Text Exploits
31,392 exploits tracked across all sources.
Ignite Realtime Openfire 3.10.2 - Cross-Site Request Forgery via Multiple Administrative Endpoints
Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via a crafted request to user-password.jsp, (2) add users via a crafted request to user-create.jsp, (3) edit server settings or (4) disable SSL on the server via a crafted request to server-props.jsp, or (5) add clients via a crafted request to plugins/clientcontrol/permitted-clients.jsp.
by hyp3rlinx
TP-Link NC200/NC220 Cloud Camera 300Mbps Wi-Fi - Hard-Coded Credentials
by LiquidWorm
WordPress Plugin EZ SQL Reports < 4.11.37 - Multiple Vulnerabilities
by Felipe Molina
ManageEngine OpManager 11.5 - Multiple Vulnerabilities
by xistence
ManageEngine EventLog Analyzer < 10.6 - SQL Injection via event/runQuery.do Query Parameter
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as demonstrated by "SELECT 1;INSERT INTO." Fixed in Build 11200.
by xistence
OpenLDAP < 2.4.42 - Denial of Service via Crafted BER Data
The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd.
by Denis Andzakovic
Octogate UTM 3.0.12 - Admin Interface Directory Traversal
by Oliver Karow
macOS < 10.10.5 - Privilege Escalation via Install Framework Legacy Runner Race Condition
Race condition in runner in Install.framework in the Install Framework Legacy component in Apple OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages incorrect privilege dropping associated with a locking error.
by Google Security Research
Apple OS X <10.10.5 - Privilege Escalation
runner in Install.framework in the Install Framework Legacy component in Apple OS X before 10.10.5 does not properly drop privileges, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
by Google Security Research
Apple OS X <10.10.4 - Privilege Escalation
runner in Install.framework in the Install Framework Legacy subsystem in Apple OS X before 10.10.4 does not properly drop privileges, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
by Google Security Research
Synology Video Station < 1.5-0757 - Remote Command Execution via Subtitle Codepage Parameter
Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitle_codepage parameter to subtitle.cgi.
by Han Sahin
QlikTech Qlikview <11.20 SR12 - SSRF
XML external entity (XXE) vulnerability in QlikTech Qlikview before 11.20 SR12 allows remote attackers to conduct server-side request forgery (SSRF) attacks and read arbitrary files via crafted XML data in a request to AccessPoint.aspx.
by Alex Haynes
Joomla HTTP Header Unauthenticated Remote Code Execution
The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple php_var_unserialize calls, which allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted session content.
by Taoguang Chen
CVSS 9.8
PHP < 5.4.45 - Remote Code Execution via Unserialization Use-After-Free
Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are mishandled during unserialization.
by Taoguang Chen
CVSS 9.8
PHP < 5.4.45 - Remote Code Execution via Unserialization Use-After-Free
Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are mishandled during unserialization.
by Taoguang Chen
CVSS 9.8
Advantech WebAccess <8.0.1 - Buffer Overflow
Multiple stack-based buffer overflows in unspecified DLL files in Advantech WebAccess before 8.0.1 allow remote attackers to execute arbitrary code via unknown vectors.
by Praveen Darshanam
WordPress Theme White-Label Framework 2.0.6 - Cross-Site Scripting
by Outlasted
DirectAdmin Web Control Panel 1.483 - Multiple Vulnerabilities
by Ashiyane Digital Security Team
IBM AIX High Availability Cluster Multiprocessing (HACMP) - Local Privilege Escalation
by Kristian Erik Hermansen
JSP/MySQL Administrador Web 1 - Cross-Site Scripting via bd Parameter
Cross-site scripting (XSS) vulnerability in JSP/MySQL Administrador Web 1 allows remote attackers to inject arbitrary web script or HTML via the bd parameter to sys/sys/listaBD2.jsp.
by hyp3rlinx
By Source