Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-28 09:53Z
2019-06-12
2019-06-12 14:29Z
HIGH

CVE-2019-1069 — Microsoft Windows_10_1507: An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-1069in the wild

An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system. To exploit the vulnerability, an attacker would require unprivileged code execution on a victim system. The security update addresses the vulnerability by correctly validating file operations. CVSSv3.1 7.8 (HIGH) · EPSS 93th percentile

CWECWE 59VNDMicrosoftTYPVulnerabilitySTAitw exploited
7.8
CVSS v3.1
91
Edit Score
2019-06-07
2019-06-07 18:29Z
CRIT

CVE-2019-10160 — Python Python: A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-10160

A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted U CVSSv3.1 9.8 (CRITICAL) · EPSS 92th percentile

CWECWE 522CWECWE 172VNDCveTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2019-06-03
2019-06-03 20:29Z
CRIT

CVE-2017-14854 — Orpak Siteomat: A stack buffer overflow exists in one of the Orpak SiteOmat CGI components, allowing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-14854

A stack buffer overflow exists in one of the Orpak SiteOmat CGI components, allowing for remote code execution. The vulnerability affects all versions prior to 2017-09-25. CVSSv3.1 9.1 (CRITICAL) · EPSS 94th percentile

CWECWE 121CWECWE 119VNDOrpakTYPVulnerability
9.1
CVSS v3.1
99
Edit Score
2019-06-03
2019-06-03 19:29Z
HIGH

CVE-2017-14853 — Orpak Siteomat: The Orpak SiteOmat OrCU component is vulnerable to code injection, for all versions prior

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-14853

The Orpak SiteOmat OrCU component is vulnerable to code injection, for all versions prior to 2017-09-25, due to a search query that uses a direct shell command. By tampering with the request, an attacker is able to run shell commands and receive valid output from the device. CVSSv3.1 8.6 (HIGH) · EPSS 81th percentile

CWECWE 94VNDOrpakTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2019-06-03
2019-06-03 19:29Z
HIGH

CVE-2017-14852 — Orpak Siteomat: The attack allows for an eavesdropper to capture the communication and decrypt the data.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-14852

An insecure communication was found between a user and the Orpak SiteOmat management console for all known versions, due to an invalid SSL certificate. The attack allows for an eavesdropper to capture the communication and decrypt the data. CVSSv3.1 8.6 (HIGH) · EPSS 69th percentile

CWECWE 311CWECWE 310VNDOrpakTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2019-06-03
2019-06-03 19:29Z
CRIT

CVE-2017-14851 — Orpak Siteomat: A SQL injection vulnerability exists in all Orpak SiteOmat versions prior to 2017-09-25.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-14851

A SQL injection vulnerability exists in all Orpak SiteOmat versions prior to 2017-09-25. The vulnerability is in the login page, where the authentication validation process contains an insecure SELECT query. The attack allows for authentication bypass. CVSSv3.1 9.8 (CRITICAL) · EPSS 90th percentile

CWECWE 89VNDOrpakTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2019-06-03
2019-06-03 19:29Z
CRIT

CVE-2017-14728 — Orpak Siteomat: An authentication bypass was found in an unknown area of the SiteOmat source code.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-14728

An authentication bypass was found in an unknown area of the SiteOmat source code. All SiteOmat BOS versions are affected, prior to the submission of this exploit. Also, the SiteOmat does not force administrators to switch passwords, leaving SSH and HTTP remote authentication open to public. CVSSv3.1 9.8 (CRITICAL) · EPSS 93th percentile

CWECWE 798VNDOrpakTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
728 × 90 / responsive · programmatic ad slot
2019-05-30
2019-05-30 16:29Z
CRIT

CVE-2019-8457 — Sqlite Sqlite: SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-8457

SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables. CVSSv3.1 9.8 (CRITICAL) · EPSS 99th percentile

CWECWE 125VNDSqliteVNDCanonicalTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2019-05-28
2019-05-28 22:29Z
HIGH

CVE-2019-5589 — Fortinet Forticlient: A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-5589

A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable CVSSv3.1 8.8 (HIGH) · EPSS 85th percentile

CWECWE 426VNDFortinetTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2019-05-28
2019-05-28 19:29Z
HIGH

CVE-2019-5436 — Haxx Libcurl: A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-5436

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1. CVSSv3.1 7.8 (HIGH) · EPSS 99th percentile

CWECWE 787CWECWE 122VNDHaxxTYPVulnerability
7.8
CVSS v3.1
100
Edit Score
2019-05-23
2019-05-23 16:29Z
CRIT

CVE-2019-7106 — Adobe Xd: versions 16.0 and earlier have a path traversal vulnerability.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-7106

Adobe XD versions 16.0 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution. CVSSv3.1 9.8 (CRITICAL) · EPSS 95th percentile

CWECWE 22VNDAdobeTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2019-05-23
2019-05-23 16:29Z
CRIT

CVE-2019-7105 — Adobe Xd: versions 16.0 and earlier have a path traversal vulnerability.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-7105

Adobe XD versions 16.0 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution. CVSSv3.1 9.8 (CRITICAL) · EPSS 95th percentile

CWECWE 22VNDAdobeTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2019-05-22
2019-05-22 20:29Z
HIGH

CVE-2019-6820 — Schneider-electric Modicon_m100_firmware: A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-6820

A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address, network mask and gateway IP address) when a specific Ethernet frame is received in all versions of: Modicon M100, Modicon M200, Modicon M221, ATV IMC drive controller, Modicon M241, Modicon M251, Modicon M258, Modicon LMC058, Modicon LMC078, PacDrive Eco ,PacDrive Pro, PacDrive Pro2 CVSSv3.1 8.2 (HIGH) · EPSS 53th percentile

CWECWE 306VNDSchneider ElectricVNDCweTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2019-05-22
2019-05-22 19:29Z
HIGH

CVE-2018-12886 — Gnu Gcc: stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-12886

stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary i CVSSv3.1 8.1 (HIGH) · EPSS 82th percentile

CWECWE 209VNDGnuTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2019-05-22
2019-05-22 17:29Z
CRIT

CVE-2019-11634 — Citrix Receiver: Workspace App before 1904 for Windows has Incorrect Access Control.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-11634in the wild

Citrix Workspace App before 1904 for Windows has Incorrect Access Control. CVSSv3.1 9.8 (CRITICAL) · EPSS 94th percentile

CWECWE 284VNDCitrixTYPVulnerabilitySTAitw exploited
9.8
CVSS v3.1
100
Edit Score
2019-05-17
2019-05-17 17:29Z
HIGH

CVE-2019-12086 — Fasterxml Jackson-databind: When Default Typing is enabled (either globally or for a specific property) for an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-12086

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs CVSSv3.1 7.5 (HIGH) · EPSS 98th percentile

CWECWE 502VNDFasterxmlVNDPolymorphicTYPVulnerability
7.5
CVSS v3.1
94
Edit Score
2019-05-15
2019-05-15 17:29Z
CRIT

CVE-2013-7285 — Oracle Endeca_information_discovery_studio: Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2013-7285

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON. CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile

CWECWE 78VNDApacheVNDOracleVNDXstreamTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2019-05-10
2019-05-10 19:29Z
HIGH

CVE-2019-5018 — Sqlite Sqlite: An exploitable use after free vulnerability exists in the window function functionality of Sqlite3

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-5018

An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability. CVSSv3.1 8.1 (HIGH) · EPSS 94th percentile

CWECWE 416VNDSqliteVNDCanonicalTYPVulnerability
8.1
CVSS v3.1
93
Edit Score
2019-05-07
2019-05-07 18:29Z
HIGH

CVE-2019-10869 — Ninjaforms Ninja_forms_file_uploads: Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-10869

Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters. CVSSv3.1 8.1 (HIGH) · EPSS 96th percentile

CWECWE 434CWECWE 22VNDNinjaformsTYPVulnerability
8.1
CVSS v3.1
94
Edit Score
2019-05-03
2019-05-03 17:29Z
HIGH

CVE-2019-1714 — Cisco Secure_firewall_threat_defense: A vulnerability in the implementation of Security Assertion Markup Language (SAML) 2.0 Single Sign-On

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-1714

A vulnerability in the implementation of Security Assertion Markup Language (SAML) 2.0 Single Sign-On (SSO) for Clientless SSL VPN (WebVPN) and AnyConnect Remote Access VPN in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to successfully establish a VPN session to an affected device. The vulnerability is due to improper credential management when using NT LAN Manager (NTLM) or CVSSv3.1 8.6 (HIGH) · EPSS 79th percentile

CWECWE 255VNDCiscoTYPVulnerability
8.6
CVSS v3.1
94
Edit Score
2019-05-03
2019-05-03 16:29Z
HIGH

CVE-2019-1708 — Cisco Secure_firewall_threat_defense: A vulnerability in the Internet Key Exchange Version 2 Mobility and Multihoming Protocol (MOBIKE)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-1708

A vulnerability in the Internet Key Exchange Version 2 Mobility and Multihoming Protocol (MOBIKE) feature for the Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to the incorrect processing of certain MOBIKE packets. An attacker could exploit this CVSSv3.1 8.6 (HIGH) · EPSS 79th percentile

CWECWE 404CWECWE 401VNDCiscoVNDInternetTYPVulnerability
8.6
CVSS v3.1
94
Edit Score
2019-05-03
2019-05-03 16:29Z
HIGH

CVE-2019-1703 — Cisco Secure_firewall_threat_defense: A vulnerability in the internal packet-processing functionality of Cisco Firepower Threat Defense (FTD) Software

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-1703

A vulnerability in the internal packet-processing functionality of Cisco Firepower Threat Defense (FTD) Software for the Cisco Firepower 2100 Series could allow an unauthenticated, remote attacker to cause an affected device to stop processing traffic, resulting in a denial of service (DoS) condition. The vulnerability is due to a logic error, which may prevent ingress buffers from being replenished under specific traffic conditions. An attacker could exploit this vulnerabili CVSSv3.1 8.6 (HIGH) · EPSS 86th percentile

CWECWE 770CWECWE 400VNDCiscoTYPVulnerability
8.6
CVSS v3.1
94
Edit Score
2019-05-03
2019-05-03 15:29Z
HIGH

CVE-2019-1694 — Cisco Adaptive_security_appliance_software: A vulnerability in the TCP processing engine of Cisco Adaptive Security Appliance (ASA) Software

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-1694

A vulnerability in the TCP processing engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to the improper handling of TCP traffic. An attacker could exploit this vulnerability by sending a specific sequence of packets at a high rate through an affected device. CVSSv3.1 8.6 (HIGH) · EPSS 83th percentile

CWECWE 20VNDCiscoVNDTcpTYPVulnerability
8.6
CVSS v3.1
94
Edit Score
2019-05-03
2019-05-03 15:29Z
HIGH

CVE-2018-15462 — Cisco Secure_firewall_threat_defense: A vulnerability in the TCP ingress handler for the data interfaces that are configured

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-15462

A vulnerability in the TCP ingress handler for the data interfaces that are configured with management access to Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an increase in CPU and memory usage, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient ingress TCP rate limiting for TCP ports 22 (SSH) and 443 (HTTPS). An attacker could exploit this vulnerability by sending a crafted, ste CVSSv3.1 8.6 (HIGH) · EPSS 79th percentile

CWECWE 770CWECWE 399VNDCiscoVNDTcpTYPVulnerability
8.6
CVSS v3.1
94
Edit Score
2019-05-03
2019-05-03 15:29Z
HIGH

CVE-2018-15388 — Cisco Adaptive_security_appliance_software: A vulnerability in the WebVPN login process of Cisco Adaptive Security Appliance (ASA) Software

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-15388

A vulnerability in the WebVPN login process of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause increased CPU utilization on an affected device. The vulnerability is due to excessive processing load for existing WebVPN login operations. An attacker could exploit this vulnerability by sending multiple WebVPN login requests to the device. A successful exploit could allow t CVSSv3.1 8.6 (HIGH) · EPSS 78th percentile

CWECWE 400VNDCiscoVNDWebvpnTYPVulnerability
8.6
CVSS v3.1
94
Edit Score