Overview 401 matches · 3 in Waratek scope · 2 protected · 9 exploited · 3 CISA KEV · 20 public PoC · 12 EPSS ≥ 0.5
401matches
3in Waratek scope0.7%
2protected0.5%
9exploited2.2%
3CISA KEV0.7%
20public PoC5.0%
12EPSS ≥ 0.53.0%
Protected by Waratek
2
0.5%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
0.2%
Outside Waratek scope
16
4.0%
Not applicable
382
95.3%
Withdrawn CVE
0
0.0%
blocked by ARMR today
2
0.5%
partly blocked
0
0.0%
not blocked
399
99.5%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 48 / year
20083
Not applicable3
High3
not blocked3
No public exploit3
20091
Not applicable1
High1
not blocked1
No public exploit1
20101
Not applicable1
High1
not blocked1
No public exploit1
20114
Not applicable4
High4
not blocked4
Exploited2
No public exploit2
201239
Not applicable39
High39
not blocked39
Working exploit published1
No public exploit38
201328
Not applicable28
High28
not blocked28
Exploited2
Working exploit published3
No public exploit23
201418
Outside Waratek scope1
Not applicable17
High18
not blocked18
No public exploit18
201521
Outside Waratek scope1
Not applicable20
High21
not blocked21
Exploited2
Working exploit published1
No public exploit18
201625
Protected by Waratek1
No exploit published1
Outside Waratek scope1
Not applicable22
High25
blocked by ARMR today1
not blocked24
Exploited1
Working exploit published4
Forecast only1
No public exploit19
201717
Not applicable17
High17
not blocked17
Working exploit published1
No public exploit16
20182
Outside Waratek scope1
Not applicable1
High2
not blocked2
No public exploit2
20196
Outside Waratek scope1
Not applicable5
High6
not blocked6
No public exploit6
202021
Not applicable21
High21
not blocked21
Working exploit published1
No public exploit20
202143
Outside Waratek scope7
Not applicable36
High43
not blocked43
Forecast only1
No public exploit42
202232
Outside Waratek scope3
Not applicable29
High32
not blocked32
Exploited1
Working exploit published3
No public exploit28
202340
Not applicable40
High40
not blocked40
Proof of concept only2
No public exploit38
202439
Protected by Waratek1
Not applicable38
High39
blocked by ARMR today1
not blocked38
Exploited1
Proof of concept only15
No public exploit23
202548
Outside Waratek scope1
Not applicable47
High48
not blocked48
Proof of concept only1
No public exploit47
202613
Not applicable13
High13
not blocked13
No public exploit13
2008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-10710 | High | 2026-08-04 | Not applicable | No public exploit | A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. |
| CVE-2026-10709 | High | 2026-08-04 | Not applicable | No public exploit | A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::FbxIO::BinaryReadSectionHeader. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. |
| CVE-2026-48389 | High | 2026-07-20 | Not applicable | No public exploit | DNG SDK versions 1.7.1 2536 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-47964 | High | 2026-06-16 | Not applicable | No public exploit | DNG SDK versions 1.7.1 2536 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-53408 | High | 2026-06-12 | Not applicable | No public exploit | Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an escalation of privilege via network access. |
| CVE-2026-4870 | High | 2026-06-12 | Not applicable | No public exploit | IBM Qiskit SDK 0.43.0 through 2.5.0 could allow an attacker to trigger a segmentation fault leading to a denial of service due to uncontrolled recursion in the parser. |
| CVE-2026-30900 | High | 2026-03-11 | Not applicable | No public exploit | Improper Check of minimum version in update functionality of certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privilege via local access. |
| CVE-2026-27280 | High | 2026-03-10 | Not applicable | No public exploit | DNG SDK versions 1.7.1 2471 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-20430 | High | 2026-03-02 | Not applicable | No public exploit | In wlan AP FW, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00467553; Issue ID: MSV-5151. |
| CVE-2026-21353 | High | 2026-02-10 | Not applicable | No public exploit | DNG SDK versions 1.7.1 2410 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-21352 | High | 2026-02-10 | Not applicable | No public exploit | DNG SDK versions 1.7.1 2410 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2026-20408 | High | 2026-02-02 | Not applicable | No public exploit | In wlan, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00461651; Issue ID: MSV-4758. |
| CVE-2026-21219 | High | 2026-01-13 | Not applicable | No public exploit | Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally. |
| CVE-2025-64893 | High | 2025-12-09 | Not applicable | No public exploit | DNG SDK versions 1.7.0 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure or application denial of service. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2025-64784 | High | 2025-12-09 | Not applicable | No public exploit | DNG SDK versions 1.7.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure or application denial of service. An attacker could leverage this vulnerability to disclose sensitive memory information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2025-64783 | High | 2025-12-09 | Not applicable | No public exploit | DNG SDK versions 1.7.0 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2025-64739 | High | 2025-11-13 | Not applicable | No public exploit | External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access. |
| CVE-2025-62483 | High | 2025-11-13 | Not applicable | No public exploit | Improper removal of sensitive information in certain Zoom Clients before version 6.5.10 may allow an unauthenticated user to conduct a disclosure of information via network access. |
| CVE-2025-20742 | High | 2025-11-04 | Not applicable | No public exploit | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00432680; Issue ID: MSV-3949. |
| CVE-2025-20737 | High | 2025-11-04 | Not applicable | No public exploit | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00435343; Issue ID: MSV-4040. |
| CVE-2025-20735 | High | 2025-11-04 | Not applicable | No public exploit | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00435349; Issue ID: MSV-4051. |
| CVE-2025-20733 | High | 2025-11-04 | Not applicable | No public exploit | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00441509; Issue ID: MSV-4138. |
| CVE-2025-20728 | High | 2025-11-04 | Not applicable | No public exploit | In wlan STA driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00447115; Issue ID: MSV-4276. |
| CVE-2025-20720 | High | 2025-10-14 | Not applicable | No public exploit | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418954; Issue ID: MSV-3569. |
| CVE-2025-20719 | High | 2025-10-14 | Not applicable | No public exploit | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418955; Issue ID: MSV-3570. |
| CVE-2025-20718 | High | 2025-10-14 | Not applicable | No public exploit | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00419945; Issue ID: MSV-3581. |
| CVE-2025-20717 | High | 2025-10-14 | Not applicable | No public exploit | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00419946; Issue ID: MSV-3582. |
| CVE-2025-20716 | High | 2025-10-14 | Not applicable | No public exploit | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00421149; Issue ID: MSV-3728. |
| CVE-2025-20715 | High | 2025-10-14 | Not applicable | No public exploit | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00421152; Issue ID: MSV-3731. |
| CVE-2025-20714 | High | 2025-10-14 | Not applicable | No public exploit | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00432659; Issue ID: MSV-3902. |
| CVE-2025-20713 | High | 2025-10-14 | Not applicable | No public exploit | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00432661; Issue ID: MSV-3904. |
| CVE-2025-20712 | High | 2025-10-14 | Not applicable | No public exploit | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00422323; Issue ID: MSV-3810. |
| CVE-2025-20711 | High | 2025-10-14 | Not applicable | No public exploit | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00422399; Issue ID: MSV-3748. |
| CVE-2025-20710 | High | 2025-10-14 | Not applicable | No public exploit | In wlan AP driver, there is a possible out of bounds write due to an integer overflow. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418785; Issue ID: MSV-3515. |
| CVE-2025-20709 | High | 2025-10-14 | Not applicable | No public exploit | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00415809; Issue ID: MSV-3405. |
| CVE-2025-49461 | High | 2025-09-09 | Not applicable | No public exploit | Cross-site scripting in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access. |
| CVE-2025-49460 | High | 2025-09-09 | Not applicable | No public exploit | Uncontrolled resource consumption in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access. |
| CVE-2025-20686 | High | 2025-07-08 | Not applicable | No public exploit | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00415570; Issue ID: MSV-3404. |
| CVE-2025-20685 | High | 2025-07-08 | Not applicable | No public exploit | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416226; Issue ID: MSV-3409. |
| CVE-2025-44531 | High | 2025-06-24 | Not applicable | Proof of concept only | An issue in Realtek RTL8762EKF-EVB RTL8762E SDK v1.4.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted before a pairing public key is received during a Bluetooth connection attempt. |
| CVE-2025-47962 | High | 2025-06-10 | Not applicable | No public exploit | Improper access control in Windows SDK allows an authorized attacker to elevate privileges locally. |
| CVE-2025-30664 | High | 2025-05-14 | Not applicable | No public exploit | Cross-site scripting in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access. |
| CVE-2025-30663 | High | 2025-05-14 | Not applicable | No public exploit | Time-of-check time-of-use race condition in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access. |
| CVE-2025-20664 | High | 2025-04-07 | Not applicable | No public exploit | In wlan AP driver, there is a possible information disclosure due to an uncaught exception. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00406217; Issue ID: MSV-2773. |
| CVE-2025-20663 | High | 2025-04-07 | Not applicable | No public exploit | In wlan AP driver, there is a possible information disclosure due to an uncaught exception. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00408868; Issue ID: MSV-3031. |
| CVE-2025-27440 | High | 2025-03-11 | Not applicable | No public exploit | Heap overflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access. |
| CVE-2025-27439 | High | 2025-03-11 | Not applicable | No public exploit | Buffer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access. |
| CVE-2025-0151 | High | 2025-03-11 | Not applicable | No public exploit | Use after free in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access. |
| CVE-2025-0150 | High | 2025-03-11 | Not applicable | No public exploit | Incorrect behavior order in some Zoom Workplace Apps for iOS before version 6.3.0 may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2025-0149 | High | 2025-03-11 | Not applicable | No public exploit | Insufficient verification of data authenticity in some Zoom Workplace Apps may allow an unprivileged user to conduct a denial of service via network access. |
| CVE-2024-45424 | High | 2025-02-25 | Not applicable | No public exploit | Business logic error in some Zoom Workplace Apps may allow an unauthenticated user to conduct a disclosure of information via network access. |
| CVE-2024-45421 | High | 2025-02-25 | Not applicable | No public exploit | Buffer overflow in some Zoom Apps may allow an authenticated user to conduct an escalation of privilege via network access. |
| CVE-2024-45418 | High | 2025-02-25 | Not applicable | No public exploit | Symlink following in the installer for some Zoom apps for macOS before version 6.1.5 may allow an authenticated user to conduct an escalation of privilege via network access. |
| CVE-2025-24928 | High | 2025-02-18 | Outside Waratek scope | No public exploit | libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047. |
| CVE-2025-20637 | High | 2025-02-03 | Not applicable | No public exploit | In network HW, there is a possible system hang due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00399035; Issue ID: MSV-2380. |
| CVE-2025-20633 | High | 2025-02-03 | Not applicable | No public exploit | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00400889; Issue ID: MSV-2491. |
| CVE-2025-20632 | High | 2025-02-03 | Not applicable | No public exploit | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00397139; Issue ID: MSV-2188. |
| CVE-2025-20631 | High | 2025-02-03 | Not applicable | No public exploit | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00397141; Issue ID: MSV-2187. |
| CVE-2025-0145 | High | 2025-01-30 | Not applicable | No public exploit | Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local access. |
| CVE-2024-20153 | High | 2025-01-06 | Not applicable | No public exploit | In wlan STA, there is a possible way to trick a client to connect to an AP with spoofed SSID. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08990446 / ALPS09057442; Issue ID: MSV-1598. |
| CVE-2024-20146 | High | 2025-01-06 | Not applicable | No public exploit | In wlan STA driver, there is a possible out of bounds write due to improper input validation. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00389496 / ALPS09137491; Issue ID: MSV-1835. |
| CVE-2024-50930 | High | 2024-12-10 | Not applicable | No public exploit | An issue in Silicon Labs Z-Wave Series 500 v6.84.0 allows attackers to execute arbitrary code. |
| CVE-2024-50920 | High | 2024-12-10 | Not applicable | No public exploit | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to create a fake node via supplying crafted packets. |
| CVE-2024-10256 | High | 2024-12-10 | Not applicable | No public exploit | Insufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker to delete arbitrary files. |
| CVE-2023-7298 | High | 2024-12-09 | Not applicable | No public exploit | A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. |
| CVE-2024-20138 | High | 2024-12-02 | Not applicable | No public exploit | In wlan driver, there is a possible out of bound read due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08998291; Issue ID: MSV-1604. |
| CVE-2024-45422 | High | 2024-11-19 | Not applicable | No public exploit | Improper input validation in some Zoom Apps before version 6.2.0 may allow an unauthenticated user to conduct a denial of service via network access. |
| CVE-2024-45419 | High | 2024-11-19 | Not applicable | No public exploit | Improper input validation in some Zoom Apps may allow an unauthenticated user to conduct a disclosure of information via network access. |
| CVE-2024-21945 | High | 2024-11-12 | Not applicable | No public exploit | Incorrect default permissions in the AMD RyzenTM Master monitoring SDK installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution. |
| CVE-2024-39819 | High | 2024-07-15 | Not applicable | No public exploit | Integrity check in the installer for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct a privilege escalation via local access. |
| CVE-2024-27241 | High | 2024-07-15 | Not applicable | No public exploit | Improper input validation in some Zoom Apps and SDKs may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2024-27238 | High | 2024-07-15 | Not applicable | No public exploit | Race condition in the installer for some Zoom Apps and SDKs for Windows before version 6.0.0 may allow an authenticated user to conduct a privilege escalation via local access. |
| CVE-2024-21778 | High | 2024-07-08 | Not applicable | Proof of concept only | A heap-based buffer overflow vulnerability exists in the configuration file mib_init_value_array functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted .dat file can lead to arbitrary code execution. An attacker can upload a malicious file to trigger this vulnerability. |
| CVE-2023-50383 | High | 2024-07-08 | Not applicable | Proof of concept only | Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to arbitrary command execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This command injection is related to the `localPin` request's parameter. |
| CVE-2023-50382 | High | 2024-07-08 | Not applicable | Proof of concept only | Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to arbitrary command execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This command injection is related to the `peerPin` request's parameter. |
| CVE-2023-50381 | High | 2024-07-08 | Not applicable | Exploited | Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to arbitrary command execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This command injection is related to the `targetAPSsid` request's parameter. |
| CVE-2023-50330 | High | 2024-07-08 | Not applicable | No public exploit | A stack-based buffer overflow vulnerability exists in the boa getInfo functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can send a series of HTTP requests to trigger this vulnerability. |
| CVE-2023-50244 | High | 2024-07-08 | Not applicable | Proof of concept only | Two stack-based buffer overflow vulnerabilities exist in the boa formIpQoS functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This stack-based buffer overflow is related to the `entry_name` request's parameter. |
| CVE-2023-50243 | High | 2024-07-08 | Not applicable | Proof of concept only | Two stack-based buffer overflow vulnerabilities exist in the boa formIpQoS functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This stack-based buffer overflow is related to the `comment` request's parameter. |
| CVE-2023-50240 | High | 2024-07-08 | Not applicable | Proof of concept only | Two stack-based buffer overflow vulnerabilities exist in the boa set_RadvdInterfaceParam functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to trigger these vulnerabilities.This stack-based buffer overflow is related to the `AdvDefaultPreference` request's parameter. |
| CVE-2023-50239 | High | 2024-07-08 | Not applicable | Proof of concept only | Two stack-based buffer overflow vulnerabilities exist in the boa set_RadvdInterfaceParam functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to trigger these vulnerabilities.This stack-based buffer overflow is related to the `interfacename` request's parameter. |
| CVE-2023-49867 | High | 2024-07-08 | Not applicable | Proof of concept only | A stack-based buffer overflow vulnerability exists in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can send a series of HTTP requests to trigger this vulnerability. |
| CVE-2023-49595 | High | 2024-07-08 | Not applicable | Proof of concept only | A stack-based buffer overflow vulnerability exists in the boa rollback_control_code functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of network requests can lead to arbitrary code execution. An attacker can send a sequence of requests to trigger this vulnerability. |
| CVE-2023-49073 | High | 2024-07-08 | Not applicable | Proof of concept only | A stack-based buffer overflow vulnerability exists in the boa formFilter functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to arbitrary code execution. An attacker can send a sequence of requests to trigger this vulnerability. |
| CVE-2023-48270 | High | 2024-07-08 | Not applicable | Proof of concept only | A stack-based buffer overflow vulnerability exists in the boa formDnsv6 functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of network requests can lead to arbitrary code execution. An attacker can send a sequence of requests to trigger this vulnerability. |
| CVE-2023-47856 | High | 2024-07-08 | Not applicable | Proof of concept only | A stack-based buffer overflow vulnerability exists in the boa set_RadvdPrefixParam functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability. |
| CVE-2023-47677 | High | 2024-07-08 | Not applicable | Proof of concept only | A cross-site request forgery (csrf) vulnerability exists in the boa CSRF protection functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted network request can lead to CSRF. An attacker can send an HTTP request to trigger this vulnerability. |
| CVE-2023-45742 | High | 2024-07-08 | Not applicable | No public exploit | An integer overflow vulnerability exists in the boa updateConfigIntoFlash functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to arbitrary code execution. An attacker can send a sequence of requests to trigger this vulnerability. |
| CVE-2023-45215 | High | 2024-07-08 | Not applicable | Proof of concept only | A stack-based buffer overflow vulnerability exists in the boa setRepeaterSsid functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of network requests can lead to arbitrary code execution. An attacker can send a sequence of requests to trigger this vulnerability. |
| CVE-2023-41251 | High | 2024-07-08 | Not applicable | Proof of concept only | A stack-based buffer overflow vulnerability exists in the boa formRoute functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability. |
| CVE-2023-34435 | High | 2024-07-08 | Not applicable | No public exploit | A firmware update vulnerability exists in the boa formUpload functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted network packets can lead to arbitrary firmware update. An attacker can provide a malicious file to trigger this vulnerability. |
| CVE-2023-38264 | High | 2024-05-14 | Protected by Waratek | No public exploit | The IBM SDK, Java Technology Edition's Object Request Broker (ORB) 7.1.0.0 through 7.1.5.21 and 8.0.0.0 through 8.0.8.21 is vulnerable to a denial of service attack in some circumstances due to improper enforcement of the JEP 290 MaxRef and MaxDepth deserialization filters. IBM X-Force ID: 260578. |
| CVE-2023-27334 | High | 2024-05-03 | Not applicable | No public exploit | Softing edgeConnector Siemens ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Softing edgeConnector Siemens. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OPC UA ConditionRefresh requests. By sending a large number of requests, an attacker can consume all available resources on the server. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20498. |
| CVE-2024-21421 | High | 2024-03-12 | Not applicable | No public exploit | Azure SDK Spoofing Vulnerability |
| CVE-2024-22473 | High | 2024-02-21 | Not applicable | No public exploit | TRNG is used before initialization by ECDSA signing driver when exiting EM2/EM3 on Virtual Secure Vault (VSE) devices. This defect may allow Signature Spoofing by Key Recreation.This issue affects Gecko SDK through v4.4.0. |
| CVE-2024-24697 | High | 2024-02-14 | Not applicable | No public exploit | Untrusted search path in some Zoom 32 bit Windows clients may allow an authenticated user to conduct an escalation of privilege via local access. |
| CVE-2023-36493 | High | 2024-02-14 | Not applicable | No public exploit | Uncontrolled search path in some Intel(R) SDK for OpenCL(TM) Applications software may allow an authenticated user to potentially enable escalation of privilege via local access. |
| CVE-2023-6874 | High | 2024-02-05 | Not applicable | No public exploit | Prior to v7.4.0, Ember ZNet is vulnerable to a denial of service attack through manipulation of the NWK sequence number |
| CVE-2023-6387 | High | 2024-02-02 | Not applicable | No public exploit | A potential buffer overflow exists in the Bluetooth LE HCI CPC sample application in the Gecko SDK which may result in a denial of service or remote code execution |
| CVE-2023-49647 | High | 2024-01-12 | Not applicable | No public exploit | Improper access control in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows before version 5.16.10 may allow an authenticated user to conduct an escalation of privilege via local access. |