Total
2630 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-6944 | 1 Crmeb | 1 Crmeb | 2025-01-03 | 6.3 Medium |
| A vulnerability was found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this issue is the function get_image_base64 of the file PublicController.php. The manipulation of the argument file leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-272066 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2022-22005 | 1 Microsoft | 3 Sharepoint Enterprise Server, Sharepoint Foundation, Sharepoint Server | 2025-01-02 | 8.8 High |
| Microsoft SharePoint Server Remote Code Execution Vulnerability | ||||
| CVE-2023-35317 | 1 Microsoft | 5 Windows Server 2012, Windows Server 2012 R2, Windows Server 2016 and 2 more | 2025-01-01 | 7.8 High |
| Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability | ||||
| CVE-2023-21713 | 1 Microsoft | 1 Sql Server | 2025-01-01 | 8.8 High |
| Microsoft SQL Server Remote Code Execution Vulnerability | ||||
| CVE-2023-21703 | 1 Microsoft | 3 Azure Data Box, Azure Data Box Gateway, Azure Stack Edge | 2025-01-01 | 6.5 Medium |
| Azure Data Box Gateway Remote Code Execution Vulnerability | ||||
| CVE-2023-21568 | 1 Microsoft | 3 Sql Server, Sql Server 2019 Integration Services, Sql Server 2022 Integration Services | 2025-01-01 | 7.3 High |
| Microsoft SQL Server Integration Service (VS extension) Remote Code Execution Vulnerability | ||||
| CVE-2023-21706 | 1 Microsoft | 1 Exchange Server | 2025-01-01 | 8.8 High |
| Microsoft Exchange Server Remote Code Execution Vulnerability | ||||
| CVE-2023-21779 | 1 Microsoft | 1 Visual Studio Code | 2025-01-01 | 7.8 High |
| Visual Studio Code Remote Code Execution Vulnerability | ||||
| CVE-2023-21538 | 3 Fedoraproject, Microsoft, Redhat | 5 Fedora, .net, Powershell and 2 more | 2025-01-01 | 7.5 High |
| .NET Denial of Service Vulnerability | ||||
| CVE-2024-43466 | 1 Microsoft | 1 Sharepoint Server | 2024-12-31 | 6.5 Medium |
| Microsoft SharePoint Server Denial of Service Vulnerability | ||||
| CVE-2024-43464 | 1 Microsoft | 1 Sharepoint Server | 2024-12-31 | 7.2 High |
| Microsoft SharePoint Server Remote Code Execution Vulnerability | ||||
| CVE-2024-38018 | 1 Microsoft | 1 Sharepoint Server | 2024-12-31 | 8.8 High |
| Microsoft SharePoint Server Remote Code Execution Vulnerability | ||||
| CVE-2024-1750 | 1 Temmokumvc | 1 Temmokumvc | 2024-12-31 | 5.6 Medium |
| A vulnerability, which was classified as critical, was found in TemmokuMVC up to 2.3. Affected is the function get_img_url/img_replace in the library lib/images_get_down.php of the component Image Download Handler. The manipulation leads to deserialization. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254532. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2023-21124 | 1 Google | 1 Android | 2024-12-18 | 7.8 High |
| In run of multiple files, there is a possible escalation of privilege due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-265798353 | ||||
| CVE-2018-9474 | 1 Google | 1 Android | 2024-12-18 | 8.4 High |
| In writeToParcel of MediaPlayer.java, there is a possible serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2024-10095 | 1 Telerik | 1 Ui For Wpf | 2024-12-18 | 8.4 High |
| In Progress Telerik UI for WPF versions prior to 2024 Q4 (2024.4.1213), a code execution attack is possible through an insecure deserialization vulnerability. | ||||
| CVE-2024-43080 | 1 Google | 1 Android | 2024-12-17 | 7.8 High |
| In onReceive of AppRestrictionsFragment.java, there is a possible escalation of privilege due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. | ||||
| CVE-2024-31317 | 1 Google | 1 Android | 2024-12-17 | 7.8 High |
| In multiple functions of ZygoteProcess.java, there is a possible way to achieve code execution as any app via WRITE_SECURE_SETTINGS due to unsafe deserialization. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2024-11947 | 1 Gfi | 1 Archiver | 2024-12-13 | 8.8 High |
| GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Authentication is required to exploit this vulnerability. The specific flaw exists within the Core Service, which listens on TCP port 8017 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-24029. | ||||
| CVE-2024-11949 | 1 Gfi | 1 Archiver | 2024-12-13 | 8.8 High |
| GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Authentication is required to exploit this vulnerability. The specific flaw exists within the Store Service, which listens on TCP port 8018 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-24331. | ||||