Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 4,054 published records · 16 KEV · 4,054 with a forecast · 0 unknown dates
4,054 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.39% · forecast 100% · unscored 24%.
CVE-2024-50317
A null pointer dereference in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service.
Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-12T15:29:58.447Z. Updated 2024-11-12T15:54:12.790Z.
Unbounded allocation in ctl(4) CAM Target Layer
The fetch(3) library uses environment variables for passing certain information, including the revocation file pathname. The environment variable name used by fetch(1) to pass the filename to the library was incorrect, in effect ignoring the option. Fetch would still connect to a host presenting a certificate include…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-12T15:06:08.435Z. Updated 2025-01-10T13:06:48.187Z.
Unbounded allocation in ctl(4) CAM Target Layer
The command ctl_persistent_reserve_out allows the caller to specify an arbitrary size which will be passed to the kernel's memory allocator.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-12T15:01:57.151Z. Updated 2025-01-10T13:06:46.829Z.
SMM arbitrary code execution in Overclock
APTIOV contains a vulnerability in BIOS where may cause Improper Access Control by a local attacker. Successful exploitation of this vulnerability may lead to unexpected SPI flash modifications and BIOS boot kit launches, also impacting the availability.
Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-12T15:01:15.370Z. Updated 2024-11-21T16:20:52.843Z.
Buffer Overflow Vulnerability In OFBD
APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Restriction of Operations within the Bounds of a Memory Buffer by local. Successful exploitation of this vulnerability may lead to privilege escalation and potentially arbitrary code execution, and impact Integrity.
Severity medium: primary CNA CVSS 4.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-12T15:01:05.234Z. Updated 2024-11-21T16:21:37.633Z.
Potential Firmware update without integrity check
An exploit is possible where an actor with physical access can manipulate SPI flash without being detected.
Severity medium: primary CNA CVSS 5.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-12T15:00:51.675Z. Updated 2024-11-21T16:22:25.320Z.
Runtime Service Access outside SMRAM
APTIOV contains a vulnerability in the BIOS where a user or attacker may cause an improper restriction of operations within the bounds of a memory buffer over the network. A successful exploitation of this vulnerability may lead to code execution outside of the intended System Management Mode.
Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-12T15:00:34.738Z. Updated 2024-11-12T15:58:50.679Z.
ZZCMS msg.php cross site scripting
A vulnerability was found in ZZCMS up to 2023. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/msg.php. The manipulation of the argument keyword leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and …
Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-12T15:00:12.803Z. Updated 2024-11-12T15:51:29.758Z.
code-projects Job Recruitment admin.php sql injection
A vulnerability was found in code-projects Job Recruitment up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file admin.php. The manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to…
Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-12T15:00:09.579Z. Updated 2024-11-12T15:57:15.318Z.
bhyve(8) NVMe driver to guest-induced infinite loops.
The NVMe driver queue processing is vulernable to guest-induced infinite loops.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-12T14:58:04.254Z. Updated 2025-11-03T20:45:22.798Z.
bhyve(8) hda driver buffer over-read
The hda driver is vulnerable to a buffer over-read from a guest-controlled value.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-12T14:53:46.211Z. Updated 2025-11-03T20:45:21.398Z.
FactoryTalk View ME Remote Code Execution Vulnerability via Project Save Path
A remote code execution vulnerability exists in the affected product. The vulnerability allows users to save projects within the public directory allowing anyone with local access to modify and/or delete files. Additionally, a malicious user could potentially leverage this vulnerability to escalate their privileges by …
Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-12T14:52:55.556Z. Updated 2024-11-12T19:04:00.897Z.
bhyve(8) infinite loop in the hda audio driver
A guest can trigger an infinite loop in the hda audio driver.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-12T14:51:51.757Z. Updated 2025-11-03T20:45:19.837Z.
bhyve(8) virtio_vq_recordon time-of-check to time-of-use race
The virtio_vq_recordon function is subject to a time-of-check to time-of-use (TOCTOU) race condition.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-12T14:47:28.189Z. Updated 2025-11-03T20:45:18.070Z.
Sensetive Data Exposure in Nomysoft Informatics' Nomysem
Missing Authentication for Critical Function, Missing Authorization vulnerability in Nomysoft Informatics Nomysem allows Collect Data as Provided by Users. This issue affects Nomysem: before 13.10.2024.
Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-12T14:45:26.428Z. Updated 2026-06-02T08:23:48.015Z.
bhyve(8) nvme_opc_get_log_page buffer over-read
The NVMe driver function nvme_opc_get_log_page is vulnerable to a buffer over-read from a guest-controlled value.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-12T14:44:28.328Z. Updated 2025-11-03T20:45:16.628Z.
Apache CloudStack: Directly downloaded templates can be used to abuse KVM-based infrastructure
Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the primary storage for deploying instances. Due to missing validation checks for KVM-compatible templates in CloudStack 4.0.0 through 4.18.2.4 and 4.19.0.0 through 4.19.1.2, an attacker that can register templa…
Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-12T14:34:08.537Z. Updated 2024-11-12T20:06:52.571Z.
Digistar AG-30 Plus Login Page excessive authentication
A vulnerability was found in Digistar AG-30 Plus 2.6b. It has been classified as problematic. Affected is an unknown function of the component Login Page. The manipulation leads to improper restriction of excessive authentication attempts. The complexity of an attack is rather high. The exploitability is told to be dif…
Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-12T14:31:06.409Z. Updated 2024-11-12T20:13:26.812Z.
GetSimpleCMS profile.php cross-site request forgery
A vulnerability was found in GetSimpleCMS 3.3.16 and classified as problematic. This issue affects some unknown processing of the file /admin/profile.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor …
Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-12T14:31:05.119Z. Updated 2024-11-12T15:46:07.836Z.
TimGeyssens UIOMatic uioMaticObject.r sql injection
A vulnerability has been found in TimGeyssens UIOMatic 5 and classified as critical. This vulnerability affects unknown code of the file /src/UIOMatic/wwwroot/backoffice/resources/uioMaticObject.r. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the publi…
Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-12T13:31:04.688Z. Updated 2024-11-12T14:13:26.626Z.