CVE-2022-42341 High 2022-10-14 Not applicable No public exploit Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction.
CVE-2022-42340 High 2022-10-14 Not applicable No public exploit Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction.
CVE-2022-38424 High 2022-10-14 Not applicable No public exploit Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. Exploitation of this issue does not require user interaction, but does require administrator privileges.
CVE-2022-38423 Medium 2022-10-14 Not applicable No public exploit Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in information disclosure. Exploitation of this issue does not require user interaction, but does require administrator privileges.
CVE-2022-38422 High 2022-10-14 Not applicable No public exploit Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in information disclosure. Exploitation of this issue does not require user interaction.
CVE-2022-38421 High 2022-10-14 Not applicable Forecast only Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but does require administrator privileges.
CVE-2022-38420 High 2022-10-14 Not applicable No public exploit Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Use of Hard-coded Credentials vulnerability that could result in application denial-of-service by gaining access to start/stop arbitrary services. Exploitation of this issue does not require user interaction.
CVE-2022-38419 High 2022-10-14 Not applicable Forecast only Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction.
CVE-2022-38418 Critical 2022-10-14 Not applicable Forecast only Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
CVE-2022-35712 Critical 2022-10-14 Not applicable No public exploit Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a crafted network packet is sent to the server.
CVE-2022-35711 Critical 2022-10-14 Not applicable Forecast only Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a crafted network packet is sent to the server.
CVE-2022-35710 Critical 2022-10-14 Not applicable No public exploit Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a crafted network packet is sent to the server.
CVE-2022-35690 Critical 2022-10-14 Not applicable Forecast only Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a crafted network packet is sent to the server.
CVE-2021-40166 High 2022-10-07 Not applicable No public exploit A maliciously crafted PNG file in Autodesk Image Processing component may be used to attempt to free an object that has already been freed while parsing them. This vulnerability may be exploited by attackers to execute arbitrary code.
CVE-2021-40165 High 2022-10-07 Not applicable No public exploit A maliciously crafted TIFF, PICT, TGA, or RLC file in Autodesk Image Processing component may be used to write beyond the allocated buffer while parsing TIFF, PICT, TGA, or RLC files. This vulnerability may be exploited to execute arbitrary code.
CVE-2021-40164 High 2022-10-07 Not applicable No public exploit A heap-based buffer overflow could occur while parsing TIFF, PICT, TGA, or RLC files. This vulnerability may be exploited to execute arbitrary code.
CVE-2021-40163 High 2022-10-07 Not applicable No public exploit A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files through Autodesk Image Processing component.
CVE-2021-40162 High 2022-10-07 Not applicable No public exploit A maliciously crafted TIF, PICT, TGA, or RLC files in Autodesk Image Processing component may be forced to read beyond allocated boundaries when parsing the TIFF, PICT, TGA, or RLC files. This vulnerability may be exploited to execute arbitrary code.
CVE-2021-45843 Medium 2022-09-29 Not applicable No public exploit glFusion CMS v1.7.9 is affected by a reflected Cross Site Scripting (XSS) vulnerability. The value of the title request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. This input was echoed unmodified in the application's response.
‹ prev page 3 of 12 next ›