Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4In Sherpa Orchestrator 141851, a low-privileged user can elevate their privileges by creating new users and roles.Check if you run itEPSS 0.29%Apr 25, 2025
- High7.5NETSCOUT nGeniusONE before 6.4.0 b2350 has a Sensitive File Accessible Without Proper Authentication to an endpoint.Check if you run itEPSS 0.43%Apr 25, 2025
- Critical9.8NETSCOUT nGeniusONE before 6.4.0 b2350 has Hardcoded Credentials that can be obtained from JAR files.Check if you run itEPSS 0.45%Apr 25, 2025
- Medium6.1NETSCOUT nGeniusONE before 6.4.0 b2350 allows Stored Cross-Site Scripting (XSS) via a certain POST parameter.Check if you run itEPSS 0.26%Apr 25, 2025
- High7.5NETSCOUT nGeniusONE before 6.4.0 b2350 allows Technical Information Disclosure via a Stack Trace.Check if you run itEPSS 0.42%Apr 25, 2025
- High7.5NETSCOUT nGeniusONE before 6.4.0 b2350 has a Broken Authorization Schema for the report module.Check if you run itEPSS 0.39%Apr 25, 2025
- High7.1NETSCOUT nGeniusONE before 6.4.0 b2350 allows local users to leverage Insecure Permissions for the nGeniusCLI File.Check if you run itEPSS 0.22%Apr 25, 2025
- Critical9.8NETSCOUT nGeniusONE before 6.4.0 P11 b3245 has a Weak Sudo Configuration.Check if you run itEPSS 0.45%Apr 25, 2025
- Medium6.5NETSCOUT nGeniusONE before 6.4.0 b2350 allows Arbitrary File Creation by authenticated users.Check if you run itEPSS 0.35%Apr 25, 2025
- Medium6.5An issue in the Printer Manager Systm of Entrust Corp Printer Manager D3.18.4-3 and below allows attackers to execute a directory traversal via a crafted POST request.Check if you run itEPSS 0.54%Apr 25, 2025
- High7.0An issue in Mytel Telecom Online Account System v1.0 allows attackers to bypass the OTP verification process via a crafted request.Check if you run itEPSS 0.43%Apr 25, 2025
- Medium6.5Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.4 and CO2Scope <= 1.3.4 allows remote authenticated attackers to execute arbitrary SQL commands via the (1) timeagCheck if you run itEPSS 0.32%Apr 25, 2025
- Critical9.8Codeastro Bus Ticket Booking System v1.0 is vulnerable to SQL injection via the kodetiket parameter in /BusTicket-CI/tiket/cekorder.Check if you run itEPSS 0.55%Apr 25, 2025
- Low2.4Andamiro Pump It Up 20th Anniversary (aka Double X or XX/2019) 1.00.0-2.08.3 allows a physically proximate attacker to cause a denial of service (application crash) via certain desCheck if you run itEPSS 0.21%Apr 25, 2025
- High8.5ALBEDO Telecom Net.Time - PTP/NTP clock (Serial No.Check if you run itEPSS 0.32%Apr 24, 2025
- High8.7Vestel AC Charger version 3.75.0 contains a vulnerability that could enable an attacker to access files containing sensitive information, such as credentials which could be used toCheck if you run itEPSS 0.41%Apr 24, 2025
- Critical9.3WGS-80HPT-V2 and WGS-4215-8T2S are missing authentication that could allow an attacker to create an administrator account without knowing any existing credentials.Check if you run itEPSS 0.57%Apr 24, 2025
- Critical9.3UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to read, manipulate and create entries in the managed database.Check if you run itEPSS 0.53%Apr 24, 2025
- Critical9.3UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to gain administrative privileges to all UNI-NMS managed devices.Check if you run itEPSS 0.56%Apr 24, 2025
- Critical9.3WGS-80HPT-V2 and WGS-4215-8T2S are vulnerable to a command injection attack that could allow an unauthenticated attacker to execute OS commands on the host system.Check if you run itEPSS 1.24%Apr 24, 2025
- Critical9.3UNI-NMS-Lite is vulnerable to a command injection attack that could allow an unauthenticated attacker to read or manipulate device data.Check if you run itEPSS 2.00%Apr 24, 2025
- High7.2The eForm - WordPress Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.18.0 due to insufficient input sanitizaCheck if you run itEPSS 0.37%Apr 24, 2025
- Medium6.4The Breeze Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cal_size’ parameter in all versions up to, and including, 1.2.3 due to insufficient inCheck if you run itEPSS 0.32%Apr 24, 2025
- Medium4.4ManageWiki is a MediaWiki extension allowing users to manage wikis.Check if you run itEPSS 0.27%Apr 24, 2025
- Medium4.6Improper sanitization of SVG files in HCL Leap allows client-side script injection in deployed applications.Check if you run itEPSS 0.23%Apr 24, 2025
Sort