#ExploitObserverAlert
CVE-2017-12633
DESCRIPTION: Exploit Observer has 10 entries related to CVE-2017-12633. The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.
FIRST-EPSS: 0.004330000
NVD-IS: 5.9
NVD-ES: 3.9
CVE-2017-12633
DESCRIPTION: Exploit Observer has 10 entries related to CVE-2017-12633. The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.
FIRST-EPSS: 0.004330000
NVD-IS: 5.9
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2015-8360
DESCRIPTION: Exploit Observer has 9 entries related to CVE-2015-8360. An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arbitrary Java code via serialized data to the JMS port.
FIRST-EPSS: 0.006510000
NVD-IS: 5.9
NVD-ES: 3.9
CVE-2015-8360
DESCRIPTION: Exploit Observer has 9 entries related to CVE-2015-8360. An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arbitrary Java code via serialized data to the JMS port.
FIRST-EPSS: 0.006510000
NVD-IS: 5.9
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2015-1920
DESCRIPTION: Exploit Observer has 9 entries related to CVE-2015-1920. IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, and 8.5 before 8.5.5.6 allows remote attackers to execute arbitrary code by sending crafted instructions in a management-port session.
FIRST-EPSS: 0.005950000
NVD-IS: 10.0
NVD-ES: 10.0
CVE-2015-1920
DESCRIPTION: Exploit Observer has 9 entries related to CVE-2015-1920. IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, and 8.5 before 8.5.5.6 allows remote attackers to execute arbitrary code by sending crafted instructions in a management-port session.
FIRST-EPSS: 0.005950000
NVD-IS: 10.0
NVD-ES: 10.0
#ExploitObserverAlert
CVE-2023-6347
DESCRIPTION: Exploit Observer has 8 entries related to CVE-2023-6347. Use after free in Mojo in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
FIRST-EPSS: 0.001750000
NVD-IS: 5.9
NVD-ES: 2.8
CVE-2023-6347
DESCRIPTION: Exploit Observer has 8 entries related to CVE-2023-6347. Use after free in Mojo in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
FIRST-EPSS: 0.001750000
NVD-IS: 5.9
NVD-ES: 2.8
#ExploitObserverAlert
CVE-2021-46360
DESCRIPTION: Exploit Observer has 4 entries related to CVE-2021-46360. Authenticated remote code execution (RCE) in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrary code via uploading a PHP shell through /adminzone/index.php?page=admin-commandr.
FIRST-EPSS: 0.010350000
NVD-IS: 5.9
NVD-ES: 2.8
CVE-2021-46360
DESCRIPTION: Exploit Observer has 4 entries related to CVE-2021-46360. Authenticated remote code execution (RCE) in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrary code via uploading a PHP shell through /adminzone/index.php?page=admin-commandr.
FIRST-EPSS: 0.010350000
NVD-IS: 5.9
NVD-ES: 2.8
#ExploitObserverAlert
CVE-2019-3948
DESCRIPTION: Exploit Observer has 10 entries related to CVE-2019-3948. The Amcrest IP2M-841B V2.520.AC00.18.R, Dahua IPC-XXBXX V2.622.0000000.9.R, Dahua IPC HX5X3X and HX4X3X V2.800.0000008.0.R, Dahua DH-IPC HX883X and DH-IPC-HX863X V2.622.0000000.7.R, Dahua DH-SD4XXXXX V2.623.0000000.7.R, Dahua DH-SD5XXXXX V2.623.0000000.1.R, Dahua DH-SD6XXXXX V2.640.0000000.2.R and V2.623.0000000.1.R, Dahua NVR5XX-4KS2 V3.216.0000006.0.R, Dahua NVR4XXX-4KS2 V3.216.0000006.0.R, and NVR2XXX-4KS2 do not require authentication to access the HTTP endpoint /videotalk. An unauthenticated, remote person can connect to this endpoint and potentionally listen to the audio of the capturing device.
FIRST-EPSS: 0.098840000
NVD-IS: 3.6
NVD-ES: 3.9
CVE-2019-3948
DESCRIPTION: Exploit Observer has 10 entries related to CVE-2019-3948. The Amcrest IP2M-841B V2.520.AC00.18.R, Dahua IPC-XXBXX V2.622.0000000.9.R, Dahua IPC HX5X3X and HX4X3X V2.800.0000008.0.R, Dahua DH-IPC HX883X and DH-IPC-HX863X V2.622.0000000.7.R, Dahua DH-SD4XXXXX V2.623.0000000.7.R, Dahua DH-SD5XXXXX V2.623.0000000.1.R, Dahua DH-SD6XXXXX V2.640.0000000.2.R and V2.623.0000000.1.R, Dahua NVR5XX-4KS2 V3.216.0000006.0.R, Dahua NVR4XXX-4KS2 V3.216.0000006.0.R, and NVR2XXX-4KS2 do not require authentication to access the HTTP endpoint /videotalk. An unauthenticated, remote person can connect to this endpoint and potentionally listen to the audio of the capturing device.
FIRST-EPSS: 0.098840000
NVD-IS: 3.6
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2022-3349
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2022-3349. A vulnerability was found in Sony PS4 and PS5. It has been classified as critical. This affects the function UVFAT_readupcasetable of the component exFAT Handler. The manipulation of the argument dataLength leads to heap-based buffer overflow. It is possible to launch the attack on the physical device. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-209679.
FIRST-EPSS: 0.000540000
NVD-IS: 5.9
NVD-ES: 0.9
CVE-2022-3349
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2022-3349. A vulnerability was found in Sony PS4 and PS5. It has been classified as critical. This affects the function UVFAT_readupcasetable of the component exFAT Handler. The manipulation of the argument dataLength leads to heap-based buffer overflow. It is possible to launch the attack on the physical device. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-209679.
FIRST-EPSS: 0.000540000
NVD-IS: 5.9
NVD-ES: 0.9
#ExploitObserverAlert
CVE-2023-45152
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2023-45152. Engelsystem is a shift planning system for chaos events. A Blind SSRF in the "Import schedule" functionality makes it possible to perform a port scan against the local environment. This vulnerability has been fixed in commit ee7d30b33. If a patch cannot be deployed, operators should ensure that no HTTP(s) services listen on localhost and/or systems only reachable from the host running the engelsystem software. If such services are necessary, they should utilize additional authentication.
FIRST-EPSS: 0.000430000
NVD-IS: 1.4
NVD-ES: 0.8
CVE-2023-45152
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2023-45152. Engelsystem is a shift planning system for chaos events. A Blind SSRF in the "Import schedule" functionality makes it possible to perform a port scan against the local environment. This vulnerability has been fixed in commit ee7d30b33. If a patch cannot be deployed, operators should ensure that no HTTP(s) services listen on localhost and/or systems only reachable from the host running the engelsystem software. If such services are necessary, they should utilize additional authentication.
FIRST-EPSS: 0.000430000
NVD-IS: 1.4
NVD-ES: 0.8
#ExploitObserverAlert
CVE-2023-49285
DESCRIPTION: Exploit Observer has 8 entries related to CVE-2023-49285. Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
FIRST-EPSS: 0.013880000
NVD-IS: 3.6
NVD-ES: 3.9
CVE-2023-49285
DESCRIPTION: Exploit Observer has 8 entries related to CVE-2023-49285. Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
FIRST-EPSS: 0.013880000
NVD-IS: 3.6
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2022-23491
DESCRIPTION: Exploit Observer has 4 entries related to CVE-2022-23491. Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.
FIRST-EPSS: 0.000460000
NVD-IS: 3.6
NVD-ES: 3.9
CVE-2022-23491
DESCRIPTION: Exploit Observer has 4 entries related to CVE-2022-23491. Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.
FIRST-EPSS: 0.000460000
NVD-IS: 3.6
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2024-22087
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2024-22087. route in main.c in Pico HTTP Server in C through f3b69a6 has an sprintf stack-based buffer overflow via a long URI, leading to remote code execution.
CVE-2024-22087
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2024-22087. route in main.c in Pico HTTP Server in C through f3b69a6 has an sprintf stack-based buffer overflow via a long URI, leading to remote code execution.
#ExploitObserverAlert
CVE-2015-0014
DESCRIPTION: Exploit Observer has 7 entries related to CVE-2015-0014. Buffer overflow in the Telnet service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows Telnet Service Buffer Overflow Vulnerability."
FIRST-EPSS: 0.875790000
NVD-IS: 10.0
NVD-ES: 10.0
CVE-2015-0014
DESCRIPTION: Exploit Observer has 7 entries related to CVE-2015-0014. Buffer overflow in the Telnet service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows Telnet Service Buffer Overflow Vulnerability."
FIRST-EPSS: 0.875790000
NVD-IS: 10.0
NVD-ES: 10.0
#ExploitObserverAlert
CVE-2021-22968
DESCRIPTION: Exploit Observer has 4 entries related to CVE-2021-22968. A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concrete5) versions 8.5.6 and below.The external file upload feature stages files in the public directory even if they have disallowed file extensions. They are stored in a directory with a random name, but it's possible to stall the uploads and brute force the directory name. You have to be an admin with the ability to upload files, but this bug gives you the ability to upload restricted file types and execute them depending on server configuration.To fix this, a check for allowed file extensions was added before downloading files to a tmp directory.Concrete CMS Security Team gave this a CVSS v3.1 score of 5.4 AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:NThis fix is also in Concrete version 9.0.0
FIRST-EPSS: 0.009040000
NVD-IS: 5.9
NVD-ES: 1.2
CVE-2021-22968
DESCRIPTION: Exploit Observer has 4 entries related to CVE-2021-22968. A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concrete5) versions 8.5.6 and below.The external file upload feature stages files in the public directory even if they have disallowed file extensions. They are stored in a directory with a random name, but it's possible to stall the uploads and brute force the directory name. You have to be an admin with the ability to upload files, but this bug gives you the ability to upload restricted file types and execute them depending on server configuration.To fix this, a check for allowed file extensions was added before downloading files to a tmp directory.Concrete CMS Security Team gave this a CVSS v3.1 score of 5.4 AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:NThis fix is also in Concrete version 9.0.0
FIRST-EPSS: 0.009040000
NVD-IS: 5.9
NVD-ES: 1.2
#ExploitObserverAlert
CVE-2021-24284
DESCRIPTION: Exploit Observer has 8 entries related to CVE-2021-24284. The Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action. The supplied zipfile being unzipped in the wp-content/uploads/kaswara/fonts_icon directory with no checks for malicious files such as PHP.
FIRST-EPSS: 0.967600000
NVD-IS: 5.9
NVD-ES: 3.9
CVE-2021-24284
DESCRIPTION: Exploit Observer has 8 entries related to CVE-2021-24284. The Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action. The supplied zipfile being unzipped in the wp-content/uploads/kaswara/fonts_icon directory with no checks for malicious files such as PHP.
FIRST-EPSS: 0.967600000
NVD-IS: 5.9
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2023-45659
DESCRIPTION: Exploit Observer has 3 entries related to CVE-2023-45659. Engelsystem is a shift planning system for chaos events. If a users' password is compromised and an attacker gained access to a users' account, i.e., logged in and obtained a session, an attackers' session is not terminated if the users' account password is reset. This vulnerability has been fixed in the commit `dbb089315ff3d`. Users are advised to update their installations. There are no known workarounds for this vulnerability.
FIRST-EPSS: 0.000430000
NVD-IS: 1.4
NVD-ES: 1.3
CVE-2023-45659
DESCRIPTION: Exploit Observer has 3 entries related to CVE-2023-45659. Engelsystem is a shift planning system for chaos events. If a users' password is compromised and an attacker gained access to a users' account, i.e., logged in and obtained a session, an attackers' session is not terminated if the users' account password is reset. This vulnerability has been fixed in the commit `dbb089315ff3d`. Users are advised to update their installations. There are no known workarounds for this vulnerability.
FIRST-EPSS: 0.000430000
NVD-IS: 1.4
NVD-ES: 1.3
#ExploitObserverAlert
CVE-2024-21907
DESCRIPTION: Exploit Observer has 9 entries related to CVE-2024-21907. Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.
CVE-2024-21907
DESCRIPTION: Exploit Observer has 9 entries related to CVE-2024-21907. Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.
#ExploitObserverAlert
CVE-2021-36765
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2021-36765. In CODESYS EtherNetIP before 4.1.0.0, specific EtherNet/IP requests may cause a null pointer dereference in the downloaded vulnerable EtherNet/IP stack that is executed by the CODESYS Control runtime system.
FIRST-EPSS: 0.001500000
NVD-IS: 3.6
NVD-ES: 3.9
CVE-2021-36765
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2021-36765. In CODESYS EtherNetIP before 4.1.0.0, specific EtherNet/IP requests may cause a null pointer dereference in the downloaded vulnerable EtherNet/IP stack that is executed by the CODESYS Control runtime system.
FIRST-EPSS: 0.001500000
NVD-IS: 3.6
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2020-2851
DESCRIPTION: Exploit Observer has 8 entries related to CVE-2020-2851. Vulnerability in the Oracle Solaris product of Oracle Systems (component: Common Desktop Environment). Supported versions that are affected are 10 and 11. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
FIRST-EPSS: 0.000910000
NVD-IS: 6.0
NVD-ES: 1.1
CVE-2020-2851
DESCRIPTION: Exploit Observer has 8 entries related to CVE-2020-2851. Vulnerability in the Oracle Solaris product of Oracle Systems (component: Common Desktop Environment). Supported versions that are affected are 10 and 11. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
FIRST-EPSS: 0.000910000
NVD-IS: 6.0
NVD-ES: 1.1
#ExploitObserverAlert
CVE-2022-1310
DESCRIPTION: Exploit Observer has 6 entries related to CVE-2022-1310. Use after free in regular expressions in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
FIRST-EPSS: 0.002390000
NVD-IS: 5.9
NVD-ES: 2.8
CVE-2022-1310
DESCRIPTION: Exploit Observer has 6 entries related to CVE-2022-1310. Use after free in regular expressions in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
FIRST-EPSS: 0.002390000
NVD-IS: 5.9
NVD-ES: 2.8
#ExploitObserverAlert
CVE-2021-20594
DESCRIPTION: Exploit Observer has 4 entries related to CVE-2021-20594. Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions "26" and prior and Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU all versions allows a remote unauthenticated attacker to acquire legitimate user names registered in the module via brute-force attack on user names.
FIRST-EPSS: 0.002510000
NVD-IS: 3.6
NVD-ES: 3.9
CVE-2021-20594
DESCRIPTION: Exploit Observer has 4 entries related to CVE-2021-20594. Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions "26" and prior and Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU all versions allows a remote unauthenticated attacker to acquire legitimate user names registered in the module via brute-force attack on user names.
FIRST-EPSS: 0.002510000
NVD-IS: 3.6
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2020-17086
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2020-17086. Raw Image Extension Remote Code Execution Vulnerability
FIRST-EPSS: 0.100700000
NVD-IS: 5.9
NVD-ES: 1.8
CVE-2020-17086
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2020-17086. Raw Image Extension Remote Code Execution Vulnerability
FIRST-EPSS: 0.100700000
NVD-IS: 5.9
NVD-ES: 1.8