58.689 CVE tracked
799 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.689 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted ascending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2014-3817 | HIGH 7.8 | juniper junos Juniper Junos 11.4 before 11.4R12, 12.1X44 before 12.1X44-D32, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, and 12.1X47 before 12.1X47-D10 on SRX Series devices, when NAT protocol translation from IPv4 to IPv6 is enabled, allows remote attackers to | 3.4% | — |
| CVE-2020-17142 | CRIT 9.1 | microsoft exchange_server Microsoft Exchange Remote Code Execution Vulnerability | 3.4% | — |
| CVE-2008-2010 | HIGH 9.3 | apple quicktime Unspecified vulnerability in Apple QuickTime Player on Windows XP SP2 and Vista SP1 allows remote attackers to execute arbitrary code via a crafted QuickTime media file. NOTE: as of 20080429, the only disclosure is a vague pre-advisory with no actionable info | 3.4% | — |
| CVE-2021-35213 | HIGH 8.9 | solarwinds orion_platform An Improper Access Control Privilege Escalation Vulnerability was discovered in the User Setting of Orion Platform version 2020.2.5. It allows a guest user to elevate privileges to the Administrator using this vulnerability. Authentication is required to explo | 3.4% | — |
| CVE-2012-0454 | HIGH 7.5 | mozilla firefox Use-after-free vulnerability in Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 on 32-bit Windows 7 platforms allows remote attackers to cause a denial | 3.4% | — |
| CVE-2005-2801 | HIGH 7.5 | linux linux_kernel xattr.c in the ext2 and ext3 file system code for Linux kernel 2.6 does not properly compare the name_index fields when sharing xattr blocks, which could prevent default ACLs from being applied. | 3.4% | — |
| CVE-2012-2005 | MED 4.3 | hp insight_management_agents Cross-site scripting (XSS) vulnerability in HP Insight Management Agents before 9.0.0.0 on Windows Server 2003 and 2008 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 3.4% | — |
| CVE-2013-0987 | HIGH 9.3 | apple quicktime Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted QTIF file. | 3.4% | — |
| CVE-2011-2024 | HIGH 10.0 | cisco cns_network_registrar Cisco Network Registrar before 7.2 has a default administrative password, which makes it easier for remote attackers to obtain access via a TCP session, aka Bug ID CSCsm50627. | 3.4% | — |
| CVE-2020-16904 | MED 5.3 | microsoft azure_functions <p>An elevation of privilege vulnerability exists in the way Azure Functions validate access keys.</p> <p>An unauthenticated attacker who successfully exploited this vulnerability could invoke an HTTP Function without proper authorization.</p> <p>This security | 3.4% | — |
| CVE-2010-1577 | HIGH 7.8 | cisco content_delivery_system Directory traversal vulnerability in Cisco Internet Streamer, as used in Cisco Content Delivery System (CDS) 2.2.x, 2.3.x, 2.4.x, and 2.5.x before 2.5.7 allows remote attackers to read arbitrary files via a crafted URL. | 3.4% | — |
| CVE-2021-26859 | HIGH 7.7 | microsoft power_bi_report_server Microsoft Power BI Information Disclosure Vulnerability | 3.4% | — |
| CVE-2021-24091 | HIGH 7.8 | microsoft windows_10 Windows Camera Codec Pack Remote Code Execution Vulnerability | 3.4% | — |
| CVE-2007-1063 | HIGH 10.0 | cisco unified_ip_phone_firmware_7906g The SSH server in Cisco Unified IP Phone 7906G, 7911G, 7941G, 7961G, 7970G, and 7971G, with firmware 8.0(4)SR1 and earlier, uses a hard-coded username and password, which allows remote attackers to access the device. | 3.4% | — |
| CVE-2019-1899 | MED 5.3 | cisco rv110w_firmware A vulnerability in the web interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to acquire the list of devices that are connected to the guest network. The vulnerability is due to improper authorization of an HT | 3.4% | — |
| CVE-2011-1581 | HIGH 9.0 | linux linux_kernel The bond_select_queue function in drivers/net/bonding/bond_main.c in the Linux kernel before 2.6.39, when a network device with a large number of receive queues is installed but the default tx_queues setting is used, does not properly restrict queue indexes, w | 3.4% | — |
| CVE-2003-1342 | MED 5.0 | trend_micro virus_control_system Trend Micro Virus Control System (TVCS) 1.8 running with IIS allows remote attackers to cause a denial of service (memory consumption) in IIS via multiple URL requests for ActiveSupport.exe. | 3.4% | — |
| CVE-2002-1101 | MED 5.0 | cisco vpn_3000_concentrator_series_software Cisco VPN 3000 Concentrator 2.2.x, 3.6(Rel), and 3.x before 3.5.5, allows remote attackers to cause a denial of service via a long user name. | 3.4% | — |
| CVE-2017-6883 | MED 4.7 | foxitsoftware foxit_reader The ConvertToPDF plugin in Foxit Reader before 8.2.1 and PhantomPDF before 8.2.1 on Windows, when the gflags app is enabled, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted TIFF image. The vulnerabi | 3.4% | — |
| CVE-2016-7185 | HIGH 7.8 | microsoft windows_10 The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted appl | 3.4% | — |
| CVE-2016-1335 | HIGH 7.5 | cisco asr_5000_series_software The SSH implementation in Cisco StarOS before 19.3.M0.62771 and 20.x before 20.0.M0.62768 on ASR 5000 devices mishandles a multi-user public-key authentication configuration, which allows remote authenticated users to gain privileges by establishing a connecti | 3.4% | — |
| CVE-2017-7678 | MED 6.1 | apache spark In Apache Spark before 2.2.0, it is possible for an attacker to take advantage of a user's trust in the server to trick them into visiting a link that points to a shared Spark cluster and submits data including MHTML to the Spark master, or history server. Thi | 3.4% | — |
| CVE-2015-0644 | HIGH 7.8 | cisco ios_xe AppNav in Cisco IOS XE 3.8 through 3.10 before 3.10.3S, 3.11 before 3.11.3S, 3.12 before 3.12.1S, 3.13 before 3.13.0S, 3.14 before 3.14.0S, and 3.15 before 3.15.0S allows remote attackers to execute arbitrary code or cause a denial of service (device reload) v | 3.4% | — |
| CVE-2005-3110 | LOW 2.6 | linux linux_kernel Race condition in ebtables netfilter module (ebtables.c) in Linux 2.6, when running on an SMP system that is operating under a heavy load, might allow remote attackers to cause a denial of service (crash) via a series of packets that cause a value to be modifi | 3.4% | — |
| CVE-2019-1194 | HIGH 7.5 | microsoft internet_explorer A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current u | 3.4% | — |