Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (347798 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-22429 1 Redox-os 1 Redox 2025-01-30 7.8 High
redox-os v0.1.0 was discovered to contain a use-after-free bug via the gethostbyaddr() function at /src/header/netdb/mod.rs.
CVE-2017-11197 1 Cyberark 1 Viewfinity 2025-01-30 7.8 High
In CyberArk Viewfinity 5.5.10.95 and 6.x before 6.1.1.220, a low privilege user can escalate to an administrative user via a bug within the "add printer" option.
CVE-2023-30466 1 Milesight 40 Ms-n1004-uc, Ms-n1004-uc Firmware, Ms-n1004-upc and 37 more 2025-01-30 9.8 Critical
This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to a weak password reset mechanism at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http requests on the targeted device. Successful exploitation of this vulnerability could allow remote attacker to account takeover on the targeted device.
CVE-2023-31434 1 Evasys 1 Evasys 2025-01-30 5.4 Medium
The parameters nutzer_titel, nutzer_vn, and nutzer_nn in the user profile, and langID and ONLINEID in direct links, in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 do not validate input, which allows authenticated attackers to inject HTML Code and XSS payloads in multiple locations.
CVE-2023-31433 1 Evasys 1 Evasys 2025-01-30 8.8 High
A SQL injection issue in Logbuch in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 allows authenticated attackers to execute SQL statements via the welche parameter.
CVE-2023-30792 1 Facebook 1 Lexical 2025-01-30 6.1 Medium
Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being parsed from untrusted sources.
CVE-2023-30403 1 Aigital 2 Wireless-n Repeater Mini Router, Wireless-n Repeater Mini Router Firmware 2025-01-30 7.5 High
An issue in the time-based authentication mechanism of Aigital Aigital Wireless-N Repeater Mini_Router v0.131229 allows attackers to bypass login by connecting to the web app after a successful attempt by a legitimate user.
CVE-2023-2445 1 Devolutions 1 Devolutions Server 2025-01-30 4.9 Medium
Improper access control in Subscriptions Folder path filter in Devolutions Server 2023.1.1 and earlier allows attackers with administrator privileges to retrieve usage information on folders in user vaults via a specific folder name.
CVE-2023-2429 1 Phpmyfaq 1 Phpmyfaq 2025-01-30 9.8 Critical
Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
CVE-2023-2428 1 Phpmyfaq 1 Phpmyfaq 2025-01-30 5.4 Medium
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
CVE-2023-29918 1 Rosariosis 1 Rosariosis 2025-01-30 5.4 Medium
RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.
CVE-2023-29868 1 Zammad 1 Zammad 2025-01-30 6.5 Medium
Zammad 5.3.x (Fixed in 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker with agent and customer roles could perform unauthorized changes on articles where they only have customer permissions.
CVE-2023-29867 1 Zammad 1 Zammad 2025-01-30 6.5 Medium
Zammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker could gain information about linked accounts of users involved in their tickets using the Zammad API.
CVE-2023-29778 1 Gl-inet 2 Gl-mt3000, Gl-mt3000 Firmware 2025-01-30 9.8 Critical
GL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread.
CVE-2023-29772 1 Asus 2 Rt-ac51u, Rt-ac51u Firmware 2025-01-30 5.2 Medium
A Cross-site scripting (XSS) vulnerability in the System Log/General Log page of the administrator web UI in ASUS RT-AC51U wireless router firmware version up to and including 3.0.0.4.380.8591 allows remote attackers to inject arbitrary web script or HTML via a malicious network request.
CVE-2023-29638 1 Winterchen 1 My-site 2025-01-30 5.4 Medium
Cross Site Scripting (XSS) vulnerability in WinterChenS my-site before commit 3f0423da6d5200c7a46e200da145c1f54ee18548, allows attackers to inject arbitrary web script or HTML via editing blog articles.
CVE-2023-29637 1 Qbian61 Forum-java Project 1 Qbian61 Forum-java 2025-01-30 6.1 Medium
Cross Site Scripting (XSS) vulnerability in Qbian61 forum-java, allows attackers to inject arbitrary web script or HTML via editing the article content in the "article editor" page.
CVE-2023-29635 1 Antabot White-jotter Project 1 Antabot White-jotter 2025-01-30 9.8 Critical
File upload vulnerability in Antabot White-Jotter v0.2.2, allows remote attackers to execute malicious code via the file parameter to function coversUpload.
CVE-2023-27892 1 Shapeshift 2 Keepkey, Keepkey Firmware 2025-01-30 3.8 Low
Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.7.0 allow a global buffer overflow via crafted messages. Flaws in cf_confirmExecTx() in ethereum_contracts.c can be used to reveal arbitrary microcontroller memory on the device screen or crash the device. With physical access to a PIN-unlocked device, attackers can extract the BIP39 mnemonic secret from the hardware wallet.
CVE-2023-27108 1 Kaiostech 1 Kaios 2025-01-30 5.3 Medium
An issue was discovered in KaiOS 3.0. The pre-installed Communications application exposes a Web Activity that returns the user's call log without origin or permission checks. An attacker can inject a JavaScript payload that runs in a browser or app without user interaction or consent. This allows an attacker to send the user's call logs to a remote server via XMLHttpRequest or Fetch.