آخرین آسیب‌پذیری‌ها

TeamT5 ThreatSonar Anti-Ransomware - Arbitrary File Upload

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege…

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input…

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.

Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in me…

Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before build 5.1.1-71, Acronis …

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenti…

Expedition: Missing Authentication Leads to Admin Account Takeover

Incomplete Input Validation in GlideExpression Script

Jelly Template Injection Vulnerability in ServiceNow UI Macros

Microsoft SharePoint Remote Code Execution Vulnerability

Windows MSHTML Platform Spoofing Vulnerability

Windows Hyper-V Elevation of Privilege Vulnerability

In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically…

Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.

Cisco NX-OS Software CLI Command Injection Vulnerability

Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver

WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user ma…

vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted n…

GeoVision EOL device - OS Command Injection

there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

XXE can expose crypt key and other secrets granting full admin access

Windows Kernel Elevation of Privilege Vulnerability