Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (361826 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-41158 1 Webmin 1 Usermin 2024-11-21 5.4 Medium
A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the description field while creating a new MIME type program.
CVE-2023-41157 1 Webmin 1 Usermin 2024-11-21 5.4 Medium
Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the folder name parameter while creating the folder to manage the folder tab, filter tab, and forward mail tab.
CVE-2023-41156 1 Webmin 1 Usermin 2024-11-21 5.4 Medium
A Stored Cross-Site Scripting (XSS) vulnerability in the filter and forward mail tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via the save to new folder named field while creating a new filter.
CVE-2023-41155 1 Webmin 2 Usermin, Webmin 2024-11-21 5.4 Medium
A Stored Cross-Site Scripting (XSS) vulnerability in the mail forwarding and replies tab in Webmin and Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the forward to field while creating a mail forwarding rule.
CVE-2023-41154 1 Webmin 1 Usermin 2024-11-21 5.4 Medium
A Stored Cross-Site Scripting (XSS) vulnerability in the scheduled cron jobs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the value field parameter while creating a new environment variable.
CVE-2023-41153 1 Webmin 1 Usermin 2024-11-21 5.4 Medium
A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via options for the host value while editing the host options.
CVE-2023-41152 1 Webmin 1 Usermin 2024-11-21 5.4 Medium
A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the handle program field while creating a new MIME type program.
CVE-2023-41150 1 F-revocrm 1 F-revocrm 2024-11-21 5.4 Medium
F-RevoCRM 7.3 series prior to version7.3.8 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product.
CVE-2023-41149 1 F-revocrm 1 F-revocrm 2024-11-21 9.8 Critical
F-RevoCRM version7.3.7 and version7.3.8 contains an OS command injection vulnerability. If this vulnerability is exploited, an attacker who can access the product may execute an arbitrary OS command on the server where the product is running.
CVE-2023-41146 1 Autodesk 1 Customer Portal 2024-11-21 4.3 Medium
Autodesk Customer Support Portal allows cases created by users under an account to see cases created by other users on the same account.
CVE-2023-41145 1 Autodesk 1 Customer Portal 2024-11-21 5.3 Medium
Autodesk users who no longer have an active license for an account can still access cases for that account.
CVE-2023-41140 1 Autodesk 10 Autocad, Autocad Advance Steel, Autocad Architecture and 7 more 2024-11-21 7.8 High
A maliciously crafted PRT file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause a Heap-Based Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVE-2023-41139 1 Autodesk 10 Autocad, Autocad Advance Steel, Autocad Architecture and 7 more 2024-11-21 7.8 High
A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.
CVE-2023-41138 1 Appsanywhere 1 Appsanywhere Client 2024-11-21 7.5 High
The AppsAnywhere macOS client-privileged helper can be tricked into executing arbitrary commands with elevated permissions by a local user process.
CVE-2023-41137 1 Appsanywhere 1 Appsanywhere Client 2024-11-21 8 High
Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonate the AppsAnywhere server.
CVE-2023-41121 1 Arraynetworks 3 Ag, Arrayos Ag, Vxag 2024-11-21 7.5 High
Array AG OS before 9.4.0.499 allows denial of service: remote attackers can cause system service processes to crash through abnormal HTTP operations.
CVE-2023-41120 1 Enterprisedb 1 Postgres Advanced Server 2024-11-21 6.5 Medium
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It permits an authenticated user to use DBMS_PROFILER to remove all accumulated profiling data on a system-wide basis, regardless of that user's permissions.
CVE-2023-41119 1 Enterprisedb 1 Postgres Advanced Server 2024-11-21 8.8 High
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It contains the function _dbms_aq_move_to_exception_queue that may be used to elevate a user's privileges to superuser. This function accepts the OID of a table, and then accesses that table as the superuser by using SELECT and DML commands.
CVE-2023-41116 1 Enterprisedb 1 Postgres Advanced Server 2024-11-21 4.3 Medium
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It allows an authenticated user to refresh any materialized view, regardless of that user's permissions.
CVE-2023-41115 1 Enterprisedb 1 Postgres Advanced Server 2024-11-21 6.5 Medium
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. When using UTL_ENCODE, an authenticated user can read any large object, regardless of that user's permissions.