Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (387103 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-33003 1 Jenkins 1 Tag Profiler 2025-01-23 4.3 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers to reset profiler statistics.
CVE-2023-33002 1 Jenkins 1 Testcomplete Support 2025-01-23 5.4 Medium
Jenkins TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2023-33001 1 Jenkins 1 Hashicorp Vault 2025-01-23 7.5 High
Jenkins HashiCorp Vault Plugin 360.v0a_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
CVE-2023-33000 1 Jenkins 1 Ns-nd Integration Performance Publisher 2025-01-23 7.5 High
Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier does not mask credentials displayed on the configuration form, increasing the potential for attackers to observe and capture them.
CVE-2023-32999 1 Jenkins 1 Appspider 2025-01-23 4.3 Medium
A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.
CVE-2023-32998 1 Jenkins 1 Appspider 2025-01-23 8.8 High
A cross-site request forgery (CSRF) vulnerability in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.
CVE-2023-32997 1 Jenkins 1 Cas 2025-01-23 8.8 High
Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login.
CVE-2023-32994 1 Jenkins 1 Saml Single Sign On 2025-01-23 3.7 Low
Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections.
CVE-2023-32987 1 Jenkins 1 Reverse Proxy Auth 2025-01-23 8.8 High
A cross-site request forgery (CSRF) vulnerability in Jenkins Reverse Proxy Auth Plugin 1.7.4 and earlier allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials.
CVE-2023-32980 2 Jenkins, Redhat 2 Email Extension, Openshift 2025-01-23 4.3 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make another user stop watching an attacker-specified job.
CVE-2023-32979 2 Jenkins, Redhat 2 Email Extension, Openshift 2025-01-23 4.3 Medium
Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files in the email-templates/ directory in the Jenkins home directory on the controller file system.
CVE-2023-32978 1 Jenkins 1 Lightweight Directory Access Protocol 2025-01-23 4.3 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins LDAP Plugin allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials.
CVE-2023-32977 2 Jenkins, Redhat 3 Pipeline\, Ocp Tools, Openshift 2025-01-23 5.4 Medium
Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to set build display names immediately.
CVE-2023-31857 1 Oretnom23 1 Online Computer And Laptop Store 2025-01-23 9.8 Critical
Sourcecodester Online Computer and Laptop Store 1.0 allows unrestricted file upload and can lead to remote code execution. The vulnerability path is /classes/Users.php?f=save.
CVE-2023-31856 1 Totolink 2 Cp300\+, Cp300\+ Firmware 2025-01-23 9.8 Critical
A command injection vulnerability in the hostTime parameter in the function NTPSyncWithHostof TOTOLINK CP300+ V5.2cu.7594_B20200910 allows attackers to execute arbitrary commands via a crafted http packet.
CVE-2023-31848 1 Davinci Project 1 Davinci 2025-01-23 8.8 High
davinci 0.3.0-rc is vulnerable to Server-side request forgery (SSRF).
CVE-2023-30452 1 Morosystems 1 Easymind 2025-01-23 5.4 Medium
The MoroSystems EasyMind - Mind Maps plugin before 2.15.0 for Confluence allows persistent XSS when saving a Mind Map with the hyperlink parameter.
CVE-2023-30281 1 Storecommander 1 Scquickaccounting 2025-01-23 7.5 High
Insecure permissions vulnerability was discovered, due to a lack of permissions’s control in scquickaccounting before v3.7.3 from Store Commander for PrestaShop, a guest can access exports from the module which can lead to leak of personnal informations from ps_customer table sush as name / surname / email
CVE-2024-31492 1 Fortinet 1 Forticlient 2025-01-23 7.8 High
An external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting the installation process.
CVE-2024-31985 1 Xwiki 1 Xwiki 2025-01-23 5.4 Medium
XWiki Platform is a generic wiki platform. Starting in version 3.1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, it is possible to schedule/trigger/unschedule existing jobs by having an admin visit the Job Scheduler page through a predictable URL, for example by embedding such an URL in any content as an image. The vulnerability has been fixed in XWiki 14.10.19, 15.5.5, and 15.9. As a workaround, manually apply the patch by modifying the `Scheduler.WebHome` page.