Export limit exceeded: 43924 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (43924 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-36646 | 1 Prolion | 1 Cryptospike | 2024-11-21 | 8.8 High |
| Incorrect user role checking in multiple REST API endpoints in ProLion CryptoSpike 3.0.15P2 allows a remote attacker with low privileges to execute privileged functions and achieve privilege escalation via REST API endpoint invocation. | ||||
| CVE-2023-36621 | 1 Nationaledtech | 1 Boomerang | 2024-11-21 | 9.1 Critical |
| An issue was discovered in the Boomerang Parental Control application through 13.83 for Android. The child can use Safe Mode to remove all restrictions temporarily or uninstall the application without the parents noticing. | ||||
| CVE-2023-36555 | 1 Fortinet | 1 Fortios | 2024-11-21 | 3.9 Low |
| An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via the SAML and Security Fabric components. | ||||
| CVE-2023-36516 | 1 Thimpress | 1 Learnpress | 2024-11-21 | 7.6 High |
| Missing Authorization vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.3. | ||||
| CVE-2023-36515 | 1 Thimpress | 1 Learnpress | 2024-11-21 | 7.3 High |
| Missing Authorization vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.3. | ||||
| CVE-2023-36387 | 1 Apache | 1 Superset | 2024-11-21 | 5.4 Medium |
| An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections. | ||||
| CVE-2023-36339 | 1 Webboss | 1 Webboss.io Cms | 2024-11-21 | 7.5 High |
| An access control issue in WebBoss.io CMS v3.7.0.1 allows attackers to access the Website Backup Tool via a crafted GET request. | ||||
| CVE-2023-36311 | 1 Phpjabbers | 1 Document Creator | 2024-11-21 | 9.8 Critical |
| There is a SQL injection (SQLi) vulnerability in the "column" parameter of index.php in PHPJabbers Document Creator v1.0. | ||||
| CVE-2023-36293 | 1 Wmanager | 1 Wmanager | 2024-11-21 | 7.5 High |
| SQL injection vulnerability in wmanager v.1.0.7 and before allows a remote attacker to obtain sensitive information via a crafted script to the company.php component. | ||||
| CVE-2023-36213 | 1 Motocms | 1 Motocms | 2024-11-21 | 9.8 Critical |
| SQL injection vulnerability in MotoCMS v.3.4.3 allows a remote attacker to gain privileges via the keyword parameter of the search function. | ||||
| CVE-2023-36189 | 1 Langchain | 1 Langchain | 2024-11-21 | 7.5 High |
| SQL injection vulnerability in langchain before v0.0.247 allows a remote attacker to obtain sensitive information via the SQLDatabaseChain component. | ||||
| CVE-2023-36140 | 1 Phpjabbers | 1 Cleaning Business Software | 2024-11-21 | 9.8 Critical |
| In PHPJabbers Cleaning Business Software 1.0, there is no encryption on user passwords allowing an attacker to gain access to all user accounts. | ||||
| CVE-2023-36092 | 1 Dlink | 2 Dir-859, Dir-859 Firmware | 2024-11-21 | 9.8 Critical |
| Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via via phpcgi_main. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2023-36091 | 2 D-link, Dlink | 3 Dir-895, Dir-895l, Dir-895l Firmware | 2024-11-21 | 9.8 Critical |
| Authentication Bypass vulnerability in D-Link DIR-895 FW102b07 allows remote attackers to gain escalated privileges via via function phpcgi_main in cgibin. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2023-36090 | 1 Dlink | 2 Dir-885l, Dir-885l Firmware | 2024-11-21 | 9.8 Critical |
| Authentication Bypass vulnerability in D-Link DIR-885L FW102b01 allows remote attackers to gain escalated privileges via phpcgi. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2023-36089 | 2 D-link, Dlink | 3 Dir-645 Firmware, Dir-645, Dir-645 Firmware | 2024-11-21 | 9.8 Critical |
| Authentication Bypass vulnerability in D-Link DIR-645 firmware version 1.03 allows remote attackers to gain escalated privileges via function phpcgi_main in cgibin. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2023-36076 | 1 Pocketmanga | 1 Smanga | 2024-11-21 | 9.8 Critical |
| SQL Injection vulnerability in smanga version 3.1.9 and earlier, allows remote attackers to execute arbitrary code and gain sensitive information via mediaId, mangaId, and userId parameters in php/history/add.php. | ||||
| CVE-2023-36054 | 4 Debian, Mit, Netapp and 1 more | 8 Debian Linux, Kerberos 5, Active Iq Unified Manager and 5 more | 2024-11-21 | 6.5 Medium |
| lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count. | ||||
| CVE-2023-36002 | 1 Proofpoint | 1 Insider Threat Management Server | 2024-11-21 | 4.3 Medium |
| A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected. | ||||
| CVE-2023-36000 | 2 Apple, Proofpoint | 2 Macos, Insider Threat Management Server | 2024-11-21 | 6.5 Medium |
| A missing authorization check in the MacOS agent configuration endpoint of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to obtain sensitive information. Successful exploitation requires an attacker to first obtain a valid agent authentication token. All versions before 7.14.3 are affected. | ||||