CWE-749 (page 2)
Page 2 of 2 — CVEs classified under CWE-749, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-51577 | High | 7.8 | 2024-05-03 | Voltronic Power ViewPower setShutdown Exposed Dangerous Method Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate… |
CVE-2023-51575 | Critical | 9.8 | 2024-05-03 | Voltronic Power ViewPower MonitorConsole Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar… |
CVE-2023-51574 | Critical | 9.8 | 2024-05-03 | Voltronic Power ViewPower updateManagerPassword Exposed Dangerous Method Authentication Bypass Vulnerability. This vulnerability allows remote attackers to byp… |
CVE-2023-44414 | Critical | 9.8 | 2024-05-03 | D-Link D-View coreservice_action_script Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a… |
CVE-2023-42032 | High | 7.5 | 2024-05-03 | Visualware MyConnection Server doRTAAccessUPass Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to di… |
CVE-2023-40501 | Critical | 9.8 | 2024-05-03 | LG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2023-40500 | Critical | 9.8 | 2024-05-03 | LG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2023-39505 | Medium | 5.5 | 2024-05-03 | PDF-XChange Editor Net.HTTP.requests Exposed Dangerous Function Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose se… |
CVE-2023-39495 | Medium | 5.5 | 2024-05-03 | PDF-XChange Editor readFileIntoStream Exposed Dangerous Function Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s… |
CVE-2023-39493 | High | 7.8 | 2024-05-03 | PDF-XChange Editor exportAsText Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2023-39468 | High | 7.2 | 2024-05-03 | Triangle MicroWorks SCADA Data Gateway DbasSectorFileToExecuteOnReset Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows… |
CVE-2023-38124 | High | 8.8 | 2024-05-03 | Inductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows rem… |
CVE-2023-38101 | High | 8.8 | 2024-05-03 | NETGEAR ProSAFE Network Management System SettingConfigController Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows rem… |
CVE-2023-38097 | High | 8.8 | 2024-05-03 | NETGEAR ProSAFE Network Management System BkreProcessThread Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote at… |
CVE-2023-37330 | High | 7.8 | 2024-05-03 | Kofax Power PDF exportAsText Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2023-27365 | High | 7.8 | 2024-05-03 | Foxit PDF Editor DOC File Parsing Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2023-27364 | High | 7.8 | 2024-05-03 | Foxit PDF Editor XLS File Parsing Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2023-27363 | High | 7.8 | 2024-05-03 | Foxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2024-32764 | Critical | 9.9 | 2024-04-26 | A missing authentication for critical function vulnerability has been reported to affect myQNAPcloud Link. If exploited, the vulnerability could allow users wi… |
CVE-2024-27261 | Medium | 6.4 | 2024-04-12 | IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.2 could allow a privileged user to install a potentially dangerous tar file, which could give them… |
CVE-2023-49074 | High | 7.4 | 2024-04-09 | A denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A… |
CVE-2023-51573 | Critical | 9.8 | 2024-04-01 | Voltronic Power ViewPower Pro updateManagerPassword Exposed Dangerous Function Authentication Bypass Vulnerability. This vulnerability allows remote attackers… |
CVE-2024-29880 | Medium | 4.2 | 2024-03-21 | In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process |
CVE-2024-27444 | Critical | 9.8 | 2024-02-26 | langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code vi… |
CVE-2024-25675 | Critical | 9.8 | 2024-02-09 | An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/Job… |
CVE-2023-5389 | Critical | 9.1 | 2024-01-30 | An attacker could potentially exploit this vulnerability, leading to the ability to modify files on Honeywell Experion ControlEdge VirtualUOC and ControlEdge… |
CVE-2023-50424 | Critical | 9.1 | 2023-12-12 | SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) - versions < 0.17.0, allow under certain conditions an escalat… |
CVE-2023-50423 | Critical | 9.1 | 2023-12-12 | SAP BTP Security Services Integration Library ([Python] sap-xssec) - versions < 4.1.0, allow under certain conditions an escalation of privileges. On successfu… |
CVE-2023-50422 | Critical | 9.1 | 2023-12-12 | SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3… |
CVE-2023-49583 | Critical | 9.1 | 2023-12-12 | SAP BTP Security Services Integration Library ([Node.js] @sap/xssec - versions < 3.6.0, allow under certain conditions an escalation of privileges. On successf… |
CVE-2023-39226 | Critical | 9.8 | 2023-11-30 | In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute arbitrary code through a singl… |
CVE-2023-40151 | Critical | 10.0 | 2023-11-21 | When user authentication is not enabled the shell can execute commands with the highest privileges. Red Lion SixTRAK and VersaTRAK Series RTUs with authenti… |
CVE-2023-42494 | High | 7.5 | 2023-10-25 | EisBaer Scada - CWE-749: Exposed Dangerous Method or Function |
CVE-2023-3656 | Critical | 9.8 | 2023-10-03 | cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by an unauthenticated remote… |
CVE-2023-3655 | High | 7.5 | 2023-10-03 | cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a dangerous methods, that… |
CVE-2023-40150 | Critical | 9.8 | 2023-09-11 | Softneta MedDream PACS does not perform an authentication check and performs some dangerous functionality, which could result in unauthenticated remote code e… |
CVE-2023-3612 | High | 8.2 | 2023-09-11 | Govee Home app has unprotected access to WebView component which can be opened by any app on the device. By sending an URL to a specially crafted site, the att… |
CVE-2023-39214 | High | 7.6 | 2023-08-08 | Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via network access. |
CVE-2023-36853 | High | 7.8 | 2023-07-19 | In Keysight Geolocation Server v2.4.2 and prior, a low privileged attacker could create a local ZIP file containing a malicious script in any location. T… |
CVE-2023-33921 | Medium | 6.8 | 2023-06-13 | A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). The affected devic… |
CVE-2023-34227 | Medium | 5.3 | 2023-05-31 | In JetBrains TeamCity before 2023.05 a specific endpoint was vulnerable to brute force attacks |
CVE-2022-37365 | High | 7.8 | 2023-03-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2023-1143 | High | 8.8 | 2023-03-27 | In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use Lua scripts, which could allow an attacker to remotely execute arb… |
CVE-2021-33639 | High | 7.5 | 2023-03-08 | REMAP cmd of SVM driver can be used to remap read only memory as read-write, then cause read only memory/file modified. |
CVE-2023-26478 | Medium | 6.6 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 14.3-rc-1, `org.xwiki.store.script.TemporaryAttachmentsScriptService#uploadTemporaryAttachment`… |
CVE-2022-46156 | High | 7.2 | 2022-11-30 | The Synthetic Monitoring Agent for Grafana's Synthetic Monitoring application provides probe functionality and executes network checks for monitoring remote ta… |
CVE-2022-4136 | Critical | 9.8 | 2022-11-24 | Dangerous method exposed which can lead to RCE in qmpass/leadshop v1.4.15 allows an attacker to control the target host by calling any function in leadshop.php… |
CVE-2021-34996 | High | 8.8 | 2022-01-13 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is requi… |
CVE-2021-35243 | Medium | 5.3 | 2021-12-23 | The HTTP PUT and DELETE methods were enabled in the Web Help Desk web server (12.7.7 and earlier), allowing users to execute dangerous HTTP requests. The HTTP… |
CVE-2021-42128 | Critical | 9.8 | 2021-12-07 | An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 using inforail Service allows Privilege Escalation via Enterprise Server Se… |
CVE-2021-26614 | High | 7.5 | 2021-11-22 | ius_get.cgi in IpTime C200 camera allows remote code execution. A remote attacker may send a crafted parameters to the exposed vulnerable web service interface… |
CVE-2021-28809 | Critical | 9.8 | 2021-07-08 | An improper access control vulnerability has been reported to affect certain legacy versions of HBS 3. If exploited, this vulnerability allows attackers to com… |
CVE-2020-2503 | Critical | 9.0 | 2020-12-24 | If exploited, this stored cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QNAP has already fixed thes… |
CVE-2019-20923 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions c… |
CVE-2020-12927 | High | 7.8 | 2020-11-12 | A potential vulnerability in a dynamically loaded AMD driver in AMD VBIOS Flash Tool SDK may allow any authenticated user to escalate privileges to NT authorit… |
CVE-2020-12912 | Medium | 5.5 | 2020-11-12 | A potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to use the Linux-based Running Average Power Limit (RAPL) interfa… |
CVE-2020-27123 | Medium | 5.5 | 2020-11-06 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local atta… |
CVE-2020-12928 | High | 7.8 | 2020-10-13 | A vulnerability in a dynamically loaded AMD driver in AMD Ryzen Master V15 may allow any authenticated user to escalate privileges to NT authority system. |
CVE-2020-3513 | Medium | 6.7 | 2020-09-24 | Multiple vulnerabilities in the initialization routines that are executed during bootup of Cisco IOS XE Software for Cisco ASR 900 Series Aggregation Services… |
CVE-2020-3416 | Medium | 6.7 | 2020-09-24 | Multiple vulnerabilities in the initialization routines that are executed during bootup of Cisco IOS XE Software for Cisco ASR 900 Series Aggregation Services… |
CVE-2020-17391 | Medium | 6.5 | 2020-08-25 | This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.3-47255. An attacker must first obtain th… |
CVE-2020-17388 | High | 8.8 | 2020-08-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is… |
CVE-2020-8212 | Critical | 9.8 | 2020-08-17 | Improper access control in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix Xen… |
CVE-2020-15623 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not requ… |
CVE-2020-10268 | Medium | 6.1 | 2020-06-16 | Critical services for operation can be terminated from windows task manager, bringing the manipulator to a halt. After this a Re-Calibration of the brakes need… |
CVE-2019-18342 | Critical | 9.9 | 2019-12-12 | A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The SFTP service (default port 22/tcp) of the Control Center Server… |
CVE-2019-13945 | Medium | 6.8 | 2019-12-12 | A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-1200 CPU family < V4.x (incl. SIPLUS varia… |
CVE-2019-12948 | High | 8.3 | 2019-07-29 | A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploit… |
CVE-2019-4386 | Medium | 6.5 | 2019-07-01 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 could allow an authenticated user to execute a function that would cause the server to c… |
CVE-2019-10918 | High | 8.8 | 2019-05-14 | A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC… |
CVE-2019-5015 | High | 7.8 | 2019-03-08 | A local privilege escalation vulnerability exists in the Mac OS X version of Pixar Renderman 22.3.0's Install Helper helper tool. A user with local access can… |
CVE-2018-19322 | High | 7.8 | 2018-12-21 | The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC… |
CVE-2018-10931 | Critical | 9.8 | 2018-08-09 | It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw… |
CVE-2018-8868 | Medium | 6.2 | 2018-07-03 | Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains debug code meant to test the functionality of the monitor's communication interfaces… |
CVE-2018-8949 | Medium | 4.3 | 2018-03-23 | An issue was discovered in app/Model/Attribute.php in MISP before 2.4.89. There is a critical API integrity bug, potentially allowing users to delete attribute… |
CVE-2017-2735 | High | 7.1 | 2017-11-22 | TIT-AL00 smartphones with software versions earlier before TIT-AL00C583B214 have a exposed system interface vulnerability. The software provides a system inter… |
CVE-2016-9469 | High | 8.2 | 2017-03-28 | Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeRequest objects on a GitL… |
CVE-2016-7462 | High | 8.5 | 2016-12-29 | The Suite REST API in VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to write arbitrary content to files or rename f… |
CVE-2014-5415 | Critical | 9.1 | 2016-10-05 | Beckhoff Embedded PC images before 2014-10-22 and Automation Device Specification (ADS) TwinCAT components might allow remote attackers to obtain access via th… |
CVE-2014-0758 | | 2014-02-24 | An ActiveX control in GenLaunch.htm in ICONICS GENESIS32 8.0, 8.02, 8.04, and 8.05 allows remote attackers to execute arbitrary programs via a crafted HTML doc… | |
CVE-2010-1428 | High | 7.5 | 2010-04-28 | The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3… |
CVE-2010-0738 | Medium | 5.3 | 2010-04-28 | The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0… |
CVE-2006-1547 | High | 7.5 | 2006-03-30 | ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form… |