Export limit exceeded: 331473 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 331477 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (331482 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-28144 | 1 Kdab | 1 Hotspot | 2025-02-27 | 7 High |
| KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involving symlinks and elevate_perf_privileges.sh chown calls. | ||||
| CVE-2023-27234 | 1 Jizhicms | 1 Jizhicms | 2025-02-27 | 6.5 Medium |
| A Cross-Site Request Forgery (CSRF) in /Sys/index.html of Jizhicms v2.4.5 allows attackers to arbitrarily make configuration changes within the application. | ||||
| CVE-2023-27070 | 1 Totaljs | 1 Openplatform | 2025-02-27 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability in TotalJS OpenPlatform commit b80b09d allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the platform name field. | ||||
| CVE-2023-26912 | 1 S-mall-ssm Project | 1 S-mall-ssm | 2025-02-27 | 4.8 Medium |
| Cross site scripting (XSS) vulnerability in xenv S-mall-ssm thru commit 3d9e77f7d80289a30f67aaba1ae73e375d33ef71 on Feb 17, 2020, allows local attackers to execute arbitrary code via the evaluate button. | ||||
| CVE-2023-25283 | 1 Dlink | 2 Dir-820l, Dir-820l Firmware | 2025-02-27 | 7.5 High |
| A stack overflow vulnerability in D-Link DIR820LA1_FW106B02 allows attackers to cause a denial of service via the reserveDHCP_HostName_1.1.1.0 parameter to lan.asp. | ||||
| CVE-2022-48111 | 1 Siri-informatica | 1 Wi400 | 2025-02-27 | 6.1 Medium |
| A cross-site scripting (XSS) vulnerability in the check_login function of SIPE s.r.l WI400 between version 8 and 11 included allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the f parameter. | ||||
| CVE-2024-3221 | 1 Mayurik | 1 Php Task Management System | 2025-02-27 | 6.3 Medium |
| A vulnerability classified as critical was found in SourceCodester PHP Task Management System 1.0. This vulnerability affects unknown code of the file attendance-info.php. The manipulation of the argument user_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259066 is the identifier assigned to this vulnerability. | ||||
| CVE-2023-0629 | 1 Docker | 1 Docker Desktop | 2025-02-27 | 7.1 High |
| Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions by setting the Docker host to docker.raw.sock, or npipe:////.pipe/docker_engine_linux on Windows, via the -H (--host) CLI flag or the DOCKER_HOST environment variable and launch containers without the additional hardening features provided by ECI. This would not affect already running containers, nor containers launched through the usual approach (without Docker's raw socket). The affected functionality is available for Docker Business customers only and assumes an environment where users are not granted local root or Administrator privileges. This issue has been fixed in Docker Desktop 4.17.0. Affected Docker Desktop versions: from 4.13.0 before 4.17.0. | ||||
| CVE-2024-3256 | 1 Chatikobo | 1 Internship Portal Management System | 2025-02-27 | 6.3 Medium |
| A vulnerability has been found in SourceCodester Internship Portal Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file admin/edit_activity.php. The manipulation of the argument activity_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259105 was assigned to this vulnerability. | ||||
| CVE-2024-22360 | 1 Ibm | 1 Db2 | 2025-02-27 | 5.3 Medium |
| IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to a denial of service with a specially crafted query on certain columnar tables. IBM X-Force ID: 280905. | ||||
| CVE-2023-0628 | 1 Docker | 1 Docker Desktop | 2025-02-27 | 6.1 Medium |
| Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to open a crafted malicious docker-desktop:// URL. | ||||
| CVE-2023-1355 | 1 Vim | 1 Vim | 2025-02-27 | 5.5 Medium |
| NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402. | ||||
| CVE-2022-25770 | 1 Acquia | 1 Mautic | 2025-02-27 | 7.8 High |
| Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation. This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable. | ||||
| CVE-2022-25768 | 1 Acquia | 1 Mautic | 2025-02-27 | 7 High |
| The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required. | ||||
| CVE-2022-25777 | 1 Acquia | 1 Mautic | 2025-02-27 | 6.5 Medium |
| Prior to the patched version, an authenticated user of Mautic could read system files and access the internal addresses of the application due to a Server-Side Request Forgery (SSRF) vulnerability. | ||||
| CVE-2024-47059 | 2 Acquia, Mautic | 2 Mautic, Mautic | 2025-02-27 | 4.3 Medium |
| When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak. However when an incorrect username is provided alongside with a weak password, the application responds with ’Invalid credentials’ notification. This difference could be used to perform username enumeration. | ||||
| CVE-2024-21848 | 1 Mattermost | 1 Mattermost Server | 2025-02-27 | 3.1 Low |
| Improper Access Control in Mattermost Server versions 8.1.x before 8.1.11 allows an attacker that is in a channel with an active call to keep participating in the call even if they are removed from the channel | ||||
| CVE-2024-3347 | 2 Sanchitkmr, Sourcecodester | 2 Airline Ticket Reservation System, Airline Ticket Reservation System | 2025-02-27 | 7.3 High |
| A vulnerability was found in SourceCodester Airline Ticket Reservation System 1.0. It has been rated as critical. This issue affects some unknown processing of the file activate_jet_details_form_handler.php. The manipulation of the argument jet_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259451. | ||||
| CVE-2023-1357 | 1 Simple Bakery Shop Management System Project | 1 Simple Bakery Shop Management System | 2025-02-27 | 7.3 High |
| A vulnerability, which was classified as critical, has been found in SourceCodester Simple Bakery Shop Management System 1.0. Affected by this issue is some unknown functionality of the component Admin Login. The manipulation of the argument username/password with the input admin' or 1=1 -- leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222860. | ||||
| CVE-2023-1359 | 1 Gadget Works Online Ordering System Project | 1 Gadget Works Online Ordering System | 2025-02-27 | 2.4 Low |
| A vulnerability has been found in SourceCodester Gadget Works Online Ordering System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /philosophy/admin/user/controller.php?action=add of the component Add New User. The manipulation of the argument U_NAME leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-222862 is the identifier assigned to this vulnerability. | ||||