Overview 46 matches · 1 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 8 public PoC · 0 EPSS ≥ 0.5
46matches
1in Waratek scope2.2%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
8public PoC17.4%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
1
2.2%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
45
97.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
46
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
8
17.4%
Proof of concept only
5
10.9%
Forecast only
0
0.0%
No public exploit
33
71.7%
split by
peak 6 / year
20001
Not applicable1
Medium1
not blocked1
No public exploit1
20011
Not applicable1
Medium1
not blocked1
No public exploit1
20020
20030
20040
20051
Not applicable1
Medium1
not blocked1
No public exploit1
20060
20076
Not applicable6
Medium6
not blocked6
Working exploit published1
No public exploit5
20085
Mitigation candidate1
Not applicable4
Medium5
not blocked5
Working exploit published4
No public exploit1
20092
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
20100
20111
Not applicable1
Medium1
not blocked1
No public exploit1
20120
20130
20144
Not applicable4
Medium4
not blocked4
Working exploit published1
No public exploit3
20154
Not applicable4
Medium4
not blocked4
Working exploit published1
No public exploit3
20160
20172
Not applicable2
Medium2
not blocked2
No public exploit2
20180
20191
Not applicable1
Medium1
not blocked1
No public exploit1
20202
Not applicable2
Medium2
not blocked2
No public exploit2
20215
Not applicable5
Medium5
not blocked5
No public exploit5
20223
Not applicable3
Medium3
not blocked3
No public exploit3
20235
Not applicable5
Medium5
not blocked5
Proof of concept only5
20241
Not applicable1
Medium1
not blocked1
No public exploit1
20251
Not applicable1
Medium1
not blocked1
No public exploit1
20261
Not applicable1
Medium1
not blocked1
No public exploit1
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-2640 | Medium | 2026-03-11 | Not applicable | No public exploit | During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager that could allow a local authenticated user to terminate privileged processes. |
| CVE-2025-2503 | Medium | 2025-05-30 | Not applicable | No public exploit | An improper permission handling vulnerability was reported in Lenovo PC Manager that could allow a local attacker to perform arbitrary file deletions as an elevated user. |
| CVE-2017-3772 | Medium | 2024-07-31 | Not applicable | No public exploit | A vulnerability was reported in Lenovo PC Manager versions prior to 2.6.40.3154 that could allow an attacker to cause a system reboot. |
| CVE-2023-48736 | Medium | 2023-11-18 | Not applicable | Proof of concept only | In International Color Consortium DemoIccMAX 3e7948b, CIccCLUT::Interp2d in IccTagLut.cpp in libSampleICC.a has an out-of-bounds read. |
| CVE-2023-47249 | Medium | 2023-11-05 | Not applicable | Proof of concept only | In International Color Consortium DemoIccMAX 79ecb74, a CIccXmlArrayType:::ParseText function (for unsigned short) in IccUtilXml.cpp in libIccXML.a has an out-of-bounds read. |
| CVE-2023-46867 | Medium | 2023-10-30 | Not applicable | Proof of concept only | In International Color Consortium DemoIccMAX 79ecb74, CIccXformMatrixTRC::GetCurve in IccCmm.cpp in libSampleICC.a has a NULL pointer dereference. |
| CVE-2023-46866 | Medium | 2023-10-30 | Not applicable | Proof of concept only | In International Color Consortium DemoIccMAX 79ecb74, CIccCLUT::Interp3d in IccProfLib/IccTagLut.cpp in libSampleICC.a attempts to access array elements at out-of-bounds indexes. |
| CVE-2023-22485 | Medium | 2023-01-24 | Not applicable | Proof of concept only | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior 0.29.0.gfm.7, a crafted markdown document can trigger an out-of-bounds read in the `validate_protocol` function. We believe this bug is harmless in practice, because the out-of-bounds read accesses `malloc` metadata without causing any visible damage.This vulnerability has been patched in 0.29.0.gfm.7. |
| CVE-2022-27910 | Medium | 2022-07-10 | Not applicable | No public exploit | In Joomla component 'Joomlatools - DOCman 3.5.13 (and likely most versions below)' are affected to an reflected Cross-Site Scripting (XSS) in an image upload function |
| CVE-2021-3722 | Medium | 2022-04-22 | Not applicable | No public exploit | A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow configuration files to be written to non-standard locations during installation. |
| CVE-2021-3721 | Medium | 2022-04-22 | Not applicable | No public exploit | A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.20.10282 that could allow an attacker with local access to trigger a blue screen error. |
| CVE-2021-21907 | Medium | 2021-12-22 | Not applicable | No public exploit | A directory traversal vulnerability exists in the CMA CLI getenv command functionality of Garrett Metal Detectors’ iC Module CMA Version 5.0. A specially-crafted command line argument can lead to local file inclusion. An attacker can provide malicious input to trigger this vulnerability. |
| CVE-2021-37124 | Medium | 2021-10-27 | Not applicable | No public exploit | There is a path traversal vulnerability in Huawei PC product. Because the product does not filter path with special characters,attackers can construct a file path with special characters to exploit this vulnerability. Successful exploitation could allow the attacker to transport a file to certain path.Affected product versions include:PC Smart Full Scene 11.1 versions PCManager 11.1.1.97. |
| CVE-2020-22808 | Medium | 2021-04-29 | Not applicable | No public exploit | An issue was found in yii2_fecshop 2.x. There is a reflected XSS vulnerability in the check cart page. |
| CVE-2021-3451 | Medium | 2021-04-27 | Not applicable | No public exploit | A denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.400.3252, that could allow configuration files to be written to non-standard locations. |
| CVE-2020-8357 | Medium | 2021-03-09 | Not applicable | No public exploit | A denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.200.2042, that could allow configuration files to be written to non-standard locations. |
| CVE-2020-25859 | Medium | 2020-10-15 | Not applicable | No public exploit | The QCMAP_CLI utility in the Qualcomm QCMAP software suite prior to versions released in October 2020 uses a system() call without validating the input, while handling a SetGatewayUrl() request. A local attacker with shell access can pass shell metacharacters and run arbitrary commands. If QCMAP_CLI can be run via sudo or setuid, this also allows elevating privileges to root. This version of QCMAP is used in many kinds of networking devices, primarily mobile hotspots and LTE routers. |
| CVE-2020-1845 | Medium | 2020-04-27 | Not applicable | No public exploit | Huawei PCManager product with versions earlier than 10.0.5.53 have a local privilege escalation vulnerability. An authenticated, local attacker can perform specific operation to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a higher privilege. |
| CVE-2019-5239 | Medium | 2019-08-08 | Not applicable | No public exploit | Huawei PCManager with the versions before 9.0.1.66 (Oversea) and versions before 9.0.1.70 (China) have an information leak vulnerability. Successful exploitation may cause the attacker to read information. |
| CVE-2017-8934 | Medium | 2017-05-15 | Not applicable | No public exploit | PCManFM 1.2.5 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (application unavailability). |
| CVE-2016-5434 | Medium | 2017-01-30 | Not applicable | No public exploit | libalpm, as used in pacman 5.0.1, allows remote attackers to cause a denial of service (infinite loop or out-of-bounds read) via a crafted signature file. |
| CVE-2015-5625 | Medium | 2015-09-07 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in OpenDocMan before 1.3.4 allows remote attackers to inject arbitrary web script or HTML via the redirection parameter. |
| CVE-2015-2971 | Medium | 2015-07-19 | Not applicable | No public exploit | Directory traversal vulnerability in Seeds acmailer before 3.8.18 and 3.9.x before 3.9.12 Beta allows remote authenticated users to delete arbitrary files via a crafted string. |
| CVE-2012-6691 | Medium | 2015-05-20 | Not applicable | No public exploit | Multiple cross-site request forgery (CSRF) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) status parameter to admin/stats_monthly_sales.php or (2) country parameter in a process action to admin/create_account_process.php. |
| CVE-2012-1664 | Medium | 2015-05-20 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter in a process action to admin/login.php; (2) pageTitle, (3) current_product_id, or (4) cPath parameter to admin/new_attributes_include.php; (5) sb_id, (6) sb_key, (7) gc_id, (8) gc_key, or (9) path parameter to admin/htaccess.php; (10) title parameter to admin/information_form.php; (11) search parameter to admin/xsell.php; (12) gross or (13) max parameter to admin/stats_products_purchased.php; (14) status parameter to admin/stats_monthly_sales.php; (15) sorted parameter to admin/stats_customers.php; (16) information_id parameter to /admin/information_manager.php; or (17) zID parameter to /admin/geo_zones.php. |
| CVE-2014-6798 | Medium | 2014-09-29 | Not applicable | No public exploit | The McMaster Marauders (aka com.weever.marauders) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. |
| CVE-2014-3896 | Medium | 2014-07-29 | Not applicable | No public exploit | Multiple cross-site request forgery (CSRF) vulnerabilities in CGI programs in Seeds acmailer before 3.8.17 and 3.9.x before 3.9.10 Beta allow remote attackers to hijack the authentication of arbitrary users for requests that modify or delete data, as demonstrated by modifying data affecting authorization. |
| CVE-2014-4853 | Medium | 2014-07-10 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in odm-init.php in OpenDocMan before 1.2.7.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name of an uploaded file. |
| CVE-2014-2317 | Medium | 2014-03-09 | Not applicable | Working exploit published | SQL injection vulnerability in ajax_udf.php in OpenDocMan before 1.2.7.2 allows remote attackers to execute arbitrary SQL commands via the table parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2011-3764 | Medium | 2011-09-24 | Not applicable | No public exploit | OpenDocMan 1.2.6-svn-2011-01-21 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by User_Perms_class.php and certain other files. |
| CVE-2009-3789 | Medium | 2009-10-26 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in OpenDocMan 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the last_message parameter to (1) add.php, (2) toBePublished.php, (3) index.php, and (4) admin.php; the PATH_INFO to the default URI to (5) category.php, (6) department.php, (7) profile.php, (8) rejects.php, (9) search.php, (10) toBePublished.php, (11) user.php, and (12) view_file.php; and (13) the caller parameter in a Modify User action to user.php. |
| CVE-2008-6552 | Medium | 2009-03-30 | Not applicable | No public exploit | Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9. |
| CVE-2008-4192 | Medium | 2008-09-29 | Not applicable | Working exploit published | The pserver_shutdown function in fence_egenera in cman 2.20080629 and 2.20080801 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/eglog temporary file. |
| CVE-2008-2788 | Medium | 2008-06-20 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in index.php in OpenDocMan 1.2.5 allows remote attackers to inject arbitrary web script or HTML via the redirection parameter. |
| CVE-2008-2787 | Medium | 2008-06-20 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in out.php in OpenDocMan 1.2.5 allows remote attackers to inject arbitrary web script or HTML via the last_message parameter. |
| CVE-2008-1855 | Medium | 2008-04-16 | Not applicable | Working exploit published | FrameworkService.exe in McAfee Common Management Agent (CMA) 3.6.0.574 Patch 3 and earlier, as used by ePolicy Orchestrator (ePO) and ProtectionPilot (PrP), allows remote attackers to corrupt memory and cause a denial of service (CMA Framework service crash) via a long invalid method in requests for the /spin//AVClient//AVClient.csp URI, a different vulnerability than CVE-2006-5274. |
| CVE-2008-1357 | Medium | 2008-03-17 | Mitigation candidate | Working exploit published | Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in a sender field in an AgentWakeup request to UDP port 8082. NOTE: this issue only exists when the debug level is 8. |
| CVE-2007-4959 | Medium | 2007-09-18 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in catalog_products_with_images.php in osCMax 2.0.0-RC3-0-1 allows remote attackers to inject arbitrary web script or HTML via the URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2007-1991 | Medium | 2007-04-12 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in mail/signup.asp in CmailServer WebMail 5.4.3, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the Comment parameter, a different vector than CVE-2007-1927. |
| CVE-2007-1927 | Medium | 2007-04-10 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in signup.asp in CmailServer WebMail 5.3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the POP3Mail parameter. |
| CVE-2007-1516 | Medium | 2007-03-20 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in functions/update.php in Cicoandcico CcMail 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the functions_dir parameter. |
| CVE-2007-0380 | Medium | 2007-01-19 | Not applicable | No public exploit | DocMan 1.3 RC2 allows remote attackers to obtain sensitive information (the full path) via unspecified vectors. |
| CVE-2007-0379 | Medium | 2007-01-19 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in DocMan 1.3 RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2004-1130 | Medium | 2005-01-10 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in admin.asp in CMailServer 5.2 allows remote attackers to execute arbitrary web script or HTML via personal information fields, such as (1) username, (2) name, or (3) comments. |
| CVE-2001-0905 | Medium | 2001-10-18 | Not applicable | No public exploit | Race condition in signal handling of procmail 3.20 and earlier, when running setuid, allows local users to cause a denial of service or gain root privileges by sending a signal while a signal handling routine is already running. |
| CVE-2000-0556 | Medium | 2000-06-05 | Not applicable | No public exploit | Buffer overflow in the web interface for Cmail 2.4.7 allows remote attackers to cause a denial of service by sending a large user name to the user dialog running on port 8002. |