Export limit exceeded: 366342 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (366342 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-33589 | 1 Ribose | 1 Rnp | 2025-02-04 | 7.5 High |
| Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than on the tin of the algorithm. | ||||
| CVE-2023-22309 | 1 Tribe29 | 1 Checkmk Appliance Firmware | 2025-02-04 | 6.1 Medium |
| Reflective Cross-Site-Scripting in Webconf in Tribe29 Checkmk Appliance before 1.6.4. | ||||
| CVE-2022-46302 | 1 Checkmk | 1 Checkmk | 2025-02-04 | 8.8 High |
| Broad access controls could allow site users to directly interact with the system Apache installation when providing the reverse proxy configurations for Tribe29's Checkmk <= 2.1.0p6, Checkmk <= 2.0.0p27, and all versions of Checkmk 1.6.0 (EOL) allowing an attacker to perform remote code execution with root privileges on the underlying host. | ||||
| CVE-2023-29528 | 1 Xwiki | 1 Commons | 2025-02-04 | 9.1 Critical |
| XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1 and massively improved in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid HTML comments. As a consequence, any code relying on this "restricted" mode for security is vulnerable to JavaScript injection ("cross-site scripting"/XSS). When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. This allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance. This problem has been patched in XWiki 14.10, HTML comments are now removed in restricted mode and a check has been introduced that ensures that comments don't start with `>`. There are no known workarounds apart from upgrading to a version including the fix. | ||||
| CVE-2023-30371 | 1 Tenda | 2 Ac15, Ac15 Firmware | 2025-02-04 | 9.8 Critical |
| In Tenda AC15 V15.03.05.19, the function "sub_ED14" contains a stack-based buffer overflow vulnerability. | ||||
| CVE-2023-30370 | 1 Tenda | 2 Ac15, Ac15 Firmware | 2025-02-04 | 9.8 Critical |
| In Tenda AC15 V15.03.05.19, the function GetValue contains a stack-based buffer overflow vulnerability. | ||||
| CVE-2023-30369 | 1 Tenda | 2 Ac15, Ac15 Firmware | 2025-02-04 | 9.8 Critical |
| Tenda AC15 V15.03.05.19 is vulnerable to Buffer Overflow. | ||||
| CVE-2023-30368 | 1 Tenda | 2 Ac5, Ac5 Firmware | 2025-02-04 | 9.8 Critical |
| Tenda AC5 V15.03.06.28 is vulnerable to Buffer Overflow via the initWebs function. | ||||
| CVE-2023-29480 | 1 Ribose | 1 Rnp | 2025-02-04 | 7.5 High |
| Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use. | ||||
| CVE-2023-29469 | 3 Debian, Redhat, Xmlsoft | 5 Debian Linux, Enterprise Linux, Jboss Core Services and 2 more | 2025-02-04 | 6.5 Medium |
| An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value). | ||||
| CVE-2023-27849 | 1 Rails-routes-to-json Project | 1 Rails-routes-to-json | 2025-02-04 | 9.8 Critical |
| rails-routes-to-json v1.0.0 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function. | ||||
| CVE-2023-1347 | 1 Fastlinemedia | 1 Customizer Export\/import | 2025-02-04 | 7.2 High |
| The Customizer Export/Import WordPress plugin before 0.9.6 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present | ||||
| CVE-2023-0542 | 1 Blackbirdi | 1 Custom Post Type List Shortcode | 2025-02-04 | 5.4 Medium |
| The Custom Post Type List Shortcode WordPress plugin through 1.4.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | ||||
| CVE-2023-0514 | 1 Membership Database Project | 1 Membership Database | 2025-02-04 | 6.1 Medium |
| The Membership Database WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | ||||
| CVE-2023-0280 | 1 Topdigitaltrends | 1 Ultimate Carousel For Elementor | 2025-02-04 | 5.4 Medium |
| The Ultimate Carousel For Elementor WordPress plugin through 2.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | ||||
| CVE-2023-30616 | 1 Epiph | 1 Form Block | 2025-02-04 | 6.5 Medium |
| Form block is a wordpress plugin designed to make form creation easier. Versions prior to 1.0.2 are subject to a Cross-Site Request Forgery due to a missing nonce check. There is potential for a Cross Site Request Forgery for all form blocks, since it allows to send requests to the forms from any website without a user noticing. Users are advised to upgrade to version 1.0.2. There are no known workarounds for this vulnerability. | ||||
| CVE-2022-47509 | 1 Solarwinds | 1 Orion Platform | 2025-02-04 | 6.1 Medium |
| The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject HTML. | ||||
| CVE-2023-46401 | 1 Kwhotel | 1 Kwhotel | 2025-02-04 | 8.8 High |
| KWHotel 0.47 is vulnerable to CSV Formula Injection in the invoice adding function. | ||||
| CVE-2023-2202 | 1 Rosariosis | 1 Rosariosis | 2025-02-04 | 6.5 Medium |
| Improper Access Control in GitHub repository francoisjacquet/rosariosis prior to 10.9.3. | ||||
| CVE-2023-2227 | 1 Modoboa | 1 Modoboa | 2025-02-04 | 9.1 Critical |
| Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0. | ||||