Export limit exceeded: 40371 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 40371 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 40371 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 40371 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 40371 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 40371 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (40371 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-30952 | 1 Palantir | 1 Foundry | 2024-11-21 | 5 Medium |
| A security defect was discovered in Foundry Issues that enabled users to create convincing phishing links by editing the request sent when creating an Issue. This defect was resolved in Frontend release 6.228.0 . | ||||
| CVE-2023-30951 | 1 Palantir | 1 Magritte-rest-source-bundle | 2024-11-21 | 6.3 Medium |
| The Foundry Magritte plugin rest-source was found to be vulnerable to an an XML external Entity attack (XXE). | ||||
| CVE-2023-30950 | 1 Palantir | 1 Foundry Campaigns | 2024-11-21 | 6.5 Medium |
| The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint | ||||
| CVE-2023-30491 | 1 Codebard | 1 Codebard\'s Patron Button And Widgets For Patreon | 2024-11-21 | 7.1 High |
| Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin <= 2.1.8 versions. | ||||
| CVE-2023-30481 | 1 Profosbox | 1 Agp Font Awesome Collection | 2024-11-21 | 7.1 High |
| Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Alexey Golubnichenko AGP Font Awesome Collection plugin <= 3.2.4 versions. | ||||
| CVE-2023-30297 | 1 N-able | 1 N-central | 2024-11-21 | 7.0 High |
| An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring function of the server. | ||||
| CVE-2023-30146 | 1 Assmann | 2 Ht-ip211hdp, Ht-ip211hdp Firmware | 2024-11-21 | 7.5 High |
| Assmann Digitus Plug&View IP Camera HT-IP211HDP, version 2.000.022 allows unauthenticated attackers to download a copy of the camera's settings and the administrator credentials. | ||||
| CVE-2023-2803 | 1 Themefic | 1 Ultimate Addons For Contact Form 7 | 2024-11-21 | 6.1 Medium |
| The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. | ||||
| CVE-2023-2802 | 1 Themefic | 1 Ultimate Addons For Contact Form 7 | 2024-11-21 | 4.8 Medium |
| The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2023-2754 | 1 Cloudflare | 1 Warp | 2024-11-21 | 7.4 High |
| The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local DNS server that performs DNS queries in a secure manner, however, if a user is connected to WARP over an IPv6-capable network, te WARP client did not assign loopback IPv6 addresses but Unique Local Addresses, which under certain conditions could point towards unknown devices in the same local network which enables an Attacker to view DNS queries made by the device. | ||||
| CVE-2023-2640 | 1 Canonical | 2 Ubantu Kernel, Ubuntu Linux | 2024-11-21 | 7.8 High |
| On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may set privileged extended attributes on the mounted files, leading them to be set on the upper files without the appropriate security checks. | ||||
| CVE-2023-2597 | 1 Eclipse | 1 Openj9 | 2024-11-21 | 7 High |
| In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache (which is enabled by default in OpenJ9 builds) the size of a string is not properly checked against the size of the buffer. | ||||
| CVE-2023-29824 | 2 Redhat, Scipy | 2 Openshift, Scipy | 2024-11-21 | 9.8 Critical |
| A use-after-free issue was discovered in Py_FindObjects() function in SciPy versions prior to 1.8.0. NOTE: the vendor and discoverer indicate that this is not a security issue. | ||||
| CVE-2023-29689 | 1 Pyrocms | 1 Pyrocms | 2024-11-21 | 9.8 Critical |
| PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited through a server-side template injection (SSTI) flaw. This vulnerability allows a malicious attacker to send customized commands to the server and execute arbitrary code on the affected system. | ||||
| CVE-2023-28938 | 1 Mdadm Project | 1 Mdadm | 2024-11-21 | 3.4 Low |
| Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access. | ||||
| CVE-2023-28935 | 1 Apache | 1 Unstructured Information Management Architecture | 2024-11-21 | 8.8 High |
| ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache UIMA DUCC. When using the "Distributed UIMA Cluster Computing" (DUCC) module of Apache UIMA, an authenticated user that has the permissions to modify core entities can cause command execution as the system user that runs the web process. As the "Distributed UIMA Cluster Computing" module for UIMA is retired, we do not plan to release a fix for this issue. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2023-28577 | 1 Qualcomm | 66 Fastconnect 6800, Fastconnect 6800 Firmware, Fastconnect 6900 and 63 more | 2024-11-21 | 6.7 Medium |
| In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which cause UAF of the kernel address. | ||||
| CVE-2023-28576 | 1 Qualcomm | 62 Fastconnect 6800, Fastconnect 6800 Firmware, Fastconnect 6900 and 59 more | 2024-11-21 | 6.4 Medium |
| The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it. In other words, user mode may race and modify the packet header (e.g. header.count), causing checks (e.g. size checks) in kernel code to be invalid. This may lead to out-of-bounds read/write issues. | ||||
| CVE-2023-28575 | 1 Qualcomm | 120 205, 205 Firmware, 215 and 117 more | 2024-11-21 | 6.7 Medium |
| The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it. | ||||
| CVE-2023-28561 | 1 Qualcomm | 2 Qcn7606, Qcn7606 Firmware | 2024-11-21 | 9.8 Critical |
| Memory corruption in QESL while processing payload from external ESL device to firmware. | ||||