Export limit exceeded: 360615 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (360615 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-2786 | 1 Mattermost | 1 Mattermost | 2024-12-06 | 4.3 Medium |
| Mattermost fails to properly check the permissions when executing commands allowing a member with no permissions to post a message in a channel to actually post it by executing channel commands. | ||||
| CVE-2023-2787 | 1 Mattermost | 1 Mattermost | 2024-12-06 | 6.5 Medium |
| Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary posts by using the message threads API. | ||||
| CVE-2023-2788 | 1 Mattermost | 1 Mattermost | 2024-12-06 | 6.2 Medium |
| Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's account is deactivated. | ||||
| CVE-2023-2791 | 1 Mattermost | 1 Mattermost | 2024-12-06 | 4.3 Medium |
| When creating a playbook run via the /dialog API, Mattermost fails to validate all parameters, allowing an authenticated attacker to edit an arbitrary channel post. | ||||
| CVE-2023-2792 | 1 Mattermost | 1 Mattermost | 2024-12-06 | 6.5 Medium |
| Mattermost fails to sanitize ephemeral error messages, allowing an attacker to obtain arbitrary message contents by a specially crafted /groupmsg command. | ||||
| CVE-2023-2793 | 1 Mattermost | 1 Mattermost | 2024-12-06 | 6.5 Medium |
| Mattermost fails to validate links on external websites when constructing a preview for a linked website, allowing an attacker to cause a denial-of-service by a linking to a specially crafted webpage in a message. | ||||
| CVE-2023-2797 | 1 Mattermost | 1 Mattermost | 2024-12-06 | 3.1 Low |
| Mattermost fails to sanitize code permalinks, allowing an attacker to preview code from private repositories by posting a specially crafted permalink on a channel. | ||||
| CVE-2023-2831 | 1 Mattermost | 1 Mattermost | 2024-12-06 | 4.3 Medium |
| Mattermost fails to unescape Markdown strings in a memory-efficient way, allowing an attacker to cause a Denial of Service by sending a message containing a large number of escaped characters. | ||||
| CVE-2023-2785 | 1 Mattermost | 1 Mattermost | 2024-12-06 | 4.3 Medium |
| Mattermost fails to properly truncate the postgres error log message of a search query failure allowing an attacker to cause the creation of large log files which can result in Denial of Service | ||||
| CVE-2024-38503 | 1 Apache | 1 Syncope | 2024-12-06 | 3.9 Low |
| When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”. Users are recommended to upgrade to version 3.0.8, which fixes this issue. | ||||
| CVE-2023-29931 | 1 Laravels Project | 1 Laravels | 2024-12-06 | 9.8 Critical |
| laravel-s 3.7.35 is vulnerable to Local File Inclusion via /src/Illuminate/Laravel.php. | ||||
| CVE-2022-48621 | 1 Huawei | 2 Emui, Harmonyos | 2024-12-06 | 6.3 Medium |
| Vulnerability of missing authentication for critical functions in the Wi-Fi module.Successful exploitation of this vulnerability may affect service confidentiality. | ||||
| CVE-2022-45287 | 1 Temenos | 1 Cwx | 2024-12-06 | 8.8 High |
| An access control issue in Registration.aspx of Temenos CWX 8.5.6 allows authenticated attackers to escalate privileges and perform arbitrary Administrative commands. | ||||
| CVE-2024-46906 | 1 Progress | 1 Whatsup Gold | 2024-12-06 | 8.8 High |
| In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permissions required) to achieve privilege escalation to the admin account. | ||||
| CVE-2023-35166 | 1 Xwiki | 1 Xwiki | 2024-12-06 | 10 Critical |
| XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension. This has been patched in XWiki 15.1-rc-1 and 14.10.5. | ||||
| CVE-2023-32274 | 1 Enphase | 1 Installer Toolkit | 2024-12-06 | 8.6 High |
| Enphase Installer Toolkit versions 3.27.0 has hard coded credentials embedded in binary code in the Android application. An attacker can exploit this and gain access to sensitive information. | ||||
| CVE-2023-33869 | 1 Enphase | 2 Envoy, Envoy Firmware | 2024-12-06 | 6.3 Medium |
| Enphase Envoy versions D7.0.88 is vulnerable to a command injection exploit that may allow an attacker to execute root commands. | ||||
| CVE-2024-21097 | 1 Oracle | 2 Peoplesoft Enterprise Peopletools, Peoplesoft Enterprise Pt Peopletools | 2024-12-06 | 4.9 Medium |
| Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported versions that are affected are 8.59, 8.60 and 8.61. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N). | ||||
| CVE-2024-21100 | 1 Oracle | 1 Commerce Platform | 2024-12-06 | 4 Medium |
| Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Platform). Supported versions that are affected are 11.3.0, 11.3.1 and 11.3.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. While the vulnerability is in Oracle Commerce Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 4.0 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N). | ||||
| CVE-2023-27083 | 1 Pluck-cms | 1 Pluck | 2024-12-06 | 7.2 High |
| An issue discovered in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev5 allows remote attackers to run arbitrary code via manage file functionality. | ||||