Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (374385 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-27863 2 Ibm, Linux 2 Spectrum Protect, Linux Kernel 2025-01-23 4.4 Medium
IBM Spectrum Protect Plus Server 10.1.13, under specific configurations, could allow an elevated user to obtain SMB credentials that may be used to access vSnap data stores. IBM X-Force ID: 249325.
CVE-2024-1222 4 Apple, Linux, Microsoft and 1 more 5 Macos, Linux Kernel, Windows and 2 more 2025-01-23 8.6 High
This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut NG/MF API calls.
CVE-2023-32996 1 Jenkins 1 Saml Single Sign-on 2025-01-23 4.3 Medium
A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails.
CVE-2023-32995 1 Jenkins 1 Saml Single Sign On 2025-01-23 8.8 High
A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails.
CVE-2023-32993 1 Jenkins 1 Saml Single Sign On 2025-01-23 4.8 Medium
Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections.
CVE-2023-32992 1 Jenkins 1 Saml Single Sign On 2025-01-23 8.8 High
Missing permission checks in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML.
CVE-2023-32784 1 Keepass 1 Keepass 2025-01-23 7.5 High
In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system. The first character cannot be recovered. In 2.54, there is different API usage and/or random string insertion for mitigation.
CVE-2023-32758 2 Coala, Semgrep 2 Git-url-parse, Semgrep 2025-01-23 7.5 High
giturlparse (aka git-url-parse) through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package (for example, to check whether it accesses any Git repository at an http:// URL), and that package's author placed a ReDoS attack payload in a URL used by the package.
CVE-2023-31986 1 Edimax 2 Br-6428ns, Br-6428ns Firmware 2025-01-23 9.8 Critical
A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the setWAN function in /bin/webs without any limitations.
CVE-2023-31843 1 Faculty Evaluation System Project 1 Faculty Evaluation System 2025-01-23 7.2 High
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/view_faculty.php?id=.
CVE-2023-31842 1 Faculty Evaluation System Project 1 Faculty Evaluation System 2025-01-23 7.2 High
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/index.php?page=edit_faculty&id=.
CVE-2023-31631 1 Openlinksw 1 Virtuoso 2025-01-23 7.5 High
An issue in the sqlo_preds_contradiction component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31630 1 Openlinksw 1 Virtuoso 2025-01-23 7.5 High
An issue in the sqlo_query_spec component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31629 1 Openlinksw 1 Virtuoso 2025-01-23 7.5 High
An issue in the sqlo_union_scope component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31628 1 Openlinksw 1 Virtuoso 2025-01-23 7.5 High
An issue in the stricmp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31627 1 Openlinksw 1 Virtuoso 2025-01-23 7.5 High
An issue in the strhash component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31626 1 Openlinksw 1 Virtuoso 2025-01-23 7.5 High
An issue in the gpf_notice component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31616 1 Openlinksw 1 Virtuoso 2025-01-23 7.5 High
An issue in the bif_mod component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-30333 1 Perfree 1 Perfreeblog 2025-01-23 9.8 Critical
An arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitrary code via a crafted file.
CVE-2023-30124 1 Lavalite 1 Lavalite 2025-01-23 5.4 Medium
LavaLite v9.0.0 is vulnerable to Cross Site Scripting (XSS).