Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (118640 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2011-1408 2 Debian, Ikiwiki 2 Debian Linux, Ikiwiki 2024-11-21 8.2 High
ikiwiki before 3.20110608 allows remote attackers to hijack root's tty and run symlink attacks.
CVE-2011-1135 1 S9y 1 Serendipity 2024-11-21 6.1 Medium
Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in plugins/ExtendedFileManager/manager.php and plugins/ImageManager/manager.php.
CVE-2011-1134 1 S9y 1 Serendipity 2024-11-21 9.8 Critical
Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in the image manager.
CVE-2011-1133 1 S9y 1 Serendipity 2024-11-21 6.1 Medium
Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code via plugins/ExtendedFileManager/backend.php.
CVE-2011-1086 1 Openfiler 1 Openfiler 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in admin/system.html in Openfiler 2.3 allows remote attackers to inject arbitrary web script or HTML via the device parameter.
CVE-2011-10004 1 Reciply Project 1 Reciply 2024-11-21 6.3 Medium
A vulnerability was found in reciply Plugin up to 1.1.7 on WordPress. It has been rated as critical. This issue affects some unknown processing of the file uploadImage.php. The manipulation leads to unrestricted upload. The attack may be initiated remotely. Upgrading to version 1.1.8 is able to address this issue. The identifier of the patch is e3ff616dc08d3aadff9253f1085e13f677d0c676. It is recommended to upgrade the affected component. The identifier VDB-242189 was assigned to this vulnerability.
CVE-2011-0704 1 Fedoraproject 1 389 Directory Server 2024-11-21 N/A
389 Directory Server 1.2.7.5, when built with mozldap, allows remote attackers to cause a denial of service (replica crash) by sending an empty modify request.
CVE-2011-0428 1 Ikiwiki 1 Ikiwiki 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) in ikiwiki before 3.20110122 could allow remote attackers to insert arbitrary JavaScript due to insufficient checking in comments.
CVE-2010-5304 2 Fedoraproject, Libvncserver Project 2 Fedora, Libvncserver 2024-11-21 7.5 High
A NULL pointer dereference flaw was found in the way LibVNCServer before 0.9.9 handled certain ClientCutText message. A remote attacker could use this flaw to crash the VNC server by sending a specially crafted ClientCutText message from a VNC client.
CVE-2010-4816 1 Openbsd 1 Openbsd 2024-11-21 7.5 High
It was found in FreeBSD 8.0, 6.3 and 4.9, and OpenBSD 4.6 that a null pointer dereference in ftpd/popen.c may lead to remote denial of service of the ftpd service.
CVE-2010-4664 3 Consolekit Project, Debian, Redhat 3 Consolekit, Debian Linux, Enterprise Linux 2024-11-21 8.8 High
In ConsoleKit before 0.4.2, an intended security policy restriction bypass was found. This flaw allows an authenticated system user to escalate their privileges by initiating a remote VNC session.
CVE-2010-4237 1 Mercurial 1 Mercurial 2024-11-21 5.9 Medium
Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate signed by a Certificate Authority to perform a man-in-the-middle attack.
CVE-2010-3917 1 Google 1 Chrome 2024-11-21 6.5 Medium
Google Chrome before 3.0 does not properly handle XML documents, which allows remote attackers to obtain sensitive information via a crafted web site.
CVE-2010-3671 1 Typo3 1 Typo3 2024-11-21 6.5 Medium
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 is open to a session fixation attack which allows remote attackers to hijack a victim's session.
CVE-2010-3663 1 Typo3 1 Typo3 2024-11-21 8.8 High
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which could allow remote attackers to execute arbitrary code on the backend.
CVE-2010-3305 1 Pixelpost 1 Pixelpost 2024-11-21 8.8 High
Cross-site request forgery (CSRF) vulnerability in pixelpost 1.7.3 could allow remote attackers to change the admin password.
CVE-2010-3048 1 Cisco 1 Unified Personal Communicator 2024-11-21 7.5 High
Cisco Unified Personal Communicator 7.0 (1.13056) does not free allocated memory for received data and does not perform validation if memory allocation is successful, causing a remote denial of service condition.
CVE-2010-1673 1 Ikiwiki 1 Ikiwiki 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability in ikiwiki before 3.20101112 allows remote attackers to inject arbitrary web script or HTML via a comment.
CVE-2010-10010 1 Psychostats 1 Psychostats 2024-11-21 3.5 Low
A vulnerability classified as problematic has been found in Stars Alliance PsychoStats up to 3.2.2a. This affects an unknown part of the file upload/admin/login.php. The manipulation of the argument ref leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 3.2.2b is able to address this issue. The identifier of the patch is 5d3b7311fd5085ec6ea1b1bfa9a05285964e07e4. It is recommended to upgrade the affected component. The identifier VDB-230265 was assigned to this vulnerability.
CVE-2010-10004 1 Simplesamlphp 1 Information Cards Module 2024-11-21 3.5 Low
A vulnerability was found in Information Cards Module on simpleSAMLphp and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.0 is able to address this issue. The identifier of the patch is f6bfea49ae16dc6e179df8306d39c3694f1ef186. It is recommended to upgrade the affected component. The identifier VDB-217661 was assigned to this vulnerability.