Multiple Reolink IP camera models have an authenticated OS command injection vulnerability that allows an admin user to execute arbitrary commands as root via the 'TestEmail' feature. This vulnerability affects models including RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W. Exploitation requires authentication but can lead to full system compromise. The vulnerability is known to be exploited in the wild.
NUUO NVRmini2 devices have a missing authentication vulnerability that permits unauthenticated attackers to upload encrypted TAR archives. This flaw can be exploited to add arbitrary users to the device, potentially compromising device security. The vulnerability is classified as high severity and has been exploited in the wild. No specific affected versions or patch information is provided.
NUUO NVRmini devices have an OS command injection vulnerability identified as CVE-2018-14933. This flaw allows remote attackers to execute arbitrary commands on the device by injecting shell metacharacters into the uploaddir parameter of the writeuploaddir command. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
ProjectSend has an improper authentication vulnerability that allows remote, unauthenticated attackers to modify application configuration via crafted HTTP requests to options.php. Exploitation enables attackers to create accounts, upload webshells, and embed malicious JavaScript, leading to potential full compromise. This vulnerability is actively exploited in the wild. No specific affected versions or patch information is provided yet.
CVE-2021-26086 is a path traversal vulnerability in Atlassian Jira Server and Data Center that permits remote attackers to read specific files via the /WEB-INF/web.xml endpoint. This vulnerability has been exploited in the wild. No explicit affected versions or patch information are provided in the input data.
CVE-2014-2120 is a cross-site scripting (XSS) vulnerability in the Cisco Adaptive Security Appliance (ASA) WebVPN login page. It allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter. This vulnerability has been exploited in the wild.
CVE-2021-41277 is a local file inclusion vulnerability in Metabase's GeoJSON API, specifically in the custom map support feature. This flaw allows unauthorized access to local files via the API. The vulnerability has been exploited in the wild and is rated as high severity. No explicit affected versions or patch information is provided in the available data.
Nostromo nhttpd contains a directory traversal vulnerability in the http_verify() function when running a non-chrooted server. This flaw allows remote attackers to execute arbitrary code on the affected system. The vulnerability is known to be exploited in the wild, posing a high risk to affected installations.
CVE-2019-0344 is a high-severity vulnerability in SAP Commerce Cloud (formerly Hybris) involving deserialization of untrusted data in the mediaconversion and virtualjdbc extensions. This flaw allows attackers to perform code injection. Exploits have been observed in the wild. No specific affected versions or patch information is provided in the available data.
Multiple DrayTek Vigor routers (Vigor3900, Vigor2960, and Vigor300B) have an OS command injection vulnerability in the cgi-bin/mainfunction.cgi/cvmcfgupload endpoint. This flaw allows remote attackers to execute arbitrary commands by injecting shell metacharacters in a filename when the content type text/x-python-script is used. The vulnerability is known to be exploited in the wild.
CVE-2020-14644 is a deserialization vulnerability in Oracle WebLogic Server that allows unauthenticated remote attackers with network access via T3 or IIOP protocols to execute arbitrary code. This vulnerability has been exploited in the wild. Oracle has released patches as part of its July 2020 Critical Patch Update and strongly recommends applying these patches promptly to mitigate the risk.
CVE-2022-21445 is a high-severity vulnerability in the Oracle ADF Faces library included with Oracle JDeveloper Distribution. It involves deserialization of untrusted data, which can lead to unauthenticated remote code execution. The vulnerability has been exploited in the wild. Oracle has released patches for this and other vulnerabilities in its April 2022 Critical Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk.
CVE-2020-0618 is a deserialization vulnerability in Microsoft SQL Server Reporting Services that allows an authenticated attacker to execute code with the privileges of the Report Server service account. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns. It affects SQL Server Reporting Services and requires authentication to exploit.
CVE-2014-0502 is a double free vulnerability in Adobe Flash Player that enables remote attackers to execute arbitrary code. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data.
Adobe Flash Player has a vulnerability in its ExternalInterface ActionScript functionality that allows remote attackers to execute arbitrary code by delivering crafted SWF content. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2013-0643 is a vulnerability in Adobe Flash Player involving incorrect default permissions in the Firefox sandbox. This flaw allows remote attackers to execute arbitrary code by delivering specially crafted SWF content. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2014-0497 is an integer underflow vulnerability in Adobe Flash Player that enables remote attackers to execute arbitrary code. This vulnerability has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.
CVE-2017-1000253 is a high-severity vulnerability in the Linux kernel involving a position-independent executable (PIE) stack buffer corruption in the load_elf_binary() function. This flaw allows a local attacker to escalate privileges on the affected system. The vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns.
ImageMagick contains an improper input validation vulnerability affecting multiple coders (EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT). This flaw allows remote attackers to execute arbitrary code via shell metacharacters in crafted images. The vulnerability is known to be exploited in the wild and is considered high severity. No specific affected versions or patch information is provided in the input data.
Draytek VigorConnect has a path traversal vulnerability in its WebServlet file download functionality. This flaw allows an unauthenticated attacker to download arbitrary files from the underlying operating system with root privileges. The vulnerability has been exploited in the wild, indicating active attacks. No specific affected versions or patch information are provided.