https://vulnogram.org/ Most recent CVEs assigned by KoreLogic Security (korelogic). https://vulnogram.org/seaview/icons/korelogic.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2025-15464 https://vulnogram.org/CVE-2025-15464 Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls. High Network Exploitable Thu, 08 Jan 2026 21:01:31 GMT https://vulnogram.org/CVE-2025-54769 https://vulnogram.org/CVE-2025-54769 An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing. This can be used to overwrite existing PERL modules within the application to achieve remote code e… High Mon, 28 Jul 2025 23:34:38 GMT https://vulnogram.org/CVE-2025-54768 https://vulnogram.org/CVE-2025-54768 An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to download logs from the appliance configuration, exposing sensitive in… Medium Network Exploitable Mon, 28 Jul 2025 23:31:09 GMT https://vulnogram.org/CVE-2025-54767 https://vulnogram.org/CVE-2025-54767 An authenticated, read-only user can kill any processes running on the Xormon Original virtual appliance as the lpar2rrd user. Medium Mon, 28 Jul 2025 23:28:27 GMT https://vulnogram.org/CVE-2025-54765 https://vulnogram.org/CVE-2025-54765 An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control t… Medium Network Exploitable Mon, 28 Jul 2025 23:25:12 GMT https://vulnogram.org/CVE-2025-54766 https://vulnogram.org/CVE-2025-54766 An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to export the appliance configuration, exposing sensitive information. Medium Network Exploitable Mon, 28 Jul 2025 23:16:13 GMT https://vulnogram.org/CVE-2025-5100 https://vulnogram.org/CVE-2025-5100 A double-free condition occurs during the cleanup of temporary image files, which can be exploited to achieve memory corruption and potentially arbitrary code execution. High Fri, 23 May 2025 01:09:41 GMT https://vulnogram.org/CVE-2025-5098 https://vulnogram.org/CVE-2025-5098 PrinterShare Android application allows the capture of Gmail authentication tokens that can be reused to access a user's Gmail account without proper authorization. Critical Network Exploitable Fri, 23 May 2025 01:06:25 GMT https://vulnogram.org/CVE-2025-5099 https://vulnogram.org/CVE-2025-5099 An Out of Bounds Write occurs when the native library attempts PDF rendering, which can be exploited to achieve memory corruption and potentially arbitrary code execution. Critical Network Exploitable Fri, 23 May 2025 01:05:53 GMT https://vulnogram.org/CVE-2024-13722 https://vulnogram.org/CVE-2024-13722 The "NagVis" component within Checkmk is vulnerable to reflected cross-site scripting. An attacker can craft a malicious link that will execute arbitrary JavaScript in the context of the browser once clicked. The attack can be performed on both authe… Medium Tue, 04 Feb 2025 22:04:00 GMT https://vulnogram.org/CVE-2024-13723 https://vulnogram.org/CVE-2024-13723 The "NagVis" component within Checkmk is vulnerable to remote code execution. An authenticated attacker with administrative level privileges is able to upload a malicious PHP file and modify specific settings to execute the contents of the file as PH… High Tue, 04 Feb 2025 22:02:19 GMT https://vulnogram.org/CVE-2024-8504 https://vulnogram.org/CVE-2024-8504 An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. This attack can be chained with CVE-2024-8503 to execute arbitrary shell commands starting from an unauthenticated perspective. High Tue, 10 Sep 2024 19:23:39 GMT https://vulnogram.org/CVE-2024-8503 https://vulnogram.org/CVE-2024-8503 An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database. Critical Network Exploitable Tue, 10 Sep 2024 19:22:40 GMT https://vulnogram.org/CVE-2024-6893 https://vulnogram.org/CVE-2024-6893 The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources. High Network Exploitable Wed, 07 Aug 2024 23:22:08 GMT https://vulnogram.org/CVE-2024-6892 https://vulnogram.org/CVE-2024-6892 Attackers can craft a malicious link that once clicked will execute arbitrary JavaScript in the context of the Journyx web application. Medium Network Exploitable Wed, 07 Aug 2024 23:19:00 GMT https://vulnogram.org/CVE-2024-6891 https://vulnogram.org/CVE-2024-6891 Attackers with a valid username and password can exploit a python code injection vulnerability during the natural login flow. High Wed, 07 Aug 2024 23:13:56 GMT https://vulnogram.org/CVE-2024-6890 https://vulnogram.org/CVE-2024-6890 Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password. Critical Network Exploitable Wed, 07 Aug 2024 23:09:40 GMT https://vulnogram.org/CVE-2024-6707 https://vulnogram.org/CVE-2024-6707 Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traversal vulnerability. High Network Exploitable Wed, 07 Aug 2024 23:04:45 GMT https://vulnogram.org/CVE-2024-6706 https://vulnogram.org/CVE-2024-6706 Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page. Medium Network Exploitable Wed, 07 Aug 2024 23:01:15 GMT