Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (361493 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-38378 1 Rigol 2 Mso5000, Mso5000 Firmware 2024-11-21 9.8 Critical
The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to execute arbitrary code via shell metacharacters in pass1 to the webcontrol changepwd.cgi application.
CVE-2023-38364 2 Ibm, Linux 2 Cics Tx, Linux Kernel 2024-11-21 6.1 Medium
IBM CICS TX Advanced 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 260821.
CVE-2023-38363 2 Ibm, Linux 2 Cics Tx, Linux Kernel 2024-11-21 4.3 Medium
IBM CICS TX Advanced 10.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 260818.
CVE-2023-38361 2 Ibm, Linux 2 Cics Tx, Linux Kernel 2024-11-21 5.9 Medium
IBM CICS TX Advanced 10.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 260770.
CVE-2023-38357 1 Rws 1 Worldserver 2024-11-21 5.3 Medium
Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized access to user sessions.
CVE-2023-38356 1 Minitool 1 Power Data Recovery 2024-11-21 8.1 High
MiniTool Power Data Recovery 11.6 contains an insecure installation process that allows attackers to achieve remote code execution through a man in the middle attack.
CVE-2023-38355 1 Minitool 1 Movie Maker 2024-11-21 8.1 High
MiniTool Movie Maker 7.0 contains an insecure installation process that allows attackers to achieve remote code execution through a man in the middle attack.
CVE-2023-38354 1 Minitool 1 Shadowmaker 2024-11-21 8.1 High
MiniTool Shadow Maker version 4.1 contains an insecure installation process that allows attackers to achieve remote code execution through a man in the middle attack.
CVE-2023-38353 1 Minitool 1 Power Data Recovery 2024-11-21 5.9 Medium
MiniTool Power Data Recovery version 11.6 and before contains an insecure in-app payment system that allows attackers to steal highly sensitive information through a man in the middle attack.
CVE-2023-38352 1 Minitool 1 Partition Wizard 2024-11-21 8.1 High
MiniTool Partition Wizard 12.8 contains an insecure update mechanism that allows attackers to achieve remote code execution through a man in the middle attack.
CVE-2023-38351 1 Minitool 1 Partition Wizard 2024-11-21 8.1 High
MiniTool Partition Wizard 12.8 contains an insecure installation mechanism that allows attackers to achieve remote code execution through a man in the middle attack.
CVE-2023-38350 1 Pnp4nagios 1 Pnp4nagios 2024-11-21 5.4 Medium
PNP4Nagios through 81ebfc5 has stored XSS in the AJAX controller via the basket API and filters. This affects 0.6.26.
CVE-2023-38349 1 Pnp4nagios 1 Pnp4nagios 2024-11-21 8.8 High
PNP4Nagios through 81ebfc5 lacks CSRF protection in the AJAX controller. This affects 0.6.26.
CVE-2023-38348 1 Lw-systems 1 Benno Mailarchiv 2024-11-21 8.8 High
A CSRF issue was discovered in LWsystems Benno MailArchiv 2.10.1.
CVE-2023-38347 1 Lw-systems 1 Benno Mailarchiv 2024-11-21 6.1 Medium
An issue was discovered in LWsystems Benno MailArchiv 2.10.1. Attackers can cause XSS via JavaScript content to a mailbox.
CVE-2023-38346 1 Windriver 1 Vxworks 2024-11-21 8.8 High
An issue was discovered in Wind River VxWorks 6.9 and 7. The function ``tarExtract`` implements TAR file extraction and thereby also processes files within an archive that have relative or absolute file paths. A developer using the "tarExtract" function may expect that the function will strip leading slashes from absolute paths or stop processing when encountering relative paths that are outside of the extraction path, unless otherwise forced. This could lead to unexpected and undocumented behavior, which in general could result in a directory traversal, and associated unexpected behavior.
CVE-2023-38344 1 Ivanti 1 Endpoint Manager 2024-11-21 6.5 Medium
An issue was discovered in Ivanti Endpoint Manager before 2022 SU4. A file disclosure vulnerability exists in the GetFileContents SOAP action exposed via /landesk/managementsuite/core/core.secure/OsdScript.asmx. The application does not sufficiently restrict user-supplied paths, allowing for an authenticated attacker to read arbitrary files from a remote system, including the private key used to authenticate to agents for remote access.
CVE-2023-38343 1 Ivanti 1 Endpoint Manager 2024-11-21 7.5 High
An XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4. External entity references are enabled in the XML parser configuration. Exploitation of this vulnerability can lead to file disclosure or Server Side Request Forgery.
CVE-2023-38337 1 Rswag Project 1 Rswag 2024-11-21 7.5 High
rswag before 2.10.1 allows remote attackers to read arbitrary JSON and YAML files via directory traversal, because rswag-api can expose a file that is not the OpenAPI (or Swagger) specification file of a project.
CVE-2023-38336 1 Netkit 1 Netkit 2024-11-21 9.8 Critical
netkit-rcp in rsh-client 0.17-24 allows command injection via filenames because /bin/sh is used by susystem, a related issue to CVE-2006-0225, CVE-2019-7283, and CVE-2020-15778.