Export limit exceeded: 365581 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (365581 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-23952 | 1 Broadcom | 2 Advanced Secure Gateway, Content Analysis | 2025-01-09 | 9.8 Critical |
| Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Command Injection vulnerability. | ||||
| CVE-2022-4676 | 1 Openstreetmap | 1 Openstreetmap | 2025-01-09 | 5.4 Medium |
| The OSM WordPress plugin through 6.01 does not validate and escape some of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. | ||||
| CVE-2017-18307 | 1 Qualcomm | 14 Sd 450, Sd 450 Firmware, Sd 625 and 11 more | 2025-01-09 | 8.4 High |
| Information disclosure possible while audio playback. | ||||
| CVE-2023-34220 | 1 Jetbrains | 1 Teamcity | 2025-01-09 | 4.6 Medium |
| In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible | ||||
| CVE-2023-26277 | 1 Ibm | 1 Qradar Wincollect | 2025-01-09 | 7.8 High |
| IBM QRadar WinCollect Agent 10.0 though 10.1.3 could allow a local user to execute commands on the system due to execution with unnecessary privileges. IBM X-Force ID: 248156. | ||||
| CVE-2023-26278 | 1 Ibm | 1 Qradar Wincollect | 2025-01-09 | 8.2 High |
| IBM QRadar WinCollect Agent 10.0 through 10.1.3 could allow a local authenticated attacker to gain elevated privileges on the system. IBM X-Force ID: 248158. | ||||
| CVE-2018-5852 | 1 Qualcomm | 46 Mdm9206, Mdm9206 Firmware, Mdm9607 and 43 more | 2025-01-09 | 8.4 High |
| An unsigned integer underflow vulnerability in IPA driver result into a buffer over-read while reading NAT entry using debugfs command 'cat /sys/kernel/debug/ipa/ip4_nat' | ||||
| CVE-2023-34088 | 1 Collaboraoffice | 1 Collabora Online | 2025-01-09 | 8.7 High |
| Collabora Online is a collaborative online office suite. A stored cross-site scripting (XSS) vulnerability was found in Collabora Online prior to versions 22.05.13, 21.11.9.1, and 6.4.27. An attacker could create a document with an XSS payload as a document name. Later, if an administrator opened the admin console and navigated to the history page, the document name was injected as unescaped HTML and executed as a script inside the context of the admin console. The administrator JSON web token (JWT) used for the websocket connection could be leaked through this flaw. Users should upgrade to Collabora Online 22.05.13 or higher; Collabora Online 21.11.9.1 or higher; Collabora Online 6.4.27 or higher to receive a patch. | ||||
| CVE-2023-3013 | 1 Gpac | 1 Gpac | 2025-01-09 | 7.1 High |
| Unchecked Return Value in GitHub repository gpac/gpac prior to 2.2.2. | ||||
| CVE-2024-5249 | 1 Perforce | 1 Akana Api | 2025-01-09 | 5.4 Medium |
| In versions of Akana API Platform prior to 2024.1.0, SAML tokens can be replayed. | ||||
| CVE-2024-7029 | 2 Avtec, Avtech | 3 Avm1203\/ipcamera\/, Avm1203, Avm1203 Firmware | 2025-01-09 | 8.8 High |
| Commands can be injected over the network and executed without authentication. | ||||
| CVE-2023-33178 | 1 Xibosignage | 1 Xibo | 2025-01-09 | 6.5 Medium |
| Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the `/dataset/data/{id}` API route inside the CMS starting in version 1.4.0 and prior to versions 2.3.17 and 3.3.5. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values in to the `filter` parameter. Values allowed in the filter parameter are checked against a deny list of commands that should not be allowed, however this checking was done in a case sensitive manor and so it is possible to bypass these checks by using unusual case combinations. Users should upgrade to version 2.3.17 or 3.3.5, which fix this issue. There are no workarounds aside from upgrading. | ||||
| CVE-2023-33551 | 1 Erofs-utils Project | 1 Erofs-utils | 2025-01-09 | 7.8 High |
| Heap Buffer Overflow in the erofsfsck_dirent_iter function in fsck/main.c in erofs-utils v1.6 allows remote attackers to execute arbitrary code via a crafted erofs filesystem image. | ||||
| CVE-2023-33486 | 1 Totolink | 2 X5000r, X5000r Firmware | 2025-01-09 | 9.8 Critical |
| TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setOpModeCfg. This vulnerability allows an attacker to execute arbitrary commands through the "hostName" parameter. | ||||
| CVE-2023-2023 | 1 Kunalnagar | 1 Custom 404 Pro | 2025-01-09 | 6.1 Medium |
| The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting. | ||||
| CVE-2023-27745 | 1 Southrivertech | 1 Titan Ftp Server Nextgen | 2025-01-09 | 8.8 High |
| An issue in South River Technologies TitanFTP Before v2.0.1.2102 allows attackers with low-level privileges to perform Administrative actions by sending requests to the user server. | ||||
| CVE-2023-27744 | 1 Southrivertech | 1 Titan Ftp Server Nextgen | 2025-01-09 | 7.8 High |
| An issue was discovered in South River Technologies TitanFTP NextGen server that allows for a vertical privilege escalation leading to remote code execution. | ||||
| CVE-2023-25750 | 1 Mozilla | 1 Firefox | 2025-01-09 | 4.3 Medium |
| Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private browsing mode. This vulnerability affects Firefox < 111. | ||||
| CVE-2023-25749 | 1 Mozilla | 1 Firefox | 2025-01-09 | 4.3 Medium |
| Android applications with unpatched vulnerabilities can be launched from a browser using Intents, exposing users to these vulnerabilities. Firefox will now confirm with users that they want to launch an external application before doing so. <br>*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.*. This vulnerability affects Firefox < 111. | ||||
| CVE-2023-25748 | 1 Mozilla | 1 Firefox | 2025-01-09 | 4.3 Medium |
| By displaying a prompt with a long description, the fullscreen notification could have been hidden, resulting in potential user confusion or spoofing attacks. <br>*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 111. | ||||