Use CVSS, EPSS, CISA KEV, affected-version data, and source evidence as separate signals for prioritization.
NVD data is used under its public data terms. This service is not endorsed or certified by NVD.MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php.
The CVSS severity warrants an early asset and exposure review.CVE-2022-48328 affects misp. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.
The CVSS severity warrants an early asset and exposure review.IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.
CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.Arris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution (RCE) via the ping utility feature.
FIRST EPSS indicates an elevated probability of exploitation.An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.
CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.CVE-2023-21823 affects Microsoft Windows. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.
CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.CVE-2023-23376 affects Microsoft Windows. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.
CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.CVE-2023-21715 affects Microsoft Office. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.
CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.CVE-2023-21529 affects Microsoft Exchange Server. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.
CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile.
The CVSS severity warrants an early asset and exposure review.Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.
CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.ureport v2.2.9 was discovered to contain a directory traversal vulnerability via the deletion function which allows for arbitrary files to be deleted.
The CVSS severity warrants an early asset and exposure review.Improper Input Validation in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to execute arbitrary code on the target via an HTTP POST request
The CVSS severity warrants an early asset and exposure review.An issue discovered in src/wallet/wallet.cpp in Ravencoin Core 4.3.2.1 and earlier allows attackers to view sensitive information via CWallet::CreateTransactionAll() function.
The CVSS severity warrants an early asset and exposure review.TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.
CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.