Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2024-1069 |
Description: The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'view_page' function in versions up to, and including, 1.3.2. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS: HIGH (7.2) EPSS Score: 2.46% SSVC Exploitation: none
May 29th, 2025 (10 days ago)
|
|
CVE-2024-1006 |
Description: A vulnerability was found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This issue affects some unknown processing of the file application/index/common.php of the component Cookie Handler. The manipulation of the argument Nod_User_Id/Nod_User_Token leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252275. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Eine kritische Schwachstelle wurde in Shanxi Diankeyun Technology NODERP bis 6.0.2 gefunden. Davon betroffen ist unbekannter Code der Datei application/index/common.php der Komponente Cookie Handler. Dank Manipulation des Arguments Nod_User_Id/Nod_User_Token mit unbekannten Daten kann eine improper authentication-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.
CVSS: HIGH (7.3) EPSS Score: 0.06% SSVC Exploitation: none
May 29th, 2025 (10 days ago)
|
|
CVE-2024-1002 |
Description: A vulnerability classified as critical was found in Totolink N200RE 9.3.5u.6139_B20201216. Affected by this vulnerability is the function setIpPortFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ePort leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252271. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. In Totolink N200RE 9.3.5u.6139_B20201216 wurde eine kritische Schwachstelle entdeckt. Das betrifft die Funktion setIpPortFilterRules der Datei /cgi-bin/cstecgi.cgi. Durch Manipulieren des Arguments ePort mit unbekannten Daten kann eine stack-based buffer overflow-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung.
CVSS: HIGH (7.2) EPSS Score: 0.07% SSVC Exploitation: poc
May 29th, 2025 (10 days ago)
|
|
CVE-2024-0998 |
Description: A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been classified as critical. This affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252267. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Es wurde eine Schwachstelle in Totolink N200RE 9.3.5u.6139_B20201216 ausgemacht. Sie wurde als kritisch eingestuft. Es geht dabei um die Funktion setDiagnosisCfg der Datei /cgi-bin/cstecgi.cgi. Durch Manipulation des Arguments ip mit unbekannten Daten kann eine stack-based buffer overflow-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung.
CVSS: HIGH (7.2) EPSS Score: 0.26% SSVC Exploitation: poc
May 29th, 2025 (10 days ago)
|
|
CVE-2024-0993 |
Description: A vulnerability was found in Tenda i6 1.0.0.9(3857). It has been classified as critical. Affected is the function formWifiMacFilterGet of the file /goform/WifiMacFilterGet of the component httpd. The manipulation of the argument index leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-252258 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Es wurde eine kritische Schwachstelle in Tenda i6 1.0.0.9(3857) ausgemacht. Dabei betrifft es die Funktion formWifiMacFilterGet der Datei /goform/WifiMacFilterGet der Komponente httpd. Mittels Manipulieren des Arguments index mit unbekannten Daten kann eine stack-based buffer overflow-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.
CVSS: HIGH (7.2) EPSS Score: 0.07% SSVC Exploitation: poc
May 29th, 2025 (10 days ago)
|
|
CVE-2024-0219 |
Description: In Telerik JustDecompile versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik JustDecompile install is present, a lower privileged user has the ability to manipulate the installation package to elevate their privileges on the underlying operating system.
CVSS: HIGH (7.8) EPSS Score: 0.6% SSVC Exploitation: none
May 29th, 2025 (10 days ago)
|
|
CVE-2022-31807 |
Description: As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
1. EXECUTIVE SUMMARY
CVSS v4 8.2
ATTENTION: Exploitable remotely/low attack complexity
Vendor: Siemens
Equipment: SiPass
Vulnerability: Improper Verification of Cryptographic Signature
2. RISK EVALUATION
Successful exploitation of this vulnerability could allow an attacker to upload a maliciously modified firmware onto the device.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
Siemens reports that the following products are affected:
Siemens SiPass integrated AC5102 (ACC-G2): All versions
Siemens SiPass integrated ACC-AP: All versions
3.2 VULNERABILITY OVERVIEW
3.2.1 IMPROPER VERIFICATION OF CRYPTOGRAPHIC SIGNATURE CWE-347
Affected devices do not properly check the integrity of firmware updates. This could allow a local attacker to upload a maliciously modified firmware onto the device. In a second scenario, a remote attacker who is able to intercept the transfer of a valid firmware from the server to the device could modify the firmware "on the fly".
CVE-2022-31807 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.2 has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
A CVSS v4 score has also ...
CVSS: HIGH (8.2)
May 29th, 2025 (11 days ago)
|
|
CVE-2022-31812 |
Description: As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
1. EXECUTIVE SUMMARY
CVSS v4 8.7
ATTENTION: Exploitable remotely/low attack complexity
Vendor: Siemens
Equipment: SiPass integrated
Vulnerability: Out-of-bounds Read
2. RISK EVALUATION
Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to cause a denial-of-service condition.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
Siemens reports that the following products are affected:
SiPass integrated: Versions prior to V2.95.3.18
3.2 VULNERABILITY OVERVIEW
3.2.1 OUT-OF-BOUNDS READ CWE-125
Affected server applications contain an out of bounds read past the end of an allocated buffer while checking the integrity of incoming packets. This could allow an unauthenticated remote attacker to create a denial of service condition.
CVE-2022-31812 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
A CVSS v4 score has also been calculated for CVE-2022-31812. A base score of 8.7 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N).
3.3 BACKGROUND
CRITICAL IN...
CVSS: HIGH (8.7)
May 29th, 2025 (11 days ago)
|
|
CVE-2024-22654 |
Description: tcpreplay v4.4.4 was discovered to contain an infinite loop via the tcprewrite function at get.c.
CVSS: HIGH (7.5) EPSS Score: 0.05%
May 29th, 2025 (11 days ago)
|
|
CVE-2025-48045 |
Description: An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials.
CVSS: HIGH (8.7) EPSS Score: 0.06%
May 29th, 2025 (11 days ago)
|