Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (360133 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-38522 1 Hushline 1 Hush Line 2024-11-21 6.3 Medium
Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The CSP policy applied on the `tips.hushline.app` website and bundled by default in this repository is trivial to bypass. This vulnerability has been patched in version 0.1.0.
CVE-2024-38521 1 Hushline 1 Hush Line 2024-11-21 8.8 High
Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. There is a stored XSS in the Inbox. The input is displayed using the `safe` Jinja2 attribute, and thus not sanitized upon display. This issue has been patched in version 0.1.0.
CVE-2024-38507 1 Jetbrains 1 Hub 2024-11-21 3.5 Low
In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible
CVE-2024-38506 1 Jetbrains 1 Youtrack 2024-11-21 6.3 Medium
In JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflows
CVE-2024-38505 1 Jetbrains 1 Youtrack 2024-11-21 5.3 Medium
In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party site
CVE-2024-38504 1 Jetbrains 1 Youtrack 2024-11-21 4.3 Medium
In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles
CVE-2024-38493 1 Broadcom 1 Symantec Privileged Access Management 2024-11-21 6.1 Medium
A reflected cross-site scripting (XSS) vulnerability exists in the PAM UI web interface. A remote attacker able to convince a PAM user to click on a specially crafted link to the PAM UI web interface could potentially execute arbitrary client-side code in the context of PAM UI.
CVE-2024-38462 1 Irods 1 Irods 2024-11-21 9.8 Critical
iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the mailMS.cpp#L94-L106 reference.
CVE-2024-38461 1 Irods 1 Irods 2024-11-21 7.5 High
irodsServerMonPerf in iRODS before 4.3.2 attempts to proceed with use of a path even if it is not a directory.
CVE-2024-38458 1 Xenforo 1 Xenforo 2024-11-21 8.8 High
Xenforo before 2.2.16 allows code injection.
CVE-2024-38457 1 Xenforo 1 Xenforo 2024-11-21 8.8 High
Xenforo before 2.2.16 allows CSRF.
CVE-2024-38438 1 Dlink 2 Dsl-225, Dsl-225 Firmware 2024-11-21 9.8 Critical
D-Link - CWE-294: Authentication Bypass by Capture-replay
CVE-2024-38437 1 Dlink 2 Dsl-225, Dsl-225 Firmware 2024-11-21 9.8 Critical
D-Link - CWE-288:Authentication Bypass Using an Alternate Path or Channel
CVE-2024-38436 1 Commugen 1 Sox 365 2024-11-21 6.1 Medium
Commugen SOX 365 – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-38433 1 Nuvoton 8 Npcm705r, Npcm705r Firmware, Npcm710r and 5 more 2024-11-21 6.7 Medium
Nuvoton - CWE-305: Authentication Bypass by Primary Weakness An attacker with write access to the SPI-Flash on an NPCM7xx BMC subsystem that uses the Nuvoton BootBlock reference code can modify the u-boot image header on flash parsed by the BootBlock which could lead to arbitrary code execution.
CVE-2024-38432 1 Matrix-globalservices 1 Tafnit 2024-11-21 5.5 Medium
Matrix Tafnit v8 - CWE-646: Reliance on File Name or Extension of Externally-Supplied File
CVE-2024-38431 1 Matrix-globalservices 1 Tafnit 2024-11-21 5.3 Medium
Matrix Tafnit v8 - CWE-204: Observable Response Discrepancy
CVE-2024-38430 1 Matrix-globalservices 1 Tafnit 2024-11-21 5.4 Medium
Matrix - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-38429 1 Matrix-globalservices 1 Tafnit 2024-11-21 7.5 High
Matrix Tafnit v8 -  CWE-552: Files or Directories Accessible to External Parties
CVE-2024-38373 1 Amazon 1 Freertos-plus-tcp 2024-11-21 9.6 Critical
FreeRTOS-Plus-TCP is a lightweight TCP/IP stack for FreeRTOS. FreeRTOS-Plus-TCP versions 4.0.0 through 4.1.0 contain a buffer over-read issue in the DNS Response Parser when parsing domain names in a DNS response. A carefully crafted DNS response with domain name length value greater than the actual domain name length, could cause the parser to read beyond the DNS response buffer. This issue affects applications using DNS functionality of the FreeRTOS-Plus-TCP stack. Applications that do not use DNS functionality are not affected, even when the DNS functionality is enabled. This vulnerability has been patched in version 4.1.1.