Export limit exceeded: 366330 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (366330 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-41613 | 1 Bentley | 1 Microstation Connect | 2025-02-13 | 7.8 High |
| Bentley Systems MicroStation Connect versions 10.17.0.209 and prior are vulnerable to an Out-of-Bounds Read when when parsing DGN files, which may allow an attacker to crash the product, disclose sensitive information, or execute arbitrary code. | ||||
| CVE-2022-40201 | 1 Bentley | 1 Microstation Connect | 2025-02-13 | 7.8 High |
| Bentley Systems MicroStation Connect versions 10.17.0.209 and prior are vulnerable to a Stack-Based Buffer Overflow when a malformed design (DGN) file is parsed. This may allow an attacker to execute arbitrary code. | ||||
| CVE-2022-3172 | 2 Kubernetes, Redhat | 3 Apiserver, Openshift, Openshift Data Foundation | 2025-02-13 | 5.1 Medium |
| A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties. | ||||
| CVE-2022-39374 | 1 Matrix | 1 Synapse | 2025-02-13 | 6.5 Medium |
| Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0 | ||||
| CVE-2022-31888 | 1 Enhancesoft | 1 Osticket | 2025-02-13 | 8.8 High |
| Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2. | ||||
| CVE-2022-25147 | 2 Apache, Redhat | 7 Portable Runtime Utility, Enterprise Linux, Jboss Core Services and 4 more | 2025-02-13 | 6.5 Medium |
| Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions. | ||||
| CVE-2022-23854 | 1 Aveva | 1 Intouch Access Anywhere | 2025-02-13 | 7.5 High |
| AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with network access to read files on the system outside of the secure gateway web server. | ||||
| CVE-2022-23540 | 2 Auth0, Redhat | 2 Jsonwebtoken, Openshift Data Foundation | 2025-02-13 | 6.4 Medium |
| In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options. | ||||
| CVE-2021-46748 | 2 Amd, Intel | 123 Radeon Pro Vega 56, Radeon Pro Vega 56 Firmware, Radeon Pro Vega 64 and 120 more | 2025-02-13 | 5.5 Medium |
| Insufficient bounds checking in the ASP (AMD Secure Processor) may allow an attacker to access memory outside the bounds of what is permissible to a TA (Trusted Application) resulting in a potential denial of service. | ||||
| CVE-2020-23258 | 1 Jsish | 1 Jsish | 2025-02-13 | 7.5 High |
| An issue found in Jsish v.3.0.11 allows a remote attacker to cause a denial of service via the Jsi_ValueIsNumber function in ./src/jsiValue.c file. | ||||
| CVE-2020-23257 | 1 Espruino | 1 Espruino | 2025-02-13 | 7.5 High |
| Buffer Overflow vulnerability found in Espruino 2v05.41 allows an attacker to cause a denial of service via the function jsvGarbageCollectMarkUsed in file src/jsvar.c. | ||||
| CVE-2020-22533 | 1 Easycorp | 1 Zentao | 2025-02-13 | 6.1 Medium |
| Cross Site Scripting vulnerability found in Zentao allows a remote attacker to execute arbitrary code via the lang parameter | ||||
| CVE-2020-21487 | 1 Netgate | 2 Pfsense, Pfsense Acme Package | 2025-02-13 | 9.6 Critical |
| Cross Site Scripting vulnerability found in Netgate pfSense 2.4.4 and ACME package v.0.6.3 allows attackers to execute arbitrary code via the RootFolder field of acme_certificates.php. | ||||
| CVE-2020-21060 | 1 Phpmywind | 1 Phpmywind | 2025-02-13 | 8.8 High |
| SQL injection vulnerability found in PHPMyWind v.5.6 allows a remote attacker to gain privileges via the delete function of the administrator management page. | ||||
| CVE-2020-19277 | 1 Mm-wiki Project | 1 Mm-wiki | 2025-02-13 | 5.4 Medium |
| Cross Site Scripting vulnerability found in Phachon mm-wiki v.0.1.2 allows a remote attacker to execute arbitrary code via javascript code in the markdown editor. | ||||
| CVE-2006-20001 | 2 Apache, Redhat | 3 Http Server, Enterprise Linux, Jboss Core Services | 2025-02-13 | 7.5 High |
| A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier. | ||||
| CVE-2023-47141 | 3 Ibm, Linux, Microsoft | 5 Aix, Db2, Linux On Ibm Z and 2 more | 2025-02-13 | 5.3 Medium |
| IIBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query. IBM X-Force ID: 270264. | ||||
| CVE-2023-46734 | 3 Debian, Sensiolabs, Symfony | 3 Debian Linux, Symfony, Twig-bridge | 2025-02-13 | 6.1 Medium |
| Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to versions 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use `is_safe=html` but don't actually ensure their input is safe. As of versions 4.4.51, 5.4.31, and 6.3.8, Symfony now escapes the output of the affected filters. | ||||
| CVE-2023-46660 | 1 Jenkins | 1 Zanata | 2025-02-13 | 5.3 Medium |
| Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token hashes are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token. | ||||
| CVE-2023-46659 | 1 Jenkins | 1 Edgewall Trac | 2025-02-13 | 5.4 Medium |
| Jenkins Edgewall Trac Plugin 1.13 and earlier does not escape the Trac website URL on the build page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. | ||||