Export limit exceeded: 374168 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (374168 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-54209 | 1 Tobit Laboratories Ag | 1 Teamdavid | 2026-08-07 | N/A |
| Tobit Laboratories AG TeamDavid's Webbox application handles password changes using a function triggered by including the string "(editini)" in the file path, writing the new password to the specified "Archive.ini" file. However, the application does not verify that the provided path actually refers to an "Archive.ini" file. If an attacker specifies a different file with excessive size, a buffer overflow occurs. This vulnerability allows an unauthenticated attacker to crash the server, resulting in denial of service. This issue affects TeamDavid through Rollout 524. | ||||
| CVE-2026-54210 | 1 Tobit Laboratories Ag | 1 Teamdavid | 2026-08-07 | N/A |
| Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities that are vulnerable to a buffer overflow condition. By specifying an excessively long filename in a file upload request, an unauthenticated attacker can trigger a crash of the server, resulting in a denial of service. Depending on the stack state or if a stack canary can be disclosed through another vulnerability, this buffer overflow could potentially be exploited for remote code execution, leading to full compromise of the server. This issue affects TeamDavid through Rollout 524. | ||||
| CVE-2026-54211 | 1 Tobit Laboratories Ag | 1 Teamdavid | 2026-08-07 | N/A |
| Tobit Laboratories AG TeamDavid's Webbox application’s endpoint “//serverClient_close.html” is vulnerable to a buffer overflow vulnerability in multiple form data parameters. By submitting excessively long values in these parameters, an authenticated attacker can trigger a server crash, resulting in denial of service. Depending on the stack state or if a stack canary can be disclosed through another vulnerability, this buffer overflow could potentially be exploited for remote code execution, leading to full compromise of the server. This issue affects TeamDavid through Rollout 524. | ||||
| CVE-2026-54213 | 1 Tobit Laboratories Ag | 1 Teamdavid | 2026-08-07 | N/A |
| Tobit Laboratories AG TeamDavid's Webbox application exposes a functionality that allows the server to be shut down when a specific endpoint (/internalRestart) is accessed. This endpoint is accessible to unauthenticated users over the public Internet. Instead of “restarting”, the server shuts completely down. As a result, a remote attacker can trigger a persistent denial of service by shutting down the web server without requiring authentication. Recovery requires manual administrator intervention to restart the service. This issue affects TeamDavid through Rollout 524. | ||||
| CVE-2026-54214 | 1 Tobit Laboratories Ag | 1 Teamdavid | 2026-08-07 | N/A |
| Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cType” URL parameter, which allows arbitrary modification of the Content-Type header in HTTP responses. Because the parameter does not properly restrict control characters such as URL-encoded newlines (“%0a”) or colons, attackers can inject additional headers including extra Location headers into the server’s response. This results e.g. in an open redirect vulnerability. This issue affects TeamDavid through Rollout 524. | ||||
| CVE-2026-54215 | 1 Tobit Laboratories Ag | 1 Teamdavid | 2026-08-07 | N/A |
| Tobit Laboratories AG TeamDavid's Webbox contains an open redirect vulnerability via the “replyUrl” parameter. An attacker can exploit this vulnerability to craft a URL within the application that, when visited, redirects the user’s browser to an arbitrary third-party site. This can be abused for phishing attacks, where users receive a trusted domain link but are redirected to a phishing website. This issue affects TeamDavid through Rollout 524. | ||||
| CVE-2026-54217 | 1 Tobit Laboratories Ag | 1 Teamdavid | 2026-08-07 | N/A |
| Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to a stored XSS vulnerability. An attacker can send an email containing malicious JavaScript code. When a user accesses the email, the stored cross-site scripting is triggered. This issue affects TeamDavid through Rollout 524. | ||||
| CVE-2026-54218 | 1 Tobit Laboratories Ag | 1 Teamdavid | 2026-08-07 | N/A |
| Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various files using only obfuscation. Any user with access to the server’s file system, or who can otherwise extract files from the server (see vulnerability “Random File Read”), can potentially obtain affected users’ passwords. This issue affects TeamDavid through Rollout 524. | ||||
| CVE-2026-54216 | 1 Tobit Laboratories Ag | 1 Teamdavid | 2026-08-07 | N/A |
| Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting (XSS) vulnerability. By sending a specially crafted link including an arbitrary path, an XSS payload or the parameter “EntryInfo”, and the parameter “!templateName=entryMail”, an attacker can cause the payload to execute in the victim’s browser when they click the link. This issue affects TeamDavid through Rollout 524. | ||||
| CVE-2026-55031 | 1 Microsoft | 15 365 Apps, Excel 2016, Microsoft 365 Apps For Enterprise and 12 more | 2026-08-07 | 7.8 High |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55029 | 1 Microsoft | 15 365 Apps, Excel 2016, Microsoft 365 Apps For Enterprise and 12 more | 2026-08-07 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55047 | 1 Microsoft | 19 365 Apps, Microsoft 365 Apps For Enterprise, Microsoft Office 365 For Mac and 16 more | 2026-08-07 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-55141 | 1 Microsoft | 15 365 Apps, Excel 2016, Microsoft 365 Apps For Enterprise and 12 more | 2026-08-07 | 7.8 High |
| Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55055 | 1 Microsoft | 19 365 Apps, Microsoft 365 Apps For Enterprise, Microsoft Office 365 For Mac and 16 more | 2026-08-07 | 7.8 High |
| Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55132 | 1 Microsoft | 19 365 Apps, Microsoft 365 Apps For Enterprise, Microsoft Office 365 For Mac and 16 more | 2026-08-07 | 7.8 High |
| Double free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55043 | 1 Microsoft | 14 365 Apps, Microsoft 365 Apps For Enterprise, Microsoft Office 365 For Mac and 11 more | 2026-08-07 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55949 | 1 Microsoft | 16 365 Apps, Excel 2016, Excel 2019 and 13 more | 2026-08-07 | 7.8 High |
| Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-56184 | 1 Microsoft | 13 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 10 more | 2026-08-07 | 5.5 Medium |
| Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-56192 | 1 Microsoft | 19 365 Apps, Microsoft 365 Apps For Enterprise, Microsoft Office 365 For Mac and 16 more | 2026-08-07 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-54124 | 1 Microsoft | 16 Terminal, Windows 10 21h2, Windows 10 21h2 and 13 more | 2026-08-07 | 7.8 High |
| Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code locally. | ||||