60.379 CVE tracked
809 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
60.379 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2022-27223 | HIGH 8.8 | debian debian_linux In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not validated and might be manipulated by the host for out-of-array access. | 2.2% | — |
| CVE-2020-3419 | MED 6.5 | cisco webex_meetings_server A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to join a Webex session without appearing on the participant list. This vulnerability is due to improper handling of authentication tokens b | 2.2% | — |
| CVE-2014-0031 | MED 4.0 | apache cloudstack The (1) ListNetworkACL and (2) listNetworkACLLists APIs in Apache CloudStack before 4.2.1 allow remote authenticated users to list network ACLS for other users via a crafted request. | 2.2% | — |
| CVE-2011-0352 | HIGH 7.8 | cisco linksys_wrt54gc_router Buffer overflow in the web-based management interface on the Cisco Linksys WRT54GC router with firmware before 1.06.1 allows remote attackers to cause a denial of service (device crash) via a long string in a POST request. | 2.2% | — |
| CVE-1999-1217 | MED 4.6 | microsoft windows_nt The PATH in Windows NT includes the current working directory (.), which could allow local users to gain privileges by placing Trojan horse programs with the same name as commonly used system programs into certain directories. | 2.2% | — |
| CVE-2018-1284 | LOW 3.7 | apache hive In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs (xpath/xpath_string/xpath_boolean/xpath_number/xpath_double/xpath_float/xpath_long/xpath_int/xpath_short) to expose the content of a file on the machine running HiveServer2 owned by HiveSer | 2.1% | — |
| CVE-2017-16939 | HIGH 7.8 | debian debian_linux The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPO | 2.1% | — |
| CVE-2013-3457 | MED 5.0 | cisco finesse Absolute path traversal vulnerability in the web interface in Cisco Finesse allows remote attackers to read directory contents via a direct request to a directory URL, aka Bug ID CSCug16772. | 2.1% | — |
| CVE-2011-0379 | HIGH 7.9 | cisco 5500_series_adaptive_security_appliance Buffer overflow on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 1.6.x; Cisco TelePresence Multipoint Switch (CTMS) devices with software 1.0.x, 1.1.x, 1.5.x, and 1.6.x; Cisco TelePresence endpoint devices with software 1.2.x throu | 2.1% | — |
| CVE-2024-43202 | CRIT 9.8 | apache dolphinscheduler Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.2. We recommend users to upgrade Apache DolphinScheduler to version 3.2.2, which fixes the issue. | 2.1% | — |
| CVE-2023-44367 | HIGH 7.8 | adobe acrobat Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user in | 2.1% | — |
| CVE-2023-44359 | HIGH 7.8 | adobe acrobat Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user in | 2.1% | — |
| CVE-2021-42735 | HIGH 7.8 | adobe photoshop Adobe Photoshop version 22.5.1 (and earlier versions ) is affected by an Access of Memory Location After End of Buffer vulnerability, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit | 2.1% | — |
| CVE-2020-13955 | MED 5.9 | apache calcite HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses internally this method to connect with Druid and Splunk so information leakage may happen whe | 2.1% | — |
| CVE-2019-14213 | HIGH 7.5 | foxitsoftware phantompdf An issue was discovered in Foxit PhantomPDF before 8.3.11. The application could crash due to the repeated release of the signature dictionary during CSG_SignatureF and CPDF_Document destruction. | 2.1% | — |
| CVE-2021-45458 | HIGH 7.5 | apache kylin Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encryption class, the cipher is initialized with a hardcoded key and IV. If users use class PasswordPlacehold | 2.1% | — |
| CVE-2015-1211 | HIGH 7.5 | canonical ubuntu_linux The OriginCanAccessServiceWorkers function in content/browser/service_worker/service_worker_dispatcher_host.cc in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android does not properly restrict the URI scheme durin | 2.1% | — |
| CVE-2009-1522 | HIGH 7.1 | ibm tivoli_storage_manager_client The IBM Tivoli Storage Manager (TSM) client 5.5.0.0 through 5.5.1.17 on AIX and Windows, when SSL is used, allows remote attackers to conduct unspecified man-in-the-middle attacks and read arbitrary files via unknown vectors. | 2.1% | — |
| CVE-2024-38076 | CRIT 9.8 | microsoft windows_server_2016 Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability | 2.1% | — |
| CVE-2021-34468 | HIGH 7.1 | microsoft sharepoint_foundation Microsoft SharePoint Server Remote Code Execution Vulnerability | 2.1% | — |
| CVE-2011-0426 | MED 4.3 | vmware vcenter Directory traversal vulnerability in vCenter Server in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1, and VMware VirtualCenter 2.5 before Update 6a, allows remote attackers to read arbitrary files via unspecified vectors. | 2.1% | — |
| CVE-2023-33150 | CRIT 9.6 | microsoft 365_apps Microsoft Office Security Feature Bypass Vulnerability | 2.1% | — |
| CVE-2021-31983 | HIGH 7.8 | microsoft paint_3d Paint 3D Remote Code Execution Vulnerability | 2.1% | — |
| CVE-2017-8654 | MED 5.4 | microsoft sharepoint_server Microsoft SharePoint Server 2010 Service Pack 2 allows a cross-site scripting (XSS) vulnerability when it does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability". | 2.1% | — |
| CVE-2016-7460 | CRIT 9.1 | vmware vrealize_automation The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and vRealize Automation 6.x before 6.2.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML document containing an external entity declar | 2.1% | — |