Export limit exceeded: 358331 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 358331 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (358331 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-4006 | 1 Phpmyfaq | 1 Phpmyfaq | 2024-11-21 | 9.8 Critical |
| Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16. | ||||
| CVE-2023-4005 | 1 Fossbilling | 1 Fossbilling | 2024-11-21 | 9.8 Critical |
| Insufficient Session Expiration in GitHub repository fossbilling/fossbilling prior to 0.5.5. | ||||
| CVE-2023-4003 | 1 Oneidentity | 1 Password Manager | 2024-11-21 | 7.6 High |
| One Identity Password Manager version 5.9.7.1 - An unauthenticated attacker with physical access to a workstation may upgrade privileges to SYSTEM through an unspecified method. CWE-250: Execution with Unnecessary Privileges. | ||||
| CVE-2023-49981 | 2 Oretnom23, Sourcecodester | 2 School Fees Management System, School Fees Management System | 2024-11-21 | 7.5 High |
| A directory listing vulnerability in School Fees Management System v1.0 allows attackers to list directories and sensitive files within the application without requiring authorization. | ||||
| CVE-2023-49980 | 2 Mayurik, Sourcecodester | 2 Best Student Result Management System, Best Student Result Management System | 2024-11-21 | 7.5 High |
| A directory listing vulnerability in Best Student Result Management System v1.0 allows attackers to list directories and sensitive files within the application without requiring authorization. | ||||
| CVE-2023-49979 | 2 Mayurik, Sourcecodester | 2 Best Student Management System, Customer Support System | 2024-11-21 | 7.5 High |
| A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the application without requiring authorization. | ||||
| CVE-2023-49978 | 1 Oretnom23 | 1 Customer Support System | 2024-11-21 | 8.8 High |
| Incorrect access control in Customer Support System v1 allows non-administrator users to access administrative pages and execute actions reserved for administrators. | ||||
| CVE-2023-49967 | 1 Typecho | 1 Typecho | 2024-11-21 | 7.5 High |
| Typecho v1.2.1 was discovered to be vulnerable to an XML Quadratic Blowup attack via the component /index.php/action/xmlrpc. | ||||
| CVE-2023-49964 | 1 Hyland | 1 Alfresco Content Services | 2024-11-21 | 8.8 High |
| An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to bypass restrictions and achieve RCE (Remote Code Execution). NOTE: this issue exists because of an incomplete fix for CVE-2020-12873. | ||||
| CVE-2023-49958 | 1 Dallmann-consulting | 1 Open Charge Point Protocol | 2024-11-21 | 7.5 High |
| An issue was discovered in Dalmann OCPP.Core through 1.2.0 for OCPP (Open Charge Point Protocol) for electric vehicles. The server processes mishandle StartTransaction messages containing additional, arbitrary properties, or duplicate properties. The last occurrence of a duplicate property is accepted. This could be exploited to alter transaction records or impact system integrity. | ||||
| CVE-2023-49957 | 1 Dallmann-consulting | 1 Open Charge Point Protocol | 2024-11-21 | 7.5 High |
| An issue was discovered in Dalmann OCPP.Core before 1.3.0 for OCPP (Open Charge Point Protocol) for electric vehicles. It permits multiple transactions with the same connectorId and idTag, contrary to the expected ConcurrentTx status. This could result in critical transaction management and billing errors. NOTE: the vendor's perspective is "Imagine you've got two cars in your family and want to charge both in parallel on the same account/token? Why should that be rejected?" | ||||
| CVE-2023-49956 | 1 Dallmann-consulting | 1 Open Charge Point Protocol | 2024-11-21 | 7.5 High |
| An issue was discovered in Dalmann OCPP.Core before 1.3.0 for OCPP (Open Charge Point Protocol) for electric vehicles. A StopTransaction message with any random transactionId terminates active transactions. | ||||
| CVE-2023-49955 | 1 Dallmann-consulting | 1 Open Charge Point Protocol | 2024-11-21 | 7.5 High |
| An issue was discovered in Dalmann OCPP.Core before 1.2.0 for OCPP (Open Charge Point Protocol) for electric vehicles. It does not validate the length of the chargePointVendor field in a BootNotification message, potentially leading to server instability and a denial of service when processing excessively large inputs. NOTE: the vendor's perspective is "OCPP.Core is intended for use in a protected environment/network." | ||||
| CVE-2023-49949 | 1 Passwork | 1 Passwork | 2024-11-21 | 8.1 High |
| Passwork before 6.2.0 allows remote authenticated users to bypass 2FA by sending all one million of the possible 6-digit codes. | ||||
| CVE-2023-49948 | 1 Forgejo | 1 Forgejo | 2024-11-21 | 5.3 Medium |
| Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss (or another extension) to a URL. | ||||
| CVE-2023-49947 | 1 Forgejo | 1 Forgejo | 2024-11-21 | 7.5 High |
| Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication. | ||||
| CVE-2023-49946 | 1 Forgejo | 1 Forgejo | 2024-11-21 | 9.1 Critical |
| In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. This allows remote attackers to read private issues, read private pull requests, delete issues, and perform other unauthorized actions. | ||||
| CVE-2023-49944 | 1 Beyondtrust | 1 Privilege Management For Windows | 2024-11-21 | 6.7 Medium |
| The Challenge Response feature of BeyondTrust Privilege Management for Windows (PMfW) before 2023-07-14 allows local administrators to bypass this feature by decrypting the shared key, or by locating the decrypted shared key in process memory. The threat is mitigated by the Agent Protection feature. | ||||
| CVE-2023-49927 | 1 Samsung | 26 Exynos 1080, Exynos 1080 Firmware, Exynos 1280 and 23 more | 2024-11-21 | 5.3 Medium |
| An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 9110, Exynos W920, Exynos Modem 5123, Exynos Modem 5300. The baseband software does not properly check format types specified by the RRC. This can lead to a lack of encryption. | ||||
| CVE-2023-49926 | 1 Misp-project | 1 Misp | 2024-11-21 | 6.1 Medium |
| app/Lib/Tools/EventTimelineTool.php in MISP before 2.4.179 allows XSS in the event timeline widget. | ||||