Export limit exceeded: 358603 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 358603 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (358603 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-39938 | 1 I-pro | 1 Video Insight | 2024-11-21 | 6.1 Medium |
| Reflected cross-site scripting vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to inject an arbitrary script. | ||||
| CVE-2023-39936 | 1 Ashlar | 1 Graphite | 2024-11-21 | 7.8 High |
| In Ashlar-Vellum Graphite v13.0.48, the affected application lacks proper validation of user-supplied data when parsing VC6 files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process. | ||||
| CVE-2023-39935 | 1 Tp-link | 2 Archer C5400, Archer C5400 Firmware | 2024-11-21 | 8.0 High |
| Archer C5400 firmware versions prior to 'Archer C5400(JP)_V2_230506' allows a network-adjacent authenticated attacker to execute arbitrary OS commands. | ||||
| CVE-2023-39932 | 1 Intel | 1 System Usage Report For Gameplay | 2024-11-21 | 6.7 Medium |
| Uncontrolled search path in the Intel(R) SUR for Gameplay Software before version 2.0.1901 may allow a privillaged user to potentially enable escalation of privilege via local access. | ||||
| CVE-2023-39930 | 1 Pingidentity | 1 Pingid Radius Pcv | 2024-11-21 | 7.5 High |
| A first-factor authentication bypass vulnerability exists in the PingFederate with PingID Radius PCV when a MSCHAP authentication request is sent via a maliciously crafted RADIUS client request. | ||||
| CVE-2023-39925 | 1 Peepso | 1 Peepso | 2024-11-21 | 5.4 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Download Community by PeepSo plugin <= 6.1.6.0 versions. | ||||
| CVE-2023-39924 | 1 Simplefilelist | 1 Simple File List | 2024-11-21 | 5.9 Medium |
| Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mitchell Bennis Simple File List plugin <= 6.1.9 versions. | ||||
| CVE-2023-39923 | 1 Radiustheme | 1 The Post Grid | 2024-11-21 | 5.4 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme The Post Grid plugin <= 7.2.7 versions. | ||||
| CVE-2023-39919 | 1 Maennchen1 | 1 Wpshopgermany - Protected Shops | 2024-11-21 | 5.9 Medium |
| Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in maennchen1.De wpShopGermany – Protected Shops plugin <= 2.0 versions. | ||||
| CVE-2023-39918 | 1 Saasproject | 1 Booking Package | 2024-11-21 | 7.1 High |
| Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in SAASPROJECT Booking Package Booking Package plugin <= 1.6.01 versions. | ||||
| CVE-2023-39917 | 1 Ays-pro | 1 Photo Gallery | 2024-11-21 | 4.3 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery Team Photo Gallery by Ays – Responsive Image Gallery plugin <= 5.2.6 versions. | ||||
| CVE-2023-39915 | 1 Nlnetlabs | 1 Routinator | 2024-11-21 | 7.5 High |
| NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. This is due to insufficient input checking in the bcder library covered by CVE-2023-39914. | ||||
| CVE-2023-39914 | 1 Nlnetlabs | 1 Bcder | 2024-11-21 | 7.5 High |
| NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding. | ||||
| CVE-2023-39910 | 1 Libbitcoin | 1 Libbitcoin Explorer | 2024-11-21 | 7.5 High |
| The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use of an mt19937 Mersenne Twister PRNG restricts the internal entropy to 32 bits regardless of settings. This allows remote attackers to recover any wallet private keys generated from "bx seed" entropy output and steal funds. (Affected users need to move funds to a secure new cryptocurrency wallet.) NOTE: the vendor's position is that there was sufficient documentation advising against "bx seed" but others disagree. NOTE: this was exploited in the wild in June and July 2023. | ||||
| CVE-2023-39909 | 1 Ericsson | 1 Network Manager | 2024-11-21 | 8.8 High |
| Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated low-privilege users can access the NCM application. | ||||
| CVE-2023-39908 | 1 Yubico | 1 Yubihsm 2 Sdk | 2024-11-21 | 7.5 High |
| The PKCS11 module of the YubiHSM 2 SDK through 2023.01 does not properly validate the length of specific read operations on object metadata. This may lead to disclosure of uninitialized and previously used memory. | ||||
| CVE-2023-39903 | 1 Fujitsu | 1 Software Infrastructure Manager | 2024-11-21 | 5.9 Medium |
| An issue was discovered in Fujitsu Software Infrastructure Manager (ISM) before 2.8.0.061. The ismsnap component (in this specific case at /var/log/fujitsu/ServerViewSuite/ism/FirmwareManagement/FirmwareManagement.log) allows insecure collection and storage of authorization credentials in cleartext. That occurs when users perform any ISM Firmware Repository Address setup test (Test the Connection), or regularly authorize against an already configured remote firmware repository site, as set up in ISM Firmware Repository Address. A privileged attacker is therefore able to potentially gather the associated ismsnap maintenance data, in the same manner as a trusted party allowed to export ismsnap data from ISM. The preconditions for an ISM installation to be generally vulnerable are that the Download Firmware (Firmware Repository Server) function is enabled and configured, and that the character \ (backslash) is used in a user credential (i.e., user/ID or password) of the remote proxy host / firmware repository server. NOTE: this may overlap CVE-2023-39379. | ||||
| CVE-2023-39902 | 2 Nxp, U Boot Secondary Program Loader\/spl\/ | 6 I.mx 8m, I.mx 8m Mini, I.mx 8m Nano and 3 more | 2024-11-21 | 7 High |
| A software vulnerability has been identified in the U-Boot Secondary Program Loader (SPL) before 2023.07 on select NXP i.MX 8M family processors. Under certain conditions, a crafted Flattened Image Tree (FIT) format structure can be used to overwrite SPL memory, allowing unauthenticated software to execute on the target, leading to privilege escalation. This affects i.MX 8M, i.MX 8M Mini, i.MX 8M Nano, and i.MX 8M Plus. | ||||
| CVE-2023-39854 | 1 Atx | 1 Ucrypt | 2024-11-21 | 6.5 Medium |
| The web interface of ATX Ucrypt through 3.5 allows authenticated users (or attackers using default credentials for the admin, master, or user account) to include files via a URL in the /hydra/view/get_cc_url url parameter. There can be resultant SSRF. | ||||
| CVE-2023-39852 | 1 Doctor Appointment System Project | 1 Doctor Appointment System | 2024-11-21 | 9.8 Critical |
| Doctormms v1.0 was discovered to contain a SQL injection vulnerability via the $userid parameter at myAppoinment.php. NOTE: this is disputed by a third party who claims that the userid is a session variable controlled by the server, and thus cannot be used for exploitation. The original reporter counterclaims that this originates from $_SESSION["userid"]=$_POST["userid"] at line 68 in doctors\doctorlogin.php, where userid under POST is not a session variable controlled by the server. | ||||