CWE-16
01
vulnerabilities (347)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-54253US | —OT critical | KEV | ||
Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this… | ||||
| CVE-2016-3643US | high7.8OT critical | KEV | ||
SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by "sudo cat /etc/passwd." | ||||
| CVE-2015-2342US | high10.0 | Exploit | ||
The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attacker… | ||||
| CVE-2004-2687US | high9.3 | Exploit | ||
distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs,… | ||||
| CVE-2006-3677US | high7.5 | Exploit | ||
Mozilla Firefox 1.5 before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code by changing certain properties of the window navigator object (windo… | ||||
| CVE-2007-2216US | high9.3 | Exploit | ||
The tblinf32.dll (aka vstlbinf.dll) ActiveX control for Internet Explorer 5.01, 6 SP1, and 7 uses an incorrect IObjectsafety implementation, which allows remote attackers to execut… | ||||
| CVE-2009-2335US | medium5.0 | Exploit | ||
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumera… | ||||
| CVE-2024-46909US | critical9.8 | — | ||
In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage this vulnerability to execute code in the context of the service account. | ||||
| CVE-2007-3898US | medium6.4 | Exploit | ||
The DNS server in Microsoft Windows 2000 Server SP4, and Server 2003 SP1 and SP2, uses predictable transaction IDs when querying other DNS servers, which allows remote attackers to… | ||||
| CVE-1999-0886US | high9.0 | Exploit | ||
The security descriptor for RASMAN allows users to point to an alternate location via the Windows NT Service Control Manager. | ||||
| CVE-2017-6639US | critical9.8OT high | — | ||
A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to access se… | ||||
| CVE-2011-4404US | medium5.0 | Exploit | ||
The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attackers… | ||||
| CVE-2009-0641US | high9.3 | Exploit | ||
sys_term.c in telnetd in FreeBSD 7.0-RELEASE and other 7.x versions deletes dangerous environment variables with a method that was valid only in older FreeBSD distributions, which… | ||||
| CVE-2006-7236US | high9.3 | Exploit | ||
The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to execute arbitrary code o… | ||||
| CVE-2006-0848US | medium5.1 | Exploit | ||
The "Open 'safe' files after downloading" option in Safari on Apple Mac OS X allows remote user-assisted attackers to execute arbitrary commands by tricking a user into downloading… | ||||
| CVE-2008-4609US | high7.1 | Exploit | ||
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cau… | ||||
| CVE-2004-2692US | high9.3 | Exploit | ||
The exec_dir PHP patch (php-exec-dir) 4.3.2 through 4.3.7 with safe mode disabled allows remote attackers to bypass restrictions and execute arbitrary commands via a backtick opera… | ||||
| CVE-1999-0725US | high7.1 | Exploit | ||
When IIS is run with a default language of Chinese, Korean, or Japanese, it allows a remote attacker to view the source code of certain files, a.k.a. "Double Byte Code Page". | ||||
| CVE-2012-5613US | medium6.0 | Exploit | ||
MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative… | ||||
| CVE-2021-33558US | high7.5 | Exploit | ||
Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, log.html, email.html, online-users.html,… | ||||
02
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan