CVE database
94,255 vulnerabilities, newest first. Each page breaks the severity score down in plain language and lists affected versions, exploitation status and the fix.
- 9.9 Critical severity
SAP NetWeaver and ABAP Platform: Exposed Dangerous Method or Function
SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authorization checks for certain internal functionality. An attacker with low privileges could invoke affected functionality to execute arbitrary operating system commands on th
- 10.0 Critical severity
SAP NetWeaver AS ABAP (Internet Communication…: Improper Validation of Specified Type of Input
SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected fun
- 7.3 High severity
Shimmy: Improper Authentication
A vulnerability was found in Michael-A-Kuykendall Shimmy up to 2.6.4. The affected element is an unknown function of the file src/server.rs of the component Inference API. Performing a manipulation results in missing authentication. The attack is possible to b
- 10.0 Critical severity
M60: Use of Hard-coded Password
A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The e
- 10.0 Critical severity
GV-Face: Cleartext Transmission of Sensitive Information
GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections. The HTTP traffic is not encrypted, an attacker with the ability to intercept network traffic.
- 7.5 High severity
GV-Face: Use of Hard-coded Cryptographic Key
An API key is hardcoded and retrievable from the GV-Face package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.
- 10.0 Critical severity
SAP NetWeaver AS ABAP and ABAP Platform (SAML2…: Improper Verification of Cryptographic Signature
SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitr
- 7.5 High severity
SAP Host Agent: Uncontrolled Search Path Element
SAP Host Agent does not sufficiently validate certain inputs. Under certain condition, an attacker with low privileges could abuse the affected functionality to influence an internal component into loading a malicious file under a privileged account. Successfu
- 7.6 High severity
SAP Web Dispatcher and Internet Communication…: Cross-Site Request Forgery
SAP HANA XSA Web Dispatcher does not perform sufficient request validation in certain administrative functionality. In the context of SAP HANA XSA Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link.
- 7.5 High severity
SAP NetWeaver Application Server (SAP Message…: Incorrect Calculation of Buffer Size
SAP NetWeaver Application Server (SAP Message Server) does not properly size memory allocations when handling certain HTTP requests. An unauthenticated attacker could send a specially crafted request to trigger a heap buffer overflow in affected functionality.
- 7.2 High severity
SAP ABAP Developer Tools (AMDP Data Preview): Improper Control of Generation of Code
SAP ABAP Developer Tools (AMDP Data Preview) does not perform sufficient validation and authorization checks within certain affected functionality. An attacker with high privileges could submit specially crafted input to inject and execute arbitrary code on th
- 8.2 High severity
SAP NetWeaver (Internet Graphics Service): Out-of-bounds Write
SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request to trigger an out-of-bounds memory write in a worker process. Successful expl
- 7.5 High severity
SAP NetWeaver (Internet Graphics Service): Integer Overflow or Wraparound
SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request causing the affected process to read beyond the declared values, resulting in
- 7.5 High severity
SAP NetWeaver (Internet Graphics Service): Out-of-bounds Read
SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request containing malformed image data, triggering an integer overflow that leads to
- 7.5 High severity
SAP NetWeaver (SAP Message Server): Use of Uninitialized Resource
SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated attacker to send specially crafted input. Successful exploitation could allow the attacker to retrieve sensitive information, resulting in a
- 9.9 Critical severity
SAP NetWeaver Knowledge Management (XML Forms): Improper Control of Generation of Code
SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations processed by the affected functionality. Under certain conditions, an authenticated user with access to the affected functionality could cause an
- 7.7 High severity
SAP Web Dispatcher: Stack-based Buffer Overflow
SAP Web Dispatcher does not sufficiently validate certain inputs during processing, which could lead to memory corruption. An attacker authenticated as a non-administrative user could exploit this vulnerability by providing specially crafted input, causing the
- 7.5 High severity
SAP Cloud SDK for Python: Improper Verification of Cryptographic Signature
The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability (CWE-347) in IASContextProvider, the runtime-context provider registered by default via bootstrap(app).IASContextProvider extracted the app_tid, sap_gtid and u
- 9.1 Critical severity
SAP BusinessObjects Business Intelligence…: Improper Restriction of XML External Entity Reference
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection requests. An authenticated attacker could exploit this vulnerability to access restricted resources, ena
- 7.1 High severity
SAP/astonish: Insufficient Granularity of Access Control
In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware sess
- 9.9 Critical severity
S4CRM: Improper Control of Generation of Code
SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An attacker with low privileges could send specially crafted input through a remote interface to inject and execute arb
- 7.5 High severity
SAP NetWeaver Application Server ABAP, ABAP…: Loop with Unreachable Exit Condition
SAP NetWeaver Application Server ABAP, ABAP Platform, and SAP Web Dispatcher do not sufficiently handle resource consumption when processing certain requests. An unauthenticated attacker could send specially crafted requests to the affected component, causing
- 7.5 High severity
SAP NetWeaver Application Server ABAP…: Stack-based Buffer Overflow
SAP NetWeaver Application Server ABAP and SAP Web Dispatcher do not sufficiently validate certain header values processed during inbound request handling. An unauthenticated attacker could send a specially crafted request to cause the affected process to becom
- 9.2 Critical severity
Plesk extension "Site Import": Improper Limitation of a Pathname to a Restricted Directory
The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitr
- 7.5 High severity
VOS: Stack-based Buffer Overflow
Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF. Buffer Overflow Vulnerability Description When a maliciously crafted IKE Auth packet is sent to VOS, the vsmd process crashes, thereby resulting in a Den
- 7.6 High severity
VOS: Weak Authentication
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before t
- 7.6 High severity
VOS: Use of Hard-coded Credentials
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded se
- 9.1 Critical severity
VOS: Generation of Predictable Numbers or Identifiers
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), whi
- 7.6 High severity
VOS: Weak Authentication
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface duri
- 7.6 High severity
VOS: Improper Neutralization of Special Elements used in an OS Command
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /authenticate endpoint of this service passes user-supplied username and
- 8.8 High severity
ettercap: Buffer Underwrite
Ettercap through 0.8.4.1 contains a stack buffer underwrite vulnerability in the telnet dissector in src/dissectors/ec_telnet.c that decrements the output pointer on backspace without a lower bound check. Attackers can send a telnet stream with more backspaces
- 8.1 High severity
ettercap: Out-of-bounds Read
Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in Parse_NTLM_Auth() in src/dissectors/ec_http.c due to unvalidated NTLM message offsets. Attackers can send a crafted HTTP Authorization header observed by Ettercap to read beyond the buffe
- 7.5 High severity
ettercap: Integer Underflow (Wrap or Wraparound)
Ettercap through 0.8.4.1 contains an integer underflow in ccmp_decrypt() in src/ec_encryption_ccmp.c that subtracts the 8-byte CCMP trailer without checking minimum length. Attackers on a network whose WPA key is loaded can send a short crafted CCMP frame to o
- 8.1 High severity
ettercap: Out-of-bounds Read
Ettercap through 0.8.4.1 contains an out-of-bounds read and size_t underflow vulnerability in sslw_remove_sts() in src/ec_sslwrap.c, caused by a stale length and an unchecked memmem() result when stripping Strict-Transport-Security headers. A malicious HTTPS s
- 8.1 High severity
ettercap: Out-of-bounds Read
Ettercap through 0.8.4.1 contains a heap out-of-bounds read vulnerability in sslw_get_clienthello_sni() in src/ec_sslwrap.c that trusts the unchecked 16-bit SNI length field. Network-adjacent attackers can send crafted TLS ClientHello messages during SSL inter
- 8.1 High severity
ettercap: Heap-based Buffer Overflow
Ettercap through 0.8.4.1 contains a heap buffer overflow vulnerability in gg_get_version() in src/dissectors/ec_gg.c that writes up to 44 bytes into a 30-byte allocation. Remote attackers can send Gadu-Gadu traffic on TCP port 8074 with a crafted version field
- 8.8 High severity
ettercap: Use After Free
Ettercap through 0.8.4.1 contains a use-after-free vulnerability in func_pcre() in src/ec_filter.c that reads the PCRE2 ovector after freeing match data. Network-adjacent attackers can send packets matching a loaded pcre_regex() substitution filter to corrupt
- 8.0 High severity
fluxion: Improper Neutralization of Special Elements used in an OS Command
Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes. Attackers within Wi-Fi range can broadcast an access point with a crafted SSID t
- 7.1 High severity
Instatic: Missing Authorization
Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of loadRowForAccess(). Attackers holding content.edit.any but l
- 7.1 High severity
nocobase: Incorrect Authorization
NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee() that lets authenticated users access unassigned AI employees by overriding the role-derived filter with a supplied username. Attackers can use t