Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (359807 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-34960 1 Chamilo 1 Chamilo 2024-11-21 9.8 Critical
A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.
CVE-2023-34942 1 Asus 2 Rt-n10lx, Rt-n10lx Firmware 2024-11-21 7.5 High
Asus RT-N10LX Router v2.0.0.39 was discovered to contain a stack overflow via the mac parameter at /start-apply.html. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2023-34941 1 Asus 2 Rt-n10lx, Rt-n10lx Firmware 2024-11-21 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in the urlFilterList function of Asus RT-N10LX Router v2.0.0.39 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL Keyword List text field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2023-34917 1 Cms Project 1 Cms 2024-11-21 6.1 Medium
Fuge CMS v1.0 contains an Open Redirect vulnerability in member/RegisterAct.java.
CVE-2023-34916 1 Cms Project 1 Cms 2024-11-21 6.1 Medium
Fuge CMS v1.0 contains an Open Redirect vulnerability via /front/ProcessAct.java.
CVE-2023-34869 1 Phpjabbers 1 Catering System 2024-11-21 6.1 Medium
PHPJabbers Catering System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /index.php?controller=pjAdmin&action=pjActionForgot.
CVE-2023-34853 1 Supermicro 542 H11dsi, H11dsi-nt, H11dsi-nt Firmware and 539 more 2024-11-21 7.8 High
Buffer Overflow vulnerability in Supermicro motherboard X12DPG-QR 1.4b allows local attackers to hijack control flow via manipulation of SmcSecurityEraseSetupVar variable.
CVE-2023-34845 1 Bludit 1 Bludit 2024-11-21 5.4 Medium
Bludit v3.14.1 was discovered to contain an arbitrary file upload vulnerability in the component /admin/new-content. This vulnerability allows attackers to execute arbitrary web scripts or HTML via uploading a crafted SVG file. NOTE: the product's security model is that users are trusted by the administrator to insert arbitrary content (users cannot create their own accounts through self-registration).
CVE-2023-34842 1 Dedecms 1 Dedecms 2024-11-21 9.8 Critical
Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote attackers to run arbitrary code via crafted POST request to /dede/tpl.php.
CVE-2023-34798 1 Weaver 1 E-office 2024-11-21 9.8 Critical
An arbitrary file upload vulnerability in eoffice before v9.5 allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2023-34758 1 Bishopfox 1 Sliver 2024-11-21 8.1 High
Sliver from v1.5.x to v1.5.39 has an improper cryptographic implementation, which allows attackers to execute a man-in-the-middle attack via intercepted and crafted responses.
CVE-2023-34725 2 Jaycar, Techview 3 La5570, La5570 Firmware, La-5570 Wireless Gateway 2024-11-21 6.8 Medium
An issue was discovered in TechView LA-5570 Wireless Gateway 1.0.19_T53, allows physical attackers to gain escalated privileges via a telnet connection.
CVE-2023-34724 2 Jaycar, Techview 3 La5570, La5570 Firmware, La-5570 Wireless Gateway 2024-11-21 6.8 Medium
An issue was discovered in TECHView LA5570 Wireless Gateway 1.0.19_T53, allows physical attackers to gain escalated privileges via the UART interface.
CVE-2023-34723 2 Jaycar, Techview 3 La5570, La5570 Firmware, La-5570 Wireless Gateway 2024-11-21 7.5 High
An issue was discovered in TechView LA-5570 Wireless Gateway 1.0.19_T53, allows attackers to gain sensitive information via /config/system.conf.
CVE-2023-34669 1 Totolink 2 Cp300\+, Cp300\+ Firmware 2024-11-21 7.5 High
TOTOLINK CP300+ V5.2cu.7594 contains a Denial of Service vulnerability in function RebootSystem of the file lib/cste_modules/system which can reboot the system.
CVE-2023-34644 2 Ruijie, Ruijienetworks 136 Re-eg1000m, Re-eg1000m Firmware, Rg-eg1000c and 133 more 2024-11-21 9.8 Critical
Remote code execution vulnerability in Ruijie Networks Product: RG-EW series home routers and repeaters EW_3.0(1)B11P204, RG-NBS and RG-S1930 series switches SWITCH_3.0(1)B11P218, RG-EG series business VPN routers EG_3.0(1)B11P216, EAP and RAP series wireless access points AP_3.0(1)B11P218, NBC series wireless controllers AC_3.0(1)B11P86 allows unauthorized remote attackers to gain the highest privileges via crafted POST request to /cgi-bin/luci/api/auth.
CVE-2023-34637 1 Isarnet 1 Isarflow 2024-11-21 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in IsarNet AG IsarFlow v5.23 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the dashboard title parameter in the IsarFlow Portal.
CVE-2023-34635 1 Wifi-soft 1 Unibox Administration 2024-11-21 9.8 Critical
Wifi Soft Unibox Administration 3.0 and 3.1 is vulnerable to SQL Injection. The vulnerability occurs because of not validating or sanitizing the user input in the username field of the login page.
CVE-2023-34625 1 Showmojo 2 Mojobox, Mojobox Firmware 2024-11-21 8.1 High
ShowMojo MojoBox Digital Lockbox 1.4 is vulnerable to Authentication Bypass. The implementation of the lock opening mechanism via Bluetooth Low Energy (BLE) is vulnerable to replay attacks. A malicious user is able to intercept BLE requests and replicate them to open the lock at any time. Alternatively, an attacker with physical access to the device on which the Android app is installed, can obtain the latest BLE messages via the app logs and use them for opening the lock.
CVE-2023-34577 1 Planned Popup Project 1 Planned Popup 2024-11-21 9.8 Critical
SQL injection vulnerability in Prestashop opartplannedpopup 1.4.11 and earlier allows remote attackers to run arbitrary SQL commands via OpartPlannedPopupModuleFrontController::prepareHook() method.