Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (88 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-22365 1 Milesight 2 Ur32l, Ur32l Firmware 2025-03-05 7.2 High
An OS command injection vulnerability exists in the ys_thirdparty check_system_user functionality of Milesight UR32L v32.3.0.5. A specially crafted set of network packets can lead to command execution. An attacker can send a network request to trigger this vulnerability.
CVE-2023-22844 1 Milesight 1 Milesightvpn 2025-03-05 7.3 High
An authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to authentication bypass. An attacker can send a network request to trigger this vulnerability.
CVE-2023-30466 1 Milesight 40 Ms-n1004-uc, Ms-n1004-uc Firmware, Ms-n1004-upc and 37 more 2025-01-30 9.8 Critical
This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to a weak password reset mechanism at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http requests on the targeted device. Successful exploitation of this vulnerability could allow remote attacker to account takeover on the targeted device.
CVE-2023-30467 1 Milesight 40 Ms-n1004-uc, Ms-n1004-uc Firmware, Ms-n1004-upc and 37 more 2025-01-30 7.5 High
This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to improper authorization at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http requests on the targeted device. Successful exploitation of this vulnerability could allow remote attacker to perform unauthorized activities on the targeted device.
CVE-2023-24506 1 Milesight 2 Ncr\/camera, Ncr\/camera Firmware 2025-01-29 7.5 High
Milesight NCR/camera version 71.8.0.6-r5 exposes credentials through an unspecified request.
CVE-2023-24505 1 Milesight 2 Ncr\/camera, Ncr\/camera Firmware 2025-01-29 5.3 Medium
Milesight NCR/camera version 71.8.0.6-r5 discloses sensitive information through an unspecified request.
CVE-2023-32220 1 Milesight 2 Ncr\/camera, Ncr\/camera Firmware 2025-01-06 8.2 High
Milesight NCR/camera version 71.8.0.6-r5 allows authentication bypass through an unspecified method.
CVE-2023-43260 1 Milesight 15 Ur32, Ur32 Firmware, Ur32l and 12 more 2024-11-21 6.1 Medium
Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the admin panel.
CVE-2023-24595 1 Milesight 2 Ur32l, Ur32l Firmware 2024-11-21 7.2 High
An OS command injection vulnerability exists in the ys_thirdparty system_user_script functionality of Milesight UR32L v32.3.0.5. A specially crafted series of network requests can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability.
CVE-2023-24018 1 Milesight 2 Ur32l, Ur32l Firmware 2024-11-21 8.8 High
A stack-based buffer overflow vulnerability exists in the libzebra.so.0.0.0 security_decrypt_password functionality of Milesight UR32L v32.3.0.5. A specially crafted HTTP request can lead to a buffer overflow. An authenticated attacker can send an HTTP request to trigger this vulnerability.
CVE-2023-23907 1 Milesight 1 Milesightvpn 2024-11-21 7.5 High
A directory traversal vulnerability exists in the server.js start functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to arbitrary file read. An attacker can send a network request to trigger this vulnerability.
CVE-2023-23902 1 Milesight 2 Ur32l, Ur32l Firmware 2024-11-21 9.8 Critical
A buffer overflow vulnerability exists in the uhttpd login functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to remote code execution. An attacker can send a network request to trigger this vulnerability.
CVE-2023-23571 1 Milesight 2 Ur32l, Ur32l Firmware 2024-11-21 7.5 High
An access violation vulnerability exists in the eventcore functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to denial of service. An attacker can send a network request to trigger this vulnerability.
CVE-2023-23550 1 Milesight 2 Ur32l, Ur32l Firmware 2024-11-21 7.2 High
An OS command injection vulnerability exists in the ys_thirdparty user_delete functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability.
CVE-2023-23547 1 Milesight 2 Ur32l, Ur32l Firmware 2024-11-21 6.5 Medium
A directory traversal vulnerability exists in the luci2-io file-export mib functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to arbitrary file read. An attacker can send a network request to trigger this vulnerability.
CVE-2023-23546 1 Milesight 2 Ur32l, Ur32l Firmware 2024-11-21 4.2 Medium
A misconfiguration vulnerability exists in the urvpn_client functionality of Milesight UR32L v32.3.0.5. A specially-crafted man-in-the-middle attack can lead to increased privileges. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
CVE-2023-22659 1 Milesight 2 Ur32l, Ur32l Firmware 2024-11-21 7.2 High
An os command injection vulnerability exists in the libzebra.so change_hostname functionality of Milesight UR32L v32.3.0.5. A specially-crafted network packets can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability.
CVE-2023-22653 1 Milesight 2 Ur32l, Ur32l Firmware 2024-11-21 8.8 High
An OS command injection vulnerability exists in the vtysh_ubus tcpdump_start_cb functionality of Milesight UR32L v32.3.0.5. A specially crafted HTTP request can lead to command execution. An authenticated attacker can send an HTTP request to trigger this vulnerability.
CVE-2023-22371 1 Milesight 1 Milesightvpn 2024-11-21 8.1 High
An os command injection vulnerability exists in the liburvpn.so create_private_key functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to command execution. An attacker can send a malicious packet to trigger this vulnerability.
CVE-2023-22319 1 Milesight 1 Milesightvpn 2024-11-21 7.3 High
A sql injection vulnerability exists in the requestHandlers.js LoginAuth functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to authentication bypass. An attacker can send a malicious packet to trigger this vulnerability.