Overview 76 matches · 10 in Waratek scope · 8 protected · 10 exploited · 8 CISA KEV · 14 public PoC · 14 EPSS ≥ 0.5
76matches
10in Waratek scope13.2%
8protected10.5%
10exploited13.2%
8CISA KEV10.5%
14public PoC18.4%
14EPSS ≥ 0.518.4%
Protected by Waratek
8
10.5%
Rule in development
0
0.0%
Mitigation candidate
1
1.3%
No exploit published
1
1.3%
Outside Waratek scope
1
1.3%
Not applicable
65
85.5%
Withdrawn CVE
0
0.0%
blocked by ARMR today
8
10.5%
partly blocked
0
0.0%
not blocked
68
89.5%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 14 / year
20143
Not applicable3
Critical3
not blocked3
Exploited3
20150
20162
Not applicable2
Critical2
not blocked2
No public exploit2
20176
Protected by Waratek1
Not applicable5
Critical6
blocked by ARMR today1
not blocked5
Working exploit published1
No public exploit5
20186
Protected by Waratek1
Not applicable5
Critical6
blocked by ARMR today1
not blocked5
Exploited1
No public exploit5
20195
Protected by Waratek3
Not applicable2
Critical5
blocked by ARMR today3
not blocked2
Exploited1
Working exploit published2
Proof of concept only1
Forecast only1
20204
Protected by Waratek1
Not applicable3
Critical4
blocked by ARMR today1
not blocked3
No public exploit4
20216
Protected by Waratek2
No exploit published1
Not applicable3
Critical6
blocked by ARMR today2
not blocked4
Exploited3
Forecast only1
No public exploit2
20226
Mitigation candidate1
Not applicable5
Critical6
not blocked6
Exploited1
Proof of concept only2
No public exploit3
202314
Not applicable14
Critical14
not blocked14
Proof of concept only2
No public exploit12
20247
Not applicable7
Critical7
not blocked7
No public exploit7
20257
Not applicable7
Critical7
not blocked7
Working exploit published1
Proof of concept only3
No public exploit3
202610
Outside Waratek scope1
Not applicable9
Critical10
not blocked10
Exploited1
No public exploit9
2014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-111497 | Critical | 2026-10-22 | Outside Waratek scope | Exploited | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. |
| CVE-2026-88092 | Critical | 2026-10-13 | Not applicable | No public exploit | Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network. |
| CVE-2026-102238 | Critical | 2026-10-13 | Not applicable | No public exploit | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network. |
| CVE-2026-81376 | Critical | 2026-09-08 | Not applicable | No public exploit | Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-65669 | Critical | 2026-09-08 | Not applicable | No public exploit | Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2026-80098 | Critical | 2026-09-03 | Not applicable | No public exploit | Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2026-47304 | Critical | 2026-07-14 | Not applicable | No public exploit | Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-9142 | Critical | 2026-06-19 | Not applicable | No public exploit | There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the server is bound beyond loopback. This may allow an unauthenticated user access to the server on the local network. This affects NI grpc-device 2.17.0 and prior versions. |
| CVE-2026-48137 | Critical | 2026-06-19 | Not applicable | No public exploit | There is an untrusted pointer dereference vulnerability in the NI grpc-device sideband streaming API that may allow an attacker to cause an arbitrary memory dereference, potentially resulting in remote code execution. Successful exploitation requires an attacker to supply a specially crafted Moniker protobuf message. This affects NI grpc-device 2.17.0 and prior versions. |
| CVE-2026-47281 | Critical | 2026-06-09 | Not applicable | No public exploit | Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2025-55315 | Critical | 2025-10-14 | Not applicable | Working exploit published | Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network. |
| CVE-2025-61929 | Critical | 2025-10-10 | Not applicable | Proof of concept only | Cherry Studio is a desktop client that supports for multiple LLM providers. Cherry Studio registers a custom protocol called `cherrystudio://`. When handling the MCP installation URL, it parses the base64-encoded configuration data and directly executes the command within it. In the files `src/main/services/ProtocolClient.ts` and `src/main/services/urlschema/mcp-install.ts`, when receiving a URL of the `cherrystudio://mcp` type, the `handleMcpProtocolUrl` function is called for processing. If an attacker crafts malicious content and posts it on a website or elsewhere (there are many exploitation methods, such as creating a malicious website with a button containing this malicious content), when the user clicks it, since the pop-up window contains normal content, the direct click is considered a scene action, and the malicious command is directly triggered, leading to the user being compromised. As of time of publication, no known patched versions exist. |
| CVE-2025-55319 | Critical | 2025-09-12 | Not applicable | No public exploit | Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network. |
| CVE-2025-35452 | Critical | 2025-09-05 | Not applicable | No public exploit | PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use default, shared credentials for the administrative web interface. |
| CVE-2025-54382 | Critical | 2025-08-13 | Not applicable | Proof of concept only | Cherry Studio is a desktop client that supports for multiple LLM providers. In version 1.5.1, a remote code execution (RCE) vulnerability exists in the Cherry Studio platform when connecting to streamableHttp MCP servers. The issue arises from the server’s implicit trust in the oauth auth redirection endpoints and failure to properly sanitize the URL. This issue has been patched in version 1.5.2. |
| CVE-2025-54063 | Critical | 2025-08-11 | Not applicable | Proof of concept only | Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.4.8 to 1.5.0, there is a one-click remote code execution vulnerability through the custom URL handling. An attacker can exploit this by hosting a malicious website or embedding a specially crafted URL on any website. If a victim clicks the exploit link in their browser, the app’s custom URL handler is triggered, leading to remote code execution on the victim’s machine. This issue has been patched in version 1.5.1. |
| CVE-2025-30387 | Critical | 2025-05-13 | Not applicable | No public exploit | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2024-49038 | Critical | 2024-11-26 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('Cross-site Scripting') in Copilot Studio by an unauthorized attacker leads to elevation of privilege over a network. |
| CVE-2024-43498 | Critical | 2024-11-12 | Not applicable | No public exploit | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2024-47406 | Critical | 2024-10-25 | Not applicable | No public exploit | Sharp and Toshiba Tec MFPs improperly process HTTP authentication requests, resulting in an authentication bypass vulnerability. |
| CVE-2024-43488 | Critical | 2024-10-08 | Not applicable | No public exploit | Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution through network attack vector. |
| CVE-2023-6078 | Critical | 2024-02-01 | Not applicable | No public exploit | An OS Command Injection vulnerability exists in BIOVIA Materials Studio products from Release BIOVIA 2021 through Release BIOVIA 2023. Upload of a specially crafted perl script can lead to arbitrary command execution. |
| CVE-2024-0057 | Critical | 2024-01-09 | Not applicable | No public exploit | NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability |
| CVE-2023-51717 | Critical | 2024-01-09 | Not applicable | No public exploit | Dataiku DSS before 11.4.5 and 12.4.1 has Incorrect Access Control that could lead to a full authentication bypass. |
| CVE-2023-36049 | Critical | 2023-11-14 | Not applicable | No public exploit | .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability |
| CVE-2023-43791 | Critical | 2023-11-09 | Not applicable | Proof of concept only | Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chained within the ORM Leak vulnerability to impersonate any account on Label Studio. An attacker could exploit these vulnerabilities to escalate their privileges from a low privilege user to a Django Super Administrator user. The vulnerability was found to affect versions before `1.8.2`, where a patch was introduced. |
| CVE-2023-36758 | Critical | 2023-09-12 | Not applicable | No public exploit | Visual Studio Elevation of Privilege Vulnerability |
| CVE-2023-39967 | Critical | 2023-09-06 | Not applicable | Proof of concept only | WireMock is a tool for mocking HTTP services. When certain request URLs like “@127.0.0.1:1234" are used in WireMock Studio configuration fields, the request might be forwarded to an arbitrary service reachable from WireMock’s instance. There are 3 identified potential attack vectors: via “TestRequester” functionality, webhooks and the proxy mode. As we can control HTTP Method, HTTP Headers, HTTP Data, it allows sending requests with the default level of credentials for the WireMock instance. The vendor has discontinued the affected Wiremock studio product and there will be no fix. Users are advised to find alternatives. |
| CVE-2023-27881 | Critical | 2023-06-07 | Not applicable | No public exploit | A user could use the “Upload Resource” functionality to upload files to any location on the disk. |
| CVE-2023-2504 | Critical | 2023-05-22 | Not applicable | No public exploit | Files present on firmware images could allow an attacker to gain unauthorized access as a root user using hard-coded credentials. |
| CVE-2023-0558 | Critical | 2023-01-27 | Not applicable | No public exploit | The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to an unsecure token check that is susceptible to type juggling in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to execute functions intended for use by users with proper API keys. |
| CVE-2023-0556 | Critical | 2023-01-27 | Not applicable | No public exploit | The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to obtain the blog metadata (via the function cstu_get_metadata) that includes the plugin's contentstudio_token. Knowing this token allows for other interactions with the plugin such as creating posts in versions prior to 1.2.5, which added other requirements to posting and updating. |
| CVE-2022-47911 | Critical | 2023-01-18 | Not applicable | No public exploit | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the backup services of the software. This could allow a remote attacker to access sensitive functions of the application and execute arbitrary system commands. |
| CVE-2022-46733 | Critical | 2023-01-18 | Not applicable | No public exploit | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site scripting in its backup services. An attacker could take advantage of this vulnerability to execute arbitrary commands. |
| CVE-2022-45444 | Critical | 2023-01-18 | Not applicable | No public exploit | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 contains hard-coded passwords for select users in the application’s database. This could allow a remote attacker to login to the database with unrestricted access. |
| CVE-2022-43483 | Critical | 2023-01-18 | Not applicable | No public exploit | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the monitor services of the software. This could allow a remote attacker to access sensitive functions of the application and execute arbitrary system commands. |
| CVE-2022-41989 | Critical | 2023-01-18 | Not applicable | No public exploit | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not validate the length of RTLS report payloads during communication. This allows an attacker to send an exceedingly long payload, resulting in an out-of-bounds write to cause a denial-of-service condition or code execution. |
| CVE-2021-4311 | Critical | 2023-01-09 | Not applicable | No public exploit | A vulnerability classified as problematic was found in Talend Open Studio for MDM. This vulnerability affects unknown code of the component XML Handler. The manipulation leads to xml external entity reference. The patch is identified as 31d442b9fb1d518128fd18f6e4d54e06c3d67793. It is recommended to apply a patch to fix this issue. VDB-217666 is the identifier assigned to this vulnerability. |
| CVE-2022-43143 | Critical | 2022-11-21 | Not applicable | Proof of concept only | A cross-site scripting (XSS) vulnerability in Beekeeper Studio v3.6.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the error modal container. |
| CVE-2021-22289 | Critical | 2022-08-11 | Not applicable | No public exploit | Improper Input Validation vulnerability in the project upload mechanism in B&R Automation Studio version >=4.0 may allow an unauthenticated network attacker to execute code. |
| CVE-2022-31525 | Critical | 2022-07-11 | Not applicable | No public exploit | The SummaLabs/DLS repository through 0.1.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
| CVE-2022-34151 | Critical | 2022-07-04 | Not applicable | Exploited | Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who successfully obtained the user credentials by analyzing the affected product to access the controller. |
| CVE-2022-22978 | Critical | 2022-05-19 | Mitigation candidate | Proof of concept only | In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass. |
| CVE-2022-26174 | Critical | 2022-03-21 | Not applicable | No public exploit | A remote code execution (RCE) vulnerability in Beekeeper Studio v3.2.0 allows attackers to execute arbitrary code via a crafted payload injected into the display fields. |
| CVE-2021-45046 | Critical | 2021-12-14 | Protected by Waratek | Exploited | It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default. |
| CVE-2021-44228 | Critical | 2021-12-10 | Protected by Waratek | Exploited | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. |
| CVE-2021-41303 | Critical | 2021-09-17 | No exploit published | Forecast only | Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0. |
| CVE-2021-22681 | Critical | 2021-03-03 | Not applicable | Exploited | Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. |
| CVE-2021-26701 | Critical | 2021-02-25 | Not applicable | No public exploit | .NET Core Remote Code Execution Vulnerability |
| CVE-2021-24112 | Critical | 2021-02-25 | Not applicable | No public exploit | .NET Core Remote Code Execution Vulnerability |
| CVE-2020-29595 | Critical | 2020-12-07 | Not applicable | No public exploit | PlugIns\IDE_ACDStd.apl in ACDSee Photo Studio Studio Professional 2021 14.0 Build 1705 has a User Mode Write AV starting at IDE_ACDStd!JPEGTransW+0x00000000000031aa. |
| CVE-2017-15681 | Critical | 2020-11-27 | Protected by Waratek | No public exploit | In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which allows unauthenticated attackers to overwrite files from the operating system which can lead to RCE. |
| CVE-2020-10284 | Critical | 2020-07-15 | Not applicable | No public exploit | No authentication is required to control the robot inside the network, moreso the latest available user manual shows an option that lets the user to add a password to the robot but as in xarm_studio 1.3.0 the option is missing from the menu. Assuming manual control, even by forcefully removing the current operator from an active session. |
| CVE-2019-19108 | Critical | 2020-04-20 | Not applicable | No public exploit | An authentication weakness in the SNMP service in B&R Automation Runtime versions 2.96, 3.00, 3.01, 3.06 to 3.10, 4.00 to 4.63, 4.72 and above allows unauthenticated users to modify the configuration of B&R products via SNMP. |
| CVE-2019-17571 | Critical | 2019-12-20 | Protected by Waratek | Proof of concept only | Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17. |
| CVE-2019-10173 | Critical | 2019-07-23 | Protected by Waratek | Forecast only | It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285) |
| CVE-2013-7285 | Critical | 2019-05-15 | Protected by Waratek | Working exploit published | Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON. |
| CVE-2019-8982 | Critical | 2019-02-21 | Not applicable | Exploited | com/wavemaker/studio/StudioService.java in WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value, leading to disclosure of local files and SSRF. |
| CVE-2019-6543 | Critical | 2019-02-13 | Not applicable | Working exploit published | AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update. Code is executed under the program runtime privileges, which could lead to the compromise of the machine. |
| CVE-2018-17916 | Critical | 2018-11-02 | Not applicable | No public exploit | InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2. A remote attacker could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag, alarm, or event related actions such as read and write, with potential for code to be executed. If InduSoft Web Studio remote communication security was not enabled, or a password was left blank, a remote user could send a carefully crafted packet to invoke an arbitrary process, with potential for code to be executed. The code would be executed under the privileges of the InduSoft Web Studio or InTouch Edge HMI runtime and could lead to a compromise of the InduSoft Web Studio or InTouch Edge HMI server machine. |
| CVE-2018-17914 | Critical | 2018-11-02 | Not applicable | No public exploit | InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2. This vulnerability could allow an unauthenticated user to remotely execute code with the same privileges as that of the InduSoft Web Studio or InTouch Edge HMI (formerly InTouch Machine Edition) runtime. |
| CVE-2018-14818 | Critical | 2018-10-08 | Not applicable | No public exploit | WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior have a stack-based buffer overflow vulnerability which may allow remote code execution. |
| CVE-2018-10620 | Critical | 2018-07-19 | Not applicable | No public exploit | AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag, alarm, or event related actions such as read and write, with potential for code to be executed. |
| CVE-2018-8840 | Critical | 2018-04-18 | Not applicable | No public exploit | A remote attacker could send a carefully crafted packet in InduSoft Web Studio v8.1 and prior versions, and/or InTouch Machine Edition 2017 v8.1 and prior versions during a tag, alarm, or event related action such as read and write, which may allow remote code execution. |
| CVE-2018-1273 | Critical | 2018-04-11 | Protected by Waratek | Exploited | Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack. |
| CVE-2017-14024 | Critical | 2017-11-13 | Not applicable | No public exploit | A Stack-based Buffer Overflow issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 Patch 1 and prior versions, and InTouch Machine Edition v8.0 SP2 Patch 1 and prior versions. The stack-based buffer overflow vulnerability has been identified, which may allow remote code execution with high privileges. |
| CVE-2017-13999 | Critical | 2017-10-17 | Not applicable | No public exploit | A Stack-based Buffer Overflow issue was discovered in WECON LEVI Studio HMI Editor v1.8.1 and prior. Multiple stack-based buffer overflow vulnerabilities have been identified in which the application does not verify string size before copying to memory; the attacker may then be able to crash the application or run arbitrary code. |
| CVE-2017-13997 | Critical | 2017-10-03 | Not applicable | No public exploit | A Missing Authentication for Critical Function issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 or prior, and InTouch Machine Edition v8.0 SP2 or prior. InduSoft Web Studio provides the capability for an HMI client to trigger script execution on the server for the purposes of performing customized calculations or actions. A remote malicious entity could bypass the server authentication and trigger the execution of an arbitrary command. The command is executed under high privileges and could lead to a complete compromise of the server. |
| CVE-2017-5645 | Critical | 2017-04-17 | Protected by Waratek | Working exploit published | In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code. |
| CVE-2014-9847 | Critical | 2017-03-20 | Not applicable | No public exploit | The jng decoder in ImageMagick 6.8.9.9 allows remote attackers to have an unspecified impact. |
| CVE-2014-9846 | Critical | 2017-03-20 | Not applicable | No public exploit | Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact. |
| CVE-2016-5118 | Critical | 2016-06-10 | Not applicable | No public exploit | The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename. |
| CVE-2016-0718 | Critical | 2016-05-26 | Not applicable | No public exploit | Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. |
| CVE-2014-7169 | Critical | 2014-09-25 | Not applicable | Exploited | GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271. |
| CVE-2014-6271 | Critical | 2014-09-24 | Not applicable | Exploited | GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix. |
| CVE-2014-0780 | Critical | 2014-04-25 | Not applicable | Exploited | Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests. |