Export limit exceeded: 358114 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 358114 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (358114 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-6071 | 1 Trellix | 1 Enterprise Security Manager | 2024-11-21 | 8.4 High |
| An Improper Neutralization of Special Elements used in a command vulnerability in ESM prior to version 11.6.9 allows a remote administrator to execute arbitrary code as root on the ESM. This is possible as the input isn't correctly sanitized when adding a new data source. | ||||
| CVE-2023-6070 | 1 Trellix | 1 Enterprise Security Manager | 2024-11-21 | 4.3 Medium |
| A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to upload arbitrary content, potentially altering configuration. This is possible through the certificate validation functionality where the API accepts uploaded content and doesn't parse for invalid data | ||||
| CVE-2023-6069 | 1 Froxlor | 1 Froxlor | 2024-11-21 | 9.9 Critical |
| Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0. | ||||
| CVE-2023-6065 | 1 Quttera | 1 Quttera Web Malware Scanner | 2024-11-21 | 5.3 Medium |
| The Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 doesn't restrict access to detailed scan logs, which allows a malicious actor to discover local paths and portions of the site's code | ||||
| CVE-2023-6063 | 1 Wpfastestcache | 1 Wp Fastest Cache | 2024-11-21 | 7.5 High |
| The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users. | ||||
| CVE-2023-6054 | 1 Tongda2000 | 1 Tongda Office Anywhere | 2024-11-21 | 5.5 Medium |
| A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.9. This affects an unknown part of the file general/wiki/cp/manage/lock.php. The manipulation of the argument TERM_ID_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244875. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2023-6053 | 1 Tongda2000 | 1 Tongda Office Anywhere | 2024-11-21 | 6.3 Medium |
| A vulnerability, which was classified as critical, has been found in Tongda OA 2017 up to 11.9. Affected by this issue is some unknown functionality of the file general/system/censor_words/manage/delete.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-244874 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2023-6045 | 1 Openatom | 1 Openharmony | 2024-11-21 | 5.9 Medium |
| in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through type confusion. | ||||
| CVE-2023-6038 | 1 H2o | 1 H2o | 2024-11-21 | 7.5 High |
| A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3. | ||||
| CVE-2023-6035 | 1 Spider-themes | 1 Eazydocs | 2024-11-21 | 8.8 High |
| The EazyDocs WordPress plugin before 2.3.4 does not properly sanitize and escape "data" parameter before using it in an SQL statement via an AJAX action, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks. | ||||
| CVE-2023-6032 | 1 Schneider-electric | 4 Galaxy Vl, Galaxy Vl Firmware, Galaxy Vs and 1 more | 2024-11-21 | 5.3 Medium |
| A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause a file system enumeration and file download when an attacker navigates to the Network Management Card via HTTPS. | ||||
| CVE-2023-6028 | 1 Br-automation | 1 Automation Runtime | 2024-11-21 | 6.1 Medium |
| A reflected cross-site scripting (XSS) vulnerability exists in the SVG version of System Diagnostics Manager of B&R Automation Runtime versions <= G4.93 that enables a remote attacker to execute arbitrary JavaScript code in the context of the attacked user’s browser session. | ||||
| CVE-2023-6027 | 1 Elijaa | 1 Phpmemcachedadmin | 2024-11-21 | 6.1 Medium |
| A critical flaw has been identified in elijaa/phpmemcachedadmin affecting version 1.3.0, specifically related to a stored XSS vulnerability. This vulnerability allows malicious actors to insert a carefully crafted JavaScript payload. The issue arises from improper encoding of user-controlled entries in the "/pmcadmin/configure.php" parameter. | ||||
| CVE-2023-6026 | 1 Elijaa | 1 Phpmemcachedadmin | 2024-11-21 | 9.8 Critical |
| A Path traversal vulnerability has been reported in elijaa/phpmemcachedadmin affecting version 1.3.0. This vulnerability allows an attacker to delete files stored on the server due to lack of proper verification of user-supplied input. | ||||
| CVE-2023-6023 | 1 Vertaai | 1 Modeldb | 2024-11-21 | 7.5 High |
| An attacker can read any file on the filesystem on the server hosting ModelDB through an LFI in the artifact_path URL parameter. | ||||
| CVE-2023-6022 | 1 Prefect | 1 Prefect | 2024-11-21 | 8.8 High |
| Cross-Site Request Forgery (CSRF) in GitHub repository prefecthq/prefect prior to 2.16.5. | ||||
| CVE-2023-6020 | 1 Ray Project | 1 Ray | 2024-11-21 | 7.5 High |
| LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication. | ||||
| CVE-2023-6018 | 1 Lfprojects | 1 Mlflow | 2024-11-21 | 9.8 Critical |
| An attacker can overwrite any file on the server hosting MLflow without any authentication. | ||||
| CVE-2023-6017 | 1 H2o | 1 H2o | 2024-11-21 | 7.1 High |
| H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL. | ||||
| CVE-2023-6016 | 1 H2o | 1 H2o | 2024-11-21 | 9.8 Critical |
| An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature. | ||||