CVE-Datenbank
Archiv bekannter Schwachstellen (CVEs) mit CVSS-Wert, Schweregrad, betroffenen Produkten und Herstellern. Nach Jahr und Schweregrad filterbar.
- CVE-2025-12480Kritisch9.1
Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.
- CVE-2025-64328Hoch7.2
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3.
- CVE-2025-27918Kritisch9.8
An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for iOS before 7.1.2, and AnyDesk for Android before 8.0.0. It has an integer overflow and resultant heap-based buffer overflow via a UDP packet during processing of an Identity user image within the Discovery feature, or when establishing a connection between any two clients.
- CVE-2023-43000Hoch8.8
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.
- CVE-2025-21079Hoch7.1
Unsachgemäße Eingabevalidierung in Samsung Members vor Version 5.5.01.3 ermöglicht es Remote-Angreifern, eine beliebige URL zu verbinden und eine beliebige Aktivität mit Samsung Members-Privileg zu starten. Für das Auslösen dieser Schwachstelle ist eine Benutzerinteraktion erforderlich.
- CVE-2025-11953Kritisch9.8
The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.
- CVE-2025-61757Kritisch9.8
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- CVE-2025-7851Kritisch9.8
Ein Angreifer kann unter eingeschränkten Bedingungen auf Omada-Gateways eine Root-Shell auf dem zugrunde liegenden OS-System erlangen.
- CVE-2025-7850Hoch7.2
Eine Command-Injection-Schwachstelle kann nach der Authentifizierung des Administrators im Webportal auf Omada-Gateways ausgenutzt werden.
- CVE-2025-61932Kritisch9.8
Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets.
- CVE-2025-53521Kritisch9.8
When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- CVE-2024-26008Mittel5.3
An improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, FortiProxy version 7.4.0 through 7.4.3 and before 7.2.9, FortiPAM before 1.2.0 and FortiSwitchManager version 7.2.0 through 7.2.3 and version 7.0.0 through 7.0.3 fgfm daemon may allow an unauthenticated attacker to repeatedly reset the fgfm connection via crafted SSL encrypted TCP requests.
- CVE-2025-59287Kritisch9.8
Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
- CVE-2025-59230Hoch7.8
Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
- CVE-2025-24990Hoch7.8
Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumulative update. Fax modem hardware dependent on this specific driver will no longer work on Windows. Microsoft recommends removing any existing dependencies on this hardware.
- CVE-2025-39964Hoch7.8
Im Linux-Kernel wurde die folgende Schwachstelle behoben: crypto: af_alg – Gleichzeitige Schreibvorgänge in af_alg_sendmsg untersagen Zwei Schreibvorgänge auf denselben af_alg-Socket auszuführen, ist fehlerhaft, da die Daten in einer unvorhersehbaren Weise ineinander verschachtelt werden. Darüber hinaus können gleichzeitige Schreibvorgänge Inkonsistenzen im internen Socket-Zustand verursachen. Dies wird verhindert, indem ein neues Feld ctx->write hinzugefügt wird, das den exklusiven Besitz für Schreibvorgänge anzeigt.
- CVE-2025-61884Hoch7.5
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
- CVE-2025-31718Hoch7.5
Im Modem besteht ein möglicher Systemabsturz aufgrund unsachgemäßer Eingabevalidierung. Dies könnte zu einer Remote-Eskalation von Berechtigungen führen, ohne dass zusätzliche Ausführungsberechtigungen erforderlich sind.
- CVE-2025-11371Hoch7.5
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
- CVE-2025-61882Kritisch9.8
Schwachstelle im Oracle Concurrent Processing-Produkt der Oracle E-Business Suite (Komponente: BI Publisher Integration). Betroffene unterstützte Versionen sind 12.2.3-12.2.14. Die leicht ausnutzbare Schwachstelle ermöglicht es einem nicht authentifizierten Angreifer mit Netzwerkzugriff über HTTP, Oracle Concurrent Processing zu kompromittieren. Erfolgreiche Angriffe auf diese Schwachstelle können zur Übernahme von Oracle Concurrent Processing führen. CVSS 3.1 Base Score 9.8 (Auswirkungen auf Vertraulichkeit, Integrität und Verfügbarkeit). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
This product uses the NVD API but is not endorsed or certified by the NVD.