Overview 29 matches · 1 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 3 public PoC · 0 EPSS ≥ 0.5
29matches
1in Waratek scope3.4%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
3public PoC10.3%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
3.4%
Outside Waratek scope
0
0.0%
Not applicable
28
96.6%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
29
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
3
10.3%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
26
89.7%
split by
peak 7 / year
20102
Not applicable2
Medium2
not blocked2
No public exploit2
20111
Not applicable1
Medium1
not blocked1
Working exploit published1
20120
20130
20140
20150
20160
20170
20182
Not applicable2
Medium2
not blocked2
Working exploit published2
20192
Not applicable2
Medium2
not blocked2
No public exploit2
20203
Not applicable3
Medium3
not blocked3
No public exploit3
20212
Not applicable2
Medium2
not blocked2
No public exploit2
20221
Not applicable1
Medium1
not blocked1
No public exploit1
20237
No exploit published1
Not applicable6
Medium7
not blocked7
No public exploit7
20245
Not applicable5
Medium5
not blocked5
No public exploit5
20251
Not applicable1
Medium1
not blocked1
No public exploit1
20263
Not applicable3
Medium3
not blocked3
No public exploit3
201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-69559 | Medium | 2026-09-08 | Not applicable | No public exploit | Origin validation error in Microsoft Teams for Android allows an authorized attacker to disclose information over a network. |
| CVE-2026-65812 | Medium | 2026-09-08 | Not applicable | No public exploit | Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network. |
| CVE-2026-32185 | Medium | 2026-05-12 | Not applicable | No public exploit | Files or directories accessible to external parties in Microsoft Teams allows an unauthorized attacker to perform spoofing locally. |
| CVE-2025-27936 | Medium | 2025-04-16 | Not applicable | No public exploit | Mattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack during webhook secret comparison. |
| CVE-2020-26067 | Medium | 2024-11-18 | Not applicable | No public exploit | A vulnerability in the web-based interface of Cisco Webex Teams could allow an authenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to improper validation of usernames. An attacker could exploit this vulnerability by creating an account that contains malicious HTML or script content and joining a space using the malicious account name. A successful exploit could allow the attacker to conduct cross-site scripting attacks and potentially gain access to sensitive browser-based information.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. |
| CVE-2024-38197 | Medium | 2024-08-13 | Not applicable | No public exploit | Microsoft Teams for iOS Spoofing Vulnerability |
| CVE-2024-20396 | Medium | 2024-07-17 | Not applicable | No public exploit | A vulnerability in the protocol handlers of Cisco Webex App could allow an unauthenticated, remote attacker to gain access to sensitive information. This vulnerability exists because the affected application does not safely handle file protocol handlers. An attacker could exploit this vulnerability by persuading a user to follow a link that is designed to cause the application to send requests. If the attacker can observe transmitted traffic in a privileged network position, a successful exploit could allow the attacker to capture sensitive information, including credential information, from the requests. |
| CVE-2024-21448 | Medium | 2024-03-12 | Not applicable | No public exploit | Microsoft Teams for Android Information Disclosure Vulnerability |
| CVE-2024-21374 | Medium | 2024-02-13 | Not applicable | No public exploit | Microsoft Teams for Android Information Disclosure Vulnerability |
| CVE-2023-46658 | Medium | 2023-10-25 | No exploit published | No public exploit | Jenkins MSTeams Webhook Trigger Plugin 0.1.1 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token. |
| CVE-2023-24881 | Medium | 2023-07-11 | Not applicable | No public exploit | Microsoft Teams Information Disclosure Vulnerability |
| CVE-2023-20104 | Medium | 2023-03-03 | Not applicable | No public exploit | A vulnerability in the file upload functionality of Cisco Webex App for Web could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending an arbitrary file to a user and persuading that user to browse to a specific URL. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. |
| CVE-2022-40137 | Medium | 2023-01-30 | Not applicable | No public exploit | A buffer overflow in the WMI SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to execute arbitrary code. |
| CVE-2022-40136 | Medium | 2023-01-30 | Not applicable | No public exploit | An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory. |
| CVE-2022-40135 | Medium | 2023-01-30 | Not applicable | No public exploit | An information leak vulnerability in the Smart USB Protection SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory. |
| CVE-2022-40134 | Medium | 2023-01-30 | Not applicable | No public exploit | An information leak vulnerability in the SMI Set BIOS Password SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory. |
| CVE-2022-20863 | Medium | 2022-09-08 | Not applicable | No public exploit | A vulnerability in the messaging interface of Cisco Webex App, formerly Webex Teams, could allow an unauthenticated, remote attacker to manipulate links or other content within the messaging interface. This vulnerability exists because the affected software does not properly handle character rendering. An attacker could exploit this vulnerability by sending messages within the application interface. A successful exploit could allow the attacker to modify the display of links or other content within the interface, potentially allowing the attacker to conduct phishing or spoofing attacks. |
| CVE-2021-24114 | Medium | 2021-02-25 | Not applicable | No public exploit | Microsoft Teams iOS Information Disclosure Vulnerability |
| CVE-2021-1242 | Medium | 2021-01-13 | Not applicable | No public exploit | A vulnerability in Cisco Webex Teams could allow an unauthenticated, remote attacker to manipulate file names within the messaging interface. The vulnerability exists because the affected software mishandles character rendering. An attacker could exploit this vulnerability by sharing a file within the application interface. A successful exploit could allow the attacker to modify how the shared file name displays within the interface, which could allow the attacker to conduct phishing or spoofing attacks. |
| CVE-2020-10146 | Medium | 2020-12-09 | Not applicable | No public exploit | The Microsoft Teams online service contains a stored cross-site scripting vulnerability in the displayName parameter that can be exploited on Teams clients to obtain sensitive information such as authentication tokens and to possibly execute arbitrary commands. This vulnerability was fixed for all Teams users in the online service on or around October 2020. |
| CVE-2020-3541 | Medium | 2020-09-04 | Not applicable | No public exploit | A vulnerability in the media engine component of Cisco Webex Meetings Client for Windows, Cisco Webex Meetings Desktop App for Windows, and Cisco Webex Teams for Windows could allow an authenticated, local attacker to gain access to sensitive information. The vulnerability is due to unsafe logging of authentication requests by the affected software. An attacker could exploit this vulnerability by reading log files that are stored in the application directory. A successful exploit could allow the attacker to gain access to sensitive information, which could be used in further attacks. |
| CVE-2020-3131 | Medium | 2020-01-26 | Not applicable | No public exploit | A vulnerability in the Cisco Webex Teams client for Windows could allow an authenticated, remote attacker to cause the client to crash, resulting in a denial of service (DoS) condition. The attacker needs a valid developer account to exploit this vulnerability. The vulnerability is due to insufficient input validation when processing received adaptive cards. The attacker could exploit this vulnerability by sending an adaptive card with malicious content to an existing user of the Cisco Webex Teams client for Windows. A successful exploit could allow the attacker to cause the targeted user's client to crash continuously. This vulnerability was introduced in Cisco Webex Teams client for Windows Release 3.0.13131. |
| CVE-2019-16001 | Medium | 2019-11-26 | Not applicable | No public exploit | A vulnerability in the loading mechanism of specific dynamic link libraries in Cisco Webex Teams for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of the resources loaded by the application at run time. An attacker could exploit this vulnerability by crafting a malicious DLL file and placing it in a specific location on the targeted system. The malicious DLL file would execute when the vulnerable application is launched. A successful exploit could allow the attacker to execute arbitrary code on the target machine with the privileges of another user account. |
| CVE-2019-16133 | Medium | 2019-09-09 | Not applicable | No public exploit | An issue was discovered in eteams OA v4.0.34. Because the session is not strictly checked, the account names and passwords of all employees in the company can be obtained by an ordinary account. Specifically, the attacker sends a jsessionid value for URIs under app/profile/summary/. |
| CVE-2014-7222 | Medium | 2018-01-08 | Not applicable | Working exploit published | Buffer overflow in TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (application crash) by connecting to a channel with a different client instance, and placing crafted data in the Chat/Server tab with two \\ (backslash) characters, a digit, a \ (backslash) character, and "z" in a series of nested img BBCODE tags. |
| CVE-2014-7221 | Medium | 2018-01-08 | Not applicable | Working exploit published | TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (buffer overflow and application crash) by connecting to a channel with a different client instance, and placing crafted data in the Chat/Server tab containing [img]//http:// substrings. |
| CVE-2011-0512 | Medium | 2011-01-20 | Not applicable | Working exploit published | SQL injection vulnerability in team.php in the Teams Structure module 3.0 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the team_id parameter. |
| CVE-2010-3383 | Medium | 2010-10-20 | Not applicable | No public exploit | The (1) teamspeak and (2) teamspeak-server scripts in TeamSpeak 2.0.32 place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. |
| CVE-2010-1339 | Medium | 2010-04-09 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in ts_other.php in the Teamsite Hack plugin 3.0 and earlier for WoltLab Burning Board allows remote attackers to inject arbitrary web script or HTML via the userid parameter in a modboard action, which is not properly handled in a forced SQL error message. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |