Overview 1,482 matches · 13 in Waratek scope · 1 protected · 15 exploited · 5 CISA KEV · 116 public PoC · 12 EPSS ≥ 0.5
1,482matches
13in Waratek scope0.9%
1protected0.1%
15exploited1.0%
5CISA KEV0.3%
116public PoC7.8%
12EPSS ≥ 0.50.8%
Protected by Waratek
1
0.1%
Rule in development
0
0.0%
Mitigation candidate
1
0.1%
No exploit published
11
0.7%
Outside Waratek scope
2
0.1%
Not applicable
1,467
99.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
0.1%
partly blocked
0
0.0%
not blocked
1,481
99.9%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 158 / year
19991
Not applicable1
Low1
not blocked1
No public exploit1
20000
20011
Not applicable1
Medium1
not blocked1
No public exploit1
20021
Not applicable1
Low1
not blocked1
No public exploit1
20035
Not applicable5
High2
Medium3
not blocked5
Working exploit published2
No public exploit3
20049
Not applicable9
High5
Medium4
not blocked9
Working exploit published2
No public exploit7
200515
Outside Waratek scope1
Not applicable14
High8
Medium6
Low1
not blocked15
Working exploit published3
No public exploit12
200640
Not applicable40
High14
Medium25
Low1
not blocked40
Working exploit published9
No public exploit31
200751
Not applicable51
High20
Medium28
Low3
not blocked51
Working exploit published5
No public exploit46
200827
Not applicable27
High3
Medium22
Low2
not blocked27
Working exploit published5
No public exploit22
200935
Not applicable35
High14
Medium20
Low1
not blocked35
Working exploit published5
No public exploit30
201037
Not applicable37
High22
Medium11
Low4
not blocked37
Working exploit published4
No public exploit33
201133
Not applicable33
High7
Medium25
Low1
not blocked33
Working exploit published8
No public exploit25
201260
Not applicable60
High8
Medium29
Low23
not blocked60
Working exploit published13
No public exploit47
2013102
Not applicable102
High10
Medium64
Low28
not blocked102
Working exploit published1
No public exploit101
201450
Not applicable50
High15
Medium35
not blocked50
Exploited1
Working exploit published6
No public exploit43
201559
Not applicable59
Critical2
High10
Medium46
Low1
not blocked59
Working exploit published3
No public exploit56
2016117
Outside Waratek scope1
Not applicable116
Critical3
High13
Medium101
not blocked117
Working exploit published20
No public exploit97
201783
Not applicable83
Critical5
High69
Medium9
not blocked83
Exploited6
Working exploit published6
No public exploit71
2018119
No exploit published1
Not applicable118
Critical8
High90
Medium19
Low2
not blocked119
Exploited1
Working exploit published2
No public exploit116
201957
Not applicable57
Critical5
High33
Medium19
not blocked57
Exploited2
Working exploit published1
No public exploit54
202058
Not applicable58
Critical10
High32
Medium16
not blocked58
Working exploit published3
No public exploit55
2021142
No exploit published2
Not applicable140
Critical14
High95
Medium31
Low2
not blocked142
Exploited1
Working exploit published1
No public exploit140
202277
No exploit published1
Not applicable76
Critical7
High25
Medium44
Low1
not blocked77
Working exploit published1
Proof of concept only4
No public exploit72
202365
Protected by Waratek1
No exploit published2
Not applicable62
Critical7
High19
Medium39
blocked by ARMR today1
not blocked64
Exploited2
Proof of concept only17
No public exploit46
202449
Not applicable49
Critical3
High27
Medium19
not blocked49
Proof of concept only15
No public exploit34
202531
Mitigation candidate1
No exploit published2
Not applicable28
Critical2
High17
Medium12
not blocked31
Exploited1
Working exploit published1
Proof of concept only1
No public exploit28
2026158
No exploit published3
Not applicable155
Critical2
High62
Medium92
Low2
not blocked158
Exploited1
Proof of concept only64
No public exploit93
1999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-20393 | High | 2024-10-02 | Not applicable | No public exploit | A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to elevate privileges on an affected device. This vulnerability exists because the web-based management interface discloses sensitive information. An attacker could exploit this vulnerability by sending crafted HTTP input to an affected device. A successful exploit could allow an attacker to elevate privileges from guest to admin. |
| CVE-2024-45803 | Medium | 2024-09-17 | Not applicable | Proof of concept only | Wire UI is a library of components and resources to empower Laravel and Livewire application development. A potential Cross-Site Scripting (XSS) vulnerability has been identified in the `/wireui/button` endpoint, specifically through the `label` query parameter. Malicious actors could exploit this vulnerability by injecting JavaScript into the `label` parameter, leading to the execution of arbitrary code in the victim's browser. The `/wireui/button` endpoint dynamically renders button labels based on user-provided input via the `label` query parameter. Due to insufficient sanitization or escaping of this input, an attacker can inject malicious JavaScript. By crafting such a request, an attacker can inject arbitrary code that will be executed by the browser when the endpoint is accessed. If exploited, this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the affected website. This could lead to: **Session Hijacking**: Stealing session cookies, tokens, or other sensitive information. **User Impersonation**: Performing unauthorized actions on behalf of authenticated users. **Phishing**: Redirecting users to malicious websites. **Content Manipulation**: Altering the appearance or behavior of the affected page to mislead users or execute further attacks. The severity of this vulnerability depends on the context of where the affected component is used, but in all cases, it poses a significant risk to user security. This issue has been addressed in release versions 1.19.3 and 2.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
| CVE-2024-8645 | Medium | 2024-09-10 | Not applicable | Proof of concept only | SPRT dissector crash in Wireshark 4.2.0 to 4.0.5 and 4.0.0 to 4.0.15 allows denial of service via packet injection or crafted capture file |
| CVE-2024-8250 | High | 2024-08-29 | Not applicable | Proof of concept only | NTLMSSP dissector crash in Wireshark 4.2.0 to 4.0.6 and 4.0.0 to 4.0.16 allows denial of service via packet injection or crafted capture file |
| CVE-2024-41597 | Medium | 2024-07-19 | Not applicable | Proof of concept only | Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to insert a comment. NOTE: this is disputed by the Supplier because the product intentionally accepts anonymous, unauthenticated comments and thus there are fewer situations in which CSRF would be a useful attack technique. Also, the submitted comments are, by default, held for moderator review. |
| CVE-2024-4855 | Medium | 2024-05-14 | Not applicable | No public exploit | Use after free issue in editcap could cause denial of service via crafted capture file |
| CVE-2024-4854 | High | 2024-05-14 | Not applicable | No public exploit | MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file |
| CVE-2024-4853 | Medium | 2024-05-14 | Not applicable | No public exploit | Memory handling issue in editcap could cause denial of service via crafted capture file |
| CVE-2024-20354 | High | 2024-03-27 | Not applicable | No public exploit | A vulnerability in the handling of encrypted wireless frames of Cisco Aironet Access Point (AP) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on the affected device. This vulnerability is due to incomplete cleanup of resources when dropping certain malformed frames. An attacker could exploit this vulnerability by connecting as a wireless client to an affected AP and sending specific malformed frames over the wireless connection. A successful exploit could allow the attacker to cause degradation of service to other clients, which could potentially lead to a complete DoS condition. |
| CVE-2024-20271 | High | 2024-03-27 | Not applicable | No public exploit | A vulnerability in the IP packet processing of Cisco Access Point (AP) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation of certain IPv4 packets. An attacker could exploit this vulnerability by sending a crafted IPv4 packet either to or through an affected device. A successful exploit could allow the attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition. To successfully exploit this vulnerability, the attacker does not need to be associated with the affected AP. This vulnerability cannot be exploited by sending IPv6 packets. |
| CVE-2024-2955 | High | 2024-03-26 | Not applicable | No public exploit | T.38 dissector crash in Wireshark 4.2.0 to 4.0.3 and 4.0.0 to 4.0.13 allows denial of service via packet injection or crafted capture file |
| CVE-2023-6175 | High | 2024-03-26 | Not applicable | Proof of concept only | NetScreen file parser crash in Wireshark 4.0.0 to 4.0.10 and 3.6.0 to 3.6.18 allows denial of service via crafted capture file |
| CVE-2024-21504 | Medium | 2024-03-19 | Not applicable | Proof of concept only | Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. An attacker can inject HTML code in the context of the user's browser session by crafting a malicious link and convincing the user to click on it. |
| CVE-2024-24278 | High | 2024-03-05 | Not applicable | No public exploit | An issue in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the message function. |
| CVE-2024-24276 | Critical | 2024-03-05 | Not applicable | No public exploit | Cross Site Scripting (XSS) vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the chat name, message preview, username and group name components. |
| CVE-2024-24275 | Critical | 2024-03-05 | Not applicable | No public exploit | Cross Site Scripting vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the global search function. |
| CVE-2024-28084 | High | 2024-03-03 | Not applicable | No public exploit | p2putil.c in iNet wireless daemon (IWD) through 2.15 allows attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact because of initialization issues in situations where parsing of advertised service information fails. |
| CVE-2023-52161 | High | 2024-02-22 | Not applicable | No public exploit | The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before 2.14 allows attackers to gain unauthorized access to a protected Wi-Fi network. An attacker can complete the EAPOL handshake by skipping Msg2/4 and instead sending Msg4/4 with an all-zero key. |
| CVE-2024-24479 | High | 2024-02-21 | Not applicable | No public exploit | A Buffer Overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the wsutil/to_str.c, and format_fractional_part_nsecs components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected. |
| CVE-2024-24478 | High | 2024-02-21 | Not applicable | No public exploit | An issue in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissect_bgp_open(tvbuff_t*tvb, proto_tree*tree, packet_info*pinfo), optlen components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected. |
| CVE-2024-24476 | High | 2024-02-21 | Not applicable | Proof of concept only | A buffer overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the pan/addr_resolv.c, and ws_manuf_lookup_str(), size components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected. |
| CVE-2023-34983 | Medium | 2024-02-14 | Not applicable | No public exploit | Improper input validation for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access. |
| CVE-2023-33875 | High | 2024-02-14 | Not applicable | No public exploit | Improper access control for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via local access.. |
| CVE-2023-32651 | Medium | 2024-02-14 | Not applicable | No public exploit | Improper validation of specified type of input for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access. |
| CVE-2023-32644 | Medium | 2024-02-14 | Not applicable | No public exploit | Protection mechanism failure for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access. |
| CVE-2023-32642 | Medium | 2024-02-14 | Not applicable | No public exploit | Insufficient adherence to expected conventions for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access. |
| CVE-2023-28720 | Medium | 2024-02-14 | Not applicable | No public exploit | Improper initialization for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access.. |
| CVE-2023-28374 | Medium | 2024-02-14 | Not applicable | No public exploit | Improper input validation for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access. |
| CVE-2023-26586 | Medium | 2024-02-14 | Not applicable | No public exploit | Uncaught exception for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access. |
| CVE-2023-25951 | Medium | 2024-02-14 | Not applicable | No public exploit | Improper input validation for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow a privileged user to potentially enable escalation of privilege via local access. |
| CVE-2024-22859 | High | 2024-02-01 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken function. NOTE: the vendor disputes this because the 5d88731 commit fixes a usability problem (HTTP 419 status codes for legitimate client activity), not a security problem. |
| CVE-2023-24676 | High | 2024-01-24 | Not applicable | Proof of concept only | An issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the download_zip_url parameter when installing a new module. NOTE: this is disputed because exploitation requires that the attacker is able to enter requests as an admin; however, a ProcessWire admin is intentionally allowed to install any module that contains any arbitrary code. |
| CVE-2022-4964 | Medium | 2024-01-24 | Not applicable | Proof of concept only | Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set. |
| CVE-2024-0211 | High | 2024-01-03 | Not applicable | Proof of concept only | DOCSIS dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file |
| CVE-2024-0210 | High | 2024-01-03 | Not applicable | No public exploit | Zigbee TLV dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file |
| CVE-2024-0209 | High | 2024-01-03 | Not applicable | Proof of concept only | IEEE 1609.2 dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted capture file |
| CVE-2024-0208 | High | 2024-01-03 | Not applicable | No public exploit | GVCP dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted capture file |
| CVE-2024-0207 | High | 2024-01-03 | Not applicable | No public exploit | HTTP3 dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file |
| CVE-2023-50069 | Medium | 2023-12-29 | Not applicable | No public exploit | WireMock with GUI versions 3.2.0.0 through 3.0.4.0 are vulnerable to stored cross-site scripting (SXSS) through the recording feature. An attacker can host a malicious payload and perform a test mapping pointing to the attacker's file, and the result will render on the Matched page in the Body area, resulting in the execution of the payload. This occurs because the response body is not validated or sanitized. |
| CVE-2023-45887 | Critical | 2023-12-20 | Not applicable | No public exploit | DS Wireless Communication (DWC) with DWC_VERSION_3 and DWC_VERSION_11 allows remote attackers to execute arbitrary code on a game-playing client's machine via a modified GPCM message. |
| CVE-2023-6174 | Medium | 2023-11-16 | Not applicable | No public exploit | SSH dissector crash in Wireshark 4.0.0 to 4.0.10 allows denial of service via packet injection or crafted capture file |
| CVE-2023-46501 | Critical | 2023-11-07 | Not applicable | Proof of concept only | An issue in BoltWire v.6.03 allows a remote attacker to obtain sensitive information via a crafted payload to the view and change admin password function. |
| CVE-2023-46604 | Critical | 2023-10-27 | Protected by Waratek | Exploited | The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue. |
| CVE-2023-5371 | Medium | 2023-10-04 | Not applicable | No public exploit | RTPS dissector memory leak in Wireshark 4.0.0 to 4.0.8 and 3.6.0 to 3.6.16 allows denial of service via packet injection or crafted capture file |
| CVE-2023-20268 | Medium | 2023-09-27 | Not applicable | No public exploit | A vulnerability in the packet processing functionality of Cisco access point (AP) software could allow an unauthenticated, adjacent attacker to exhaust resources on an affected device. This vulnerability is due to insufficient management of resources when handling certain types of traffic. An attacker could exploit this vulnerability by sending a series of specific wireless packets to an affected device. A successful exploit could allow the attacker to consume resources on an affected device. A sustained attack could lead to the disruption of the Control and Provisioning of Wireless Access Points (CAPWAP) tunnel and intermittent loss of wireless client traffic. |
| CVE-2023-41329 | Medium | 2023-09-06 | No exploit published | No public exploit | WireMock is a tool for mocking HTTP services. The proxy mode of WireMock, can be protected by the network restrictions configuration, as documented in Preventing proxying to and recording from specific target addresses. These restrictions can be configured using the domain names, and in such a case the configuration is vulnerable to the DNS rebinding attacks. A similar patch was applied in WireMock 3.0.0-beta-15 for the WireMock Webhook Extensions. The root cause of the attack is a defect in the logic which allows for a race condition triggered by a DNS server whose address expires in between the initial validation and the outbound network request that might go to a domain that was supposed to be prohibited. Control over a DNS service is required to exploit this attack, so it has high execution complexity and limited impact. This issue has been addressed in version 2.35.1 of wiremock-jre8 and wiremock-jre8-standalone, version 3.0.3 of wiremock and wiremock-standalone, version 2.6.1 of the python version of wiremock, and versions 2.35.1-1 and 3.0.3-1 of the wiremock/wiremock Docker container. Users are advised to upgrade. Users unable to upgrade should either configure firewall rules to define the list of permitted destinations or to configure WireMock to use IP addresses instead of the domain names. |
| CVE-2023-41327 | Medium | 2023-09-06 | No exploit published | No public exploit | WireMock is a tool for mocking HTTP services. WireMock can be configured to only permit proxying (and therefore recording) to certain addresses. This is achieved via a list of allowed address rules and a list of denied address rules, where the allowed list is evaluated first. Until WireMock Webhooks Extension 3.0.0-beta-15, the filtering of target addresses from the proxy mode DID NOT work for Webhooks, so the users were potentially vulnerable regardless of the `limitProxyTargets` settings. Via the WireMock webhooks configuration, POST requests from a webhook might be forwarded to an arbitrary service reachable from WireMock’s instance. For example, If someone is running the WireMock docker Container inside a private cluster, they can trigger internal POST requests against unsecured APIs or even against secure ones by passing a token, discovered using another exploit, via authentication headers. This issue has been addressed in versions 2.35.1 and 3.0.3 of wiremock. Wiremock studio has been discontinued and will not see a fix. Users unable to upgrade should use external firewall rules to define the list of permitted destinations. |
| CVE-2023-2906 | Medium | 2023-08-25 | Not applicable | Proof of concept only | Due to a failure in validating the length provided by an attacker-crafted CP2179 packet, Wireshark versions 2.0.0 through 4.0.7 is susceptible to a divide by zero allowing for a denial of service attack. |
| CVE-2023-4513 | High | 2023-08-24 | Not applicable | No public exploit | BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file |
| CVE-2023-4512 | High | 2023-08-24 | Not applicable | Proof of concept only | CBOR dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file |
| CVE-2023-4511 | High | 2023-08-24 | Not applicable | No public exploit | BT SDP dissector infinite loop in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file |
| CVE-2023-28714 | High | 2023-08-11 | Not applicable | No public exploit | Improper access control in firmware for some Intel(R) PROSet/Wireless WiFi software for Windows before version 22.220 HF (Hot Fix) may allow a privileged user to potentially enable escalation of privilege via local access. |
| CVE-2022-46329 | High | 2023-08-11 | Not applicable | No public exploit | Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi software may allow a privileged user to potentially enable escalation of privilege via local access. |
| CVE-2022-40964 | High | 2023-08-11 | Not applicable | No public exploit | Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow a privileged user to potentially enable escalation of privilege via local access. |
| CVE-2022-38076 | High | 2023-08-11 | Not applicable | No public exploit | Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an authenticated user to potentially enable escalation of privilege via local access. |
| CVE-2022-36351 | Medium | 2023-08-11 | Not applicable | No public exploit | Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an unauthenticated user to potentially enable denial of service via adjacent access. |
| CVE-2022-27635 | High | 2023-08-11 | Not applicable | No public exploit | Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow a privileged user to potentially enable escalation of privilege via local access. |
| CVE-2023-35838 | Medium | 2023-08-09 | Not applicable | No public exploit | The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a local network that uses non-RFC1918 IP addresses is blocked. This allows an adversary to trick the victim into blocking IP traffic to selected IP addresses and services even while the VPN is enabled. NOTE: the tunnelcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to "LocalNet attack resulting in the blocking of traffic" rather than to only WireGuard. |
| CVE-2023-3649 | Medium | 2023-07-14 | Not applicable | No public exploit | iSCSI dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file |
| CVE-2023-3648 | Medium | 2023-07-14 | Not applicable | No public exploit | Kafka dissector crash in Wireshark 4.0.0 to 4.0.6 and 3.6.0 to 3.6.14 allows denial of service via packet injection or crafted capture file |
| CVE-2022-44720 | Critical | 2023-06-29 | Not applicable | Proof of concept only | An issue was discovered in Weblib Ucopia before 6.0.13. OS Command Injection injection can occur, related to chroot. |
| CVE-2022-44719 | High | 2023-06-29 | Not applicable | Proof of concept only | An issue was discovered in Weblib Ucopia before 6.0.13. The SSH Server has Insecure Permissions. |
| CVE-2023-34364 | Critical | 2023-06-09 | Not applicable | No public exploit | A buffer overflow was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle. An overly large value for certain options of a connection string may overrun the buffer allocated to process the string value. This allows an attacker to execute code of their choice on an affected host by copying carefully selected data that will be executed as code. |
| CVE-2023-34363 | Medium | 2023-06-09 | Not applicable | No public exploit | An issue was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle. When using Oracle Advanced Security (OAS) encryption, if an error is encountered initializing the encryption object used to encrypt data, the code falls back to a different encryption mechanism that uses an insecure random number generator to generate the private key. It is possible for a well-placed attacker to predict the output of this random number generator, which could lead to an attacker decrypting traffic between the driver and the database server. The vulnerability does not exist if SSL / TLS encryption is used. |
| CVE-2023-0668 | Medium | 2023-06-07 | Not applicable | Proof of concept only | Due to failure in validating the length provided by an attacker-crafted IEEE-C37.118 packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark. |
| CVE-2023-0667 | Medium | 2023-06-07 | Not applicable | Proof of concept only | Due to failure in validating the length provided by an attacker-crafted MSMMS packet, Wireshark version 4.0.5 and prior, in an unusual configuration, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark |
| CVE-2023-0666 | Medium | 2023-06-07 | Not applicable | Proof of concept only | Due to failure in validating the length provided by an attacker-crafted RTPS packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark. |
| CVE-2023-2952 | Medium | 2023-05-30 | Not applicable | Proof of concept only | XRA dissector infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file |
| CVE-2022-46361 | Medium | 2023-05-30 | Not applicable | No public exploit | An attacker having physical access to WDM can plug USB device to gain access and execute unwanted commands. A malicious user could enter a system command along with a backup configuration, which could result in the execution of unwanted commands. This issue affects OneWireless all versions up to 322.1 and fixed in version 322.2. |
| CVE-2022-43485 | Medium | 2023-05-30 | Not applicable | No public exploit | Use of Insufficiently Random Values in Honeywell OneWireless. This vulnerability may allow attacker to manipulate claims in client's JWT token. This issue affects OneWireless version 322.1 |
| CVE-2022-4240 | High | 2023-05-30 | Not applicable | No public exploit | Missing Authentication for Critical Function vulnerability in Honeywell OneWireless allows Authentication Bypass. This issue affects OneWireless version 322.1 |
| CVE-2023-2879 | High | 2023-05-26 | Not applicable | Proof of concept only | GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file |
| CVE-2023-2858 | Medium | 2023-05-26 | Not applicable | No public exploit | NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file |
| CVE-2023-2857 | Medium | 2023-05-26 | Not applicable | Proof of concept only | BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file |
| CVE-2023-2856 | Medium | 2023-05-26 | Not applicable | Proof of concept only | VMS TCPIPtrace file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file |
| CVE-2023-2855 | Medium | 2023-05-26 | Not applicable | Proof of concept only | Candump log parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file |
| CVE-2023-2854 | Medium | 2023-05-26 | Not applicable | Proof of concept only | BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file |
| CVE-2023-31904 | High | 2023-05-17 | Not applicable | Proof of concept only | savysoda Wifi HD Wireless Disk Drive 11 is vulnerable to Local File Inclusion. |
| CVE-2023-30403 | High | 2023-05-02 | Not applicable | Proof of concept only | An issue in the time-based authentication mechanism of Aigital Aigital Wireless-N Repeater Mini_Router v0.131229 allows attackers to bypass login by connecting to the web app after a successful attempt by a legitimate user. |
| CVE-2023-30405 | Medium | 2023-04-28 | Not applicable | Proof of concept only | A cross-site scripting (XSS) vulnerability in Aigital Wireless-N Repeater Mini_Router v0.131229 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the wl_ssid parameter at /boafrm/formHomeWlanSetup. |
| CVE-2023-30404 | Critical | 2023-04-26 | Not applicable | No public exploit | Aigital Wireless-N Repeater Mini_Router v0.131229 was discovered to contain a remote code execution (RCE) vulnerability via the sysCmd parameter in the formSysCmd function. This vulnerability is exploited via a crafted HTTP request. |
| CVE-2023-1994 | Medium | 2023-04-12 | Not applicable | No public exploit | GQUIC dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file |
| CVE-2023-1993 | Medium | 2023-04-12 | Not applicable | No public exploit | LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file |
| CVE-2023-1992 | High | 2023-04-12 | Not applicable | No public exploit | RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file |
| CVE-2023-20097 | Medium | 2023-03-23 | Not applicable | No public exploit | A vulnerability in Cisco access points (AP) software could allow an authenticated, local attacker to inject arbitrary commands and execute them with root privileges. This vulnerability is due to improper input validation of commands that are issued from a wireless controller to an AP. An attacker with Administrator access to the CLI of the controller could exploit this vulnerability by issuing a command with crafted arguments. A successful exploit could allow the attacker to gain full root access on the AP. |
| CVE-2023-20056 | Medium | 2023-03-23 | Not applicable | No public exploit | A vulnerability in the management CLI of Cisco access point (AP) software could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation of commands supplied by the user. An attacker could exploit this vulnerability by authenticating to a device and submitting crafted input to the affected command. A successful exploit could allow the attacker to cause an affected device to reload spontaneously, resulting in a DoS condition. |
| CVE-2023-1262 | High | 2023-03-21 | Not applicable | No public exploit | Missing MAC layer security in Silicon Labs Wi-SUN Linux Border Router v1.5.2 and earlier allows malicious node to route malicious messages through network. |
| CVE-2023-1161 | High | 2023-03-06 | Not applicable | No public exploit | ISO 15765 and ISO 10681 dissector crash in Wireshark 4.0.0 to 4.0.3 and 3.6.0 to 3.6.11 allows denial of service via packet injection or crafted capture file |
| CVE-2023-25717 | Critical | 2023-02-13 | Not applicable | Exploited | Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring. |
| CVE-2021-46873 | Medium | 2023-01-29 | Not applicable | No public exploit | WireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an adversary might be able to set a victim's system time to a future value, e.g., because unauthenticated NTP is used. This can lead to an outcome in which one static private key becomes permanently useless. |
| CVE-2023-22737 | Medium | 2023-01-28 | Not applicable | No public exploit | wire-server provides back end services for Wire, a team communication and collaboration platform. Prior to version 2022-12-09, every member of a Conversation can remove a Bot from a Conversation due to a missing permissions check. Only Conversation admins should be able to remove Bots. Regular Conversations are not allowed to do so. The issue is fixed in wire-server 2022-12-09 and is already deployed on all Wire managed services. On-premise instances of wire-server need to be updated to 2022-12-09/Chart 4.29.0, so that their backends are no longer affected. There are no known workarounds. |
| CVE-2022-39380 | Medium | 2023-01-27 | Not applicable | No public exploit | Wire web-app is part of Wire communications. Versions prior to 2022-11-02 are subject to Improper Handling of Exceptional Conditions. In the wire-webapp, certain combinations of Markdown formatting can trigger an unhandled error in the conversion to HTML representation. The error makes it impossible to display the affected chat history, other conversations are not affected. The issue has been fixed in version 2022-11-02 and is already deployed on all Wire managed services. On-premise instances of wire-webapp need to be updated to docker tag 2022-11-02-production.0-v0.31.9-0-337e400 or wire-server 2022-11-03 (chart/4.26.0), so that their applications are no longer affected. As a workaround, you may use an iOS or Android client and delete the corresponding message from the history OR write 30 or more messages into the affected conversation to prevent the client from further rendering of the corresponding message. When attempting to retrieve messages from the conversation history, the error will continue to occur once the malformed message is part of the result. |
| CVE-2023-0417 | Medium | 2023-01-26 | Not applicable | No public exploit | Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file |
| CVE-2023-0416 | Medium | 2023-01-26 | Not applicable | No public exploit | GNW dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file |
| CVE-2023-0415 | Medium | 2023-01-26 | Not applicable | No public exploit | iSCSI dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file |
| CVE-2023-0414 | Medium | 2023-01-26 | Not applicable | No public exploit | Crash in the EAP dissector in Wireshark 4.0.0 to 4.0.2 allows denial of service via packet injection or crafted capture file |
| CVE-2023-0413 | Medium | 2023-01-26 | Not applicable | No public exploit | Dissection engine bug in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file |
| CVE-2023-0412 | High | 2023-01-26 | Not applicable | No public exploit | TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file |
| CVE-2023-0411 | Medium | 2023-01-26 | Not applicable | No public exploit | Excessive loops in multiple dissectors in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file |
| CVE-2023-20045 | High | 2023-01-20 | Not applicable | No public exploit | A vulnerability in the web-based management interface of Cisco Small Business RV160 and RV260 Series VPN Routers could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands using root-level privileges on the affected device. To exploit this vulnerability, the attacker must have valid Administrator-level credentials on the affected device. |