60.379 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.379 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2020-11976 | HIGH 7.5 | apache fortress By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions | 3.8% | — |
| CVE-2014-1209 | HIGH 9.3 | vmware vsphere_client VMware vSphere Client 4.0, 4.1, 5.0 before Update 3, and 5.1 before Update 2 does not properly validate updates to Client files, which allows remote attackers to trigger the downloading and execution of an arbitrary program via unspecified vectors. | 3.8% | — |
| CVE-2021-42284 | MED 6.8 | microsoft windows_10 Windows Hyper-V Denial of Service Vulnerability | 3.8% | — |
| CVE-2006-5660 | HIGH 7.5 | cisco security_agent_management_center Cisco Security Agent Management Center (CSAMC) 5.1 before 5.1.0.79 does not properly handle certain LDAP error messages, which allows remote attackers to bypass authentication requirements via an empty password when using an external LDAP server. | 3.8% | — |
| CVE-2019-19230 | CRIT 9.8 | broadcom nolio An unsafe deserialization vulnerability exists in CA Release Automation (Nolio) 6.6 with the DataManagement component that can allow a remote attacker to execute arbitrary code. | 3.8% | — |
| CVE-2007-0187 | HIGH 7.5 | f5 firepass F5 FirePass 5.4 through 5.5.2 and 6.0 allows remote attackers to access restricted URLs via (1) a trailing null byte, (2) multiple leading slashes, (3) Unicode encoding, (4) URL-encoded directory traversal or same-directory characters, or (5) upper case letter | 3.8% | — |
| CVE-2019-1753 | HIGH 8.8 | cisco ios_xe A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated but unprivileged (level 1), remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to a failure to validate and sanitize input in We | 3.8% | — |
| CVE-2018-0353 | HIGH 7.5 | cisco web_security_appliance A vulnerability in traffic-monitoring functions in Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to circumvent Layer 4 Traffic Monitor (L4TM) functionality and bypass security protections. The vulnerability is due to a chan | 3.8% | — |
| CVE-2020-1046 | HIGH 7.8 | microsoft .net_framework A remote code execution vulnerability exists when Microsoft .NET Framework processes input. An attacker who successfully exploited this vulnerability could take control of an affected system. To exploit the vulnerability, an attacker would need to be able to u | 3.8% | — |
| CVE-2020-0728 | MED 5.5 | microsoft windows_10 An information vulnerability exists when Windows Modules Installer Service improperly discloses file information, aka 'Windows Modules Installer Service Information Disclosure Vulnerability'. | 3.8% | — |
| CVE-2015-1725 | HIGH 7.2 | microsoft windows_7 Buffer overflow in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local | 3.8% | — |
| CVE-2022-37973 | HIGH 7.7 | microsoft windows_10 Windows Local Session Manager (LSM) Denial of Service Vulnerability | 3.8% | — |
| CVE-2019-15544 | HIGH 7.5 | apache hbase An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls. | 3.8% | — |
| CVE-2017-4907 | CRIT 9.8 | vmware horizon_view VMware Unified Access Gateway (2.5.x, 2.7.x, 2.8.x prior to 2.8.1) and Horizon View (7.x prior to 7.1.0, 6.x prior to 6.2.4) contain a heap buffer-overflow vulnerability which may allow a remote attacker to execute code on the security gateway. | 3.8% | — |
| CVE-2009-2874 | HIGH 7.8 | cisco unified_presence_server The TimesTenD process in Cisco Unified Presence 1.x, 6.x before 6.0(6), and 7.x before 7.0(4) allows remote attackers to cause a denial of service (process crash) via a large number of TCP connections to ports 16200 and 22794, aka Bug ID CSCsy17662. | 3.8% | — |
| CVE-2019-12295 | HIGH 7.5 | canonical ubuntu_linux In Wireshark 3.0.0 to 3.0.1, 2.6.0 to 2.6.8, and 2.4.0 to 2.4.14, the dissection engine could crash. This was addressed in epan/packet.c by restricting the number of layers and consequently limiting recursion. | 3.8% | — |
| CVE-2004-1078 | HIGH 7.5 | citrix metaframe_client Stack-based buffer overflow in the client for Citrix Program Neighborhood Agent for Win32 8.00.24737 and earlier and Citrix MetaFrame Presentation Server client for WinCE before 8.33 allows remote attackers to execute arbitrary code via a long cached icon file | 3.8% | — |
| CVE-2017-8714 | HIGH 7.8 | microsoft windows_10 The Windows Hyper-V component on Microsoft Windows 8.1, Windows Server 2012 Gold and R2,, Windows 10 1607, and Windows Server 2016 allows a remote code execution vulnerability when it fails to properly validate input from an authenticated user on a guest opera | 3.8% | — |
| CVE-2014-3624 | CRIT 9.8 | apache traffic_server Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly tunnel remap requests using CONNECT. | 3.8% | — |
| CVE-2010-1151 | MED 6.8 | apache apache_http_server Race condition in the mod_auth_shadow module for the Apache HTTP Server allows remote attackers to bypass authentication, and read and possibly modify data, via vectors related to improper interaction with an external helper application for validation of crede | 3.8% | — |
| CVE-2020-1176 | HIGH 7.8 | microsoft windows_10 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system. An attacker could exploit this vu | 3.8% | — |
| CVE-2020-1175 | HIGH 7.8 | microsoft windows_10 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system. An attacker could exploit this vu | 3.8% | — |
| CVE-2020-1051 | HIGH 7.8 | microsoft windows_10 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system. An attacker could exploit this vu | 3.8% | — |
| CVE-2021-34838 | HIGH 7.8 | foxit pdf_reader This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. | 3.8% | — |
| CVE-2021-34836 | HIGH 7.8 | foxit pdf_reader This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. | 3.8% | — |