Export limit exceeded: 95397 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (95397 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2023-29804 1 Iodata 4 Wfs-sr03k, Wfs-sr03k Firmware, Wfs-sr03w and 1 more 2025-02-06 8.8 High
WFS-SR03 v1.0.3 was discovered to contain a command injection vulnerability via the sys_smb_pwdmod function.
CVE-2023-29803 1 Totolink 2 X18, X18 Firmware 2025-02-06 9.8 Critical
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the pid parameter in the disconnectVPN function.
CVE-2023-29802 1 Totolink 2 X18, X18 Firmware 2025-02-06 9.8 Critical
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function.
CVE-2023-29801 1 Totolink 2 X18, X18 Firmware 2025-02-06 9.8 Critical
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain multiple command injection vulnerabilities via the rtLogEnabled and rtLogServer parameters in the setSyslogCfg function.
CVE-2023-29800 1 Totolink 2 X18, X18 Firmware 2025-02-06 9.8 Critical
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.
CVE-2023-29798 1 Totolink 2 X18, X18 Firmware 2025-02-06 9.8 Critical
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function.
CVE-2023-29067 1 Autodesk 10 Autocad, Autocad Advance Steel, Autocad Architecture and 7 more 2025-02-06 7.8 High
A maliciously crafted X_B file when parsed through Autodesk® AutoCAD® 2023 could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVE-2023-27915 1 Autodesk 10 Autocad, Autocad Advance Steel, Autocad Architecture and 7 more 2025-02-06 7.8 High
A maliciously crafted X_B file when parsed through Autodesk® AutoCAD® 2023 could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVE-2023-27914 1 Autodesk 10 Autocad, Autocad Advance Steel, Autocad Architecture and 7 more 2025-02-06 7.8 High
A maliciously crafted X_B file when parsed through Autodesk® AutoCAD® 2023 can be used to write beyond the allocated buffer causing a Stack Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash or read sensitive data or execute arbitrary code in the context of the current process.
CVE-2023-26123 1 Raylib 1 Raylib 2025-02-06 6.1 Medium
Versions of the package raysan5/raylib before 4.5.0 are vulnerable to Cross-site Scripting (XSS) such that the SetClipboardText API does not properly escape the ' character, allowing attacker-controlled input to break out of the string and execute arbitrary JavaScript via emscripten_run_script function. **Note:** This vulnerability is present only when compiling raylib for PLATFORM_WEB. All the other Desktop/Mobile/Embedded platforms are not affected.
CVE-2022-43697 1 Open-xchange 1 Ox App Suite 2025-02-06 6.1 Medium
OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob.
CVE-2018-17536 1 Gitlab 1 Gitlab 2025-02-06 5.4 Medium
An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is stored XSS on the merge request page via project import.
CVE-2018-17454 1 Gitlab 1 Gitlab 2025-02-06 5.4 Medium
An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is stored XSS on the issue details screen.
CVE-2023-29799 1 Totolink 2 X18, X18 Firmware 2025-02-06 9.8 Critical
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpModeCfg function.
CVE-2023-48709 1 Combodo 1 Itop 2025-02-06 8 High
iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include malicious formulas that may be imported into Excel. As Excel 2016 does **not** prevent Remote Code Execution by default, uninformed users may become victims. This vulnerability is fixed in 2.7.9, 3.0.4, 3.1.1, and 3.2.0.
CVE-2023-47626 1 Combodo 1 Itop 2025-02-06 8.8 High
iTop is an IT service management platform. When displaying/editing the user's personal tokens, XSS attacks are possible. This vulnerability is fixed in 3.1.1.
CVE-2023-47622 1 Combodo 1 Itop 2025-02-06 8.8 High
iTop is an IT service management platform. When dashlet are refreshed, XSS attacks are possible. This vulnerability is fixed in 3.0.4 and 3.1.1.
CVE-2023-47123 1 Combodo 1 Itop 2025-02-06 8.7 High
iTop is an IT service management platform. By filling malicious code in an object friendlyname / complementary name, an XSS attack can be performed when this object will displayed as an n:n relation item in another object. This vulnerability is fixed in 3.1.1 and 3.2.0.
CVE-2023-44396 1 Combodo 1 Itop 2025-02-06 6.8 Medium
iTop is an IT service management platform. Dashlet edits ajax endpoints can be used to produce XSS. Fixed in iTop 2.7.10, 3.0.4, and 3.1.1.
CVE-2023-43790 1 Combodo 1 Itop 2025-02-06 5.7 Medium
iTop is an IT service management platform. By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname value. This vulnerability is fixed in 3.1.1 and 3.2.0.