#ExploitObserverAlert
CVE-2019-9976
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2019-9976. The Boa server configuration on DASAN H660RM devices with firmware 1.03-0022 logs POST data to the /tmp/boa-temp file, which allows logged-in users to read the credentials of administration web interface users.
FIRST-EPSS: 0.001040000
NVD-IS: 5.9
NVD-ES: 2.8
CVE-2019-9976
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2019-9976. The Boa server configuration on DASAN H660RM devices with firmware 1.03-0022 logs POST data to the /tmp/boa-temp file, which allows logged-in users to read the credentials of administration web interface users.
FIRST-EPSS: 0.001040000
NVD-IS: 5.9
NVD-ES: 2.8
#ExploitObserverAlert
CVE-2022-2585
DESCRIPTION: Exploit Observer has 5 entries related to CVE-2022-2585.
CVE-2022-2585
DESCRIPTION: Exploit Observer has 5 entries related to CVE-2022-2585.
#ExploitObserverAlert
CVE-2023-28588
DESCRIPTION: Exploit Observer has 3 entries in 2 file formats related to CVE-2023-28588. Transient DOS in Bluetooth Host while rfc slot allocation.
FIRST-EPSS: 0.000460000
NVD-IS: 3.6
NVD-ES: 3.9
CVE-2023-28588
DESCRIPTION: Exploit Observer has 3 entries in 2 file formats related to CVE-2023-28588. Transient DOS in Bluetooth Host while rfc slot allocation.
FIRST-EPSS: 0.000460000
NVD-IS: 3.6
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2023-7028
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2023-7028. An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
GITLAB-IS: 10.0
CVE-2023-7028
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2023-7028. An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
GITLAB-IS: 10.0
#ExploitObserverAlert
CVE-2023-5631
DESCRIPTION: Exploit Observer has 14 entries in 3 file formats related to CVE-2023-5631. Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.
FIRST-EPSS: 0.006800000
NVD-IS: 2.7
NVD-ES: 2.3
CVE-2023-5631
DESCRIPTION: Exploit Observer has 14 entries in 3 file formats related to CVE-2023-5631. Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.
FIRST-EPSS: 0.006800000
NVD-IS: 2.7
NVD-ES: 2.3
#ExploitObserverAlert
CVE-2021-34606
DESCRIPTION: Exploit Observer has 2 entries in 2 file formats related to CVE-2021-34606. A vulnerability exists in XINJE XD/E Series PLC Program Tool in versions up to v3.5.1 that can allow an authenticated, local attacker to load a malicious DLL. Local access is required to successfully exploit this vulnerability. This means the potential attacker must have access to the system and sufficient file-write privileges. If exploited, the attacker could place a malicious DLL file on the system, that when running XINJE XD/E Series PLC Program Tool will allow the attacker to execute arbitrary code with the privileges of another user's account.
FIRST-EPSS: 0.000420000
NVD-IS: 5.9
NVD-ES: 1.3
CVE-2021-34606
DESCRIPTION: Exploit Observer has 2 entries in 2 file formats related to CVE-2021-34606. A vulnerability exists in XINJE XD/E Series PLC Program Tool in versions up to v3.5.1 that can allow an authenticated, local attacker to load a malicious DLL. Local access is required to successfully exploit this vulnerability. This means the potential attacker must have access to the system and sufficient file-write privileges. If exploited, the attacker could place a malicious DLL file on the system, that when running XINJE XD/E Series PLC Program Tool will allow the attacker to execute arbitrary code with the privileges of another user's account.
FIRST-EPSS: 0.000420000
NVD-IS: 5.9
NVD-ES: 1.3
#ExploitObserverAlert
CVE-2023-49099
DESCRIPTION: Exploit Observer has 2 entries in 2 file formats related to CVE-2023-49099. Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users even when login is required. This vulnerability has been patched in 3.2.0.beta4 and 3.1.4.
CVE-2023-49099
DESCRIPTION: Exploit Observer has 2 entries in 2 file formats related to CVE-2023-49099. Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users even when login is required. This vulnerability has been patched in 3.2.0.beta4 and 3.1.4.
#ExploitObserverAlert
CVE-2022-4962
DESCRIPTION: Exploit Observer has 3 entries in 2 file formats related to CVE-2022-4962. A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /users of the component Configuration Center. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. VDB-250430 is the identifier assigned to this vulnerability. NOTE: The maintainer explains that user data information like user id, name, and email are not sensitive.
CVE-2022-4962
DESCRIPTION: Exploit Observer has 3 entries in 2 file formats related to CVE-2022-4962. A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /users of the component Configuration Center. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. VDB-250430 is the identifier assigned to this vulnerability. NOTE: The maintainer explains that user data information like user id, name, and email are not sensitive.
#ExploitObserverAlert
CVE-2024-22206
DESCRIPTION: Exploit Observer has 2 entries in 2 file formats related to CVE-2024-22206. Clerk helps developers build user management. Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the Pages Router. This vulnerability was patched in version 4.29.3.
CVE-2024-22206
DESCRIPTION: Exploit Observer has 2 entries in 2 file formats related to CVE-2024-22206. Clerk helps developers build user management. Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the Pages Router. This vulnerability was patched in version 4.29.3.
#ExploitObserverAlert
CVE-2023-6448
DESCRIPTION: Exploit Observer has 5 entries in 2 file formats related to CVE-2023-6448. Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
FIRST-EPSS: 0.068430000
NVD-IS: 5.9
NVD-ES: 3.9
CVE-2023-6448
DESCRIPTION: Exploit Observer has 5 entries in 2 file formats related to CVE-2023-6448. Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
FIRST-EPSS: 0.068430000
NVD-IS: 5.9
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2019-12962
DESCRIPTION: Exploit Observer has 4 entries in 3 file formats related to CVE-2019-12962. LiveZilla Server before 8.0.1.1 is vulnerable to XSS in mobile/index.php via the Accept-Language HTTP header.
FIRST-EPSS: 0.206890000
NVD-IS: 2.7
NVD-ES: 2.8
CVE-2019-12962
DESCRIPTION: Exploit Observer has 4 entries in 3 file formats related to CVE-2019-12962. LiveZilla Server before 8.0.1.1 is vulnerable to XSS in mobile/index.php via the Accept-Language HTTP header.
FIRST-EPSS: 0.206890000
NVD-IS: 2.7
NVD-ES: 2.8
#ExploitObserverAlert
CVE-2023-51806
DESCRIPTION: Exploit Observer has 2 entries in 2 file formats related to CVE-2023-51806. File Upload vulnerability in Ujcms v.8.0.2 allows a local attacker to execute arbitrary code via a crafted file.
CVE-2023-51806
DESCRIPTION: Exploit Observer has 2 entries in 2 file formats related to CVE-2023-51806. File Upload vulnerability in Ujcms v.8.0.2 allows a local attacker to execute arbitrary code via a crafted file.
#ExploitObserverAlert
CVE-2021-44152
DESCRIPTION: Exploit Observer has 5 entries in 3 file formats related to CVE-2021-44152. An issue was discovered in Reprise RLM 14.2. Because /goform/change_password_process does not verify authentication or authorization, an unauthenticated user can change the password of any existing user. This allows an attacker to change the password of any known user, thereby preventing valid users from accessing the system and granting the attacker full access to that user's account.
FIRST-EPSS: 0.865970000
NVD-IS: 5.9
NVD-ES: 3.9
CVE-2021-44152
DESCRIPTION: Exploit Observer has 5 entries in 3 file formats related to CVE-2021-44152. An issue was discovered in Reprise RLM 14.2. Because /goform/change_password_process does not verify authentication or authorization, an unauthenticated user can change the password of any existing user. This allows an attacker to change the password of any known user, thereby preventing valid users from accessing the system and granting the attacker full access to that user's account.
FIRST-EPSS: 0.865970000
NVD-IS: 5.9
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2022-35413
DESCRIPTION: Exploit Observer has 5 entries in 3 file formats related to CVE-2022-35413. WAPPLES through 6.0 has a hardcoded systemi account. A threat actor could use this account to access the system configuration and confidential information (such as SSL keys) via an HTTPS request to the /webapi/ URI on port 443 or 5001.
FIRST-EPSS: 0.622570000
NVD-IS: 5.9
NVD-ES: 3.9
CVE-2022-35413
DESCRIPTION: Exploit Observer has 5 entries in 3 file formats related to CVE-2022-35413. WAPPLES through 6.0 has a hardcoded systemi account. A threat actor could use this account to access the system configuration and confidential information (such as SSL keys) via an HTTPS request to the /webapi/ URI on port 443 or 5001.
FIRST-EPSS: 0.622570000
NVD-IS: 5.9
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2023-31747
DESCRIPTION: Exploit Observer has 4 entries in 2 file formats related to CVE-2023-31747. Wondershare Filmora 12 (Build 12.2.1.2088) was discovered to contain an unquoted service path vulnerability via the component NativePushService. This vulnerability allows attackers to launch processes with elevated privileges.
FIRST-EPSS: 0.000520000
NVD-IS: 5.9
NVD-ES: 1.8
CVE-2023-31747
DESCRIPTION: Exploit Observer has 4 entries in 2 file formats related to CVE-2023-31747. Wondershare Filmora 12 (Build 12.2.1.2088) was discovered to contain an unquoted service path vulnerability via the component NativePushService. This vulnerability allows attackers to launch processes with elevated privileges.
FIRST-EPSS: 0.000520000
NVD-IS: 5.9
NVD-ES: 1.8
#ExploitObserverAlert
CVE-2019-12583
DESCRIPTION: Exploit Observer has 4 entries in 3 file formats related to CVE-2019-12583. Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service.
FIRST-EPSS: 0.004810000
NVD-IS: 5.2
NVD-ES: 3.9
CVE-2019-12583
DESCRIPTION: Exploit Observer has 4 entries in 3 file formats related to CVE-2019-12583. Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service.
FIRST-EPSS: 0.004810000
NVD-IS: 5.2
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2021-44515
DESCRIPTION: Exploit Observer has 6 entries in 3 file formats related to CVE-2021-44515. Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. For MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3.
FIRST-EPSS: 0.972330000
NVD-IS: 5.9
NVD-ES: 3.9
CVE-2021-44515
DESCRIPTION: Exploit Observer has 6 entries in 3 file formats related to CVE-2021-44515. Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. For MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3.
FIRST-EPSS: 0.972330000
NVD-IS: 5.9
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2019-19368
DESCRIPTION: Exploit Observer has 4 entries in 3 file formats related to CVE-2019-19368. A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1. An attacker can exploit it by sending a crafted link to end users and can execute arbitrary Javascripts
FIRST-EPSS: 0.006240000
NVD-IS: 2.7
NVD-ES: 2.8
CVE-2019-19368
DESCRIPTION: Exploit Observer has 4 entries in 3 file formats related to CVE-2019-19368. A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1. An attacker can exploit it by sending a crafted link to end users and can execute arbitrary Javascripts
FIRST-EPSS: 0.006240000
NVD-IS: 2.7
NVD-ES: 2.8
#ExploitObserverAlert
CVE-2021-44427
DESCRIPTION: Exploit Observer has 3 entries in 3 file formats related to CVE-2021-44427. An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.
FIRST-EPSS: 0.021950000
NVD-IS: 5.9
NVD-ES: 3.9
CVE-2021-44427
DESCRIPTION: Exploit Observer has 3 entries in 3 file formats related to CVE-2021-44427. An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.
FIRST-EPSS: 0.021950000
NVD-IS: 5.9
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2020-19625
DESCRIPTION: Exploit Observer has 4 entries in 3 file formats related to CVE-2020-19625. Remote Code Execution Vulnerability in tests/support/stores/test_grid_filter.php in oria gridx 1.3, allows remote attackers to execute arbitrary code, via crafted value to the $query parameter.
FIRST-EPSS: 0.787770000
NVD-IS: 5.9
NVD-ES: 3.9
CVE-2020-19625
DESCRIPTION: Exploit Observer has 4 entries in 3 file formats related to CVE-2020-19625. Remote Code Execution Vulnerability in tests/support/stores/test_grid_filter.php in oria gridx 1.3, allows remote attackers to execute arbitrary code, via crafted value to the $query parameter.
FIRST-EPSS: 0.787770000
NVD-IS: 5.9
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2023-51062
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2023-51062. An unauthenticated log file read in the component log-smblog-save of QStar Archive Solutions RELEASE_3-0 Build 7 Patch 0 allows attackers to disclose the SMB Log contents via executing a crafted command.
CVE-2023-51062
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2023-51062. An unauthenticated log file read in the component log-smblog-save of QStar Archive Solutions RELEASE_3-0 Build 7 Patch 0 allows attackers to disclose the SMB Log contents via executing a crafted command.