Web Application Vulnerabilities Index

This page lists vulnerabilities categorized as High severity that can be detected by Invicti.

Select Category
Critical
High
Medium
Low
Best Practice
Information
Select Vulnerability
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Select Vulnerability
Vulnerability Name
Classification
Severity
Apache OFBiz Log4Shell RCE
Apache OFBiz Log4Shell RCE
CWE-CWE-78
, 
High
Apache OFBiz SOAPService Deserialization RCE
Apache OFBiz SOAPService Deserialization RCE
CWE-CWE-502
, 
AV:N/AC:M/Au:N/C:C/I:C/A:C
, 
High
Apache OFBiz SSRF (CVE-2023-50968)
Apache OFBiz SSRF (CVE-2023-50968)
CWE-CWE-918
, 
High
Apache OFBiz XMLRPC Deserialization RCE (CVE-2020-9496/CVE-2023-49070)
Apache OFBiz XMLRPC Deserialization RCE (CVE-2020-9496/CVE-2023-49070)
CWE-CWE-502
, 
AV:N/AC:M/Au:N/C:N/I:P/A:N
, 
High
Arbitrary File Creation Detected
Arbitrary File Creation Detected
CWE-20
, 
OWASP 2017-A5
, 
High
Arbitrary File Deletion Detected
Arbitrary File Deletion Detected
CWE-20
, 
OWASP 2017-A5
, 
High
ASP.NET Tracing Is Enabled
ASP.NET Tracing Is Enabled
CWE-11
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
, 
High
Authentication Bypass in Fortra's GoAnywhere MFT (CVE-2024-0204)
Authentication Bypass in Fortra's GoAnywhere MFT (CVE-2024-0204)
PCI v3.2-6.5.1
, 
CAPEC-114
, 
115
, 
CWE-425
, 
HIPAA-164.306(a)
, 
ISO27001-A.13.1.1
, 
WASC-1
, 
OWASP 2013-A9
, 
OWASP 2017-A9
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
, 
High
Authentication Bypass in Ivanti Connect Secure and Policy Secure (CVE-2023-46805)
Authentication Bypass in Ivanti Connect Secure and Policy Secure (CVE-2023-46805)
PCI v3.2-6.5.1
, 
CAPEC-114
, 
115
, 
CWE-287
, 
HIPAA-164.306(a)
, 
ISO27001-A.13.1.1
, 
WASC-1
, 
OWASP 2013-A9
, 
OWASP 2017-A9
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
, 
High
Backup Source Code Detected
Backup Source Code Detected
PCI v3.2-6.5.8
, 
CAPEC-87
, 
CWE-530
, 
HIPAA-164.306(a)
, 
164.308(a)
, 
ISO27001-A.18.1.3
, 
WASC-34
, 
OWASP 2013-A7
, 
OWASP 2017-A5
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
, 
High
Basic Authorization over HTTP
Basic Authorization over HTTP
PCI v3.2-6.5.4
, 
CAPEC-65
, 
CWE-319
, 
ISO27001-A.14.1.3
, 
WASC-4
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
, 
High
Blind Cross-site Scripting
Blind Cross-site Scripting
PCI v3.2-6.5.7
, 
CAPEC-19
, 
CWE-79
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
WASC-8
, 
OWASP 2013-A3
, 
OWASP 2017-A7
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
, 
High
Blind MongoDB Injection
Blind MongoDB Injection
PCI v3.2-6.5.1
, 
CWE-943
, 
HIPAA-164.306(a)
, 
164.308(a)
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
, 
High
Boolean Based MongoDB Injection
Boolean Based MongoDB Injection
PCI v3.2-6.5.1
, 
CWE-943
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
, 
High
Certificate is Signed Using a Weak Signature Algorithm
Certificate is Signed Using a Weak Signature Algorithm
PCI v3.2-6.5.4
, 
CAPEC-459
, 
ISO27001-A.10
, 
WASC-4
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
, 
High
Cross-site Scripting
Cross-site Scripting
CAPEC-19
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
, 
CWE-79
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A3
, 
OWASP 2017-A7
, 
PCI v3.2-6.5.7
, 
WASC-8
, 
High
Cross-site Scripting (DOM based)
Cross-site Scripting (DOM based)
CAPEC-19
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
, 
CWE-79
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A3
, 
OWASP 2017-A7
, 
PCI v3.2-6.5.7
, 
WASC-8
, 
High
Cross-site Scripting via File Upload
Cross-site Scripting via File Upload
CAPEC-19
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
, 
CWE-79
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A3
, 
OWASP 2017-A7
, 
PCI v3.2-6.5.7
, 
WASC-8
, 
High
Cross-site Scripting via Remote File Inclusion
Cross-site Scripting via Remote File Inclusion
CAPEC-19
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
, 
CWE-79
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A3
, 
OWASP 2017-A7
, 
PCI v3.2-6.5.7
, 
WASC-8
, 
High
Database User Has Admin Privileges
Database User Has Admin Privileges
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
, 
CWE-267
, 
ISO27001-A.9.2.2
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
PCI v3.2-6.5.6
, 
WASC-14
, 
High
Elmah.axd / Errorlog.axd Detected
Elmah.axd / Errorlog.axd Detected
PCI v3.2-6.5.6
, 
CAPEC-347
, 
CWE-16
, 
HIPAA-164.306(a)
, 
164.308(a)
, 
ISO27001-A.18.1.3
, 
WASC-15
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C
, 
High
Error-Based MongoDB Injection
Error-Based MongoDB Injection
PCI v3.2-6.5.1
, 
CWE-943
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
, 
High
Expression Language Injection
Expression Language Injection
PCI v3.2-6.5.1
, 
CWE-20
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
, 
High
F5 Big-IP Local File Inclusion (CVE-2020-5902)
F5 Big-IP Local File Inclusion (CVE-2020-5902)
PCI v3.2-6.5.8
, 
CAPEC-252
, 
CWE-22
, 
HIPAA-164.306(a)
, 
ISO27001-A.14.2.5
, 
WASC-33
, 
OWASP 2013-A4
, 
OWASP 2017-A5
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
, 
High
Fortigate SSL VPN Arbitrary File reading (CVE-2018-13379)
Fortigate SSL VPN Arbitrary File reading (CVE-2018-13379)
CWE-22
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
, 
High
Grafana Open Redirect (CVE-2025-4123)
Grafana Open Redirect (CVE-2025-4123)
CWE-CWE-601
, 
High
Insecure Transportation Security Protocol Supported (SSLv2)
Insecure Transportation Security Protocol Supported (SSLv2)
PCI v3.2-6.5.4
, 
CAPEC-217
, 
CWE-326
, 
HIPAA-164.306
, 
ISO27001-A.14.1.3
, 
WASC-4
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C
, 
High
Insecure Transportation Security Protocol Supported (SSLv3)
Insecure Transportation Security Protocol Supported (SSLv3)
PCI v3.2-6.5.4
, 
CAPEC-217
, 
CWE-326
, 
HIPAA-164.306
, 
ISO27001-A.14.1.3
, 
WASC-4
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C
, 
High
Insecure Transportation Security Protocol Supported (TLS 1.0)
Insecure Transportation Security Protocol Supported (TLS 1.0)
PCI v3.2-6.5.4
, 
CAPEC-217
, 
CWE-326
, 
HIPAA-164.306
, 
ISO27001-A.14.1.3
, 
WASC-4
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
High
JBoss Web Console JMX Invoker
JBoss Web Console JMX Invoker
CWE-200
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
, 
High
JWT Forgery via Chaining Jku Parameter with Open Redirect
JWT Forgery via Chaining Jku Parameter with Open Redirect
CWE-347
, 
OWASP 2017-A2
, 
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
, 
High
JWT Forgery via Path Traversal
JWT Forgery via Path Traversal
CWE-22
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
, 
High
JWT Forgery via SQL Injection
JWT Forgery via SQL Injection
CWE-89
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
, 
High
JWT Forgery via unvalidated jku parameter
JWT Forgery via unvalidated jku parameter
CWE-639
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
, 
High
JWT Signature Bypass via None Algorithm
JWT Signature Bypass via None Algorithm
CWE-287
, 
OWASP 2017-A2
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
, 
High
JWT Signature is not Verified
JWT Signature is not Verified
CWE-287
, 
OWASP 2017-A2
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
, 
High
Local File Inclusion
Local File Inclusion
PCI v3.2-6.5.8
, 
CAPEC-252
, 
CWE-22
, 
HIPAA-164.306(a)
, 
ISO27001-A.14.2.5
, 
WASC-33
, 
OWASP 2013-A4
, 
OWASP 2017-A5
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
, 
High
Local File Inclusion (IAST)
Local File Inclusion (IAST)
PCI v3.2-6.5.8
, 
CAPEC-252
, 
CWE-22
, 
HIPAA-164.306(a)
, 
ISO27001-A.14.2.5
, 
WASC-33
, 
OWASP 2013-A4
, 
OWASP 2017-A5
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
, 
High
MongoDB Operator Injection
MongoDB Operator Injection
PCI v3.2-6.5.1
, 
CWE-943
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
, 
High
No SAML Response Signature Check
No SAML Response Signature Check
CWE-16
, 
ISO27001-A.14.2.5
, 
WASC-15
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
, 
High
Oracle Access Manager 'opensso' Deserialization RCE (CVE-2021-35587)
Oracle Access Manager 'opensso' Deserialization RCE (CVE-2021-35587)
CWE-CWE-502
, 
High
Oracle WebLogic Authentication Bypass (CVE-2020-14883)
Oracle WebLogic Authentication Bypass (CVE-2020-14883)
CWE-288
, 
OWASP 2013-A2
, 
OWASP 2017-A2
, 
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
, 
High
Out of Band SAML Consumer Service XML Entity Injection
Out of Band SAML Consumer Service XML Entity Injection
PCI v3.2-6.5.1
, 
CAPEC-376
, 
CWE-611
, 
HIPAA-164.306(a)
, 
164.308(a)
, 
ISO27001-A.14.2.5
, 
WASC-43
, 
OWASP 2013-A1
, 
OWASP 2017-A4
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
, 
High
Out of Band SAML Consumer Service XSLT Injection
Out of Band SAML Consumer Service XSLT Injection
PCI v3.2-6.5.1
, 
CAPEC-376
, 
CWE-611
, 
HIPAA-164.306(a)
, 
164.308(a)
, 
ISO27001-A.14.2.5
, 
WASC-43
, 
OWASP 2013-A1
, 
OWASP 2017-A4
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
, 
High
Out of Band XML External Entity Injection
Out of Band XML External Entity Injection
PCI v3.2-6.5.1
, 
CAPEC-376
, 
CWE-611
, 
HIPAA-164.306(a)
, 
164.308(a)
, 
ISO27001-A.14.2.5
, 
WASC-43
, 
OWASP 2013-A1
, 
OWASP 2017-A4
, 
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:H
, 
High
Out-of-date Version (HSQLDB)
Out-of-date Version (HSQLDB)
PCI v3.2-6.2
, 
CAPEC-310
, 
CWE-1035
, 
937
, 
HIPAA-164.308(a)(1)(i)
, 
ISO27001-A.14.1.2
, 
OWASP 2013-A9
, 
OWASP 2017-A9
, 
High
Out-of-date Version (Microsoft SQL Server)
Out-of-date Version (Microsoft SQL Server)
PCI v3.2-6.2
, 
CAPEC-310
, 
CWE-1035
, 
937
, 
HIPAA-164.308(a)(1)(i)
, 
ISO27001-A.14.1.2
, 
OWASP 2013-A9
, 
OWASP 2017-A9
, 
High
Out-of-date Version (MongoDb)
Out-of-date Version (MongoDb)
PCI v3.2-6.2
, 
CAPEC-310
, 
CWE-1035
, 
937
, 
HIPAA-164.308(a)(1)(i)
, 
ISO27001-A.14.1.2
, 
OWASP 2013-A9
, 
OWASP 2017-A9
, 
High
Out-of-date Version (MySQL)
Out-of-date Version (MySQL)
PCI v3.2-6.2
, 
CAPEC-310
, 
CWE-1035
, 
937
, 
HIPAA-164.308(a)(1)(i)
, 
ISO27001-A.14.1.2
, 
OWASP 2013-A9
, 
OWASP 2017-A9
, 
High
Out-of-date Version (Oracle)
Out-of-date Version (Oracle)
PCI v3.2-6.2
, 
CAPEC-310
, 
CWE-1035
, 
937
, 
HIPAA-164.308(a)(1)(i)
, 
ISO27001-A.14.1.2
, 
OWASP 2013-A9
, 
OWASP 2017-A9
, 
High
Out-of-date Version (PostgreSQL)
Out-of-date Version (PostgreSQL)
PCI v3.2-6.2
, 
CAPEC-310
, 
CWE-1035
, 
937
, 
HIPAA-164.308(a)(1)(i)
, 
ISO27001-A.14.1.2
, 
OWASP 2013-A9
, 
OWASP 2017-A9
, 
High
Out-of-date Version (SQLite)
Out-of-date Version (SQLite)
PCI v3.2-6.2
, 
CAPEC-310
, 
CWE-1035
, 
937
, 
HIPAA-164.308(a)(1)(i)
, 
ISO27001-A.14.1.2
, 
OWASP 2013-A9
, 
OWASP 2017-A9
, 
High
Password Transmitted over HTTP
Password Transmitted over HTTP
PCI v3.2-6.5.4
, 
CAPEC-65
, 
CWE-319
, 
ISO27001-A.14.1.3
, 
WASC-4
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
, 
High
Polyfill.io Supply Chain Attack
Polyfill.io Supply Chain Attack
No items found.
High
Progress MOVEit Transfer SQL Injection
Progress MOVEit Transfer SQL Injection
PCI v3.2-6.5.1
, 
CAPEC-66
, 
CWE-89
, 
HIPAA-164.306(a)
, 
164.308(a)
, 
ISO27001-A.14.2.5
, 
WASC-19
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
, 
High
ROBOT Attack Detected (Strong Oracle)
ROBOT Attack Detected (Strong Oracle)
PCI v3.2-6.5.4
, 
CAPEC-217
, 
ISO27001-A.14.1.3
, 
WASC-4
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:W/RC:C
, 
High
ROBOT Attack Detected (Weak Oracle)
ROBOT Attack Detected (Weak Oracle)
PCI v3.2-6.5.4
, 
CAPEC-217
, 
ISO27001-A.14.1.3
, 
WASC-4
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:W/RC:C
, 
High
Ruby on Rails File Content Disclosure (CVE-2019-5418)
Ruby on Rails File Content Disclosure (CVE-2019-5418)
PCI v3.2-6.5.8
, 
CAPEC-252
, 
CWE-98
, 
HIPAA-164.306(a)
, 
ISO27001-A.14.2.5
, 
WASC-33
, 
OWASP 2013-A4
, 
OWASP 2017-A5
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
, 
High
SAML Response Signature Exclusion
SAML Response Signature Exclusion
CWE-16
, 
ISO27001-A.14.2.5
, 
WASC-15
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
, 
High
SAML Response Without Signature
SAML Response Without Signature
CWE-16
, 
ISO27001-A.14.2.5
, 
WASC-15
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
, 
High
Server-Side Request Forgery (Apache Server Status)
Server-Side Request Forgery (Apache Server Status)
CWE-918
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
, 
High
Server-Side Request Forgery (AWS)
Server-Side Request Forgery (AWS)
CWE-918
, 
ISO27001-A.14.2.5
, 
OWASP 2017-A5
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
, 
High
Server-Side Request Forgery (elmah)
Server-Side Request Forgery (elmah)
PCI v3.2-6.5.6
, 
CAPEC-347
, 
CWE-918
, 
HIPAA-164.306(a)
, 
164.308(a)
, 
ISO27001-A.14.2.5
, 
WASC-15
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C
, 
High
Server-Side Request Forgery (elmah MVC)
Server-Side Request Forgery (elmah MVC)
PCI v3.2-6.5.6
, 
CAPEC-347
, 
CWE-918
, 
HIPAA-164.306(a)
, 
164.308(a)
, 
ISO27001-A.14.2.5
, 
WASC-15
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C
, 
High
Server-Side Request Forgery (MySQL)
Server-Side Request Forgery (MySQL)
CWE-918
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
, 
High
Server-Side Request Forgery (SSH)
Server-Side Request Forgery (SSH)
CWE-918
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
, 
High
Server-Side Template Injection (IAST)
Server-Side Template Injection (IAST)
PCI v3.2-6.5.1
, 
CAPEC-66
, 
CWE-20
, 
HIPAA-164.306(a)
, 
164.308(a)
, 
ISO27001-A.14.2.5
, 
WASC-19
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
, 
High
SimpleHelp Path Traversal (CVE-2024-57727)
SimpleHelp Path Traversal (CVE-2024-57727)
CWE-CWE-22
, 
High
Sitecore Arbitrary File Read (CVE-2024-46938)
Sitecore Arbitrary File Read (CVE-2024-46938)
CWE-CWE-200
, 
High
Stored Cross-site Scripting
Stored Cross-site Scripting
PCI v3.2-6.5.7
, 
CAPEC-19
, 
CWE-79
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
WASC-8
, 
OWASP 2013-A3
, 
OWASP 2017-A7
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
, 
High
SVN Detected
SVN Detected
CAPEC-118
, 
CWE-527
, 
ISO27001-A.9.4.1
, 
WASC-13
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
, 
High
TorchServe Management API Publicly Exposed
TorchServe Management API Publicly Exposed
PCI v3.2-6.5.8
, 
CAPEC-212
, 
CWE-200
, 
HIPAA-164.312(a)(1)
, 
ISO27001-A.18.1.3
, 
WASC-14
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
High
Trace.axd Detected
Trace.axd Detected
PCI v3.2-6.5.6
, 
CAPEC-347
, 
CWE-16
, 
HIPAA-164.306(a)
, 
164.308(a)
, 
ISO27001-A.18.1.3
, 
WASC-15
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C
, 
High
Unrestricted File Upload
Unrestricted File Upload
PCI v3.2-6.5.1
, 
CWE-434
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
, 
High