Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (30492 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-32478 1 Dell 1 Powerstoreos 2024-11-21 9 Critical
Dell PowerStore versions prior to 3.5.0.1 contain an insertion of sensitive information into log file vulnerability. A high privileged malicious user could potentially exploit this vulnerability, leading to sensitive information disclosure.
CVE-2023-32232 1 Vasion 1 Printerlogic Client 2024-11-21 9.9 Critical
An issue was discovered in Vasion PrinterLogic Client for Windows before 25.0.0.836. During client installation and repair, a PrinterLogic binary is called by the installer to configure the device. This window is not hidden, and is running with elevated privileges. A standard user can break out of this window, obtaining a full SYSTEM command prompt window. This results in complete compromise via arbitrary SYSTEM code execution (elevation of privileges).
CVE-2023-32231 1 Vasion 1 Printerlogic Client 2024-11-21 9.9 Critical
An issue was discovered in Vasion PrinterLogic Client for Windows before 25.0.0.818. During installation, binaries gets executed out of a subfolder in C:\Windows\Temp. A standard user can create the folder and path file ahead of time and obtain elevated code execution.
CVE-2023-32227 1 Synel 2 Synergy\/a, Synergy\/a Firmware 2024-11-21 9.8 Critical
Synel SYnergy Fingerprint Terminals - CWE-798: Use of Hard-coded Credentials
CVE-2023-32225 1 Sysaid 1 Sysaid On-premises 2024-11-21 9.8 Critical
Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type -  A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method.
CVE-2023-32090 2 Pega, Pegasystems 2 Pega Platform, Pega Platform 2024-11-21 9.8 Critical
Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default credentials
CVE-2023-31753 1 Endonesia 1 Endonesia 2024-11-21 9.8 Critical
SQL injection vulnerability in diskusi.php in eNdonesia 8.7, allows an attacker to execute arbitrary SQL commands via the "rid=" parameter.
CVE-2023-31719 1 Frangoteam 1 Fuxa 2024-11-21 9.8 Critical
FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.
CVE-2023-31714 1 Waqaskanju 1 Chitor-cms 2024-11-21 9.8 Critical
Chitor-CMS before v1.1.2 was discovered to contain multiple SQL injection vulnerabilities.
CVE-2023-31710 1 Tp-link 2 Archer Ax21, Archer Ax21 Firmware 2024-11-21 9.8 Critical
TP-Link Archer AX21(US)_V3_1.1.4 Build 20230219 and AX21(US)_V3.6_1.1.4 Build 20230219 are vulnerable to Buffer Overflow.
CVE-2023-31704 1 Oretnom23 1 Online Computer And Laptop Store 2024-11-21 9.8 Critical
Sourcecodester Online Computer and Laptop Store 1.0 is vulnerable to Incorrect Access Control, which allows remote attackers to elevate privileges to the administrator's role.
CVE-2023-31581 1 Dromara 1 Sureness 2024-11-21 9.8 Critical
Dromara Sureness before v1.0.8 was discovered to use a hardcoded key.
CVE-2023-31579 1 Tangyh 1 Lamp-cloud 2024-11-21 9.8 Critical
Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows attackers to authenticate to the application via a crafted JWT token.
CVE-2023-31546 1 Dedebiz 1 Dedebiz 2024-11-21 9.6 Critical
Cross Site Scripting (XSS) vulnerability in DedeBIZ v6.0.3 allows attackers to run arbitrary code via the search feature.
CVE-2023-31488 1 Cisco 3 Ironport Email Security Appliance, Secure Email Gateway, Secure Email Gateway Firmware 2024-11-21 9.8 Critical
Hyland Perceptive Filters releases before 2023-12-08 (e.g., 11.4.0.2647), as used in Cisco IronPort Email Security Appliance Software, Cisco Secure Email Gateway, and various non-Cisco products, allow attackers to trigger a segmentation fault and execute arbitrary code via a crafted document.
CVE-2023-31465 1 Fsmlabs 1 Timekeeper 2024-11-21 9.8 Critical
An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28. By intercepting requests from various timekeeper streams, it is possible to find the getsamplebacklog call. Some query parameters are passed directly in the URL and named arg[x], with x an integer starting from 1; it is possible to modify arg[2] to insert Bash code that will be executed directly by the server.
CVE-2023-31447 1 Draytek 4 Vigor2620, Vigor2620 Firmware, Vigor2625 and 1 more 2024-11-21 9.8 Critical
user_login.cgi on Draytek Vigor2620 devices before 3.9.8.4 (and on all versions of Vigor2925 devices) allows attackers to send a crafted payload to modify the content of the code segment, insert shellcode, and execute arbitrary code.
CVE-2023-31422 1 Elastic 1 Kibana 2024-11-21 9 Critical
An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The issue impacts only Kibana version 8.10.0 when logging in the JSON layout or when the pattern layout is configured to log the %meta pattern. Elastic has released Kibana 8.10.1 which resolves this issue. The error object recorded in the log contains request information, which can include sensitive data, such as authentication credentials, cookies, authorization headers, query params, request paths, and other metadata. Some examples of sensitive data which can be included in the logs are account credentials for kibana_system, kibana-metricbeat, or Kibana end-users.
CVE-2023-31273 1 Intel 1 Data Center Manager 2024-11-21 10 Critical
Protection mechanism failure in some Intel DCM software before version 5.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
CVE-2023-31224 1 Jamf 1 Jamf 2024-11-21 9.8 Critical
There is broken access control during authentication in Jamf Pro Server before 10.46.1.