Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.2Versa Concerto Improper Authentication VulnerabilityPatch nowKEVEPSS 81.78%May 21, 2025
- Medium4.3jq is a command-line JSON processor.Check if you run itEPSS 0.46%May 21, 2025
- Medium5.3A vulnerability has been found in Kingdee Cloud Galaxy Private Cloud BBC System up to 9.0 Patch April 2025 and classified as critical.Check if you run itEPSS 0.53%May 21, 2025
- Low2.4Data provided in a request performed to the server while activating a new device are put in a database.Check if you run itEPSS 0.25%May 21, 2025
- Low2.4Input provided in a field containing "activationMessage" in Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored Cross-Site Scripting attaCheck if you run itEPSS 0.24%May 21, 2025
- Low2.4Input provided in comment section of Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored Cross-Site Scripting attack.Check if you run itEPSS 0.24%May 21, 2025
- Medium5.1A low-privileged user can access information about profiles created in Proget MDM (Mobile Device Management), which contain details about allowed/prohibited functions.Check if you run itEPSS 0.19%May 21, 2025
- Medium4.6In Proget MDM, a low-privileged user can access information about changes contained in backups of all devices managed by the MDM (Mobile Device Management).Check if you run itEPSS 0.19%May 21, 2025
- High7.0In Proget MDM, a low-privileged user can retrieve passwords for managed devices and subsequently use functionalities restricted by the MDM (Mobile Device Management).Check if you run itEPSS 0.20%May 21, 2025
- High7.5When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it.Check this weekEPSS 15.30%May 21, 2025
- Medium6.5The certificate and private key used for providing transport layer security for connections to the web interface (TCP port 443) is hard-coded in the firmware and are shipped with tCheck if you run itEPSS 0.22%May 21, 2025
- High8.1An OpenSSH daemon listens on TCP port 22.Check if you run itEPSS 0.57%May 21, 2025
- Medium6.2A USB backdoor feature can be triggered by attaching a USB drive that contains specially crafted "salia.ini" files.Check if you run itEPSS 0.22%May 21, 2025
- Medium6.5There are several scripts in the web interface that are accessible via undocumented hard-coded credentials.Check if you run itEPSS 0.35%May 21, 2025
- High7.7The and files reveal hard-coded password hashes for the operating system "root" user.Check if you run itEPSS 0.23%May 21, 2025
- Medium6.5Several OS command injection vulnerabilities exist in the device firmware in the /var/salia/mqtt.php script.Check if you run itEPSS 1.01%May 21, 2025
- Medium6.5The devices do not implement any authentication for the web interface or the MQTT server.Check if you run itEPSS 0.45%May 21, 2025
- Medium5.1A low-privileged user is able to obtain information about tasks executed on devices controlled by Proget MDM (Mobile Device Management), as well as details of the devices like theiCheck if you run itEPSS 0.21%May 21, 2025
- Critical9.1Spring Security Aspects may not correctly locate method security annotations on private methods.Check if you run itEPSS 0.62%May 21, 2025
- Medium6.4The Animated Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'auto-downloader' shortcode in all versions up to, and including, 1.0.0 dueCheck if you run itEPSS 0.25%May 21, 2025
- Medium6.4The WP YouTube Video Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ib_youtube' shortcode in all versions up to, and including, 1.2 dCheck if you run itEPSS 0.25%May 21, 2025
- Medium6.4The Network Posts Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘post_height’ parameter in all versions up to, and including, 7.7.1 due to insuCheck if you run itEPSS 0.31%May 21, 2025
- Medium6.4The Slim SEO – Fast & Automated WordPress SEO Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's slim_seo_breadcrumbs shortcode in all versioCheck if you run itEPSS 0.53%May 21, 2025
- Medium5.4The Splitit plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on several functions in the 'splitIt-flexfields-payment-gatewayCheck if you run itEPSS 0.29%May 21, 2025
- High7.2The Glossary by WPPedia – Best Glossary plugin for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.0 via deserializatCheck if you run itEPSS 0.74%May 21, 2025
Sort