Filtered by CWE-20
Filtered by vendor Subscriptions
Total 13091 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-28291 1 Microsoft 5 Raw Image Extension, Windows 10 20h2, Windows 10 21h2 and 2 more 2025-01-23 8.4 High
Raw Image Extension Remote Code Execution Vulnerability
CVE-2023-23375 1 Microsoft 2 Odbc, Ole Db 2025-01-23 7.8 High
Microsoft ODBC and OLE DB Remote Code Execution Vulnerability
CVE-2024-28240 1 Glpi-project 1 Glpi Agent 2025-01-22 7.3 High
The GLPI Agent is a generic management agent. A vulnerability that only affects GLPI-Agent installed on windows via MSI packaging can allow a local user to cause denial of agent service by replacing GLPI server url with a wrong url or disabling the service. Additionally, in the case the Deploy task is installed, a local malicious user can trigger privilege escalation configuring a malicious server providing its own deploy task payload. GLPI-Agent 1.7.2 contains a patch for this issue. As a workaround, edit GLPI-Agent related key under `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall` and add `SystemComponent` DWORD value setting it to `1` to hide GLPI-Agent from installed applications.
CVE-2023-50733 2025-01-22 8.6 High
A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Web Services feature of newer Lexmark devices.
CVE-2024-28976 1 Dell 1 Repository Manager 2025-01-21 8.8 High
Dell Repository Manager, versions prior to 3.4.5, contains a Path Traversal vulnerability in API module. A local attacker with low privileges could potentially exploit this vulnerability to gain unauthorized write access to the files stored on the server filesystem with the privileges of the running web application.
CVE-2024-28977 1 Dell 1 Repository Manager 2025-01-21 3.3 Low
Dell Repository Manager, versions 3.4.2 through 3.4.4,contains a Path Traversal vulnerability in logger module. A local attacker with low privileges could potentially exploit this vulnerability to gain unauthorized read access to the files stored on the server filesystem with the privileges of the running web application.
CVE-2024-3488 1 Microfocus 1 Imanager 2025-01-21 5.6 Medium
File Upload vulnerability in unauthenticated session found in OpenText™ iManager 3.2.6.0200. The vulnerability could allow ant attacker to upload a file without authentication.
CVE-2024-3968 1 Microfocus 1 Imanager 2025-01-21 7.8 High
Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger remote code execution using custom file upload task.
CVE-2024-4353 1 Concretecms 1 Concrete Cms 2025-01-18 4.8 Medium
Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in the generate dashboard board instance functionality. The Name input field does not check the input sufficiently letting a rogue administrator have the capability to inject malicious JavaScript code. The Concrete CMS security team gave this vulnerability a CVSS v4 score of 4.6 with a vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Concrete versions below 9 are not affected by this vulnerability.Thanks fhAnso for reporting. (CNA updated this risk rank on 17 Jan 2025 by lowering the AC based on CVSS 4.0 documentation that access privileges should not be considered for AC).
CVE-2024-7512 1 Concretecms 1 Concrete Cms 2025-01-18 4.8 Medium
Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in Board instances. A rogue administrator could inject malicious code. The Concrete CMS security team gave this vulnerability a CVSS 4.0 Score of 4.6 with vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Versions below 9 are not affected. Thanks, m3dium for reporting. (CNA updated AC score to L based on CVSS 4.0 documentation)
CVE-2024-54101 1 Huawei 2 Emui, Harmonyos 2025-01-17 6.2 Medium
Denial of service (DoS) vulnerability in the installation module Impact: Successful exploitation of this vulnerability will affect availability.
CVE-2023-25915 1 Danfoss 2 Ak-sm 800a, Ak-sm 800a Firmware 2025-01-17 9.9 Critical
Due to improper input validation, an authenticated remote attacker could execute arbitrary commands on the target system.
CVE-2023-30440 1 Ibm 1 Powervm Hypervisor 2025-01-17 6.7 Medium
IBM PowerVM Hypervisor FW860.00 through FW860.B3, FW950.00 through FW950.70, FW1010.00 through FW1010.50, FW1020.00 through FW1020.30, and FW1030.00 through FW1030.10 could allow a local attacker with control a partition that has been assigned SRIOV virtual function (VF) to cause a denial of service to a peer partition or arbitrary data corruption. IBM X-Force ID: 253175.
CVE-2022-24806 4 Debian, Fedoraproject, Net-snmp and 1 more 16 Debian Linux, Fedora, Net-snmp and 13 more 2025-01-17 6.5 Medium
net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can exploit an Improper Input Validation vulnerability when SETing malformed OIDs in master agent and subagent simultaneously. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.
CVE-2024-31212 1 Instantcms 2 Icms2, Instantcms 2025-01-17 6.7 Medium
InstantCMS is a free and open source content management system. A SQL injection vulnerability affects instantcms v2.16.2 in which an attacker with administrative privileges can cause the application to execute unauthorized SQL code. The vulnerability exists in index_chart_data action, which receives an input from user and passes it unsanitized to the core model `filterFunc` function that further embeds this data in an SQL statement. This allows attackers to inject unwanted SQL code into the statement. The `period` should be escaped before inserting it in the query. As of time of publication, a patched version is not available.
CVE-2022-43455 1 Sewio 1 Real-time Location System Studio 2025-01-17 5.5 Medium
Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation of user input to the service_start, service_stop, and service_restart modules of the software. This could allow an attacker to start, stop, or restart arbitrary services running on the server.
CVE-2022-47917 1 Sewio 1 Real-time Location System Studio 2025-01-17 6.8 Medium
Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation of user input to several modules and services of the software. This could allow an attacker to delete arbitrary files and cause a denial-of-service condition.
CVE-2023-28649 1 Snapone 2 Orvc, Ovrc-300-pro 2025-01-17 8.6 High
The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. A vulnerability exists in which an attacker could impersonate a hub and send device requests to claim already claimed devices. The OvrC cloud platform receives the requests but does not validate if the found devices are already managed by another user.
CVE-2021-25748 1 Kubernetes 1 Ingress-nginx 2025-01-17 7.6 High
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the `spec.rules[].http.paths[].path` field of an Ingress object (in the `networking.k8s.io` or `extensions` API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
CVE-2023-21514 1 Samsung 1 Galaxy Store 2025-01-16 7.5 High
Improper scheme validation from InstantPlay Deeplink in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store.