Export limit exceeded: 103236 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (103236 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-35157 | 1 Xwiki | 1 Xwiki | 2024-11-27 | 8.5 High |
| XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. Now this XSS can be exploited only if the attacker knows the CSRF token of the user, or if the user ignores the warning about the missing CSRF token. The vulnerability has been patched in XWiki 15.1-rc-1 and XWiki 14.10.6. | ||||
| CVE-2023-43870 | 1 Paxton-access | 1 Net2 | 2024-11-27 | 8.1 High |
| When installing the Net2 software a root certificate is installed into the trusted store. A potential hacker could access the installer batch file or reverse engineer the source code to gain access to the root certificate password. Using the root certificate and password they could then create their own certificates to emulate another site. Then by establishing a proxy service to emulate the site they could monitor traffic passed between the end user and the site allowing access to the data content. | ||||
| CVE-2023-35932 | 1 Jcvi Project | 1 Jcvi | 2024-11-27 | 7.1 High |
| jcvi is a Python library to facilitate genome assembly, annotation, and comparative genomics. A configuration injection happens when user input is considered by the application in an unsanitized format and can reach the configuration file. A malicious user may craft a special payload that may lead to a command injection. The impact of a configuration injection may vary. Under some conditions, it may lead to command injection if there is for instance shell code execution from the configuration file values. This vulnerability does not currently have a fix. | ||||
| CVE-2023-1724 | 1 Ladybirdweb | 1 Faveo Helpdesk | 2024-11-27 | 7.3 High |
| Faveo Helpdesk Enterprise version 6.0.1 allows an attacker with agent permissions to perform privilege escalation on the application. This occurs because the application is vulnerable to stored XSS. | ||||
| CVE-2023-36612 | 1 Basecamp | 1 Basecamp | 2024-11-27 | 7.5 High |
| Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1 for Android, which may allow an attacker to write arbitrary files in the application's private directory. Additionally, by using a malicious intent, the attacker may redirect the server's responses (containing sensitive information) to third-party applications by using a custom-crafted deeplink scheme. | ||||
| CVE-2023-36630 | 1 Mgt-commerce | 1 Cloudpanel | 2024-11-27 | 8.8 High |
| In CloudPanel before 2.3.1, insecure file upload leads to privilege escalation and authentication bypass. | ||||
| CVE-2023-36632 | 1 Python | 1 Python | 2024-11-27 | 7.5 High |
| The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the documentation of the Python email package. Applications should instead use the email.parser.BytesParser or email.parser.Parser class. NOTE: the vendor's perspective is that this is neither a vulnerability nor a bug. The email package is intended to have size limits and to throw an exception when limits are exceeded; they were exceeded by the example demonstration code. | ||||
| CVE-2020-20210 | 1 Bludit | 1 Bludit | 2024-11-27 | 8.8 High |
| Bludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images. | ||||
| CVE-2023-2482 | 1 Wpwox | 1 Responsive Css Editor | 2024-11-27 | 7.2 High |
| The Responsive CSS EDITOR WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admin. | ||||
| CVE-2024-8924 | 1 Servicenow | 1 Servicenow | 2024-11-27 | 7.5 High |
| ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to extract unauthorized information. ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes. | ||||
| CVE-2023-2842 | 1 Wpinventory | 1 Wp Inventory Manager | 2024-11-27 | 8.1 High |
| The WP Inventory Manager WordPress plugin before 2.1.0.14 does not have CSRF checks, which could allow attackers to make logged-in admins delete Inventory Items via a CSRF attack | ||||
| CVE-2023-2592 | 1 Ncrafts | 1 Formcraft | 2024-11-27 | 7.2 High |
| The FormCraft WordPress plugin before 3.9.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. | ||||
| CVE-2023-2628 | 1 Iqonic | 1 Kivicare | 2024-11-27 | 8.8 High |
| The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. This includes, but is not limited to: Delete arbitrary appointments/medical records/etc, create/update various users (patients, doctors etc) | ||||
| CVE-2023-44482 | 1 Projectworlds | 1 Leave Management System | 2024-11-27 | 8.8 High |
| Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setsickleave' parameter of the admin/setleaves.php resource does not validate the characters received and they are sent unfiltered to the database. | ||||
| CVE-2023-37306 | 1 Misp-project | 1 Misp | 2024-11-27 | 7.5 High |
| MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error messages. | ||||
| CVE-2023-5961 | 1 Moxa | 20 Iologik E1210, Iologik E1210 Firmware, Iologik E1211 and 17 more | 2024-11-27 | 8.8 High |
| A Cross-Site Request Forgery (CSRF) vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. An attacker can exploit this vulnerability to trick a client into making an unintentional request to the web server, which will be treated as an authentic request. This vulnerability may lead an attacker to perform operations on behalf of the victimized user. | ||||
| CVE-2023-26509 | 1 Anydesk | 1 Anydesk | 2024-11-27 | 7.5 High |
| AnyDesk 7.0.8 allows remote Denial of Service. | ||||
| CVE-2023-33570 | 1 Webkul | 1 Bagisto | 2024-11-27 | 8.8 High |
| Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). | ||||
| CVE-2023-33298 | 1 Perimeter81 | 1 Xpc Helpertool | 2024-11-27 | 7.8 High |
| com.perimeter81.osx.HelperTool in Perimeter81 10.0.0.19 on macOS allows Local Privilege Escalation (to root) via shell metacharacters in usingCAPath. | ||||
| CVE-2023-32223 | 2 D-link, Dlink | 3 Dsl-224 Firmware, Dsl-224, Dsl-224 Firmware | 2024-11-27 | 8.8 High |
| D-Link DSL-224 firmware version 3.0.10 allows post authentication command execution via an unspecified method. | ||||