Export limit exceeded: 357917 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 357917 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (357917 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-38507 | 1 Jetbrains | 1 Hub | 2024-11-21 | 3.5 Low |
| In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible | ||||
| CVE-2024-38506 | 1 Jetbrains | 1 Youtrack | 2024-11-21 | 6.3 Medium |
| In JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflows | ||||
| CVE-2024-38505 | 1 Jetbrains | 1 Youtrack | 2024-11-21 | 5.3 Medium |
| In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party site | ||||
| CVE-2024-38504 | 1 Jetbrains | 1 Youtrack | 2024-11-21 | 4.3 Medium |
| In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles | ||||
| CVE-2024-38493 | 1 Broadcom | 1 Symantec Privileged Access Management | 2024-11-21 | 6.1 Medium |
| A reflected cross-site scripting (XSS) vulnerability exists in the PAM UI web interface. A remote attacker able to convince a PAM user to click on a specially crafted link to the PAM UI web interface could potentially execute arbitrary client-side code in the context of PAM UI. | ||||
| CVE-2024-38462 | 1 Irods | 1 Irods | 2024-11-21 | 9.8 Critical |
| iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the mailMS.cpp#L94-L106 reference. | ||||
| CVE-2024-38461 | 1 Irods | 1 Irods | 2024-11-21 | 7.5 High |
| irodsServerMonPerf in iRODS before 4.3.2 attempts to proceed with use of a path even if it is not a directory. | ||||
| CVE-2024-38458 | 1 Xenforo | 1 Xenforo | 2024-11-21 | 8.8 High |
| Xenforo before 2.2.16 allows code injection. | ||||
| CVE-2024-38457 | 1 Xenforo | 1 Xenforo | 2024-11-21 | 8.8 High |
| Xenforo before 2.2.16 allows CSRF. | ||||
| CVE-2024-38438 | 1 Dlink | 2 Dsl-225, Dsl-225 Firmware | 2024-11-21 | 9.8 Critical |
| D-Link - CWE-294: Authentication Bypass by Capture-replay | ||||
| CVE-2024-38437 | 1 Dlink | 2 Dsl-225, Dsl-225 Firmware | 2024-11-21 | 9.8 Critical |
| D-Link - CWE-288:Authentication Bypass Using an Alternate Path or Channel | ||||
| CVE-2024-38436 | 1 Commugen | 1 Sox 365 | 2024-11-21 | 6.1 Medium |
| Commugen SOX 365 – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | ||||
| CVE-2024-38433 | 1 Nuvoton | 8 Npcm705r, Npcm705r Firmware, Npcm710r and 5 more | 2024-11-21 | 6.7 Medium |
| Nuvoton - CWE-305: Authentication Bypass by Primary Weakness An attacker with write access to the SPI-Flash on an NPCM7xx BMC subsystem that uses the Nuvoton BootBlock reference code can modify the u-boot image header on flash parsed by the BootBlock which could lead to arbitrary code execution. | ||||
| CVE-2024-38432 | 1 Matrix-globalservices | 1 Tafnit | 2024-11-21 | 5.5 Medium |
| Matrix Tafnit v8 - CWE-646: Reliance on File Name or Extension of Externally-Supplied File | ||||
| CVE-2024-38431 | 1 Matrix-globalservices | 1 Tafnit | 2024-11-21 | 5.3 Medium |
| Matrix Tafnit v8 - CWE-204: Observable Response Discrepancy | ||||
| CVE-2024-38430 | 1 Matrix-globalservices | 1 Tafnit | 2024-11-21 | 5.4 Medium |
| Matrix - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | ||||
| CVE-2024-38429 | 1 Matrix-globalservices | 1 Tafnit | 2024-11-21 | 7.5 High |
| Matrix Tafnit v8 - CWE-552: Files or Directories Accessible to External Parties | ||||
| CVE-2024-38373 | 1 Amazon | 1 Freertos-plus-tcp | 2024-11-21 | 9.6 Critical |
| FreeRTOS-Plus-TCP is a lightweight TCP/IP stack for FreeRTOS. FreeRTOS-Plus-TCP versions 4.0.0 through 4.1.0 contain a buffer over-read issue in the DNS Response Parser when parsing domain names in a DNS response. A carefully crafted DNS response with domain name length value greater than the actual domain name length, could cause the parser to read beyond the DNS response buffer. This issue affects applications using DNS functionality of the FreeRTOS-Plus-TCP stack. Applications that do not use DNS functionality are not affected, even when the DNS functionality is enabled. This vulnerability has been patched in version 4.1.1. | ||||
| CVE-2024-38369 | 1 Xwiki | 1 Xwiki | 2024-11-21 | 10 Critical |
| XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The content of a document included using `{{include reference="targetdocument"/}}` is executed with the right of the includer and not with the right of its author. This means that any user able to modify the target document can impersonate the author of the content which used the `include` macro. This vulnerability has been patched in XWiki 15.0 RC1 by making the default behavior safe. | ||||
| CVE-2024-38368 | 1 Cocoapods | 2 Cocoapods, Trunk.cocoapods.org | 2024-11-21 | 9.3 Critical |
| trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. A vulnerability affected older pods which migrated from the pre-2014 pull request workflow to trunk. If the pods had never been claimed then it was still possible to do so. It was also possible to have all owners removed from a pod, and that made the pod available for the same claiming system. This was patched server-side in commit 71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4 in September 2023. | ||||