Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-27 06:35Z
2022-02-09
2022-02-09 04:15Z
MED

CVE-2022-24682 — Synacor Zimbra_collaboration_suite: An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-24682in the wild

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document. CVSSv3.1 6.1 (MEDIUM) · EPSS 98th percentile

CWECWE 116VNDSynacorTYPVulnerabilitySTAitw exploited
6.1
CVSS v3.1
90
Edit Score
2022-02-04
2022-02-04 23:15Z
HIGH

CVE-2020-7534 — Schneider-electric Modicon_m340_bmxp342020_firmware: A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists on the web server used, that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-7534

A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists on the web server used, that could cause a leak of sensitive data or unauthorized actions on the web server during the time the user is logged in. Affected Products: Modicon M340 CPUs: BMXP34 (All Versions), Modicon Quantum CPUs with integrated Ethernet (Copro): 140CPU65 (All Versions), Modicon Premium CPUs with integrated Ethernet (Copro): TSXP57 (All Versions), Modicon M340 ethernet modules: (BMXNOC0401, BMXN CVSSv3.1 8.8 (HIGH) · EPSS 39th percentile

CWECWE 352VNDSchneider ElectricVNDCweTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2022-02-03
2022-02-03 02:15Z
HIGH

CVE-2022-24031 — Insyde Insydeh2o: An SMM memory corruption vulnerability allows an attacker to write fixed or predictable data

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-24031

An issue was discovered in NvmExpressDxe in Insyde InsydeH2O with kernel 5.1 through 5.5. An SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM. CVSSv3.1 8.2 (HIGH)

CWECWE 787VNDInsydeVNDNvmexpressdxeTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2022-02-03
2022-02-03 02:15Z
HIGH

CVE-2021-43615 — Insyde Insydeh2o: An SMM memory corruption vulnerability allows an attacker to write fixed or predictable data

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-43615

An issue was discovered in HddPassword in Insyde InsydeH2O with kernel 5.1 before 05.16.23, 5.2 before 05.26.23, 5.3 before 05.35.23, 5.4 before 05.43.22, and 5.5 before 05.51.22. An SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM. CVSSv3.1 8.2 (HIGH) · EPSS 21th percentile

CWECWE 787VNDInsydeVNDHddpasswordTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2022-02-03
2022-02-03 02:15Z
HIGH

CVE-2021-43323 — Insyde Insydeh2o: An SMM callout vulnerability allows an attacker to hijack execution flow of code running

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-43323

An issue was discovered in UsbCoreDxe in Insyde InsydeH2O with kernel 5.5 before 05.51.45, 5.4 before 05.43.45, 5.3 before 05.35.45, 5.2 before 05.26.45, 5.1 before 05.16.45, and 5.0 before 05.08.45. An SMM callout vulnerability allows an attacker to hijack execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM. CVSSv3.1 8.2 (HIGH)

VNDInsydeVNDUsbcoredxeTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2022-02-03
2022-02-03 02:15Z
HIGH

CVE-2021-42554 — Insyde Insydeh2o: An SMM memory corruption vulnerability in FvbServicesRuntimeDxe allows a possible attacker to write fixed

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-42554

An issue was discovered in Insyde InsydeH2O with Kernel 5.0 before 05.08.42, Kernel 5.1 before 05.16.42, Kernel 5.2 before 05.26.42, Kernel 5.3 before 05.35.42, Kernel 5.4 before 05.42.51, and Kernel 5.5 before 05.50.51. An SMM memory corruption vulnerability in FvbServicesRuntimeDxe allows a possible attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM. CVSSv3.1 8.2 (HIGH) · EPSS 25th percentile

CWECWE 787VNDSiemensVNDInsydeTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2022-02-03
2022-02-03 02:15Z
HIGH

CVE-2021-42113 — Insyde Insydeh2o: An SMM callout vulnerability allows an attacker to hijack execution flow of code running

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-42113

An issue was discovered in StorageSecurityCommandDxe in Insyde InsydeH2O with Kernel 5.1 before 05.14.28, Kernel 5.2 before 05.24.28, and Kernel 5.3 before 05.32.25. An SMM callout vulnerability allows an attacker to hijack execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM. CVSSv3.1 8.2 (HIGH) · EPSS 22th percentile

VNDInsydeVNDStoragesecuritycommanddxeTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
728 × 90 / responsive · programmatic ad slot
2022-02-03
2022-02-03 02:15Z
HIGH

CVE-2021-42060 — Insyde Insydeh2o: An Int15ServiceSmm SMM callout vulnerability allows an attacker to hijack execution flow of code

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-42060

An issue was discovered in Insyde InsydeH2O Kernel 5.0 through 05.08.41, Kernel 5.1 through 05.16.41, Kernel 5.2 before 05.23.22, and Kernel 5.3 before 05.32.22. An Int15ServiceSmm SMM callout vulnerability allows an attacker to hijack execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM. CVSSv3.1 8.2 (HIGH) · EPSS 28th percentile

VNDInsydeTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2022-02-03
2022-02-03 02:15Z
HIGH

CVE-2021-41841 — Insyde Insydeh2o: There is an SMM callout that allows an attacker to access the System Management

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-41841

An issue was discovered in AhciBusDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System Management Mode and execute arbitrary code. This occurs because of Inclusion of Functionality from an Untrusted Control Sphere. CVSSv3.1 8.2 (HIGH)

CWECWE 829VNDInsydeVNDAhcibusdxeTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2022-02-03
2022-02-03 02:15Z
HIGH

CVE-2021-41840 — Insyde Insydeh2o: There is an SMM callout that allows an attacker to access the System Management

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-41840

An issue was discovered in NvmExpressDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System Management Mode and execute arbitrary code. This occurs because of Inclusion of Functionality from an Untrusted Control Sphere. CVSSv3.1 8.2 (HIGH) · EPSS 22th percentile

CWECWE 770VNDInsydeVNDNvmexpressdxeTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2022-02-03
2022-02-03 02:15Z
HIGH

CVE-2021-41839 — Insyde Insydeh2o: Because of an Untrusted Pointer Dereference that causes SMM memory corruption, an attacker may

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-41839

An issue was discovered in NvmExpressDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. Because of an Untrusted Pointer Dereference that causes SMM memory corruption, an attacker may be able to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM. CVSSv3.1 8.2 (HIGH) · EPSS 19th percentile

CWECWE 119VNDInsydeVNDNvmexpressdxeTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2022-02-03
2022-02-03 02:15Z
HIGH

CVE-2021-41838 — Insyde Insydeh2o: There is an SMM callout that allows an attacker to access the System Management

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-41838

An issue was discovered in SdHostDriver in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System Management Mode and execute arbitrary code. This occurs because of a Numeric Range Comparison Without a Minimum Check. CVSSv3.1 8.2 (HIGH) · EPSS 22th percentile

CWECWE 119VNDSiemensVNDInsydeTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2022-02-03
2022-02-03 02:15Z
HIGH

CVE-2021-41837 — Insyde Insydeh2o: Because of an Untrusted Pointer Dereference that causes SMM memory corruption, an attacker may

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-41837

An issue was discovered in AhciBusDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. Because of an Untrusted Pointer Dereference that causes SMM memory corruption, an attacker may be able to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM. CVSSv3.1 8.2 (HIGH)

CWECWE 119VNDSiemensVNDInsydeTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2022-02-03
2022-02-03 02:15Z
HIGH

CVE-2021-33627 — Insyde Insydeh2o: Software SMI services that use the Communicate() function of the EFI_SMM_COMMUNICATION_PROTOCOL do not check

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-33627

An issue was discovered in Insyde InsydeH2O Kernel 5.0 before 05.09.11, 5.1 before 05.17.11, 5.2 before 05.27.11, 5.3 before 05.36.11, 5.4 before 05.44.11, and 5.5 before 05.52.11 affecting FwBlockServiceSmm. Software SMI services that use the Communicate() function of the EFI_SMM_COMMUNICATION_PROTOCOL do not check whether the address of the buffer is valid, which allows use of SMRAM, MMIO, or OS kernel addresses. CVSSv3.1 8.2 (HIGH) · EPSS 25th percentile

CWECWE 119VNDSiemensVNDInsydeTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2022-02-03
2022-02-03 00:15Z
HIGH

CVE-2022-24069 — Insyde Insydeh2o: An SMM callout vulnerability allows an attacker to hijack the execution flow of code

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-24069

An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.0 before 05.08.41, 5.1 before 05.16.29, 5.2 before 05.26.29, 5.3 before 05.35.29, 5.4 before 05.43.29, and 5.5 before 05.51.29. An SMM callout vulnerability allows an attacker to hijack the execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM. CVSSv3.1 8.2 (HIGH) · EPSS 22th percentile

VNDInsydeVNDAhcibusdxeTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2022-02-02
2022-02-02 18:15Z
CRIT

CVE-2021-42640 — Printerlogic Web_stack: Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-42640

PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticated attacker to reassign drivers for any printer. CVSSv3.1 9.1 (CRITICAL) · EPSS 79th percentile

CWECWE 668VNDPrinterlogicTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2022-02-02
2022-02-02 18:15Z
CRIT

CVE-2021-42637 — Printerlogic Web_stack: Web Stack versions 19.1.1.13 SP9 and below use user-controlled input to craft a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-42637

PrinterLogic Web Stack versions 19.1.1.13 SP9 and below use user-controlled input to craft a URL, resulting in a Server Side Request Forgery (SSRF) vulnerability. CVSSv3.1 9.8 (CRITICAL) · EPSS 81th percentile

CWECWE 918VNDPrinterlogicTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2022-02-01
2022-02-01 23:15Z
HIGH

CVE-2021-42638 — Printerlogic Web_stack: Web Stack versions 19.1.1.13 SP9 and below do not sanitize user input resulting

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-42638

PrinterLogic Web Stack versions 19.1.1.13 SP9 and below do not sanitize user input resulting in pre-auth remote code execution. CVSSv3.1 8.1 (HIGH) · EPSS 92th percentile

CWECWE 77VNDPrinterlogicTYPVulnerability
8.1
CVSS v3.1
92
Edit Score
2022-01-31
2022-01-31 18:15Z
HIGH

CVE-2021-42635 — Printerlogic Web_stack: Web Stack versions 19.1.1.13 SP9 and below use a hardcoded APP_KEY value, leading

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-42635

PrinterLogic Web Stack versions 19.1.1.13 SP9 and below use a hardcoded APP_KEY value, leading to pre-auth remote code execution. CVSSv3.1 8.1 (HIGH) · EPSS 92th percentile

CWECWE 798VNDPrinterlogicTYPVulnerability
8.1
CVSS v3.1
92
Edit Score
2022-01-31
2022-01-31 18:15Z
HIGH

CVE-2021-42631 — Printerlogic Virtual_appliance: Web Stack versions 19.1.1.13 SP9 and below deserializes attacker controlled leading to pre-auth

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-42631

PrinterLogic Web Stack versions 19.1.1.13 SP9 and below deserializes attacker controlled leading to pre-auth remote code execution. CVSSv3.1 8.1 (HIGH) · EPSS 93th percentile

CWECWE 502VNDPrinterlogicTYPVulnerability
8.1
CVSS v3.1
92
Edit Score
2022-01-28
2022-01-28 19:15Z
CRIT

CVE-2021-44971 — Tenda Ac15_firmware: Multiple Tenda devices are affected by authentication bypass, such as AC15V1.0 Firmware V15.03.05.20_multi?AC5V1.0 Firmware

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-44971

Multiple Tenda devices are affected by authentication bypass, such as AC15V1.0 Firmware V15.03.05.20_multi?AC5V1.0 Firmware V15.03.06.48_multi and so on. an attacker can obtain sensitive information, and even combine it with authenticated command injection to implement RCE. CVSSv3.1 9.8 (CRITICAL) · EPSS 83th percentile

CWECWE 697VNDTendaTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2022-01-27
2022-01-27 13:15Z
HIGH

CVE-2021-44793 — Krontech Single_connect: The exploitation of this vulnerability might allow a remote attacker to obtain sensitive information

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-44793

Single Connect does not perform an authorization check when using the sc-reports-ui" module. A remote attacker could exploit this vulnerability to access the device configuration page and export the data to an external file. The exploitation of this vulnerability might allow a remote attacker to obtain sensitive information including the database credentials. Since the database runs with high privileges it is possible to execute commands with the attained credentials. CVSSv3.1 8.6 (HIGH) · EPSS 63th percentile

CWECWE 862VNDKrontechTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2022-01-26
2022-01-26 19:15Z
HIGH

CVE-2021-46114 — Jpress Jpress: v 4.2.0 is vulnerable to RCE via io.jpress.module.product.ProductNotifyKit#doSendEmail.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-46114

jpress v 4.2.0 is vulnerable to RCE via io.jpress.module.product.ProductNotifyKit#doSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code. CVSSv3.1 8.8 (HIGH) · EPSS 74th percentile

CWECWE 94VNDJpressTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2022-01-24
2022-01-24 15:15Z
MED

CVE-2022-23437 — Apache Xerces-j: There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-23437

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions. CVSSv3.1 6.5 (MEDIUM) · EPSS 96th percentile

CWECWE 835VNDApacheVNDOracleTYPVulnerability
6.5
CVSS v3.1
86
Edit Score
2022-01-24
2022-01-24 02:15Z
CRIT

CVE-2022-23852 — Libexpat_project Libexpat: Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-23852

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES. CVSSv3.1 9.8 (CRITICAL) · EPSS 91th percentile

CWECWE 190VNDNetappVNDLibexpat ProjectVNDTenableTYPVulnerability
9.8
CVSS v3.1
100
Edit Score