Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (120061 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-47370 1 Linecorp 1 Line 2024-11-21 6.5 Medium
The leakage of channel access token in bluetrick Line 13.6.1 allows remote attackers to send malicious notifications to victims.
CVE-2023-47369 1 Linecorp 1 Line 2024-11-21 6.5 Medium
The leakage of channel access token in best_training_member Line 13.6.1 allows remote attackers to send malicious notifications.
CVE-2023-47368 1 Linecorp 1 Line 2024-11-21 6.5 Medium
The leakage of channel access token in taketorinoyu Line 13.6.1 allows remote attackers to send malicious notifications to victims.
CVE-2023-47367 1 Linecorp 1 Line 2024-11-21 6.5 Medium
The leakage of channel access token in platinum clinic Line 13.6.1 allows remote attackers to send malicious notifications to victims.
CVE-2023-47366 1 Linecorp 1 Line 2024-11-21 6.5 Medium
The leakage of channel access token in craft_members Line 13.6.1 allows remote attackers to send malicious notifications to victims.
CVE-2023-47365 1 Linecorp 1 Line 2024-11-21 6.5 Medium
The leakage of channel access token in Lil.OFF-PRICE STORE Line 13.6.1 allows remote attackers to send malicious notifications to victims.
CVE-2023-47363 1 Linecorp 1 Line 2024-11-21 6.5 Medium
The leakage of channel access token in F.B.P members Line 13.6.1 allows remote attackers to send malicious notifications to victims.
CVE-2023-47283 1 Cubecart 1 Cubecart 2024-11-21 4.9 Medium
Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to obtain files in the system.
CVE-2023-47261 1 Dokmee 1 Enterprise Content Management 2024-11-21 9.8 Critical
Dokmee ECM 7.4.6 allows remote code execution because the response to a GettingStarted/SaveSQLConnectionAsync /#/gettingstarted request contains a connection string for privileged SQL Server database access, and xp_cmdshell can be enabled.
CVE-2023-47254 1 Draytek 2 Vigor167, Vigor167 Firmware 2024-11-21 9.8 Critical
An OS Command Injection in the CLI interface on DrayTek Vigor167 version 5.2.2, allows remote attackers to execute arbitrary system commands and escalate privileges via any account created within the web interface.
CVE-2023-47213 1 C-first 56 Cfr-1004ea, Cfr-1004ea Firmware, Cfr-1008ea and 53 more 2024-11-21 9.8 Critical
First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.
CVE-2023-47175 1 Luxsoft 1 Luxcal Web Calendar 2024-11-21 6.1 Medium
Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is accessing the product.
CVE-2023-47174 1 Thorntech 2 Sftp Gateway, Sftp Gateway Firmware 2024-11-21 9.8 Critical
Thorn SFTP gateway 3.4.x before 3.4.4 uses Pivotal Spring Framework for Java deserialization of untrusted data, which is not supported by Pivotal, a related issue to CVE-2016-1000027. Also, within the specific context of Thorn SFTP gateway, this leads to remote code execution.
CVE-2023-47164 1 Digitaldruid 1 Hoteldruid 2024-11-21 6.1 Medium
Cross-site scripting vulnerability in HOTELDRUID 3.0.5 and earlier allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product.
CVE-2023-47148 2 Ibm, Linux 2 Spectrum Protect Plus, Linux Kernel 2024-11-21 5.3 Medium
IBM Storage Protect Plus Server 10.1.0 through 10.1.15.2 Admin Console could allow a remote attacker to obtain sensitive information due to improper validation of unsecured endpoints which could be used in further attacks against the system. IBM X-Force ID: 270599.
CVE-2023-47130 1 Yiiframework 1 Yii 2024-11-21 8.1 High
Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been developed for the 1.1.29 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-47099 1 Virtualmin 1 Virtualmin 2024-11-21 5.4 Medium
A Stored Cross-Site Scripting (XSS) vulnerability in the Create Virtual Server in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via Description field while creating the Virtual server.
CVE-2023-47098 1 Virtualmin 1 Virtualmin 2024-11-21 4.8 Medium
A Stored Cross-Site Scripting (XSS) vulnerability in the Manage Extra Admins under Administration Options in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the real name or description field.
CVE-2023-47097 1 Virtualmin 1 Virtualmin 2024-11-21 5.4 Medium
A Stored Cross-Site Scripting (XSS) vulnerability in the Server Template under System Setting in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Template name field while creating server templates.
CVE-2023-47096 1 Virtualmin 1 Virtualmin 2024-11-21 5.4 Medium
A Reflected Cross-Site Scripting (XSS) vulnerability in the Cloudmin Services Client under System Setting in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Cloudmin services master field.