Filtered by CWE-284
Filtered by vendor Subscriptions
Total 5100 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-7152 1 Campcodes 1 Advanced Online Voting System 2025-07-08 6.3 Medium
A vulnerability classified as critical has been found in Campcodes Advanced Online Voting System 1.0. Affected is an unknown function of the file /admin/candidates_add.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-7124 1 Anisha 1 Online Note Sharing 2025-07-08 6.3 Medium
A vulnerability classified as critical has been found in code-projects Online Note Sharing 1.0. Affected is an unknown function of the file /dashboard/userprofile.php of the component Profile Image Handler. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-1568 1 Google 1 Chrome Os 2025-07-08 8.8 High
Access Control Vulnerability in Gerrit chromiumos project configuration in Google ChromeOS 16063.87.0 allows an attacker with a registered Gerrit account to inject malicious code into ChromeOS projects and potentially achieve Remote Code Execution and Denial of Service via editing trusted pipelines by insufficient access controls and misconfigurations in Gerrit's project.config.
CVE-2024-29215 1 Mattermost 1 Mattermost Server 2025-07-08 4.3 Medium
Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access control which allows a user to run a slash command in a channel they are not a member of via linking a playbook run to that channel and running a slash command as a playbook task command.
CVE-2025-4536 1 Gosuncntech 1 Group Audio-visual Integrated Management 2025-07-08 5.3 Medium
A vulnerability has been found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /sysmgr/user/listByPage. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-4535 1 Gosuncntech 1 Group Audio-visual Integrated Management 2025-07-08 5.3 Medium
A vulnerability, which was classified as problematic, was found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 4.0. Affected is an unknown function of the file /config/config.properties of the component Configuration File Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-49049 1 Microsoft 1 Remote Ssh 2025-07-08 7.1 High
Visual Studio Code Remote Extension Elevation of Privilege Vulnerability
CVE-2024-49044 1 Microsoft 1 Visual Studio 2022 2025-07-08 6.7 Medium
Visual Studio Elevation of Privilege Vulnerability
CVE-2024-43530 1 Microsoft 5 Windows 10 21h2, Windows 10 22h2, Windows 11 22h2 and 2 more 2025-07-08 7.8 High
Windows Update Stack Elevation of Privilege Vulnerability
CVE-2024-38204 1 Microsoft 1 Azure Functions 2025-07-08 7.5 High
Improper access control in Imagine Cup allows an authorized attacker to elevate privileges over a network.
CVE-2024-43590 1 Microsoft 3 Visual Studio 2017, Visual Studio 2019, Visual Studio 2022 2025-07-08 7.8 High
Visual C++ Redistributable Installer Elevation of Privilege Vulnerability
CVE-2024-43456 1 Microsoft 6 Windows Server 2008, Windows Server 2012, Windows Server 2016 and 3 more 2025-07-08 4.8 Medium
Windows Remote Desktop Services Tampering Vulnerability
CVE-2024-43503 1 Microsoft 1 Sharepoint Server 2025-07-08 7.8 High
Microsoft SharePoint Elevation of Privilege Vulnerability
CVE-2024-49105 1 Microsoft 17 Remote Desktop Client, Windows 10 1507, Windows 10 1607 and 14 more 2025-07-07 8.4 High
Remote Desktop Client Remote Code Execution Vulnerability
CVE-2024-20319 1 Cisco 1 Ios Xr 2025-07-07 4.3 Medium
A vulnerability in the UDP forwarding code of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to bypass configured management plane protection policies and access the Simple Network Management Plane (SNMP) server of an affected device. This vulnerability is due to incorrect UDP forwarding programming when using SNMP with management plane protection. An attacker could exploit this vulnerability by attempting to perform an SNMP operation using broadcast as the destination address that could be processed by an affected device that is configured with an SNMP server. A successful exploit could allow the attacker to communicate to the device on the configured SNMP ports. Although an unauthenticated attacker could send UDP datagrams to the configured SNMP port, only an authenticated user can retrieve or modify data using SNMP requests.
CVE-2025-6837 1 Code-projects 1 Library System 2025-07-07 6.3 Medium
A vulnerability classified as critical was found in code-projects Library System 1.0. Affected by this vulnerability is an unknown functionality of the file /profile.php. The manipulation of the argument image leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-6900 1 Code-projects 1 Library System 2025-07-07 6.3 Medium
A vulnerability has been found in code-projects Library System 1.0 and classified as critical. This vulnerability affects unknown code of the file /add-book.php. The manipulation of the argument image leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2012-6068 1 3s-software 1 Codesys Runtime System 2025-07-02 9.8 Critical
The Runtime Toolkit in CODESYS Runtime System 2.3.x and 2.4.x does not require authentication, which allows remote attackers to execute commands via the command-line interface in the TCP listener service or transfer files via requests to the TCP listener service.
CVE-2023-47294 1 Ncr 1 Terminal Handler 2025-07-02 8.1 High
An issue in NCR Terminal Handler v1.5.1 allows low-level privileged authenticated attackers to arbitrarily deactivate, lock, and delete user accounts via a crafted session cookie.
CVE-2025-2955 1 Totolink 2 A3000ru, A3000ru Firmware 2025-07-02 5.3 Medium
A vulnerability has been found in TOTOLINK A3000RU up to 5.9c.5185 and classified as problematic. This vulnerability affects unknown code of the file /cgi-bin/ExportIbmsConfig.sh of the component IBMS Configuration File Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.