Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (360133 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-6249 1 Zephyrproject 1 Zephyr 2025-01-23 8 High
Signed to unsigned conversion esp32_ipm_send
CVE-2024-25978 2 Fedoraproject, Moodle 2 Fedora, Moodle 2025-01-23 7.5 High
Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality.
CVE-2024-25979 2 Fedoraproject, Moodle 2 Fedora, Moodle 2025-01-23 5.3 Medium
The URL parameters accepted by forum search were not limited to the allowed parameters.
CVE-2024-25980 2 Fedoraproject, Moodle 3 Fedora, H5p, Moodle 2025-01-23 4.3 Medium
Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.
CVE-2024-25981 2 Fedoraproject, Moodle 2 Fedora, Moodle 2025-01-23 4.3 Medium
Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only provided additional access to non-editing teachers.
CVE-2023-37869 1 Leap13 1 Premium Addons 2025-01-23 6.5 Medium
Missing Authorization vulnerability in Premium Addons Premium Addons PRO.This issue affects Premium Addons PRO: from n/a through 2.9.0.
CVE-2023-33007 1 Jenkins 1 Loadcomplete Support 2025-01-23 5.4 Medium
Jenkins LoadComplete support Plugin 1.0 and earlier does not escape the LoadComplete test name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2023-33006 1 Jenkins 1 Wso2 Oauth 2025-01-23 5.4 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins WSO2 Oauth Plugin 1.0 and earlier allows attackers to trick users into logging in to the attacker's account.
CVE-2023-33005 1 Jenkins 1 Wso2 Oauth 2025-01-23 5.4 Medium
Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login.
CVE-2023-33004 1 Jenkins 1 Tag Profiler 2025-01-23 4.3 Medium
A missing permission check in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers with Overall/Read permission to reset profiler statistics.
CVE-2023-33003 1 Jenkins 1 Tag Profiler 2025-01-23 4.3 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers to reset profiler statistics.
CVE-2023-33002 1 Jenkins 1 Testcomplete Support 2025-01-23 5.4 Medium
Jenkins TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2023-33001 1 Jenkins 1 Hashicorp Vault 2025-01-23 7.5 High
Jenkins HashiCorp Vault Plugin 360.v0a_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
CVE-2023-33000 1 Jenkins 1 Ns-nd Integration Performance Publisher 2025-01-23 7.5 High
Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier does not mask credentials displayed on the configuration form, increasing the potential for attackers to observe and capture them.
CVE-2023-32999 1 Jenkins 1 Appspider 2025-01-23 4.3 Medium
A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.
CVE-2023-32998 1 Jenkins 1 Appspider 2025-01-23 8.8 High
A cross-site request forgery (CSRF) vulnerability in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.
CVE-2023-32997 1 Jenkins 1 Cas 2025-01-23 8.8 High
Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login.
CVE-2023-32994 1 Jenkins 1 Saml Single Sign On 2025-01-23 3.7 Low
Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections.
CVE-2023-32987 1 Jenkins 1 Reverse Proxy Auth 2025-01-23 8.8 High
A cross-site request forgery (CSRF) vulnerability in Jenkins Reverse Proxy Auth Plugin 1.7.4 and earlier allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials.
CVE-2023-32980 2 Jenkins, Redhat 2 Email Extension, Openshift 2025-01-23 4.3 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make another user stop watching an attacker-specified job.