Export limit exceeded: 107024 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (107024 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-44310 | 1 Ecdh Project | 1 Ecdh | 2025-03-12 | 7.5 High |
| In Development IL ecdh before 0.2.0, an attacker can send an invalid point (not on the curve) as the public key, and obtain the derived shared secret. | ||||
| CVE-2021-34249 | 1 Online Book Store Project | 1 Online Book Store | 2025-03-12 | 7.5 High |
| SQL injection vulnerability in sourcecodester online-book-store 1.0 allows remote attackers to view sensitive information via the id paremeter in application URL. | ||||
| CVE-2021-34167 | 1 Taogogo | 1 Taocms | 2025-03-12 | 8.8 High |
| Cross Site Request Forgery (CSRF) vulnerability in taoCMS 3.0.2 allows remote attackers to gain escalated privileges via taocms/admin/admin.php. | ||||
| CVE-2023-24575 | 1 Dell | 1 Multifunction Printer E525w Driver And Software Suite | 2025-03-12 | 7.8 High |
| Dell Multifunction Printer E525w Driver and Software Suite, versions prior to 1.047.2022, A05, contain a local privilege escalation vulnerability that could be exploited by malicious users to compromise the affected system | ||||
| CVE-2023-0994 | 1 Rosariosis | 1 Rosariosis | 2025-03-12 | 7.5 High |
| Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository francoisjacquet/rosariosis prior to 10.8.2. | ||||
| CVE-2022-4492 | 1 Redhat | 17 Build Of Quarkus, Camel Spring Boot, Integration Camel For Spring Boot and 14 more | 2025-03-12 | 7.5 High |
| The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol. | ||||
| CVE-2022-48341 | 1 Thingsboard | 1 Thingsboard | 2025-03-12 | 8.8 High |
| ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator dashboard access by modifying the scope via the scopes parameter. | ||||
| CVE-2022-41567 | 1 Tibco | 1 Businessconnect | 2025-03-12 | 7.3 High |
| The BusinessConnect UI component of TIBCO Software Inc.'s TIBCO BusinessConnect contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a cross-site scripting (XSS) attack on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO BusinessConnect: versions 7.3.0 and below. | ||||
| CVE-2023-22973 | 1 Open-emr | 1 Openemr | 2025-03-12 | 8.8 High |
| A Local File Inclusion (LFI) vulnerability in interface/forms/LBF/new.php in OpenEMR < 7.0.0 allows remote authenticated users to execute code via the formname parameter. | ||||
| CVE-2023-22974 | 1 Open-emr | 1 Openemr | 2025-03-12 | 7.5 High |
| A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-controlled MySQL server. | ||||
| CVE-2023-38122 | 1 Inductiveautomation | 1 Ignition | 2025-03-12 | 7.2 High |
| Inductive Automation Ignition OPC UA Quick Client Permissive Cross-domain Policy Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the configuration of the web server. The issue results from the lack of appropriate Content Security Policy headers. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of SYSTEM. Was ZDI-CAN-20539. | ||||
| CVE-2021-24952 | 1 Conversios | 1 Conversios | 2025-03-12 | 8.8 High |
| The Conversios.io WordPress plugin before 4.6.2 does not sanitise, validate and escape the sync_progressive_data parameter for the tvcajax_product_sync_bantch_wise AJAX action before using it in a SQL statement, allowing any authenticated user to perform SQL injection attacks. | ||||
| CVE-2023-23294 | 1 Korenix | 29 Jetwave 2111, Jetwave 2111 Firmware, Jetwave 2111l and 26 more | 2025-03-12 | 8.8 High |
| Korenix JetWave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection. An attacker can modify the file_name parameter to execute commands as root. | ||||
| CVE-2023-39477 | 1 Inductiveautomation | 1 Ignition | 2025-03-12 | 7.5 High |
| Inductive Automation Ignition ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Inductive Automation Ignition. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OPC UA ConditionRefresh requests. By sending a large number of requests, an attacker can consume all available resources on the server. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20499. | ||||
| CVE-2023-24317 | 1 Judging Management System Project | 1 Judging Management System | 2025-03-12 | 8.1 High |
| Judging Management System 1.0 was discovered to contain an arbitrary file upload vulnerability via the component edit_organizer.php. | ||||
| CVE-2023-26325 | 1 Wpdeveloper | 1 Reviewx | 2025-03-12 | 8.8 High |
| The 'rx_export_review' action in the ReviewX WordPress Plugin, is affected by an authenticated SQL injection vulnerability in the 'filterValue' and 'selectedColumns' parameters. | ||||
| CVE-2023-26462 | 1 Thingsboard | 1 Thingsboard | 2025-03-12 | 8.1 High |
| ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials (usable for privilege escalation) are stored in an insecure format. (To read this stored data, the attacker needs access to the application server or its source code.) | ||||
| CVE-2023-0953 | 1 Devolutions | 1 Devolutions Server | 2025-03-12 | 8.8 High |
| Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an authenticated attacker to perform an SQL Injection, potentially resulting in unauthorized access to system resources. | ||||
| CVE-2023-50218 | 1 Inductiveautomation | 1 Ignition | 2025-03-12 | 8.8 High |
| Inductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability. The specific flaw exists within the ModuleInvoke class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-21624. | ||||
| CVE-2023-50219 | 1 Inductiveautomation | 1 Ignition | 2025-03-12 | 8.8 High |
| Inductive Automation Ignition RunQuery Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability. The specific flaw exists within the RunQuery class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-21625. | ||||