Export limit exceeded: 365581 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 365581 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (365581 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-24253 | 1 Domoticalabs | 1 Ikon Server | 2025-03-11 | 9.8 Critical |
| Domotica Labs srl Ikon Server before v2.8.6 was discovered to contain a SQL injection vulnerability. | ||||
| CVE-2022-2422 | 1 Feathersjs | 1 Feathers-sequelize | 2025-03-11 | 10 Critical |
| Due to improper input validation in the Feathers js library, it is possible to perform a SQL injection attack on the back-end database, in case the feathers-sequelize package is used. | ||||
| CVE-2022-45052 | 3 Axiell, Linux, Microsoft | 3 Iguana, Linux Kernel, Windows | 2025-03-11 | 8.8 High |
| A Local File Inclusion vulnerability has been found in Axiell Iguana CMS. Due to insufficient neutralisation of user input on the url parameter on the Proxy.type.php endpoint, external users are capable of accessing files on the server. | ||||
| CVE-2022-24385 | 1 Smartertools | 1 Smartertrack | 2025-03-11 | 6.5 Medium |
| A Direct Object Access vulnerability in SmarterTools SmarterTrack leads to information disclosure This issue affects: SmarterTools SmarterTrack 100.0.8019.14010. | ||||
| CVE-2022-24386 | 1 Smartertools | 1 Smartertrack | 2025-03-11 | 8.8 High |
| Stored XSS in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010. | ||||
| CVE-2022-24384 | 1 Smartertools | 1 Smartertrack | 2025-03-11 | 8.8 High |
| Cross-site Scripting (XSS) vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010. | ||||
| CVE-2022-25151 | 1 Itarian | 2 On-premise, Saas Service Desk | 2025-03-11 | 7.5 High |
| Within the Service Desk module of the ITarian platform (SAAS and on-premise), a remote attacker can obtain sensitive information, caused by the failure to set the HTTP Only flag. A remote attacker could exploit this vulnerability to gain access to the management interface by using this vulnerability in combination with a successful Cross-Site Scripting attack on a user. | ||||
| CVE-2022-25152 | 1 Itarian | 2 On-premise, Saas Service Desk | 2025-03-11 | 9.9 Critical |
| The ITarian platform (SAAS / on-premise) offers the possibility to run code on agents via a function called procedures. It is possible to require a mandatory approval process. Due to a vulnerability in the approval process, present in any version prior to 6.35.37347.20040, a malicious actor (with a valid session token) can create a procedure, bypass approval, and execute the procedure. This results in the ability for any user with a valid session token to perform arbitrary code execution and full system take-over on all agents. | ||||
| CVE-2022-29822 | 1 Feathersjs | 1 Feathers-sequelize | 2025-03-11 | 10 Critical |
| Due to improper parameter filtering in the Feathers js library, which may ultimately lead to SQL injection | ||||
| CVE-2022-29823 | 1 Feathersjs | 1 Feathers-sequelize | 2025-03-11 | 10 Critical |
| Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution (RCE) with privileges of application. | ||||
| CVE-2022-24387 | 1 Smartertools | 1 Smartertrack | 2025-03-11 | 9.1 Critical |
| With administrator or admin privileges the application can be tricked into overwriting files in app_data/Config folder, e.g. the systemsettings.xml file. THis is possible in SmarterTrack v100.0.8019.14010 | ||||
| CVE-2022-25153 | 1 Itarian | 1 Endpoint Manager Communication Client | 2025-03-11 | 7.8 High |
| The ITarian Endpoint Manage Communication Client, prior to version 6.43.41148.21120, is compiled using insecure OpenSSL settings. Due to this setting, a malicious actor with low privileges access to a system can escalate his privileges to SYSTEM abusing an insecure openssl.conf lookup. | ||||
| CVE-2023-22577 | 1 Home.cern | 2 White Rabbit Switch, White Rabbit Switch Firmware | 2025-03-11 | 9.8 Critical |
| Within White Rabbit Switch it's possible as an unauthenticated user to retrieve sensitive information such as password hashes and the SNMP community strings. | ||||
| CVE-2023-22581 | 1 Home.cern | 2 White Rabbit Switch, White Rabbit Switch Firmware | 2025-03-11 | 9.8 Critical |
| White Rabbit Switch contains a vulnerability which makes it possible for an attacker to perform system commands under the context of the web application (the default installation makes the webserver run as the root user). | ||||
| CVE-2024-27120 | 2 Celsius Benelux, Celsiusbenelux | 2 Comfortkey, Comfortkey | 2025-03-11 | 7.5 High |
| A Local File Inclusion vulnerability has been found in ComfortKey, a product of Celsius Benelux. Using this vulnerability, an unauthenticated attacker may retrieve sensitive information about the underlying system. The vulnerability has been remediated in version 24.1.2. | ||||
| CVE-2024-21875 | 1 Badge.team | 1 Hacker Hotel Badge 2024 | 2025-03-11 | 6.5 Medium |
| Allocation of Resources Without Limits or Throttling vulnerability in Badge leading to a denial of service attack.Team Hacker Hotel Badge 2024 on risc-v (billboard modules) allows Flooding.This issue affects Hacker Hotel Badge 2024: from 0.1.0 through 0.1.3. | ||||
| CVE-2024-27114 | 2 So Planning, Soplanning | 2 Simple Online Planning, Soplanning | 2025-03-11 | 9.8 Critical |
| A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. If the public view setting is enabled, a attacker can upload a PHP-file that will be available for execution for a few milliseconds before it is removed, leading to execution of code on the underlying system. The vulnerability has been remediated in version 1.52.02. | ||||
| CVE-2024-27115 | 2 Simple Online Planning, Soplanning | 2 So Planning, Soplanning | 2025-03-11 | 9.8 Critical |
| A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. With this vulnerability, an attacker can upload executable files that are moved to a publicly accessible folder before verifying any requirements. This leads to the possibility of execution of code on the underlying system when the file is triggered. The vulnerability has been remediated in version 1.52.02. | ||||
| CVE-2024-27113 | 1 Soplanning | 1 Soplanning | 2025-03-11 | 9.8 Critical |
| An unauthenticated Insecure Direct Object Reference (IDOR) to the database has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database by exporting it as a CSV file. The vulnerability has been remediated in version 1.52.02. | ||||
| CVE-2024-27112 | 1 Soplanning | 1 Soplanning | 2025-03-11 | 9.8 Critical |
| A unauthenticated SQL Injection has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database. The vulnerability has been remediated in version 1.52.02. | ||||