Export limit exceeded: 363393 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (363393 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-2625 | 2 Fedoraproject, Google | 2 Fedora, Chrome | 2025-03-13 | 8.8 High |
| Object lifecycle issue in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2024-52723 | 1 Totolink | 2 X6000r, X6000r Firmware | 2025-03-13 | 9.8 Critical |
| In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering. An attacker can achieve arbitrary command execution by constructing the payload. | ||||
| CVE-2024-4381 | 1 Wielebenwir | 1 Commonsbooking | 2025-03-13 | 4.8 Medium |
| The CB (legacy) WordPress plugin through 0.9.4.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2024-46958 | 2 Linux, Nextcloud | 2 Linux Kernel, Desktop | 2025-03-13 | 9.1 Critical |
| In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or world readable. This is fixed in 3.13.4. | ||||
| CVE-2024-46557 | 1 Draytek | 2 Vigor3910, Vigor3910 Firmware | 2025-03-13 | 7.5 High |
| Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. | ||||
| CVE-2024-44819 | 1 Zzcms | 1 Zzcms | 2025-03-13 | 6.1 Medium |
| Cross Site Scripting vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information via a crafted script to the pagename parameter of the admin/del.php component. | ||||
| CVE-2024-40039 | 1 Idccms Project | 1 Idccms | 2025-03-13 | 8.8 High |
| idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userGroup_deal.php?mudi=del | ||||
| CVE-2024-3516 | 2 Fedoraproject, Google | 2 Fedora, Chrome | 2025-03-13 | 8.8 High |
| Heap buffer overflow in ANGLE in Google Chrome prior to 123.0.6312.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2024-37768 | 1 B1ackc4t | 1 14finger | 2025-03-13 | 9.1 Critical |
| 14Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id. | ||||
| CVE-2024-37632 | 1 Totolink | 2 A3700r, A3700r Firmware | 2025-03-13 | 6.5 Medium |
| TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via the password parameter in function loginAuth . | ||||
| CVE-2024-33764 | 1 Sammycage | 1 Lunasvg | 2025-03-13 | 5.5 Medium |
| lunasvg v2.3.9 was discovered to contain a stack-overflow at lunasvg/source/element.h. | ||||
| CVE-2024-32504 | 1 Samsung | 16 Exynos 1080, Exynos 1080 Firmware, Exynos 1280 and 13 more | 2025-03-13 | 8.4 High |
| An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 850, Exynos 1080, Exynos 2100, Exynos 1280, Exynos 1380, Exynos 1330, Exynos W920, Exynos W930. The mobile processor lacks proper length checking, which can result in an OOB (Out-of-Bounds) Write vulnerability. | ||||
| CVE-2024-31847 | 1 Italtel | 1 Embrace | 2025-03-13 | 6.1 Medium |
| An issue was discovered in Italtel Embrace 1.6.4. A stored cross-site scripting (XSS) vulnerability allows authenticated and unauthenticated remote attackers to inject arbitrary web script or HTML into a GET parameter. This reflects/stores the user input without sanitization. | ||||
| CVE-2024-31611 | 1 Seacms | 1 Seacms | 2025-03-13 | 9.1 Critical |
| SeaCMS 12.9 has a file deletion vulnerability via admin_template.php. | ||||
| CVE-2024-29472 | 1 Zhyd | 1 Oneblog | 2025-03-13 | 5.4 Medium |
| OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Privilege Management module. | ||||
| CVE-2024-29318 | 1 Personal-management-system | 1 Personal Management System | 2025-03-13 | 5.4 Medium |
| Volmarg Personal Management System 1.4.64 is vulnerable to stored cross site scripting (XSS) via upload of a SVG file with embedded javascript code. | ||||
| CVE-2024-28761 | 1 Ibm | 1 App Connect Enterprise | 2025-03-13 | 5.4 Medium |
| IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 285245. | ||||
| CVE-2024-26489 | 1 Flusity | 1 Flusity | 2025-03-13 | 6.1 Medium |
| A cross-site scripting (XSS) vulnerability in the Addon JD Flusity 'Social block links' module of flusity-CMS v2.33 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Profile Name text field. | ||||
| CVE-2024-21677 | 1 Atlassian | 2 Confluence Data Center, Confluence Server | 2025-03-13 | 8.8 High |
| This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. This Path Traversal vulnerability, with a CVSS Score of 8.3, allows an unauthenticated attacker to exploit an undefinable vulnerability which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Data Center Atlassian recommends that Confluence Data Center customers upgrade to the latest version and that Confluence Server customers upgrade to the latest 8.5.x LTS version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives. This vulnerability was reported via our Bug Bounty program. | ||||
| CVE-2024-20129 | 2 Google, Mediatek | 47 Android, Mt6580, Mt6739 and 44 more | 2025-03-13 | 7.5 High |
| In Telephony, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09289881; Issue ID: MSV-2025. | ||||