Text Exploits
31,330 exploits tracked across all sources.
Panda Security Products <16.1.2 - Code Injection
PSEvents.exe in multiple Panda Security products runs hourly with SYSTEM privileges and loads DLL files from a user-writable directory without proper validation. An attacker with low-privileged access who can write DLL files to the monitored directory can achieve arbitrary code execution with SYSTEM privileges. Affected products include Panda Global Protection 2016, Panda Antivirus Pro 2016, Panda Small Business Protection, and Panda Internet Security 2016 (all versions up to 16.1.2).
by Security-Assessment.com
WordPress Plugin Ultimate Product Catalog 3.8.6 - Arbitrary File Upload
by i0akiN SEC-LABORATORY
Riverbed SteelCentral NetProfiler & NetExpress 10.8.7 - Multiple Vulnerabilities
by Security-Assessment.com
iBilling 3.7.0 - Persistent Cross-Site Scripting / Reflected Cross-Site Scripting
by Bikramaditya Guha
CodoForum 3.4 - Persistent Cross-Site Scripting
by Ahmed Sherif
Option CloudGate CG0192-11897 - Multiple Vulnerabilities
by LiquidWorm
Magnet Networks Tesley CPVA 642 Router - Weak WPA-PSK Passphrase Algorithm
by Matt O'Connor
Alibaba Clone B2B Script - Arbitrary File Disclosure
by Meisam Monsef
Microsoft JScript/VBScript <5.8 - RCE
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0187.
by Brian Pak
CVSS 7.5
Microsoft Windows 10 - Access Control
The kernel-mode driver in Microsoft Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
by Google Security Research
CVSS 7.8
Microsoft Windows 10 - Access Control
atmfd.dll in the Adobe Type Manager Font Driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "ATMFD.dll Elevation of Privilege Vulnerability."
by Google Security Research
CVSS 7.8
Microsoft Windows 10 - Information Disclosure
GDI32.dll in the Graphics component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to bypass the ASLR protection mechanism via unspecified vectors, aka "Windows Graphics Component Information Disclosure Vulnerability."
by Google Security Research
CVSS 4.3
Radiant CMS 1.1.3 - Multiple Persistent Cross-Site Scripting Vulnerabilities
by David Silveiro
YetiForce CRM < 3.1 - Persistent Cross-Site Scripting
by David Silveiro
SAP NetWeaver AS Java <7.6 - Path Traversal
Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971.
by ERPScan
CVSS 7.5
SAP NetWeaver Java AS <7.5 - DoS
XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of service, conduct SMB Relay attacks, or access arbitrary files via a crafted XML request to _tc~monitoring~webservice~web/ServerNodesWSService, aka SAP Security Note 2235994.
by ERPScan
CVSS 9.1
ACROS Security 0patch 2016.05.19.539 - '0PatchServicex64.exe' Unquoted Service Path Privilege Escalation
by LiquidWorm
By Source