Export limit exceeded: 33413 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 33413 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 33413 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 33413 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (33413 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-0872 | 1 Angeljudesuarez | 1 Tailoring Management System | 2025-02-07 | 6.3 Medium |
| A vulnerability classified as critical has been found in itsourcecode Tailoring Management System 1.0. Affected is an unknown function of the file /addpayment.php. The manipulation of the argument id/amount/desc/inccat leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2022-34128 | 1 Glpi-project | 1 Positions | 2025-02-06 | 9.8 Critical |
| The Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php. | ||||
| CVE-2022-34127 | 1 Glpi-project | 1 Manageentities | 2025-02-06 | 7.5 High |
| The Managentities plugin before 4.0.2 for GLPI allows reading local files via directory traversal in the inc/cri.class.php file parameter. | ||||
| CVE-2022-34126 | 1 Glpi-project | 1 Activity | 2025-02-06 | 7.5 High |
| The Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in the front/cra.send.php file parameter. | ||||
| CVE-2022-34125 | 1 Glpi-project | 1 Cmdb | 2025-02-06 | 6.5 Medium |
| front/icon.send.php in the CMDB plugin before 3.0.3 for GLPI allows attackers to gain read access to sensitive information via a _log/ pathname in the file parameter. | ||||
| CVE-2023-38099 | 1 Netgear | 1 Prosafe Network Management System | 2025-02-06 | 8.8 High |
| NETGEAR ProSAFE Network Management System getNodesByTopologyMapSearch SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the getNodesByTopologyMapSearch function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-19723. | ||||
| CVE-2021-34337 | 1 Gnu | 1 Mailman | 2025-02-06 | 6.3 Medium |
| An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces. | ||||
| CVE-2021-23165 | 1 Htmldoc Project | 1 Htmldoc | 2025-02-05 | 9.8 Critical |
| A flaw was found in htmldoc before v1.9.12. Heap buffer overflow in pspdf_prepare_outpages(), in ps-pdf.cxx may lead to execute arbitrary code and denial of service. | ||||
| CVE-2024-49838 | 1 Qualcomm | 338 Ar8035, Ar8035 Firmware, Fastconnect 6200 and 335 more | 2025-02-05 | 8.2 High |
| Information disclosure while parsing the OCI IE with invalid length. | ||||
| CVE-2023-2160 | 1 Modoboa | 1 Modoboa | 2025-02-05 | 6.3 Medium |
| Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0. | ||||
| CVE-2024-38404 | 1 Qualcomm | 80 Ar8035, Ar8035 Firmware, Fastconnect 7800 and 77 more | 2025-02-05 | 7.5 High |
| Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem. | ||||
| CVE-2023-2227 | 1 Modoboa | 1 Modoboa | 2025-02-04 | 9.1 Critical |
| Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0. | ||||
| CVE-2023-2228 | 1 Modoboa | 1 Modoboa | 2025-02-04 | 6.8 Medium |
| Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0. | ||||
| CVE-2025-0849 | 1 Campcodes | 1 School Management Software | 2025-02-04 | 6.3 Medium |
| A vulnerability classified as critical has been found in CampCodes School Management Software 1.0. Affected is an unknown function of the file /edit-staff/ of the component Staff Handler. The manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2024-4263 | 1 Lfprojects | 1 Mlflow | 2025-02-03 | 5.4 Medium |
| A broken access control vulnerability exists in mlflow/mlflow versions before 2.10.1, where low privilege users with only EDIT permissions on an experiment can delete any artifacts. This issue arises due to the lack of proper validation for DELETE requests by users with EDIT permissions, allowing them to perform unauthorized deletions of artifacts. The vulnerability specifically affects the handling of artifact deletions within the application, as demonstrated by the ability of a low privilege user to delete a directory inside an artifact using a DELETE request, despite the official documentation stating that users with EDIT permission can only read and update artifacts, not delete them. | ||||
| CVE-2024-27134 | 1 Lfprojects | 1 Mlflow | 2025-02-03 | 7 High |
| Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called. | ||||
| CVE-2022-34292 | 1 Docker | 1 Desktop | 2025-01-31 | 7.1 High |
| Docker Desktop for Windows before 4.6.0 allows attackers to overwrite any file through a symlink attack on the hyperv/create dockerBackendV2 API by controlling the DataFolder parameter for DockerDesktop.vhdx, a similar issue to CVE-2022-31647. | ||||
| CVE-2024-40679 | 1 Ibm | 1 Db2 | 2025-01-31 | 5.5 Medium |
| IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an information disclosure vulnerability as sensitive information may be included in a log file under specific conditions. | ||||
| CVE-2024-13312 | 2025-01-31 | 5.3 Medium | ||
| Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 11.8.0 before 12.3.10, from 12.4.0 before 12.4.9. | ||||
| CVE-2023-38739 | 1 Ibm | 1 Sterling B2b Integrator | 2025-01-31 | 4.3 Medium |
| IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. | ||||