Tagged “exploit-available”
CVEs tagged exploit-available, newest first.
9298 CVEsRSS
CVE-2024-3094Critical· 10.0PoCXz: malicious code in distributed source
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the s…
CVE-2024-28085Low· 3.3PoCwall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv
wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequence…
CVE-2024-2466Medium· 6.5PoClibcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as a…
CVE-2024-1023Medium· 6.5PoCA vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures
A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. …
CVE-2024-0858High· 8.8PoCThe Innovs HR WordPress plugin before 1.0.3.7.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding them as employees.
The Innovs HR WordPress plugin before 1.0.3.7.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding them as employees.
CVE-2024-1753High· 8.6PoCA flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers
A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the ro…
CVE-2024-22513LowPoCImproper Privilege Management in djangorestframework-simplejwt
Improper Privilege Management in djangorestframework-simplejwt
CVE-2024-27102Critical· 9.9PoCWings is the server control plane for Pterodactyl Panel
Wings is the server control plane for Pterodactyl Panel. This vulnerability impacts anyone running the affected versions of Wings. The vulnerability can potentially be used to access files and directories on the host system. The full sco…
CVE-2023-42789Critical· 9.8PoCA out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiProxy 7.4.0, FortiProxy 7.2.0 throug…
A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiProxy 7.4.0, FortiProxy 7.2.0 throug…
CVE-2024-1441Medium· 5.5PoCLibvirt: off-by-one error in udevlistinterfacesbystatus()
An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially crafted data to the libvirt…
CVE-2024-28757High· 7.5PoClibexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).
CVE-2024-27304High· 8.1PoCpgx: SQL Injection via Protocol Message Size Overflow (CVE-2024-27304)
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be…
CVE-2024-22889Medium· 5.5PoCPhone information disclosure vulnerability
Phone information disclosure vulnerability
CVE-2024-20017Critical· 9.8PoCIn wlan service, there is a possible out of bounds write due to improper input validation
In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation Patch ID:…
CVE-2024-27292High· 7.5PoCDocassemble unauthorized access through URL manipulation
Docassemble unauthorized access through URL manipulation
CVE-2024-25169MediumPoCMezzanine allows attackers to bypass access control mechanisms
Mezzanine allows attackers to bypass access control mechanisms
CVE-2024-25170MediumPoCMezzanine allows attackers to bypass access controls via manipulating the Host header
Mezzanine allows attackers to bypass access controls via manipulating the Host header
CVE-2024-25723Medium· 6.5PoCZenML Server Remote Privilege Escalation Vulnerability
ZenML Server Remote Privilege Escalation Vulnerability
CVE-2019-25162High· 7.8PoCIn the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after f…
In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after f…
CVE-2023-52447High· 7.8PoCIn the Linux kernel, the following vulnerability has been resolved: bpf: Defer the free of inner map when necessary When updating or deleting an inner map in map array or map htab, the map may still be accessed by non-sleepable program…
In the Linux kernel, the following vulnerability has been resolved: bpf: Defer the free of inner map when necessary When updating or deleting an inner map in map array or map htab, the map may still be accessed by non-sleepable program…
CVE-2023-52440Critical· 9.8PoCIn the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob() If authblob->SessionKey.Length is bigger than session key size(CIFS_KEY_SIZE), slub overflow can happen in…
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob() If authblob->SessionKey.Length is bigger than session key size(CIFS_KEY_SIZE), slub overflow can happen in…
CVE-2024-1212Critical· 10.0CISA KEVPoCUnauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.
CVE-2024-21338High· 7.8CISA KEV0dayPoCWindows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-21490High· 7.5PoCThis affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0
This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. Wit…
CVE-2024-21762Critical· 9.8CISA KEV0dayPoCA out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7…
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7…
CVE-2024-0684Medium· 5.5PoCA flaw was found in the GNU coreutils "split" program
A flaw was found in the GNU coreutils "split" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_bytes_split() function, potentially leading to an application crash and denial o…
CVE-2024-24590High· 8.8PoCAllegro AI ClearML vulnerable to deserialization of untrusted data
Allegro AI ClearML vulnerable to deserialization of untrusted data
CVE-2023-7216Medium· 5.3PoCCpio: extraction allows symlinks which enables remote command execution
A path traversal vulnerability was found in the CPIO utility. This issue could allow a remote unauthenticated attacker to trick a user into opening a specially crafted archive. During the extraction process, the archiver could follow sym…
CVE-2023-6240Medium· 6.5PoCKernel: marvin vulnerability side-channel leakage in the rsa decryption operation
A Marvin vulnerability side-channel leakage was found in the RSA decryption operation in the Linux Kernel. This issue may allow a network attacker to decrypt ciphertexts or forge signatures, limiting the services that use that private key.
CVE-2024-21485Medium· 6.5PoCDash apps vulnerable to Cross-site Scripting
Dash apps vulnerable to Cross-site Scripting