60.375 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.375 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2012-5703 | MED 5.0 | vmware esx The vSphere API in VMware ESXi 4.1 and ESX 4.1 allows remote attackers to cause a denial of service (host daemon crash) via an invalid value in a (1) RetrieveProp or (2) RetrievePropEx SOAP request. | 2.4% | — |
| CVE-2020-23315 | HIGH 7.5 | microsoft chakracore There is an ASSERTION (pFuncBody->GetYieldRegister() == oldYieldRegister) failed in Js::DebugContext::RundownSourcesAndReparse in ChakraCore version 1.12.0.0-beta. | 2.4% | — |
| CVE-2019-0943 | HIGH 7.8 | microsoft windows_10 An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC). An attacker who successfully exploited this vulnerability could run arbitrary code in the security context of the local system. An att | 2.4% | — |
| CVE-2017-6630 | MED 5.3 | cisco ip_phone_8800_series_firmware A vulnerability in the Session Initiation Protocol (SIP) implementation of Cisco IP Phone 8851 11.0(0.1) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to an abnormal SIP message. An attac | 2.4% | — |
| CVE-2021-39233 | CRIT 9.1 | apache ozone In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client. | 2.4% | — |
| CVE-2021-39231 | CRIT 9.1 | apache ozone In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to download raw data from Datanode and Ozone manager and modify Ratis replication configuration. | 2.4% | — |
| CVE-2018-0230 | HIGH 8.6 | cisco adaptive_security_appliance_software A vulnerability in the internal packet-processing functionality of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Security Appliances could allow an unauthenticated, remote attacker to cause an affected device to stop processing | 2.4% | — |
| CVE-2015-3620 | MED 4.3 | fortinet fortianalyzer_firmware Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through 5.0.10 and 5.2.0 through 5.2.1 allows remote attackers to inject arbitrary web s | 2.4% | — |
| CVE-2015-0619 | MED 5.0 | cisco adaptive_security_appliance_software Memory leak in the embedded web server in the WebVPN subsystem in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to cause a denial of service (memory consumption and SSL outage) via multiple crafted HTTP requests, aka Bug ID CSCue0545 | 2.4% | — |
| CVE-2015-0581 | HIGH 7.5 | cisco prime_service_catalog The XML parser in Cisco Prime Service Catalog before 10.1 allows remote authenticated users to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference, as demonst | 2.4% | — |
| CVE-2020-16996 | MED 6.5 | microsoft windows_server_2012 Kerberos Security Feature Bypass Vulnerability | 2.4% | — |
| CVE-2020-0638 | HIGH 7.8 | ransomware microsoft windows_10_1709 An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege | 2.4% | |
| CVE-2013-0942 | MED 4.3 | emc rsa_authentication_agent Cross-site scripting (XSS) vulnerability in EMC RSA Authentication Agent 7.1 before 7.1.1 for Web for Internet Information Services, and 7.1 before 7.1.1 for Web for Apache, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors | 2.4% | — |
| CVE-2022-38023 | HIGH 8.1 | fedoraproject fedora Netlogon RPC Elevation of Privilege Vulnerability | 2.4% | — |
| CVE-2022-33678 | HIGH 7.2 | microsoft azure_site_recovery Azure Site Recovery Remote Code Execution Vulnerability | 2.4% | — |
| CVE-2022-33676 | HIGH 7.2 | microsoft azure_site_recovery Azure Site Recovery Remote Code Execution Vulnerability | 2.4% | — |
| CVE-2019-13374 | MED 6.1 | dlink central_wifimanager A cross-site scripting (XSS) vulnerability in resource view in PayAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to inject arbitrary web script or HTML via the index.php/Pay/passcodeAuth passcode parame | 2.4% | — |
| CVE-2023-35639 | HIGH 8.8 | microsoft windows_10_1507 Microsoft ODBC Driver Remote Code Execution Vulnerability | 2.4% | — |
| CVE-2022-33649 | CRIT 9.6 | microsoft edge_chromium Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability | 2.4% | — |
| CVE-2010-3810 | MED 4.3 | apple safari WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, does not properly handle the History object, which allows remote attackers to spoof the location bar's URL or add URLs to the history via a cross- | 2.4% | — |
| CVE-2007-0959 | HIGH 7.8 | cisco asa_5500 Cisco PIX 500 and ASA 5500 Series Security Appliances 7.2.2, when configured to inspect certain TCP-based protocols, allows remote attackers to cause a denial of service (device reboot) via malformed TCP packets. | 2.4% | — |
| CVE-2021-1712 | HIGH 8.0 | microsoft sharepoint_enterprise_server Microsoft SharePoint Elevation of Privilege Vulnerability | 2.4% | — |
| CVE-2015-6425 | MED 5.0 | cisco unified_communications_manager The WebApplications Identity Management subsystem in Cisco Unified Communications Manager 10.5(0.98000.88) allows remote attackers to cause a denial of service (subsystem outage) via invalid session tokens, aka Bug ID CSCul83786. | 2.4% | — |
| CVE-2014-3369 | HIGH 7.1 | cisco expressway_software The SIP IX implementation in Cisco TelePresence Video Communication Server (VCS) and Expressway Software before X8.1.1 allows remote attackers to cause a denial of service (device reload) via crafted SDP packets, aka Bug ID CSCuo42252. | 2.4% | — |
| CVE-2014-3361 | HIGH 7.1 | cisco ios The ALG module in Cisco IOS 15.0 through 15.4 does not properly implement SIP over NAT, which allows remote attackers to cause a denial of service (device reload) via multipart SDP IPv4 traffic, aka Bug ID CSCun54071. | 2.4% | — |