CVE & Exploit Intelligence Database

CVE-2025-32463 9.3 CRITICAL KEV 95 PoCs Analysis EPSS 0.26

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

CWE-829 Jun 30, 2025

CVE-2020-16846 9.8 CRITICAL KEV 2 PoCs Analysis NUCLEI EPSS 0.94

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

CWE-78 Nov 06, 2020

CVE-2020-16009 8.8 HIGH KEV EPSS 0.84

Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CWE-843 Nov 03, 2020

CVE-2020-15999 9.6 CRITICAL KEV 5 PoCs Analysis EPSS 0.93

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CWE-120 Nov 03, 2020

CVE-2020-1472 5.5 MEDIUM KEV RANSOMWARE 95 PoCs Analysis EPSS 0.94

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels. For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020). When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.

Aug 17, 2020

CVE-2020-12641 9.8 CRITICAL KEV 2 PoCs Analysis NUCLEI EPSS 0.93

rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.

CWE-78 May 04, 2020

CVE-2020-11652 6.5 MEDIUM KEV 10 PoCs Analysis EPSS 0.94

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.

CWE-22 Apr 30, 2020

CVE-2020-11651 9.8 CRITICAL KEV 16 PoCs Analysis EPSS 0.94

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.

Apr 30, 2020

CVE-2020-1938 9.8 CRITICAL KEV 42 PoCs Analysis NUCLEI EPSS 0.94

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.

Feb 24, 2020

CVE-2019-13720 8.8 HIGH KEV 5 PoCs Analysis EPSS 0.88

Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CWE-416 Nov 25, 2019

CVE-2019-0211 7.8 HIGH KEV RANSOMWARE 4 PoCs Analysis EPSS 0.89

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

CWE-416 Apr 08, 2019

CVE-2019-5418 7.5 HIGH KEV 12 PoCs Analysis NUCLEI EPSS 0.94

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

CWE-22 Mar 27, 2019

CVE-2016-4171 9.8 CRITICAL KEV EPSS 0.51

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.

Jun 16, 2016

CVE-2016-4117 9.8 CRITICAL KEV RANSOMWARE 4 PoCs Analysis EPSS 0.93

Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.

May 11, 2016

CVE-2016-3718 5.5 MEDIUM KEV 1 PoC Analysis EPSS 0.84

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

CWE-918 May 05, 2016

CVE-2016-3715 5.5 MEDIUM KEV 1 PoC Analysis EPSS 0.78

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.

CWE-552 May 05, 2016

CVE-2016-3714 8.4 HIGH KEV 9 PoCs Analysis EPSS 0.94

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

CWE-20 May 05, 2016

CVE-2016-3427 9.8 CRITICAL KEV EPSS 0.94

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

CWE-284 Apr 21, 2016

CVE-2016-1646 8.8 HIGH KEV EPSS 0.67

The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.

CWE-125 Mar 29, 2016

CVE-2016-0752 7.5 HIGH KEV 4 PoCs Analysis EPSS 0.93

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

CWE-22 Feb 16, 2016