Exploit Database
149,289 exploits tracked across all sources.
Biostar RACING GT Evo <2.1.1905.1700 - Code Injection
An issue was discovered in BS_RCIO64.sys in Biostar RACING GT Evo 2.1.1905.1700. A low-integrity process can open the driver's device object and issue IOCTLs to read or write to arbitrary physical memory locations (or call an arbitrary address), leading to execution of arbitrary code. This is associated with 0x226040, 0x226044, and 0x226000.
CVSS 7.8
Lexmark B2236 Firmware < mslsg.076.294 - OS Command Injection
Embedded web server command injection vulnerability in Lexmark devices through 2021-12-07.
CVSS 9.8
Linux Kernel < 5.14.16 - Remote Denial of Service via TIPC MSG_CRYPTO Size Validation
An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of user-supplied sizes for the MSG_CRYPTO message type.
CVSS 9.8
Sourcecodester Simple Subscription Website 1.0 - XSS
Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Simple Subscription Website 1.0 via the id parameter in plan_application.
CVSS 6.1
Simple Subscription Website 1.0 - SQL Injection via Login
SQL Injection vulnerability exists in Sourcecodester. Simple Subscription Website 1.0. via the login.
CVSS 9.8
Seowon 130-SLC Firmware < 2021-09-15 - Remote Code Execution via queriesCnt Parameter
Seowon 130-SLC router all versions as of 2021-09-15 is vulnerable to Remote Code Execution via the queriesCnt parameter.
CVSS 9.8
TP-Link TL-WR840N EU v5 Firmware <= TL-WR840N(EU)_V5_171211 - Remote Code Execution via PING IP Address Input
The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payload in an IP address input field.
CVSS 9.8
Android - Out-of-bounds Write in SimpleDecodingSource.cpp
In doRead of SimpleDecodingSource.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-194105348
CVSS 9.8
XStream < 1.4.18 - Remote Code Execution via Untrusted Data Deserialization
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CVSS 8.5
Apache Druid < 0.22.0 - Authenticated Arbitrary File Read via HTTP InputSource
In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource. This issue was previously mentioned as being fixed in 0.21.0 as per CVE-2021-26920 but was not fixed in 0.21.0 or 0.21.1.
CVSS 6.5
Microsoft DWM Core Library - Privilege Escalation
Microsoft DWM Core Library Elevation of Privilege Vulnerability
CVSS 8.4
Microsoft DWM Core Library - Privilege Escalation
Microsoft DWM Core Library Elevation of Privilege Vulnerability
CVSS 8.4
Dahua IPC-HUM7XXX IPC-HX3XXX IPC-HX5XXX SD1A1 SD22 SD49 SD50 SD52C SD6AL TPC-BF1241 Firmware Authentication Bypass
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
CVSS 9.8
gerapy < 0.9.9 - Authenticated OS Command Injection
Gerapy is a distributed crawler management framework. Prior to version 0.9.9, an authenticated user could execute arbitrary commands. This issue is fixed in version 0.9.9. There are no known workarounds.
CVSS 8.8
Windows 10 1809-21H1 and Windows Server 2019-20H2 - Kernel Information Disclosure
Windows Kernel Information Disclosure Vulnerability
CVSS 5.5
Windows 10 1809-21H1 and Windows Server 2019-20H2 - Kernel Information Disclosure
Windows Kernel Information Disclosure Vulnerability
CVSS 5.5
Google Chrome <93.0.4577.82 - Heap Corruption
Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS 8.8
Google Chrome <93.0.4577.82 - Heap Corruption
Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS 8.8
Apache OFBiz <17.12.07 - Deserialization
Apache OFBiz has unsafe deserialization prior to 17.12.07 version
CVSS 9.8
Nacos < 1.4.1 - Unauthenticated Database Manipulation via Derby Endpoint
Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)
CVSS 8.6
Apache OFBiz < 17.12.07 - Unauthenticated Remote Code Execution via Unsafe Deserialization
Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack
CVSS 9.8
Windows Hyper-V - Remote Code Execution
Windows Hyper-V Remote Code Execution Vulnerability
CVSS 9.9
MariaDB <10.2.37, 10.3.28, 10.4.18, 10.5.9 - RCE
A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product.
CVSS 7.2
Microsoft Windows Remote Access API - Elevation of Privilege
Remote Access API Elevation of Privilege Vulnerability
CVSS 7.8
AfterLogic Aurora and WebMail Pro < 7.7.9 - Unauthenticated Path Traversal via CalDAV Server Endpoint
An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such as a data/settings/settings.xml file containing admin panel credentials), as demonstrated by dav/server.php/files/personal/%2e%2e when using the caldav_public_user account (with caldav_public_user as its password).
CVSS 7.5
By Source