Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (614 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-25110 1 Microsoft 1 Azure Uamqp 2024-11-22 9.8 Critical
The UAMQP is a general purpose C library for AMQP 1.0. During a call to open_get_offered_capabilities, a memory allocation may fail causing a use-after-free issue and if a client called it during connection communication it may cause a remote code execution. Users are advised to update the submodule with commit `30865c9c`. There are no known workarounds for this vulnerability.
CVE-2024-33879 2 Microsoft, Virtosoftware 2 Sharepoint Server, Sharepoint Bulk File Download 2024-11-21 9.8 Critical
An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted method allows arbitrary file download and deletion via absolute path traversal in the path parameter.
CVE-2024-25140 2 Microsoft, Rustdesk 2 Windows, Rustdesk 2024-11-21 9.8 Critical
A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with Enhanced Key Usage of Code Signing (1.3.6.1.5.5.7.3.3), valid from 2023 until 2033. This is potentially unwanted, e.g., because there is no public documentation of security measures for the private key, and arbitrary software could be signed if the private key were to be compromised. NOTE: the vendor's position is "we do not have EV cert, so we use test cert as a workaround." Insertion into Trusted Root Certification Authorities was the originally intended behavior, and the UI ensured that the certificate installation step (checked by default) was visible to the user before proceeding with the product installation.
CVE-2024-24482 2 Apktool, Microsoft 2 Apktool, Windows 2024-11-21 9.8 Critical
Aprktool before 2.9.3 on Windows allows ../ and /.. directory traversal.
CVE-2024-20738 2 Adobe, Microsoft 2 Framemaker Publishing Server, Windows 2024-11-21 9.8 Critical
Adobe FrameMaker Publishing Server versions 2022.1 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass authentication mechanisms and gain unauthorized access. Exploitation of this issue does not require user interaction.
CVE-2023-5766 2 Devolutions, Microsoft 2 Remote Desktop Manager, Windows 2024-11-21 9.8 Critical
A remote code execution vulnerability in Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to remotely execute code from another windows user session on the same host via a specially crafted TCP packet.
CVE-2023-5765 2 Devolutions, Microsoft 2 Remote Desktop Manager, Windows 2024-11-21 9.8 Critical
Improper access control in the password analyzer feature in Devolutions Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to bypass permissions via data source switching.
CVE-2023-48692 1 Microsoft 1 Azure Rtos Netx Duo 2024-11-21 9.1 Critical
Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execution due to memory overflow vulnerabilities in Azure RTOS NETX Duo. The affected components include processes/functions related to icmp, tcp, snmp, dhcp, nat and ftp in RTOS v6.2.1 and below. The fixes have been included in NetX Duo release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-48316 1 Microsoft 1 Azure Rtos Netx Duo 2024-11-21 9.8 Critical
Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execution due to memory overflow vulnerabilities in Azure RTOS NETX Duo. The affected components include processes/functions related to snmp, smtp, ftp and dtls in RTOS v6.2.1 and below. The fixes have been included in NetX Duo release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-46264 2 Ivanti, Microsoft 2 Avalanche, Windows 2024-11-21 9.8 Critical
An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution.
CVE-2023-46263 2 Ivanti, Microsoft 2 Avalanche, Windows 2024-11-21 9.8 Critical
An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remote code execution.
CVE-2023-46261 2 Ivanti, Microsoft 2 Avalanche, Windows 2024-11-21 9.8 Critical
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVE-2023-46259 2 Ivanti, Microsoft 2 Avalanche, Windows 2024-11-21 9.8 Critical
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVE-2023-46258 2 Ivanti, Microsoft 2 Avalanche, Windows 2024-11-21 9.8 Critical
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVE-2023-46225 2 Ivanti, Microsoft 2 Avalanche, Windows 2024-11-21 9.8 Critical
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVE-2023-46224 2 Ivanti, Microsoft 2 Avalanche, Windows 2024-11-21 9.8 Critical
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVE-2023-46223 2 Ivanti, Microsoft 2 Avalanche, Windows 2024-11-21 9.8 Critical
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVE-2023-46222 2 Ivanti, Microsoft 2 Avalanche, Windows 2024-11-21 9.8 Critical
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVE-2023-46221 2 Ivanti, Microsoft 2 Avalanche, Windows 2024-11-21 9.8 Critical
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVE-2023-46220 2 Ivanti, Microsoft 2 Avalanche, Windows 2024-11-21 9.8 Critical
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.