Export limit exceeded: 95399 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (95399 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-28194 | 1 Yooooomi | 1 Your Spotify | 2025-02-12 | 9.1 Critical |
| your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.8.0 use a hardcoded JSON Web Token (JWT) secret to sign authentication tokens. Attackers can use this well-known value to forge valid authentication tokens for arbitrary users. This vulnerability allows attackers to bypass authentication and authenticate as arbitrary YourSpotify users, including admin users. This issue has been addressed in version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. | ||||
| CVE-2023-28726 | 1 Panasonic | 2 Aiseg2, Aiseg2 Firmware | 2025-02-12 | 7.5 High |
| Panasonic AiSEG2 versions 2.80F through 2.93A allows remote attackers to execute arbitrary OS commands. | ||||
| CVE-2022-42452 | 1 Hcltechsw | 1 Hcl Launch | 2025-02-12 | 4.6 Medium |
| HCL Launch is vulnerable to HTML injection. HTML code is stored and included without being sanitized. This can lead to further attacks such as XSS and Open Redirections. | ||||
| CVE-2025-20904 | 1 Samsung | 1 Android | 2025-02-12 | 6.3 Medium |
| Out-of-bounds write in mPOS TUI trustlet prior to SMR Feb-2025 Release 1 allows local privileged attackers to cause memory corruption. | ||||
| CVE-2025-20889 | 1 Samsung | 1 Android | 2025-02-12 | 5.3 Medium |
| Out-of-bounds read in decoding malformed bitstream for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory. User interaction is required for triggering this vulnerability. | ||||
| CVE-2025-20888 | 1 Samsung | 1 Android | 2025-02-12 | 7 High |
| Out-of-bounds write in handling the block size for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code with privilege. User interaction is required for triggering this vulnerability. | ||||
| CVE-2025-20882 | 1 Samsung | 1 Android | 2025-02-12 | 7 High |
| Out-of-bounds write in accessing uninitialized memory for svc1td in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code with privilege. User interaction is required for triggering this vulnerability. | ||||
| CVE-2025-20881 | 1 Samsung | 1 Android | 2025-02-12 | 7 High |
| Out-of-bounds write in accessing buffer storing the decoded video frames in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code with privilege. User interaction is required for triggering this vulnerability. | ||||
| CVE-2024-1707 | 1 Garo | 2 Wallbox Glb\+ T2ev7, Wallbox Glb\+ T2ev7 Firmware | 2025-02-12 | 4.3 Medium |
| A vulnerability, which was classified as problematic, was found in GARO WALLBOX GLB+ T2EV7 0.5. This affects an unknown part of the file /index.jsp#settings of the component Software Update Handler. The manipulation of the argument Reference leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-254397 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2023-1121 | 1 Ibenic | 1 Simple Giveaways | 2025-02-11 | 4.8 Medium |
| The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2023-0157 | 1 Updraftplus | 1 All-in-one Security | 2025-02-11 | 4.8 Medium |
| The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing an authorized user (admin+) to plant bogus log files containing malicious JavaScript code that will be executed in the context of any administrator visiting this page. | ||||
| CVE-2024-37944 | 1 Wptravelengine | 1 Wp Travel Engine | 2025-02-11 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Travel Engine allows Stored XSS.This issue affects WP Travel Engine: from n/a through 5.9.1. | ||||
| CVE-2024-35209 | 1 Siemens | 2 Sinec Traffic Analyzer, Traffic Analyzer | 2025-02-11 | 6.2 Medium |
| A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server is allowing HTTP methods like PUT and Delete. This could allow an attacker to modify unauthorized files. | ||||
| CVE-2023-6322 | 3 Roku, Throughtek, Wyze | 5 Indoor Camera Se, Indoor Camera Se Firmware, Kalay Platform and 2 more | 2025-02-11 | 7.2 High |
| A stack-based buffer overflow vulnerability exists in the message parsing functionality of the Roku Indoor Camera SE version 3.0.2.4679 and Wyze Cam v3 version 4.36.11.5859. A specially crafted message can lead to stack-based buffer overflow. An attacker can make authenticated requests to trigger this vulnerability. | ||||
| CVE-2023-6321 | 2 Owletcare, Throughtek | 5 Cam, Cam 2, Cam 2 Firmware and 2 more | 2025-02-11 | 7.2 High |
| A command injection vulnerability exists in the IOCTL that manages OTA updates. A specially crafted command can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability. | ||||
| CVE-2023-26555 | 1 Ntp | 1 Ntp | 2025-02-11 | 6.4 Medium |
| praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write. Any attack method would be complex, e.g., with a manipulated GPS receiver. | ||||
| CVE-2023-22615 | 1 Insyde | 1 Insydeh2o | 2025-02-11 | 8.4 High |
| An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. IHISI subfunction execution may corrupt SMRAM. An attacker can pass an address in the RCX save state register that overlaps SMRAM, thereby coercing an IHISI subfunction handler to overwrite private SMRAM. | ||||
| CVE-2022-43309 | 1 Supermicro | 292 H11dsi, H11dsi-nt, H11dsi-nt Firmware and 289 more | 2025-02-11 | 5.5 Medium |
| Supermicro X11SSL-CF HW Rev 1.01, BMC firmware v1.63 was discovered to contain insecure permissions. | ||||
| CVE-2023-1687 | 1 Task Allocation System Project | 1 Task Allocation System | 2025-02-11 | 3.5 Low |
| A vulnerability classified as problematic has been found in SourceCodester Simple Task Allocation System 1.0. Affected is an unknown function of the file LoginRegistration.php?a=register_user. The manipulation of the argument Fullname leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-224244. | ||||
| CVE-2024-50664 | 1 Gpac | 1 Gpac | 2025-02-11 | 7.8 High |
| gpac 2.4 contains a heap-buffer-overflow at isomedia/sample_descs.c:1799 in gf_isom_new_mpha_description in gpac/MP4Box. | ||||