Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (118660 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2013-0570 1 Ibm 12 Flex System Fabric Cn4093, Flex System Fabric En4093, Flex System Si4093 and 9 more 2024-11-21 N/A
The Fibre Channel over Ethernet (FCoE) feature in IBM System Networking and Blade Network Technology (BNT) switches running IBM Networking Operating System (aka NOS, formerly BLADE Operating System) floods data frames with unknown MAC addresses out on all interfaces on the same VLAN, which might allow remote attackers to obtain sensitive information in opportunistic circumstances by eavesdropping on the broadcast domain. IBM X-Force ID: 83166.
CVE-2013-0342 1 Pyrad Project 1 Pyrad 2024-11-21 4.3 Medium
The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packets by predicting the next ID, a different vulnerability than CVE-2013-0294.
CVE-2013-0294 2 Fedoraproject, Pyrad Project 2 Fedora, Pyrad 2024-11-21 5.9 Medium
packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack.
CVE-2013-0267 1 Apache 1 Vcl 2024-11-21 N/A
The Privileges portion of the web GUI and the XMLRPC API in Apache VCL 2.3.x before 2.3.2, 2.2.x before 2.2.2 and 2.1 allow remote authenticated users with nodeAdmin, manageGroup, resourceGrant, or userGrant permissions to gain privileges, cause a denial of service, or conduct cross-site scripting (XSS) attacks by leveraging improper data validation.
CVE-2013-0195 1 Matomo 1 Matomo 2024-11-21 6.1 Medium
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0194.
CVE-2013-0194 1 Matomo 1 Matomo 2024-11-21 6.1 Medium
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0195.
CVE-2013-0193 1 Matomo 1 Matomo 2024-11-21 6.1 Medium
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0194 and CVE-2013-0195.
CVE-2013-0186 1 Redhat 3 Cloudforms, Cloudforms Managementengine, Manageiq Enterprise Virtualization Manager 2024-11-21 6.1 Medium
Multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2013-0185 1 Redhat 2 Cloudforms Managementengine, Manageiq Enterprise Virtualization Manager 2024-11-21 N/A
Cross-site request forgery (CSRF) vulnerability in ManageIQ Enterprise Virtualization Manager (EVM) allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors.
CVE-2012-6720 1 Socialengine 1 Socialengine 2024-11-21 6.1 Medium
Multiple cross-site scripting (XSS) vulnerabilities in SocialEngine before 4.2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to music/create, (2) location parameter to events/create, or (3) search parameter to widget/index/content_id/*.
CVE-2012-6710 1 Extplorer 1 Extplorer 2024-11-21 N/A
ext_find_user in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password[]= (aka an empty array) in an action=login request to index.php.
CVE-2012-6682 1 Dragonbyte-tech 1 Vbdownloads Module 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in downloads/actions/editdownload.php in the DragonByte Technologies vBDownloads module 1.3.2 and earlier for vBulletin allows remote attackers to inject arbitrary web script or HTML via the mirrors[] parameter.
CVE-2012-6671 1 Dragonbyte-tech 1 Forumon Rpg Module 2024-11-21 N/A
Multiple cross-site scripting (XSS) vulnerabilities in actions/main.php in the DragonByte Technologies Forumon RPG module before 1.0.8 for vBulletin when creating a new monster, allow remote attackers to inject arbitrary web script or HTML via the (1) monster[title] or (2) monster[description] parameters.
CVE-2012-6670 1 Dragonbyte-tech 1 Vbactivity Module 2024-11-21 N/A
Multiple cross-site scripting (XSS) vulnerabilities in the DragonByte Technologies vbActivity module before 3.0.1 for vBulletin allow remote attackers to inject arbitrary web script or HTML via the reason parameter in (1) actions/nominatemedal.php or (2) actions/requestmedal.php.
CVE-2012-6668 1 Dragonbyte-tech 1 Vbshout Module 2024-11-21 N/A
Multiple cross-site scripting (XSS) vulnerabilities in the Shout Reports in the DragonByte Technologies vBShout module before 6.0.6 for vBulletin allow remote attackers to inject arbitrary web script or HTML via the (1) reportreason parameter in actions/doreport.php or (2) modnotes parameter in actions/updatereport.php.
CVE-2012-6667 1 Dragonbyte-tech 1 Vbshout 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in vbshout.php in DragonByte Technologies vBShout module for vBulletin allows remote attackers to inject arbitrary web script or HTML via the shout parameter in a shout action.
CVE-2012-6652 1 Page Flip Book Project 1 Page Flip Book 2024-11-21 N/A
Directory traversal vulnerability in pageflipbook.php script from index.php in Page Flip Book plugin for WordPress (wppageflip) allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pageflipbook_language parameter.
CVE-2012-6649 1 Devfarm 1 Wp Gpx Maps 2024-11-21 9.8 Critical
WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload.
CVE-2012-6614 1 Dlink 2 Dsr-250n, Dsr-250n Firmware 2024-11-21 7.2 High
D-Link DSR-250N devices before 1.08B31 allow remote authenticated users to obtain "persistent root access" via the BusyBox CLI, as demonstrated by overwriting the super user password.
CVE-2012-6610 1 Polycom 3 Hdx 8000, Hdx Video End Points, Uc Apl 2024-11-21 8.8 High
Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote authenticated users to execute arbitrary commands as demonstrated by a ; (semicolon) to the ping command feature.