Use CVSS, EPSS, CISA KEV, affected-version data, and source evidence as separate signals for prioritization.
NVD data is used under its public data terms. This service is not endorsed or certified by NVD.An arbitrary file upload vulnerability in the apiImportLabs function in api_labs.php of EVE-NG 2.0.3-112 Community allows attackers to execute arbitrary code via a crafted UNL file.
The CVSS severity warrants an early asset and exposure review.Acer Altos W2000h-W570h F4 R01.03.0018 was discovered to contain a stack overflow in the RevserveMem component. This vulnerability allows attackers to cause a Denial of Service (DoS) via injecting crafted shellcode into the NVRAM variable.
The CVSS severity warrants an early asset and exposure review.D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.
CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.An access control issue in nopcommerce v4.50.2 allows attackers to arbitrarily modify any customer's address via the addressedit endpoint.
The CVSS severity warrants an early asset and exposure review.Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.Beijing Feishu Technology Co., Ltd Feishu v3.40.3 was discovered to contain an untrusted search path vulnerability.
The CVSS severity warrants an early asset and exposure review.An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login page.
The CVSS severity warrants an early asset and exposure review.WiJungle NGFW Version U250 was discovered to be vulnerable to No Rate Limit attack, allowing the attacker to brute force the admin password leading to Account Take Over.
The CVSS severity warrants an early asset and exposure review.CVE-2022-41033 affects Microsoft Windows COM+ Event System Service. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.
CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.CVE-2022-38028 affects Microsoft Windows. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.
CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do.
FIRST EPSS indicates an elevated probability of exploitation.An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5_r allows attackers to arbitrarily create admin users via a crafted HTTP request.
The CVSS severity warrants an early asset and exposure review.CVE-2022-41082 affects Microsoft Exchange Server. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.
CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.CVE-2022-41040 affects Microsoft Exchange Server. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.
CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.