Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 3,433 published records · 11 KEV · 3,433 with a forecast · 0 unknown dates
3,433 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.32% · forecast 100% · unscored 21%.
IBM Security Verify Access privilege escalation
IBM Security Verify Access Docker 10.0.0 through 10.0.6 could allow a local user to escalate their privileges due to execution of unnecessary privileges.
Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-19T01:10:05.711Z. Updated 2025-11-03T21:54:54.603Z.
IBM Db2 denial of service
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query.
Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-19T01:04:07.275Z. Updated 2024-12-19T16:38:43.360Z.
IBM Robotic Process Automation information disclosure
IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 could allow a user with psychical access to the system to obtain sensitive information due to insufficiently protected credentials.
Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-19T00:44:55.747Z. Updated 2024-12-19T16:38:49.868Z.
IBM Cognos Analytics Mobile information disclosure
IBM Cognos Analytics Mobile for Android 1.1.14 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-19T00:22:15.460Z. Updated 2024-12-19T16:38:54.983Z.
CVE-2024-54663
An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Local File Inclusion (LFI) vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers to include and access sensitive files in the WebRoot directory. Exploitation requires a valid auth tok…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-19T00:00:00.000Z. Updated 2024-12-31T19:05:36.462Z.
CVE-2024-54790
A SQL Injection vulnerability was found in /index.php in PHPGurukul Pre-School Enrollment System v1.0, which allows remote attackers to execute arbitrary code via the visittime parameter.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-19T00:00:00.000Z. Updated 2024-12-19T15:52:05.059Z.
CVE-2024-54982
An issue in Quectel BC25 with firmware version BC25PAR01A06 allows attackers to bypass authentication via a crafted NAS message. NOTE: Quectel disputes this because the issue is in the chipset supply chain and is not localized to one or more Quectel products.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-19T00:00:00.000Z. Updated 2025-01-16T20:35:23.219Z.
CVE-2024-54983
An issue in Quectel BC95-CNV V100R001C00SPC051 allows attackers to bypass authentication via a crafted NAS message.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-19T00:00:00.000Z. Updated 2024-12-31T19:10:45.368Z.
CVE-2024-54984
An issue in Quectel BG96 BG96MAR02A08M1G allows attackers to bypass authentication via a crafted NAS message. NOTE: this is disputed by the supplier.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-19T00:00:00.000Z. Updated 2025-01-09T16:28:30.316Z.
CVE-2024-55081
An XML External Entity (XXE) injection vulnerability in the component /datagrip/upload of Chat2DB v0.3.5 allows attackers to execute arbitrary code via supplying a crafted XML input.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-19T00:00:00.000Z. Updated 2025-01-02T19:24:50.253Z.
CVE-2024-55082
A Server-Side Request Forgery (SSRF) in the endpoint http://{your-server}/url-to-pdf of Stirling-PDF 0.35.1 allows attackers to access sensitive information via a crafted request.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-19T00:00:00.000Z. Updated 2025-01-02T19:23:07.821Z.
CVE-2024-55196
Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMAP and SMTP servers.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-19T00:00:00.000Z. Updated 2025-01-02T19:26:48.250Z.
Insufficient session invalidation in Kanboard
Kanboard is project management software that focuses on the Kanban methodology. In affected versions sessions are still usable even though their lifetime has exceeded. Kanboard implements a cutom session handler (`app/Core/Session/SessionHandler.php`), to store the session data in a database. Therefore, when a `session…
Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-18T23:52:57.327Z. Updated 2024-12-20T20:12:10.648Z.
IBM InfoSphere Information Server clickjacking
IBM InfoSphere Information Server 11.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
Severity medium: primary CNA CVSS 5.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-18T23:44:18.973Z. Updated 2024-12-19T16:39:00.402Z.
IBM Sterling B2B Integrator Standard Edition cross-site scripting
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-18T23:39:03.856Z. Updated 2024-12-19T16:39:07.625Z.
Acrobat Reader | NULL Pointer Dereference (CWE-476)
Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a NULL Pointer Dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Expl…
Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-18T23:32:03.651Z. Updated 2024-12-19T16:39:14.090Z.
Acrobat Reader | Use After Free (CWE-416)
Acrobat Reader DC version 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open…
Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-18T23:28:21.380Z. Updated 2024-12-19T16:39:19.866Z.
Acrobat Reader | Out-of-bounds Read (CWE-125)
Acrobat Reader DC version 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to by…
Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-18T23:28:16.489Z. Updated 2024-12-19T16:39:25.153Z.
Acrobat Reader | Use After Free (CWE-416)
Acrobat Reader DC version 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue r…
Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-18T23:28:15.314Z. Updated 2024-12-19T16:39:31.613Z.
Acrobat Reader | Out-of-bounds Write (CWE-787)
Acrobat Reader DC version 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim mus…
Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-18T23:28:09.769Z. Updated 2024-12-19T16:39:37.536Z.