Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (998 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-47088 1 Apexsoftcell 2 Ld Dp Back Office, Ld Geo 2024-09-26 9.8 Critical
This vulnerability exists in Apex Softcell LD Geo due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack on login OTP, which could lead to gain unauthorized access to other user accounts.
CVE-2024-5958 2 Eliz Software, Elizsoftware 2 Panel, Panel 2024-09-26 8.8 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eliz Software Panel allows Command Line Execution through SQL Injection.This issue affects Panel: before v2.3.24.
CVE-2024-5959 1 Elizsoftware 1 Panel 2024-09-26 5.4 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Eliz Software Panel allows Stored XSS.This issue affects Panel: before v2.3.24.
CVE-2024-7735 1 Exnet Informatics Software 1 Ferry Reservation System 2024-09-26 N/A
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Exnet Informatics Software Ferry Reservation System allows SQL Injection.This issue affects Ferry Reservation System: before 240805-002.
CVE-2024-4657 1 Talentsoftware 1 Bap Automation 2024-09-26 N/A
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software BAP Automation allows Stored XSS.This issue affects BAP Automation: before 30840.
CVE-2024-6877 2 Eliz Software, Elizsoftware 2 Panel, Panel 2024-09-25 6.1 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Eliz Software Panel allows Reflected XSS.This issue affects Panel: before v2.3.24.
CVE-2024-7609 1 Vidco 1 Voc Tester 2024-09-23 7.5 High
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Vidco Software VOC TESTER allows Path Traversal.This issue affects VOC TESTER: before 12.34.8.
CVE-2024-8752 3 Beijerelectronics, Microsoft, Smart-hmi 3 Webiq, Windows, Webiq 2024-09-20 7.5 High
The Windows version of WebIQ 2.15.9 is affected by a directory traversal vulnerability that allows remote attackers to read any file on the system.
CVE-2024-7098 2 Sfs, Sfs Consulting 2 Winsure, Wwwinsure 2024-09-20 9.8 Critical
Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection.This issue affects ww.Winsure: before 4.6.2.
CVE-2024-6401 2 Sfs, Sfs Consulting 2 Insuree Gl, Insuree Gl 2024-09-20 9.8 Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting InsureE GL allows SQL Injection.This issue affects InsureE GL: before 4.6.2.
CVE-2024-7104 2 Sfs, Sfs Consulting 2 Winsure, Wwwinsure 2024-09-20 9.8 Critical
Improper Control of Generation of Code ('Code Injection') vulnerability in SFS Consulting ww.Winsure allows Code Injection.This issue affects ww.Winsure: before 4.6.2.
CVE-2024-7873 1 Veribilim Software 1 Veribase Order Management 2024-09-20 N/A
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, CWE - 83 Improper Neutralization of Script in Attributes in a Web Page vulnerability in Veribilim Software Veribase Order allows Stored XSS, Cross-Site Scripting (XSS), Exploit Script-Based APIs, XSS Through HTTP Headers.This issue affects Veribase Order: before v4.010.3.
CVE-2024-8986 2024-09-20 5.5 Medium
The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running `git remote get-url origin`. If credentials are included in the repository URI (for instance, to allow for fetching of private dependencies), the final binary will contain the full URI, including said credentials.
CVE-2024-7785 2024-09-20 N/A
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ece Software Electronic Ticket System allows Reflected XSS, Cross-Site Scripting (XSS).This issue affects Electronic Ticket System: before 2024.08.
CVE-2024-8395 1 Flycass 1 Flycass 2024-09-19 9.8 Critical
FlyCASS CASS and KCM systems did not correctly filter SQL queries, which made them vulnerable to attack by outside attackers with no authentication.
CVE-2024-45790 1 Reedos 1 Aim-star 2024-09-18 9.8 Critical
This vulnerability exists in Reedos aiM-Star version 2.0.1 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user passwords, which could lead to gain unauthorized access and compromise other user accounts.
CVE-2024-6919 2 Nac, Nac Telecommunication Systems 2 Nacpremium, Nacpremium 2024-09-17 9.8 Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Blind SQL Injection.This issue affects NACPremium: through 01082024.
CVE-2024-1744 2 Accordors, Ariva Computer 2 Accord Ors, Accord Ors 2024-09-13 7.5 High
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ariva Computer Accord ORS allows Retrieve Embedded Sensitive Data.This issue affects Accord ORS: before 7.3.2.1.
CVE-2024-8695 1 Docker 2 Desktop, Docker Desktop 2024-09-13 9.8 Critical
A remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before 4.34.2.
CVE-2024-23497 1 Intel 2 Ethernet 800 Series Controllers Driver, Ethernet Complete Driver Pack 2024-09-12 8.8 High
Out-of-bounds write in Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters before version 28.3 may allow an authenticated user to potentially enable escalation of privilege via local access.