Lucene search
+L
NvdMost viewed

381023 matches found

NVD
NVD
added 2023/11/07 12:15 p.m.53 views

CVE-2023-5567

The QR Code Tag plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'qrcodetag' shortcode in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

6.4CVSS0.00434EPSS
SaveExploits0References2
NVD
NVD
added 2023/10/26 10:15 p.m.53 views

CVE-2023-42406

SQL injection vulnerability in D-Link Online behavior audit gateway DAR-7000 V31R02B1413C allows a remote attacker to obtain sensitive information and execute arbitrary code via the editrole.php component...

9.8CVSS9.7AI score0.01947EPSS
SaveExploits1References2
NVD
NVD
added 2023/10/23 7:15 a.m.53 views

CVE-2023-45802

When a HTTP/2 stream was reset RST frame by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing...

5.9CVSS8AI score0.03024EPSS
SaveExploits1References6
NVD
NVD
added 2023/10/16 9:15 p.m.53 views

CVE-2023-45128

Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery CSRF vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulnerability can allow an attacker to injec...

10CVSS9.6AI score0.00313EPSS
SaveExploits0References2
NVD
NVD
added 2023/10/12 5:15 p.m.53 views

CVE-2023-45138

Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly. Starting in version 0.11 and prior to version 1.9.2, it's possible for a user without any specific right to perform script injection and remote code execution just by inserting an...

10CVSS10AI score0.71159EPSS
SaveExploits0References3
NVD
NVD
added 2023/09/27 3:19 p.m.53 views

CVE-2023-42461

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The ITIL actors input field from the Ticket form can be used to perform a SQL injection. Users are advised...

9.8CVSS7.6AI score0.00899EPSS
SaveExploits0References1
NVD
NVD
added 2023/09/20 6:15 p.m.53 views

CVE-2023-20597

Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access...

5.5CVSS5.1AI score0.00171EPSS
SaveExploits0References1
NVD
NVD
added 2023/09/20 3:15 a.m.53 views

CVE-2023-4088

Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service DoS condition, if the...

9.3CVSS8.8AI score0.00177EPSS
SaveExploits0References3
NVD
NVD
added 2023/09/11 8:15 p.m.53 views

CVE-2023-4278

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to register on the site as an instructor. They can then add courses and/or posts...

7.5CVSS7.4AI score0.03495EPSS
SaveExploits6References2
NVD
NVD
added 2023/09/01 8:15 p.m.53 views

CVE-2023-41046

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute Velocity code without having script right by creating an XClass with a property of type "TextArea" and content type "VelocityCode" or "VelocityWiki". For the...

6.3CVSS6.5AI score0.00445EPSS
SaveExploits0References4
NVD
NVD
added 2023/08/10 6:15 p.m.53 views

CVE-2023-39961

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 24.0.4 and prior to versions 25.0.9, 26.0.4, and 27.0.1, when a folder with images or an image was shared without download permissions, the user could add the image inline into a text file and...

4.3CVSS4.2AI score0.00585EPSS
SaveExploits0References3
NVD
NVD
added 2023/08/09 12:15 p.m.53 views

CVE-2023-32781

A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier versions in the HL7 sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor. The severity of this...

7.2CVSS7AI score0.14261EPSS
SaveExploits3References3
NVD
NVD
added 2023/08/08 3:15 p.m.53 views

CVE-2023-36306

A Cross Site Scripting XSS vulnerability in Adiscon Aiscon LogAnalyzer through 4.1.13 allows a remote attacker to execute arbitrary code via the asktheoracle.php, details.php, index.php, search.php, export.php, reports.php, and statistics.php components...

6.1CVSS6AI score0.05313EPSS
SaveExploits4References1
NVD
NVD
added 2023/08/02 8:15 p.m.53 views

CVE-2023-29409

Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to = 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three...

5.3CVSS6.7AI score0.01588EPSS
SaveExploits0References6
NVD
NVD
added 2023/07/25 1:15 p.m.53 views

CVE-2023-3637

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significa...

6.5CVSS5.2AI score0.01305EPSS
SaveExploits0References3
NVD
NVD
added 2023/07/12 4:15 p.m.53 views

CVE-2023-37961

A cross-site request forgery CSRF vulnerability in Jenkins Assembla Auth Plugin 1.14 and earlier allows attackers to trick users into logging in to the attacker's account...

8.8CVSS0.0048EPSS
SaveExploits0References2
NVD
NVD
added 2023/07/11 10:15 a.m.53 views

CVE-2023-37391

Cross-Site Request Forgery CSRF vulnerability in WPMobilePack.Com WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps plugin = 3.4.1 versions...

6.5CVSS5.9AI score0.0022EPSS
SaveExploits0References1
NVD
NVD
added 2023/07/11 9:15 a.m.53 views

CVE-2023-34015

Cross-Site Request Forgery CSRF vulnerability in PI Websolution Conditional shipping & Advanced Flat rate shipping rates / Flexible shipping for WooCommerce shipping plugin = 1.6.4.4 versions...

8.8CVSS6.5AI score0.00248EPSS
SaveExploits0References1
NVD
NVD
added 2023/07/06 11:15 p.m.53 views

CVE-2023-36829

Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the access-control-allow-credentials: true HTTP header if the Origin request header ends with the system.base-hostname option of Sentry...

6.8CVSS6.5AI score0.00666EPSS
SaveExploits0References4
NVD
NVD
added 2023/06/27 2:15 p.m.53 views

CVE-2023-2744

The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the type parameter in the erp/v1/accounting/v1/people REST API endpoint before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

7.2CVSS7.2AI score0.02632EPSS
SaveExploits5References2
NVD
NVD
added 2023/06/26 10:15 a.m.53 views

CVE-2023-29430

Unauth. Reflected Cross-Site Scripting XSS vulnerability in CTHthemes TheRoof theme = 1.0.3 versions...

7.1CVSS6.3AI score0.00382EPSS
SaveExploits0References1
NVD
NVD
added 2023/06/09 6:15 a.m.53 views

CVE-2023-1404

The Weaver Show Posts Plugin for WordPress is vulnerable to stored Cross-Site Scripting due to insufficient escaping of the profile display name in versions up to, and including, 1.6. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitra...

6.4CVSS5.9AI score0.00508EPSS
SaveExploits2References3
NVD
NVD
added 2023/06/06 7:15 p.m.53 views

CVE-2023-32682

Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the...

5.4CVSS5.4AI score0.00752EPSS
SaveExploits0References7
NVD
NVD
added 2023/05/27 7:15 p.m.53 views

CVE-2015-20108

xmlsecurity.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used...

9.8CVSS9.9AI score0.01332EPSS
SaveExploits0References5
NVD
NVD
added 2023/05/24 5:15 p.m.53 views

CVE-2021-25749

Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true...

7.8CVSS7.5AI score0.00211EPSS
SaveExploits0References1
NVD
NVD
added 2023/05/18 10:15 p.m.53 views

CVE-2023-23557

An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malicious attacker to execute arbitrary code via type confusion. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScrip...

9.8CVSS9.7AI score0.00891EPSS
SaveExploits0References2
NVD
NVD
added 2023/05/15 10:15 p.m.53 views

CVE-2023-31131

Greenplum Database GPDB is an open source data warehouse based on PostgreSQL. In versions prior to 6.22.3 Greenplum Database used an unsafe methods to extract tar files within GPPKGs. greenplum-db is vulnerable to path traversal leading to arbitrary file writes. An attacker can use this...

9.1CVSS7.9AI score0.00746EPSS
SaveExploits0References2
NVD
NVD
added 2023/05/11 7:15 a.m.53 views

CVE-2023-2643

A vulnerability classified as critical was found in SourceCodester File Tracker Manager System 1.0. This vulnerability affects unknown code of the file register/updatepassword.php of the component POST Parameter Handler. The manipulation of the argument newpassword leads to sql injection. The...

9.8CVSS7.5AI score0.00726EPSS
SaveExploits1References3
NVD
NVD
added 2023/05/09 7:15 p.m.53 views

CVE-2023-20520

Improper access control settings in ASP Bootloader may allow an attacker to corrupt the return address causing a stack-based buffer overrun potentially leading to arbitrary code execution...

9.8CVSS9.6AI score0.00789EPSS
SaveExploits0References1
NVD
NVD
added 2023/05/08 10:15 p.m.53 views

CVE-2023-23894

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Surbma Surbma | GDPR Proof Cookie Consent & Notice Bar plugin = 17.5.3 versions...

6.5CVSS5.8AI score0.00361EPSS
SaveExploits0References1
NVD
NVD
added 2023/05/02 4:15 p.m.53 views

CVE-2023-29918

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module...

5.4CVSS5.6AI score0.02166EPSS
SaveExploits3References1
NVD
NVD
added 2023/04/28 10:15 p.m.53 views

CVE-2023-24269

An arbitrary file upload vulnerability in the plugin upload function of Textpattern v4.8.8 allows attackers to execute arbitrary code via a crafted Zip file...

8.8CVSS8.8AI score0.0111EPSS
SaveExploits1References1
NVD
NVD
added 2023/04/26 2:15 p.m.53 views

CVE-2022-25273

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter...

7.5CVSS7.4AI score0.00568EPSS
SaveExploits0References1
NVD
NVD
added 2023/04/16 3:15 a.m.53 views

CVE-2022-30076

ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames such as s10000 through s20000. There is no rate limiting...

5.3CVSS5.2AI score0.03572EPSS
SaveExploits4References1
NVD
NVD
added 2023/04/05 10:15 p.m.53 views

CVE-2022-31890

SQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae via the order parameter to the getOrder function...

9.8CVSS9.9AI score0.01503EPSS
SaveExploits1References2
NVD
NVD
added 2023/04/05 5:15 p.m.53 views

CVE-2023-1879

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12...

5.4CVSS4.8AI score0.00475EPSS
SaveExploits1References2
NVD
NVD
added 2023/03/27 9:15 p.m.53 views

CVE-2023-28628

lambdaisland/uri is a pure Clojure/ClojureScript URI library. In versions prior to 1.14.120 authority-regex allows an attacker to send malicious URLs to be parsed by the lambdaisland/uri and return the wrong authority. This issue is similar to but distinct from CVE-2020-8910. The regex in questio...

6.1CVSS5.9AI score0.00553EPSS
SaveExploits1References2
NVD
NVD
added 2023/03/24 8:15 p.m.53 views

CVE-2021-3684

A vulnerability was found in OpenShift Assisted Installer. During generation of the Discovery ISO, image pull secrets were leaked as plaintext in the installation logs. An authenticated user could exploit this by re-using the image pull secret to pull container images from the registry as the...

5.5CVSS5.4AI score0.00249EPSS
SaveExploits0References3
NVD
NVD
added 2023/03/23 7:15 p.m.53 views

CVE-2023-1606

A vulnerability was found in novel-plus 3.6.2 and classified as critical. Affected by this issue is some unknown functionality of the file DictController.java. The manipulation of the argument orderby leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to t...

9.8CVSS7.3AI score0.00891EPSS
SaveExploits1References3
NVD
NVD
added 2023/03/23 5:15 p.m.53 views

CVE-2022-28496

TOTOLink outdoor CPE CP900 V6.3c.566B20171026 discovered to contain a command injection vulnerability in the setPasswordCfg function via the adminuser and adminpassparameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

9.8CVSS9.9AI score0.01357EPSS
SaveExploits0References1
NVD
NVD
added 2023/03/22 6:15 a.m.53 views

CVE-2023-1168

An authenticated remote code execution vulnerability exists in the AOS-CX Network Analytics Engine. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system, leading to a complete compromise of the switc...

8.8CVSS7.8AI score0.01141EPSS
SaveExploits0References1
NVD
NVD
added 2023/03/21 11:15 p.m.53 views

CVE-2022-43512

Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file...

5.5CVSS5.2AI score0.00255EPSS
SaveExploits0References1
NVD
NVD
added 2023/03/02 3:15 a.m.53 views

CVE-2023-1147

Cross-site Scripting XSS - Stored in GitHub repository flatpressblog/flatpress prior to 1.3...

6.5CVSS5.6AI score0.00479EPSS
SaveExploits1References2
NVD
NVD
added 2023/02/22 12:15 a.m.53 views

CVE-2023-20855

VMware vRealize Orchestrator contains an XML External Entity XXE vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted input to bypass XML parsing restrictions leading to access to sensitive information or possible escalati...

8.8CVSS8.8AI score0.01265EPSS
SaveExploits0References1
NVD
NVD
added 2023/02/19 9:15 a.m.53 views

CVE-2023-0916

A vulnerability classified as critical was found in SourceCodester Auto Dealer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /adms/classes/Users.php. The manipulation leads to improper access controls. The attack can be launched remotely. The exploi...

8.8CVSS7.2AI score0.03074EPSS
SaveExploits4References3
NVD
NVD
added 2023/02/14 11:15 a.m.53 views

CVE-2022-31808

A vulnerability has been identified in SiPass integrated AC5102 ACC-G2 All versions V2.85.44, SiPass integrated ACC-AP All versions V2.85.43. Affected devices improperly sanitize user input on the telnet command line interface. This could allow an authenticated user to escalate privileges by...

7.8CVSS7.9AI score0.00229EPSS
SaveExploits0References1
NVD
NVD
added 2023/02/13 3:15 p.m.53 views

CVE-2023-0099

The Simple URLs WordPress plugin before 115 does not sanitise and escape some parameters before outputting them back in some pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

6.1CVSS6AI score0.01726EPSS
SaveExploits6References2
NVD
NVD
added 2023/01/16 11:15 a.m.53 views

CVE-2022-43718

Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0...

5.4CVSS5.1AI score0.01302EPSS
SaveExploits0References1
NVD
NVD
added 2023/01/13 12:15 a.m.53 views

CVE-2023-22404

An Out-of-bounds Write vulnerability in the Internet Key Exchange Protocol daemon iked of Juniper Networks Junos OS on SRX series and MX with SPC3 allows an authenticated, network-based attacker to cause a Denial of Service DoS. iked will crash and restart, and the tunnel will not come up when a...

6.5CVSS6.5AI score0.0063EPSS
SaveExploits0References1
NVD
NVD
added 2023/01/11 8:15 a.m.53 views

CVE-2023-20529

Insufficient bound checks in the SMU may allow an attacker to update the from/to address space to an invalid value potentially resulting in a denial of service...

7.5CVSS7.4AI score0.00616EPSS
SaveExploits0References1
Total number of security vulnerabilities5000