Export limit exceeded: 33777 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (33777 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-54211 | 1 Tobit Laboratories Ag | 1 Teamdavid | 2026-08-07 | N/A |
| Tobit Laboratories AG TeamDavid's Webbox application’s endpoint “//serverClient_close.html” is vulnerable to a buffer overflow vulnerability in multiple form data parameters. By submitting excessively long values in these parameters, an authenticated attacker can trigger a server crash, resulting in denial of service. Depending on the stack state or if a stack canary can be disclosed through another vulnerability, this buffer overflow could potentially be exploited for remote code execution, leading to full compromise of the server. This issue affects TeamDavid through Rollout 524. | ||||
| CVE-2026-54213 | 1 Tobit Laboratories Ag | 1 Teamdavid | 2026-08-07 | N/A |
| Tobit Laboratories AG TeamDavid's Webbox application exposes a functionality that allows the server to be shut down when a specific endpoint (/internalRestart) is accessed. This endpoint is accessible to unauthenticated users over the public Internet. Instead of “restarting”, the server shuts completely down. As a result, a remote attacker can trigger a persistent denial of service by shutting down the web server without requiring authentication. Recovery requires manual administrator intervention to restart the service. This issue affects TeamDavid through Rollout 524. | ||||
| CVE-2026-54214 | 1 Tobit Laboratories Ag | 1 Teamdavid | 2026-08-07 | N/A |
| Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cType” URL parameter, which allows arbitrary modification of the Content-Type header in HTTP responses. Because the parameter does not properly restrict control characters such as URL-encoded newlines (“%0a”) or colons, attackers can inject additional headers including extra Location headers into the server’s response. This results e.g. in an open redirect vulnerability. This issue affects TeamDavid through Rollout 524. | ||||
| CVE-2026-54215 | 1 Tobit Laboratories Ag | 1 Teamdavid | 2026-08-07 | N/A |
| Tobit Laboratories AG TeamDavid's Webbox contains an open redirect vulnerability via the “replyUrl” parameter. An attacker can exploit this vulnerability to craft a URL within the application that, when visited, redirects the user’s browser to an arbitrary third-party site. This can be abused for phishing attacks, where users receive a trusted domain link but are redirected to a phishing website. This issue affects TeamDavid through Rollout 524. | ||||
| CVE-2026-54217 | 1 Tobit Laboratories Ag | 1 Teamdavid | 2026-08-07 | N/A |
| Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to a stored XSS vulnerability. An attacker can send an email containing malicious JavaScript code. When a user accesses the email, the stored cross-site scripting is triggered. This issue affects TeamDavid through Rollout 524. | ||||
| CVE-2026-54218 | 1 Tobit Laboratories Ag | 1 Teamdavid | 2026-08-07 | N/A |
| Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various files using only obfuscation. Any user with access to the server’s file system, or who can otherwise extract files from the server (see vulnerability “Random File Read”), can potentially obtain affected users’ passwords. This issue affects TeamDavid through Rollout 524. | ||||
| CVE-2026-54205 | 2026-08-07 | N/A | ||
| Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality (//ServerClient_celink.htm) accepts a “pathname” parameter, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled SMB servers. This enables authenticated attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information (such as NTLM hashes). If outbound connections to port 445 (SMB) are permitted, attackers can use this to conduct SMB relay or credential theft attacks. Exploitation of the “pathname” parameter is possible without authentication. This issue affects TeamDavid through Rollout 524. | ||||
| CVE-2026-55031 | 1 Microsoft | 15 365 Apps, Excel 2016, Microsoft 365 Apps For Enterprise and 12 more | 2026-08-07 | 7.8 High |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55029 | 1 Microsoft | 15 365 Apps, Excel 2016, Microsoft 365 Apps For Enterprise and 12 more | 2026-08-07 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55047 | 1 Microsoft | 19 365 Apps, Microsoft 365 Apps For Enterprise, Microsoft Office 365 For Mac and 16 more | 2026-08-07 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-55141 | 1 Microsoft | 15 365 Apps, Excel 2016, Microsoft 365 Apps For Enterprise and 12 more | 2026-08-07 | 7.8 High |
| Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55055 | 1 Microsoft | 19 365 Apps, Microsoft 365 Apps For Enterprise, Microsoft Office 365 For Mac and 16 more | 2026-08-07 | 7.8 High |
| Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55132 | 1 Microsoft | 19 365 Apps, Microsoft 365 Apps For Enterprise, Microsoft Office 365 For Mac and 16 more | 2026-08-07 | 7.8 High |
| Double free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55043 | 1 Microsoft | 14 365 Apps, Microsoft 365 Apps For Enterprise, Microsoft Office 365 For Mac and 11 more | 2026-08-07 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55949 | 1 Microsoft | 16 365 Apps, Excel 2016, Excel 2019 and 13 more | 2026-08-07 | 7.8 High |
| Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-56184 | 1 Microsoft | 13 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 10 more | 2026-08-07 | 5.5 Medium |
| Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-56192 | 1 Microsoft | 19 365 Apps, Microsoft 365 Apps For Enterprise, Microsoft Office 365 For Mac and 16 more | 2026-08-07 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-54124 | 1 Microsoft | 16 Terminal, Windows 10 21h2, Windows 10 21h2 and 13 more | 2026-08-07 | 7.8 High |
| Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-57092 | 1 Microsoft | 24 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 21 more | 2026-08-07 | 9.9 Critical |
| Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-55121 | 1 Microsoft | 21 365 Apps, Microsoft 365 Apps For Enterprise, Microsoft Office 2016 and 18 more | 2026-08-07 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | ||||