Lucene search
+L
NvdMost viewed

381023 matches found

NVD
NVD
added 2023/11/28 4:15 a.m.54 views

CVE-2023-32063

OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1...

5CVSS0.00538EPSS
SaveExploits0References3
NVD
NVD
added 2023/11/21 11:15 p.m.54 views

CVE-2023-48701

Statamic CMS is a Laravel and Git powered content management system CMS. Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or...

7.5CVSS0.007EPSS
SaveExploits0References3
NVD
NVD
added 2023/11/21 10:15 p.m.54 views

CVE-2023-48302

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, when a user is tricked into copy pasting HTML code without markup Ctrl+Shift+V the...

5.4CVSS0.00571EPSS
SaveExploits0References3
NVD
NVD
added 2023/11/14 10:15 p.m.54 views

CVE-2023-47524

Unauth. Reflected Cross-Site Scripting XSS vulnerability requires PHP 8.x in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin = 2.1.9 versions...

6.1CVSS0.00358EPSS
SaveExploits0References1
NVD
NVD
added 2023/11/10 6:15 p.m.54 views

CVE-2023-47128

Piccolo is an object-relational mapping and query builder which supports asyncio. Prior to version 1.1.1, the handling of named transaction savepoints in all database implementations is vulnerable to SQL Injection via f-strings. While the likelihood of an end developer exposing a savepoints name...

9.1CVSS0.00782EPSS
SaveExploits2References2
NVD
NVD
added 2023/11/06 6:15 p.m.54 views

CVE-2023-45827

Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation. In versions prior to 1.0.2 there is a Prototype Pollution vulnerability in the setByPath function which can leads to remote code...

9.8CVSS8.1AI score0.01172EPSS
SaveExploits1References2
NVD
NVD
added 2023/10/20 7:15 a.m.54 views

CVE-2023-4402

The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the getproducts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugi...

9.8CVSS8.8AI score0.0134EPSS
SaveExploits3References2
NVD
NVD
added 2023/10/19 9:15 p.m.54 views

CVE-2023-45823

Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which by using symbolic links in certain kinds of repositories load...

7.5CVSS7.6AI score0.00631EPSS
SaveExploits0References2
NVD
NVD
added 2023/09/29 2:15 p.m.54 views

CVE-2023-5289

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.4...

8.8CVSS7.4AI score0.00652EPSS
SaveExploits1References2
NVD
NVD
added 2023/09/27 3:19 p.m.54 views

CVE-2023-41861

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Restrict plugin = 2.2.4 versions...

7.1CVSS6.2AI score0.00351EPSS
SaveExploits0References1
NVD
NVD
added 2023/09/25 4:15 p.m.54 views

CVE-2023-3664

The FileOrganizer WordPress plugin through 1.0.2 does not restrict functionality on multisite instances, allowing site admins to gain full control over the server...

7.2CVSS7.1AI score0.008EPSS
SaveExploits1References1
NVD
NVD
added 2023/09/12 8:15 p.m.54 views

CVE-2023-3710

Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM Printer web page modules allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 e.g. P10.19.050006...

9.9CVSS9.6AI score0.33094EPSS
SaveExploits3References3
NVD
NVD
added 2023/09/11 9:15 p.m.54 views

CVE-2023-35677

In onCreate of DeviceAdminAdd.java, there is a possible way to forcibly add a device admin due to a missing permission check. This could lead to local denial of service factory reset or continuous locking with no additional execution privileges needed. User interaction is not needed for...

5.5CVSS5.4AI score0.00093EPSS
SaveExploits0References2
NVD
NVD
added 2023/09/04 12:15 p.m.54 views

CVE-2023-4216

The Orders Tracking for WooCommerce WordPress plugin before 1.2.6 doesn't validate the fileurl parameter when importing a CSV file, allowing high privilege users with the managewoocommerce capability to access any file on the web server via a Traversal attack. The content retrieved is however...

2.7CVSS3.5AI score0.00659EPSS
SaveExploits2References1
NVD
NVD
added 2023/08/30 2:15 a.m.54 views

CVE-2023-4597

The Slimstat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slimstat' shortcode in versions up to, and including, 5.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

6.4CVSS5.7AI score0.00576EPSS
SaveExploits2References4
NVD
NVD
added 2023/08/28 1:15 a.m.54 views

CVE-2023-26270

IBM Security Guardium Data Encryption IBM Guardium Cloud Key Manager GCKM 1.10.3 could allow a remote attacker to execute arbitrary code on the system, caused by an angular template injection flaw. By sending specially crafted request, an attacker could exploit this vulnerability to execute...

9.8CVSS8.4AI score0.00698EPSS
SaveExploits0References2
NVD
NVD
added 2023/08/22 7:16 p.m.54 views

CVE-2022-37052

A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject...

6.5CVSS6.3AI score0.0091EPSS
SaveExploits1References3
NVD
NVD
added 2023/08/18 2:15 p.m.54 views

CVE-2023-31218

Cross-Site Request Forgery CSRF leading to Stored Cross-Site Scripting XSS vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin = 1.0.6 versions...

7.1CVSS6.4AI score0.00212EPSS
SaveExploits0References1
NVD
NVD
added 2023/08/16 10:15 p.m.54 views

CVE-2023-38894

A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function...

9.8CVSS9.6AI score0.01689EPSS
SaveExploits1References2
NVD
NVD
added 2023/08/14 9:15 p.m.54 views

CVE-2023-40013

SVG Loader is a javascript library that fetches SVGs using XMLHttpRequests and injects the SVG code in the tag's place. According to the docs, svg-loader will strip all JS code before injecting the SVG file for security reasons but the input sanitization logic is not sufficient and can be trivial...

7.1CVSS6.6AI score0.00558EPSS
SaveExploits0References4
NVD
NVD
added 2023/08/08 6:15 p.m.54 views

CVE-2023-20589

An attacker with specialized hardware and physical access to an impacted device may be able to perform a voltage fault injection attack resulting in compromise of the ASP secure boot potentially leading to arbitrary code execution...

6.8CVSS6.8AI score0.00584EPSS
SaveExploits0References1
NVD
NVD
added 2023/08/08 11:15 a.m.54 views

CVE-2023-4203

Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stored Cross-Site Scripting vulnerability, which can be triggered by authenticated users in the ping tool of the web-interface...

9CVSS8.2AI score0.01079EPSS
SaveExploits2References3
NVD
NVD
added 2023/08/04 1:15 a.m.54 views

CVE-2023-39343

Sulu is an open-source PHP content management system based on the Symfony framework. It allows over the Admin Login form to detect which user username, email exists and which one do not exist. Sulu Installation not using the old Symfony 5.4 security System and previous version are not impacted by...

4.3CVSS4.6AI score0.00617EPSS
SaveExploits0References3
NVD
NVD
added 2023/07/26 7:15 a.m.54 views

CVE-2023-1401

An issue has been discovered in GitLab DAST scanner affecting all versions starting from 3.0.29 before 4.0.5, in which the DAST scanner leak cross site cookies on redirect during authorization...

5CVSS4.8AI score0.00522EPSS
SaveExploits1References2
NVD
NVD
added 2023/06/28 6:15 p.m.54 views

CVE-2023-21171

In verifyInputEvent of InputDispatcher.cpp, there is a possible way to conduct click fraud due to side channel information disclosure. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions...

6.7CVSS6.5AI score0.00096EPSS
SaveExploits0References1
NVD
NVD
added 2023/06/19 11:15 a.m.54 views

CVE-2023-2527

The Integration for Contact Form 7 and Zoho CRM, Bigin WordPress plugin before 1.2.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

4.8CVSS5.4AI score0.0044EPSS
SaveExploits2References2
NVD
NVD
added 2023/06/07 1:15 a.m.54 views

CVE-2023-33781

An issue in D-Link DIR-842V2 v1.0.3 allows attackers to execute arbitrary commands via importing a crafted file...

8.8CVSS8.9AI score0.32032EPSS
SaveExploits2References2
NVD
NVD
added 2023/05/15 4:15 a.m.54 views

CVE-2023-32758

giturlparse aka git-url-parse through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS Regular Expression Denial of Service if parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package for example, to check whether it accesses any Git...

7.5CVSS7.4AI score0.01033EPSS
SaveExploits0References5
NVD
NVD
added 2023/05/10 12:15 p.m.54 views

CVE-2023-1732

When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read returns an error. In rare deployment cases error thrown by the Read function, this could lead to a predictable shared secret. The tkn20 and blindrsa components did not...

8.2CVSS6.4AI score0.00386EPSS
SaveExploits0References1
NVD
NVD
added 2023/05/03 10:15 p.m.54 views

CVE-2023-22637

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability CWE-79 in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in License Management would permit an authenticated...

9CVSS7.5AI score0.0061EPSS
SaveExploits0References1
NVD
NVD
added 2023/04/27 3:15 a.m.54 views

CVE-2023-31285

An XSS issue was discovered in Serenity Serene and StartSharp before 6.7.0. When users upload temporary files, some specific file endings are not allowed, but it is possible to upload .html or .htm files containing an XSS payload. The resulting link can be sent to an administrator user...

6.1CVSS6AI score0.00785EPSS
SaveExploits1References3
NVD
NVD
added 2023/04/26 9:15 p.m.54 views

CVE-2023-30845

ESPv2 is a service proxy that provides API management capabilities using Google Service Infrastructure. ESPv2 2.20.0 through 2.42.0 contains an authentication bypass vulnerability. API clients can craft a malicious X-HTTP-Method-Override header value to bypass JWT authentication in specific cases...

9.8CVSS8.9AI score0.00649EPSS
SaveExploits0References4
NVD
NVD
added 2023/04/24 8:15 p.m.54 views

CVE-2023-29530

Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users who create HTTP requests or responses using laminas/laminas-diactoros, when providing a newline at the start or end of a header key or value...

7.5CVSS7.2AI score0.00965EPSS
SaveExploits0References3
NVD
NVD
added 2023/04/11 5:15 p.m.54 views

CVE-2022-41331

A missing authentication for critical function vulnerability CWE-306 in FortiPresence infrastructure server before version 1.2.1 allows a remote, unauthenticated attacker to access the Redis and MongoDB instances via crafted authentication requests...

9.8CVSS9.7AI score0.01275EPSS
SaveExploits0References1
NVD
NVD
added 2023/03/28 9:15 p.m.54 views

CVE-2022-36060

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear...

8.2CVSS8.1AI score0.00906EPSS
SaveExploits0References1
NVD
NVD
added 2023/03/13 12:15 p.m.54 views

CVE-2023-24033

The Samsung Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto T512 baseband modem chipsets do not properly check format types specified by the Session Description Protocol SDP module, which can lead to a denial of service...

9.8CVSS7.8AI score0.33167EPSS
SaveExploits0References3
NVD
NVD
added 2023/03/03 11:15 p.m.54 views

CVE-2023-25403

CleverStupidDog yf-exam v 1.8.0 is vulnerable to Authentication Bypass. The program uses a fixed JWT key, and the stored key uses username format characters. Any user who logged in within 24 hours. A token can be forged with his username to bypass authentication...

7.5CVSS7.5AI score0.00652EPSS
SaveExploits1References2
NVD
NVD
added 2023/02/21 9:15 p.m.54 views

CVE-2023-25158

GeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filter expression language parsing, encoding and execution against a range of datastore. SQL Injection Vulnerabilities have been found when executing OGC Filters with JDBCDataStore...

9.8CVSS10AI score0.01072EPSS
SaveExploits2References2
NVD
NVD
added 2023/02/17 3:15 p.m.54 views

CVE-2022-45701

Arris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution RCE via the ping utility feature...

8.8CVSS9AI score0.42326EPSS
SaveExploits6References1
NVD
NVD
added 2023/02/14 4:15 p.m.54 views

CVE-2022-22564

Dell EMC Unity versions before 5.2.0.0.5.173 , usees broken cryptographic algorithm. A remote unauthenticated attacker could potentially exploit this vulnerability by performing MitM attacks and let attackers obtain sensitive information...

5.9CVSS5.8AI score0.00451EPSS
SaveExploits0References1
NVD
NVD
added 2023/01/26 9:18 p.m.54 views

CVE-2023-23619

Modelina is a library for generating data models based on inputs such as AsyncAPI, OpenAPI, or JSON Schema documents. Versions prior to 1.0.0 are vulnerable to Code injection. This issue affects anyone who is using the default presets and/or does not handle the functionality themself. This issue...

9.9CVSS9.8AI score0.01064EPSS
SaveExploits1References1
NVD
NVD
added 2022/12/21 11:15 a.m.54 views

CVE-2022-38060

A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. A misconfiguration in /etc/sudoers within a container can lead to increased privileges...

8.8CVSS0.00211EPSS
SaveExploits0References1
NVD
NVD
added 2022/12/20 9:15 p.m.54 views

CVE-2022-23542

OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered that OpenFGA version 0.3.0 is vulnerable to authorization bypass under certain conditions. This issue has been patched in version 0.3.1 and...

9.8CVSS0.0091EPSS
SaveExploits0References3
NVD
NVD
added 2022/12/19 11:15 a.m.54 views

CVE-2022-44755

HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is different from the vulnerability described in...

9.8CVSS0.00704EPSS
SaveExploits0References1
NVD
NVD
added 2022/12/15 7:15 p.m.54 views

CVE-2022-32531

The Apache Bookkeeper Java Client before 4.14.6 and also 4.15.0 does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack. The problem affects BookKeeper client prior to versions 4.14.6 a...

5.9CVSS0.01021EPSS
SaveExploits0References1
NVD
NVD
added 2022/12/14 3:15 p.m.54 views

CVE-2022-46609

Python3-RESTfulAPI commit d9907f14e9e25dcdb54f5b22252b0e9452e3970e and e772e0beee284c50946e94c54a1d43071ca78b74 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well ...

9.8CVSS0.01416EPSS
SaveExploits1References4
NVD
NVD
added 2022/12/13 4:15 p.m.54 views

CVE-2022-4223

The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pgdump and pgrestore. The utility is executed by the server to determine what PostgreSQL version it is from. Versions of pgAdmin prior to 6.17 failed to...

8.8CVSS0.79933EPSS
SaveExploits0References2
NVD
NVD
added 2022/11/28 9:15 p.m.54 views

CVE-2022-45921

FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process...

7.5CVSS0.00667EPSS
SaveExploits0References2
NVD
NVD
added 2022/11/17 11:15 p.m.55 views

CVE-2022-39178

Webvendome - webvendome Internal Server IP Disclosure. Send GET Request to the request which is shown in the picture. Internal Server IP and Full path disclosure...

5.3CVSS0.00583EPSS
SaveExploits0References1
NVD
NVD
added 2022/11/08 8:15 p.m.54 views

CVE-2022-33321

Cleartext Transmission of Sensitive Information vulnerability due to the use of Basic Authentication for HTTP connections in Mitsubishi Electric consumer electronics products PHOTOVOLTAIC COLOR MONITOR ECO-GUIDE, HEMS adapter, Wi-Fi Interface, Air Conditioning, Induction hob, Mitsubishi Electric...

9.8CVSS0.00933EPSS
SaveExploits0References3
Total number of security vulnerabilities5000