Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (7481 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2011-1136 2 Debian, Tesseract Project 2 Debian Linux, Tesseract 2024-11-21 4.7 Medium
In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by guessing the PID and creating a link to the user's file.
CVE-2010-4817 2 Debian, Pithos Project 2 Debian Linux, Pithos 2024-11-21 5.5 Medium
pithos before 0.3.5 allows overwrite of arbitrary files via symlinks.
CVE-2010-4178 2 Fedoraproject, Oracle 2 Fedora, Mysql-gui-tools 2024-11-21 5.5 Medium
MySQL-GUI-tools (mysql-administrator) leaks passwords into process list after with launch of mysql text console
CVE-2010-3095 1 Mailscanner 1 Mailscanner 2024-11-21 4.7 Medium
mailscanner before 4.79.11-2.1 might allow local users to overwrite arbitrary files via a symlink attack on certain temporary files. NOTE: this issue exists because of an incomplete fix for CVE-2008-5313.
CVE-2010-2496 1 Clusterlabs 2 Cluster Glue, Pacemaker 2024-11-21 5.5 Medium
stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer.
CVE-2010-2064 1 Rpcbind Project 1 Rpcbind 2024-11-21 7.1 High
rpcbind 0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /tmp/portmap.xdr and (2) /tmp/rpcbind.xdr.
CVE-2010-0398 1 Autokey Project 1 Autokey 2024-11-21 6.5 Medium
The init script in autokey before 0.61.3-2 allows local attackers to write to arbitrary files via a symlink attack.
CVE-2009-0035 1 Alsa-project 1 Alsa 2024-11-21 5.5 Medium
alsa-utils 1.0.19 and later versions allows local users to overwrite arbitrary files via a symlink attack via the /usr/bin/alsa-info and /usr/bin/alsa-info.sh scripts.
CVE-2008-7273 1 Getfiregpg 1 Iceweasel-firegpg 2024-11-21 7.8 High
A symlink issue exists in Iceweasel-firegpg before 0.6 due to insecure tempfile handling.
CVE-2024-52430 1 Lis 1 Video Gallery 2024-11-20 9.8 Critical
Deserialization of Untrusted Data vulnerability in Lis Lis Video Gallery allows Object Injection.This issue affects Lis Video Gallery: from n/a through 0.2.1.
CVE-2024-52432 2 Nix Solutions, Nixsolutions 2 Nix Anti-spam Light, Nix Anti-spam Light 2024-11-20 9.8 Critical
Deserialization of Untrusted Data vulnerability in NIX Solutions Ltd NIX Anti-Spam Light allows Object Injection.This issue affects NIX Anti-Spam Light: from n/a through 0.0.4.
CVE-2024-52433 1 Mindstien 1 My Geo Posts Free 2024-11-20 9.8 Critical
Deserialization of Untrusted Data vulnerability in Mindstien Technologies My Geo Posts Free allows Object Injection.This issue affects My Geo Posts Free: from n/a through 1.2.
CVE-2024-52292 1 Craftcms 1 Craft Cms 2024-11-19 7.7 High
Craft is a content management system (CMS). The dataUrl function can be exploited if an attacker has write permissions on system notification templates. This function accepts an absolute file path, reads the file's content, and converts it into a Base64-encoded string. By embedding this function within a system notification template, the attacker can exfiltrate the Base64-encoded file content through a triggered system email notification. Once the email is received, the Base64 payload can be decoded, allowing the attacker to read arbitrary files on the server. This is fixed in 5.4.9 and 4.12.8.
CVE-2024-10828 1 Algolplus 2 Advanced Order Export, Advanced Order Export For Woocommerce 2024-11-19 8.1 High
The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.5 via deserialization of untrusted input during Order export when the "Try to convert serialized values" option is enabled. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVE-2021-3838 2 Dompdf, Dompdf Project 2 Dompdf, Dompdf 2024-11-19 9.8 Critical
DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function. An attacker who can upload files of any type to the server can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution, especially when DOMPdf is used with frameworks with documented POP chains like Laravel or vulnerable developer code.
CVE-2024-52414 1 Anthony Carbon 1 Wdes Responsive Mobile Menu 2024-11-19 9.8 Critical
Deserialization of Untrusted Data vulnerability in Anthony Carbon WDES Responsive Mobile Menu allows Object Injection.This issue affects WDES Responsive Mobile Menu: from n/a through 5.3.18.
CVE-2024-52413 1 Dmc 1 Airin Blog 2024-11-19 9.8 Critical
Deserialization of Untrusted Data vulnerability in DMC Airin Blog allows Object Injection.This issue affects Airin Blog: from n/a through 1.6.1.
CVE-2024-52306 2 Backpackforlaravel, Laravel-backpack 2 Filemanager, File Manager 2024-11-19 7.7 High
FileManager provides a Backpack admin interface for files and folder. Prior to 3.0.9, deserialization of untrusted data from the mimes parameter could lead to remote code execution. This vulnerability is fixed in 3.0.9.
CVE-2024-52412 1 Stephen Cui 1 Xin 2024-11-19 9.8 Critical
Deserialization of Untrusted Data vulnerability in Stephen Cui Xin allows Object Injection.This issue affects Xin: from n/a through 1.0.8.1.
CVE-2024-52411 1 Flowcraft Ux Design Studio 1 Advanced Personalization 2024-11-19 9.8 Critical
Deserialization of Untrusted Data vulnerability in Flowcraft UX Design Studio Advanced Personalization allows Object Injection.This issue affects Advanced Personalization: from n/a through 1.1.2.