Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
v.26.4.2314

Known Vulnerabilities

This page lists 15552 vulnerabilities in this category.

Critical: 1687 High: 4225 Medium: 8839 Low: 799 Information: 2
Vulnerability Name
CVE
CWE
Severity
ColdFusion AMF Deserialization RCE
CVE-2017-3066
CWE-502
High
ColdFusion Arbitrary File Upload
CVE-2018-15961
CWE-434
High
ColdFusion JNDI injection RCE
CVE-2018-15957
CWE-502
High
Drupal Remote Code Execution (SA-CORE-2018-002)
CVE-2018-7600
CWE-94
High
Drupal Remote Code Execution (SA-CORE-2018-004)
CVE-2018-7602
CWE-94
High
JBoss InvokerTransformer Remote Code Execution
CVE-2015-7501
CWE-502
High
Jboss Application Server HTTPServerILServlet.java remote code execution
CVE-2017-7504
CWE-502
High
JavaMelody XML External Entity (XXE) vulnerability
CVE-2018-15531
CWE-611
High
Deserialization of Untrusted Data (Java JSON Deserialization) Jackson
CVE-2017-7525
CWE-502
High
Paperclip gem SSRF (Server side request forgery)
CVE-2017-0889
CWE-918
High
Rails Asset Pipeline Directory Traversal Vulnerability
CVE-2018-3760
CWE-22
High
Arbitrary EL Evaluation in RichFaces
CVE-2015-0279
CWE-917
High
Remote Code Execution (RCE) in Spring Security OAuth
CVE-2016-4977
CWE-94
High
Spring Data REST RCE via PATCH requests
CVE-2017-8046
CWE-94
High
Spring Security Authentication Bypass
CVE-2016-5007
CWE-287
High
Data Binding Expression Vulnerability in Spring Web Flow
CVE-2017-4971
CWE-78
High
Apache Struts Remote Code Execution (S2-057)
CVE-2018-11776
CWE-917
High
Telerik.Web.UI.dll Cryptographic Weakness
CVE-2017-9248
CWE-338
High
IBM WebSphere RCE Java Deserialization Vulnerability
CVE-2015-7450
CWE-502
High
Oracle Weblogic WLS-WSAT Component Deserialization RCE
CVE-2017-10271
CWE-94
High
Adobe Experience Manager Misconfiguration
CVE-2016-0957
CWE-1188
High
Apache CouchDB JSON Remote Privilege Escalation Vulnerability
CVE-2017-12635
CWE-285
High
Ektron CMS authentication bypass
CVE-2018-12596
CWE-285
High
GoAhead web server remote code execution
CVE-2017-17562
CWE-94
High
jQuery File Upload unauthenticated arbitrary file upload
CVE-2018-9206
CWE-434
High
Laravel log viewer local file download (LFD)
CVE-2018-8947
CWE-22
High
ACME mini_httpd arbitrary file read
CVE-2018-18778
CWE-23
High
Node.js path validation vulnerability
CVE-2017-14849
CWE-22
High
PHPUnit Remote Code Execution
CVE-2017-9841
CWE-94
High
RCE with Spring Data Commons
CVE-2018-1273
CWE-94
High
Oracle WebLogic Authentication Bypass
CVE-2018-2894
CWE-287
High
Oracle WebLogic Remote Code Execution via T3
CVE-2018-3245
CWE-502
High
WordPress Plugin WPML Unauthenticated Stored XSS
CVE-2018-18069
CWE-80
High
Jira Unauthorized SSRF via REST API
CVE-2019-8451
CWE-918
High
ColdFusion FlashGateway Deserialization RCE CVE-2019-7091
CVE-2019-7091
CWE-502
High
Confluence Widget Connector SSTI
CVE-2019-3396
CWE-22
High
Fortigate SSL VPN Arbitrary File reading (CVE-2018-13379)
CVE-2018-13379
CWE-22
High
Jira SSTI CVE-2019-11581
CVE-2019-11581
CWE-22
High
Oracle Business Intelligence Adfresource Path traversal CVE-2019-2588
CVE-2019-2588
CWE-200
High
Oracle Business Intelligence AuthBypass CVE-2019-2768
CVE-2019-2768
CWE-200
High
Oracle Business Intelligence Convert XXE CVE-2019-2767
CVE-2019-2767
CWE-611
High
Oracle Business Intelligence ReportTemplateService XXE CVE-2019-2616
CVE-2019-2616
CWE-611
High
Oracle Business Intelligence ReportTemplateService XXE (CVE-2021-2400)
CVE-2021-2400
CWE-611
High
Pulse Secure SSL VPN Arbitrary File reading (CVE-2019-11510)
CVE-2019-11510
CWE-22
High
SAP Hybris Deserialization RCE
CVE-2019-0344
CWE-502
High
Apache REST RCE CVE-2018-11770
CVE-2018-11770
CWE-94
High
Oracle Weblogic T3 XXE (CVE-2019-2647)
CVE-2019-2647
CWE-611
High
Oracle Weblogic T3 XXE (CVE-2019-2888)
CVE-2019-2888
CWE-611
High
Oracle Weblogic Async Component Deserialization RCE CVE-2019-2725
CVE-2019-2725
CWE-94
High
Apache Solr Deserialization of untrusted data via jmx.serviceUrl
CVE-2019-0192
CWE-502
High
Atlassian Crowd Remote Code Execution
CVE-2019-11580
CWE-78
High
Remote code execution in bootstrap-sass 3.2.0.3
CVE-2019-10842
CWE-95
High
Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerability
CVE-2018-15440
CWE-80
High
Drupal REST Remote Code Execution
CVE-2019-6340
CWE-78
High
Horde Imp Unauthenticated Remote Command Execution
CVE-2018-19518
CWE-94
High
Magento (2.2.0 to 2.3.0) Unauthenticated SQL Injection Vulnerability
CVE-2019-7139
CWE-89
High
Nagios XI Magpie_debug.php Unauthenticated RCE
CVE-2018-15708
CWE-94
High
Nagios XI Unauthenticated SQLi CVE-2018-8734
CVE-2018-8734
CWE-89
High
File Content Disclosure in Action View
CVE-2019-5418
CWE-200
High
Webmin v1.920 Unauhenticated Remote Command Execution
CVE-2019-15107
CWE-94
High
Cisco Adaptive Security Appliance (ASA) Path Traversal CVE-2020-3452
CVE-2020-3452
CWE-20
High
DNN (DotNetNuke) CMS Cookie Deserialization RCE CVE-2017-9822
CVE-2017-9822
CWE-502
High
Kentico CMS Deserialization RCE
CVE-2019-10068
CWE-502
High
Kentico CMS RCE CVE-2017-17736
CVE-2017-17736
CWE-425
High
Oracle Business Intelligence AMF Deserialization RCE CVE-2020-2950
CVE-2020-2950
CWE-502
High
Oracle E-Business Suite SQL injection (CVE-2017-3549)
CVE-2017-3549
CWE-89
High
Oracle E-Business Suite SSRF (CVE-2017-10246)
CVE-2017-10246
CWE-918
High
Apache OFBiz XMLRPC Deserialization RCE (CVE-2020-9496/CVE-2023-49070)
CVE-2023-49070
CWE-502
High
Odoo LFI (CVE-2019-14322)
CVE-2019-14322
CWE-22
High
Ruby on Rails DoubleTap RCE (CVE-2019-5420)
CVE-2019-5420
CWE-502
High
SAP IGS XXE (CVE-2018-2392, CVE-2018-2393)
CVE-2018-2393
CWE-611
High
SAP NetWeaver RECON CVE-2020-6287
CVE-2020-6287
CWE-287
High
Telerik Web UI Unrestricted File Upload (CVE-2014-2217)
CVE-2014-2217
CWE-78
High
Telerik Web UI Unrestricted File Upload (CVE-2017-11317)
CVE-2017-11317
CWE-78
High
Telerik Web UI Insecure Direct Object Reference
CVE-2017-11357
CWE-78
High