Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (89463 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2010-5337 1 Icewarp 1 Webclient 2024-11-21 6.1 Medium
IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][controller] is non-persistent in 10.1.3 and 10.2.0.
CVE-2010-5336 1 Icewarp 1 Webclient 2024-11-21 6.1 Medium
IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: admin/login.html with the parameter username is persistent in 10.2.0.
CVE-2010-4662 1 Pmwiki 1 Pmwiki 2024-11-21 6.1 Medium
PmWiki before 2.2.21 has XSS.
CVE-2010-4659 1 Status 1 Statusnet 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in statusnet through 2010 in error message contents.
CVE-2010-4658 1 Status 1 Statusnet 2024-11-21 5.3 Medium
statusnet through 2010 allows attackers to spoof syslog messages via newline injection attacks.
CVE-2010-4657 3 Debian, Php, Redhat 3 Debian Linux, Php, Enterprise Linux 2024-11-21 7.5 High
PHP5 before 5.4.4 allows passing invalid utf-8 strings via the xmlTextWriterWriteAttribute, which are then misparsed by libxml2. This results in memory leak into the resulting output.
CVE-2010-4654 2 Debian, Freedesktop 2 Debian Linux, Poppler 2024-11-21 7.8 High
poppler before 0.16.3 has malformed commands that may cause corruption of the internal stack.
CVE-2010-4264 1 Vanillaforums 1 Vanilla Forums 2024-11-21 6.1 Medium
It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to execute on the client side.
CVE-2010-4245 1 Translatehouse 1 Pootle 2024-11-21 6.1 Medium
pootle 2.0.5 has XSS via 'match_names' parameter
CVE-2010-4240 1 Tiki 1 Tikiwiki Cms\/groupware 2024-11-21 6.1 Medium
Tiki Wiki CMS Groupware 5.2 has XSS
CVE-2010-3857 1 Redhat 1 Jboss Business Rules Management System 2024-11-21 6.1 Medium
JBoss BRMS before 5.1.0 has a XSS vulnerability via asset=UUID parameter.
CVE-2010-3843 1 Ettercap-project 1 Ettercap 2024-11-21 7.8 High
The GTK version of ettercap uses a global settings file at /tmp/.ettercap_gtk and does not verify ownership of this file. When parsing this file for settings in gtkui_conf_read() (src/interfacesgtk/ec_gtk_conf.c), an unchecked sscanf() call allows a maliciously placed settings file to overflow a statically-sized buffer on the stack.
CVE-2010-3674 2 Debian, Typo3 2 Debian Linux, Typo3 2024-11-21 6.1 Medium
TYPO3 before 4.4.1 allows XSS in the frontend search box.
CVE-2010-3672 1 Typo3 1 Typo3 2024-11-21 6.1 Medium
TYPO3 before 4.3.4 and 4.4.x before 4.4.1 allows XSS in the textarea view helper in an extbase extension.
CVE-2010-3669 1 Typo3 1 Typo3 2024-11-21 5.4 Medium
TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS and Open Redirection in the frontend login box.
CVE-2010-3668 1 Typo3 1 Typo3 2024-11-21 7.5 High
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Header Injection in the secure download feature jumpurl.
CVE-2010-3665 1 Typo3 1 Typo3 2024-11-21 5.4 Medium
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the Extension Manager.
CVE-2010-3660 1 Typo3 1 Typo3 2024-11-21 5.4 Medium
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the backend.
CVE-2010-2472 1 Drupal 1 Drupal 2024-11-21 4.8 Medium
Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes, native and English language names properly which could allow an attacker to perform a cross-site scripting (XSS) attack. This vulnerability is mitigated by the fact that an attacker must have a role with the 'administer languages' permission.
CVE-2010-2250 1 Drupal 1 Drupal 2024-11-21 6.1 Medium
Drupal 5.x and 6.x before 6.16 uses a user-supplied value in output during site installation which could allow an attacker to craft a URL and perform a cross-site scripting attack.