Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (382331 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-37869 1 Leap13 1 Premium Addons 2025-01-23 6.5 Medium
Missing Authorization vulnerability in Premium Addons Premium Addons PRO.This issue affects Premium Addons PRO: from n/a through 2.9.0.
CVE-2023-33007 1 Jenkins 1 Loadcomplete Support 2025-01-23 5.4 Medium
Jenkins LoadComplete support Plugin 1.0 and earlier does not escape the LoadComplete test name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2023-33006 1 Jenkins 1 Wso2 Oauth 2025-01-23 5.4 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins WSO2 Oauth Plugin 1.0 and earlier allows attackers to trick users into logging in to the attacker's account.
CVE-2023-33005 1 Jenkins 1 Wso2 Oauth 2025-01-23 5.4 Medium
Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login.
CVE-2023-33004 1 Jenkins 1 Tag Profiler 2025-01-23 4.3 Medium
A missing permission check in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers with Overall/Read permission to reset profiler statistics.
CVE-2023-33003 1 Jenkins 1 Tag Profiler 2025-01-23 4.3 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers to reset profiler statistics.
CVE-2023-33002 1 Jenkins 1 Testcomplete Support 2025-01-23 5.4 Medium
Jenkins TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2023-33001 1 Jenkins 1 Hashicorp Vault 2025-01-23 7.5 High
Jenkins HashiCorp Vault Plugin 360.v0a_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
CVE-2023-33000 1 Jenkins 1 Ns-nd Integration Performance Publisher 2025-01-23 7.5 High
Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier does not mask credentials displayed on the configuration form, increasing the potential for attackers to observe and capture them.
CVE-2023-32999 1 Jenkins 1 Appspider 2025-01-23 4.3 Medium
A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.
CVE-2023-32998 1 Jenkins 1 Appspider 2025-01-23 8.8 High
A cross-site request forgery (CSRF) vulnerability in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.
CVE-2023-32997 1 Jenkins 1 Cas 2025-01-23 8.8 High
Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login.
CVE-2023-32994 1 Jenkins 1 Saml Single Sign On 2025-01-23 3.7 Low
Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections.
CVE-2023-32987 1 Jenkins 1 Reverse Proxy Auth 2025-01-23 8.8 High
A cross-site request forgery (CSRF) vulnerability in Jenkins Reverse Proxy Auth Plugin 1.7.4 and earlier allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials.
CVE-2023-32980 2 Jenkins, Redhat 2 Email Extension, Openshift 2025-01-23 4.3 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make another user stop watching an attacker-specified job.
CVE-2023-32979 2 Jenkins, Redhat 2 Email Extension, Openshift 2025-01-23 4.3 Medium
Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files in the email-templates/ directory in the Jenkins home directory on the controller file system.
CVE-2023-32978 1 Jenkins 1 Lightweight Directory Access Protocol 2025-01-23 4.3 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins LDAP Plugin allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials.
CVE-2023-32977 2 Jenkins, Redhat 3 Pipeline\, Ocp Tools, Openshift 2025-01-23 5.4 Medium
Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to set build display names immediately.
CVE-2023-31857 1 Oretnom23 1 Online Computer And Laptop Store 2025-01-23 9.8 Critical
Sourcecodester Online Computer and Laptop Store 1.0 allows unrestricted file upload and can lead to remote code execution. The vulnerability path is /classes/Users.php?f=save.
CVE-2023-31856 1 Totolink 2 Cp300\+, Cp300\+ Firmware 2025-01-23 9.8 Critical
A command injection vulnerability in the hostTime parameter in the function NTPSyncWithHostof TOTOLINK CP300+ V5.2cu.7594_B20200910 allows attackers to execute arbitrary commands via a crafted http packet.