Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (85166 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-36670 1 Kratosdefense 2 Ngc Indoor Unit, Ngc Indoor Unit Firmware 2024-11-21 9.8 Critical
A remotely exploitable command injection vulnerability was found on the Kratos NGC-IDU 9.1.0.4. An attacker can execute arbitrary Linux commands as root by sending crafted TCP requests to the device.
CVE-2023-36660 1 Nettle Project 1 Nettle 2024-11-21 9.8 Critical
The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.
CVE-2023-36656 1 Jaegertracing 1 Jaeger Ui 2024-11-21 5.4 Medium
Cross Site Scripting (XSS) vulnerability in Jaegertracing Jaeger UI before v.1.31.0 allows a remote attacker to execute arbitrary code via the KeyValuesTable component.
CVE-2023-36651 1 Prolion 1 Cryptospike 2024-11-21 7.2 High
Hidden and hard-coded credentials in ProLion CryptoSpike 3.0.15P2 allow remote attackers to login to web management as super-admin and consume the most privileged REST API endpoints via these credentials.
CVE-2023-36642 1 Fortinet 1 Fortitester 2024-11-21 6.5 Medium
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiTester 3.0.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.
CVE-2023-36637 1 Fortinet 1 Fortimail 2024-11-21 3.4 Low
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiMail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to inject HTML tags in FortiMail's calendar via input fields.
CVE-2023-36634 1 Fortinet 1 Fortiap-u 2024-11-21 6.5 Medium
An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-U 7.0.0, 6.2.0 through 6.2.5, 6.0 all versions, 5.4 all versions may allow an authenticated attacker to list and delete arbitrary files and directory via specially crafted command arguments.
CVE-2023-36633 1 Fortinet 1 Fortimail 2024-11-21 5.3 Medium
An improper authorization vulnerability [CWE-285] in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to see and modify the title of address book folders of other users via crafted HTTP or HTTPs requests.
CVE-2023-36618 1 Unify 1 Session Border Controller 2024-11-21 8.8 High
Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of OS commands as root user by low-privileged authenticated users.
CVE-2023-36555 1 Fortinet 1 Fortios 2024-11-21 3.9 Low
An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via the SAML and Security Fabric components.
CVE-2023-36550 1 Fortinet 1 Fortiwlm 2024-11-21 9.6 Critical
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.
CVE-2023-36549 1 Fortinet 1 Fortiwlm 2024-11-21 8.6 High
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.
CVE-2023-36548 1 Fortinet 1 Fortiwlm 2024-11-21 9.6 Critical
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.
CVE-2023-36547 1 Fortinet 1 Fortiwlm 2024-11-21 9.6 Critical
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.
CVE-2023-36533 1 Zoom 2 Meeting Software Development Kit, Video Software Development Kit 2024-11-21 7.1 High
Uncontrolled resource consumption in Zoom SDKs before 5.14.7 may allow an unauthenticated user to enable a denial of service via network access.
CVE-2023-36532 1 Zoom 3 Rooms, Virtual Desktop Infrastructure, Zoom 2024-11-21 5.9 Medium
Buffer overflow in Zoom Clients before 5.14.5 may allow an unauthenticated user to enable a denial of service via network access.
CVE-2023-36530 1 Smartypantsplugins 1 Sp Project \& Document Manager 2024-11-21 5.9 Medium
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Smartypants SP Project & Document Manager plugin <= 4.67 versions.
CVE-2023-36503 1 Maxfoundry 1 Maxbuttons 2024-11-21 6.5 Medium
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Max Foundry WordPress Button Plugin MaxButtons plugin <= 9.5.3 versions.
CVE-2023-36502 1 Cththemes 1 Balkon 2024-11-21 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cththemes Balkon plugin <= 1.3.2 versions.
CVE-2023-36501 1 Mtrv 1 Teachpress 2024-11-21 7.1 High
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Michael Winkler teachPress plugin <= 9.0.2 versions.