Exploit Database
149,243 exploits tracked across all sources.
Microsoft Exchange Server - Remote Code Execution via Untrusted Search Path
Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS 8.8
Microsoft Exchange Server - Remote Code Execution via Untrusted Search Path
Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS 8.8
Microsoft Windows 11 22h2 < 10.0.22621.3296 - Buffer Over-read
Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability
CVSS 5.5
Microsoft Windows 11 22h2 < 10.0.22621.3296 - Buffer Over-read
Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability
CVSS 5.5
QNAP QTS < 4.5.4.2627 and QuTS hero < h4.5.4.2626 and QuTScloud < c5.1.5.2651 - Improper Authentication
An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to compromise the security of the system via a network.
We have already fixed the vulnerability in the following versions:
QTS 5.1.3.2578 build 20231110 and later
QTS 4.5.4.2627 build 20231225 and later
QuTS hero h5.1.3.2578 build 20231110 and later
QuTS hero h4.5.4.2626 build 20231225 and later
QuTScloud c5.1.5.2651 and later
CVSS 9.8
Ivanti Connect Secure 9.x, 22.x - Unauthenticated Heap Overflow in IPSec Component
A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack. In certain conditions this may lead to execution of arbitrary code
CVSS 9.8
jsonpath-plus < 10.2.0 - Remote Code Execution via Unsafe vm Usage
All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node.
**Note:**
There were several attempts to fix it in versions [10.0.0-10.1.0](https://github.com/JSONPath-Plus/JSONPath/compare/v9.0.0...v10.1.0) but it could still be exploited using [different payloads](https://github.com/JSONPath-Plus/JSONPath/issues/226).
CVSS 9.8
mysql2 < 3.9.4 - Remote Code Execution via readCodeFor Function
Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.
CVSS 9.8
Microsoft SharePoint Server - Remote Code Execution
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS 7.8
Microsoft SharePoint Server - Remote Code Execution
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS 7.8
Skype < 8.113 - Remote Code Execution
Skype for Consumer Remote Code Execution Vulnerability
CVSS 8.8
Microsoft Exchange Server - Elevation of Privilege via Improper Authentication
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVSS 9.8
Microsoft Exchange Server - Elevation of Privilege via Improper Authentication
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVSS 9.8
Windows Hyper-V - Remote Code Execution via Use-After-Free
Windows Hyper-V Remote Code Execution Vulnerability
CVSS 8.1
Microsoft Confidential Containers < 0.3.3 - Elevation of Privilege via Path Traversal
Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability
CVSS 9.0
Microsoft Outlook - Remote Code Execution
Microsoft Outlook Remote Code Execution Vulnerability
CVSS 8.8
Open Management Infrastructure < 1.8.1-0 - Remote Code Execution
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
CVSS 9.8
WordPress Integrate Google Drive - Info Disclosure
The Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files Into Your WordPress Site plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on multiple AJAX in all versions up to, and including, 1.3.8. This makes it possible for authenticated attackers to modify plugin settings as well as allowing full read/write/delete access to the Google Drive associated with the plugin.
CVSS 10.0
Cisco NX-OS Software - Command Injection
A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator credentials to execute arbitrary commands as root on the underlying operating system of an affected device.
This vulnerability is due to insufficient validation of arguments that are passed to specific configuration CLI commands. An attacker could exploit this vulnerability by including crafted input as the argument of an affected configuration CLI command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of root.
Note: To successfully exploit this vulnerability on a Cisco NX-OS device, an attacker must have Administrator credentials. The following Cisco devices already allow administrative users to access the underlying operating system through the bash-shell feature, so, for these devices, this vulnerability does not grant any additional privileges:
Nexus 3000 Series Switches
Nexus 7000 Series Switches that are running Cisco NX-OS Software releases 8.1(1) and later
Nexus 9000 Series Switches in standalone NX-OS mode
CVSS 6.0
Cisco Secure Client - CRLF Injection
A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed (CRLF) injection attack against a user.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link while establishing a VPN session. A successful exploit could allow the attacker to execute arbitrary script code in the browser or access sensitive, browser-based information, including a valid SAML token. The attacker could then use the token to establish a remote access VPN session with the privileges of the affected user. Individual hosts and services behind the VPN headend would still need additional credentials for successful access.
CVSS 8.2
Cisco NX-OS - Unauthenticated Access Control Bypass via Port Channel Subinterface ACL Programming
A vulnerability in the access control list (ACL) programming for port channel subinterfaces of Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, remote attacker to send traffic that should be blocked through an affected device.
This vulnerability is due to incorrect hardware programming that occurs when configuration changes are made to port channel member ports. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to access network resources that should be protected by an ACL that was applied on port channel subinterfaces.
CVSS 5.8
Adifier System <3.1.7 - Privilege Escalation
The Adifier System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.1.7. This is due to the plugin not properly validating a user's identity prior to updating their details like password through the adifier_recover() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
CVSS 9.8
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) unauthenticated Remote Code Execution
A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.
CVSS 9.8
LoadMaster 7.2.48.1-7.2.48.9 - Unauthenticated OS Command Injection
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.
CVSS 10.0
WooCommerce Point of Sale <6.1.0 - Privilege Escalation
The WooCommerce Point of Sale plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0. This is due to insufficient validation on the 'logged_in_user_id' value when option values are empty and the ability for attackers to change the email of arbitrary user accounts. This makes it possible for unauthenticated attackers to change the email of arbitrary user accounts, including administrators, and reset their password to gain access to the account.
CVSS 9.8
By Source