Search

Expected end of text, found '/' (at char 44), (line:1, col:45)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (367977 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2019-10158 2 Infinispan, Redhat 2 Infinispan, Jboss Data Grid 2025-02-13 9.8 Critical
A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.
CVE-2019-0231 2 Apache, Redhat 6 Mina, Jboss Enterprise Bpms Platform, Jboss Enterprise Brms Platform and 3 more 2025-02-13 7.5 High
Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This issue affects: Apache MINA.
CVE-2018-1890 1 Ibm 1 Sdk 2025-02-13 N/A
IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 152081.
CVE-2018-1822 1 Ibm 4 Flashsystem 840, Flashsystem 840 Firmware, Flashsystem 900 and 1 more 2025-02-13 N/A
IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to remotely change the superuser password. This can be used by an attacker to gain administrative control or to deny service. IBM X-Force ID: 150296.
CVE-2018-16838 2 Fedoraproject, Redhat 2 Sssd, Enterprise Linux 2025-02-13 N/A
A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side, SSSD will allow all authenticated users to login instead of denying access.
CVE-2018-1495 1 Ibm 4 Flashsystem 840, Flashsystem 840 Firmware, Flashsystem 900 and 1 more 2025-02-13 N/A
IBM FlashSystem V840 and V900 products could allow an authenticated attacker with specialized access to overwrite arbitrary files which could cause a denial of service. IBM X-Force ID: 141148.
CVE-2018-14628 2 Fedoraproject, Samba 2 Fedora, Samba 2025-02-13 4.3 Medium
An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store.
CVE-2018-12480 1 Microfocus 1 Access Manager 2025-02-13 N/A
Mitigates an XSS issue in NetIQ Access Manager versions prior to 4.4 SP3.
CVE-2014-125087 1 Java-xmlbuilder Project 1 Java-xmlbuilder 2025-02-13 5.5 Medium
A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to address this issue. The name of the patch is e6fddca201790abab4f2c274341c0bb8835c3e73. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221480.
CVE-2012-5639 3 Apache, Debian, Libreoffice 3 Openoffice, Debian Linux, Libreoffice 2025-02-13 6.5 Medium
LibreOffice and OpenOffice automatically open embedded content
CVE-2023-28342 1 Zohocorp 1 Manageengine Adselfservice Plus 2025-02-13 7.5 High
Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API.
CVE-2023-27770 1 Wondershare 1 Edraw-max 2025-02-13 7.8 High
An issue found in Wondershare Technology Co.,Ltd Edraw-max v.12.0.4 allows a remote attacker to execute arbitrary commands via the edraw-max_setup_full5371.exe file.
CVE-2023-26976 1 Tenda 2 Ac6, Ac6 Firmware 2025-02-13 7.5 High
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function.
CVE-2023-26974 1 Irfanview 1 Irfanview 2025-02-13 5.5 Medium
Irfanview v4.62 allows a user-mode write access violation via a crafted JPEG 2000 file starting at JPEG2000+0x0000000000001bf0.
CVE-2023-26921 1 Quectel 2 Ag550qcn, Ag550qcn Firmware 2025-02-13 9.8 Critical
OS Command Injection vulnerability in quectel AG550QCN allows attackers to execute arbitrary commands via ql_atfwd.
CVE-2023-26866 1 Greenpacket 4 Ot-235, Ot-235 Firmware, Wr-1200 and 1 more 2025-02-13 9.8 Critical
GreenPacket OH736's WR-1200 Indoor Unit, OT-235 with firmware versions M-IDU-1.6.0.3_V1.1 and MH-46360-2.0.3-R5-GP respectively are vulnerable to remote command injection. Commands are executed using pre-login execution and executed with root privileges allowing complete takeover.
CVE-2023-26857 1 Dynamic Transaction Queuing System Project 1 Dynamic Transaction Queuing System 2025-02-13 7.2 High
An arbitrary file upload vulnerability in /admin/ajax.php?action=save_uploads of Dynamic Transaction Queuing System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2023-26856 1 Dynamic Transaction Queuing System Project 1 Dynamic Transaction Queuing System 2025-02-13 7.2 High
Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/ajax.php?action=login.
CVE-2023-26855 1 Churchcrm 1 Churchcrm 2025-02-13 7.5 High
The hashing algorithm of ChurchCRM v4.5.3 utilizes a non-random salt value which allows attackers to use precomputed hash tables or dictionary attacks to crack the hashed passwords.
CVE-2023-26777 1 Uptime Kuma Project 1 Uptime Kuma 2025-02-13 6.1 Medium
Cross Site Scripting vulnerability found in : louislam Uptime Kuma v.1.19.6 and before allows a remote attacker to execute arbitrary commands via the description, title, footer, and incident creation parameter of the status_page.js endpoint.