Export limit exceeded: 46864 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (46864 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-11487 | 1 Code4berry | 1 Decoration Management System | 2024-12-02 | 6.3 Medium |
| A vulnerability has been found in Code4Berry Decoration Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /decoration/admin/btndates_report.php of the component Between Dates Reports. The manipulation of the argument fromdate/todate leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2024-47078 | 1 Meshtastic | 2 Firmware, Meshtastic Firmware | 2024-12-02 | 8.1 High |
| Meshtastic is an open source, off-grid, decentralized, mesh network. Meshtastic uses MQTT to communicate over an internet connection to a shared or private MQTT Server. Nodes can communicate directly via an internet connection or proxied through a connected phone (i.e., via bluetooth). Prior to version 2.5.1, multiple weaknesses in the MQTT implementation allow for authentication and authorization bypasses resulting in unauthorized control of MQTT-connected nodes. Version 2.5.1 contains a patch. | ||||
| CVE-2023-42711 | 2 Google, Unisoc | 14 Android, S8000, Sc7731e and 11 more | 2024-12-02 | 5.5 Medium |
| In firewall service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed | ||||
| CVE-2023-42742 | 2 Google, Unisoc | 14 Android, S8000, Sc7731e and 11 more | 2024-12-02 | 5.5 Medium |
| In sysui, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges needed | ||||
| CVE-2023-42744 | 2 Google, Unisoc | 14 Android, S8000, Sc7731e and 11 more | 2024-12-02 | 5.5 Medium |
| In telecom service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges needed | ||||
| CVE-2023-42675 | 2 Google, Unisoc | 14 Android, S8000, Sc7731e and 11 more | 2024-12-02 | 5.5 Medium |
| In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed | ||||
| CVE-2023-42687 | 2 Google, Unisoc | 14 Android, S8000, Sc7731e and 11 more | 2024-12-02 | 7.8 High |
| In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed | ||||
| CVE-2023-42700 | 2 Google, Unisoc | 14 Android, S8000, Sc7731e and 11 more | 2024-12-02 | 5.5 Medium |
| In firewall service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed | ||||
| CVE-2023-36364 | 1 Monetdb | 1 Monetdb | 2024-12-02 | 7.5 High |
| An issue in the rel_deps component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | ||||
| CVE-2023-36363 | 1 Monetdb | 1 Monetdb | 2024-12-02 | 7.5 High |
| An issue in the __nss_database_lookup component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | ||||
| CVE-2023-36362 | 1 Monetdb | 1 Monetdb | 2024-12-02 | 7.5 High |
| An issue in the rel_sequences component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | ||||
| CVE-2023-45084 | 1 Softiron | 1 Hypercloud | 2024-12-02 | 7 High |
| An issue exists in SoftIron HyperCloud where drive caddy removal and reinsertion without a reboot may erroneously cause the system to recognize the caddy as new media and wipe all data on the drives due to a missing synchronization flaw, which impacts data availability and integrity. This issue only impacts SoftIron HyperCloud "density" storage nodes running HyperCloud software versions 1.0 to before 2.0.3. | ||||
| CVE-2023-49239 | 1 Huawei | 2 Emui, Harmonyos | 2024-12-02 | 7.5 High |
| Unauthorized access vulnerability in the card management module. Successful exploitation of this vulnerability may affect service confidentiality. | ||||
| CVE-2024-11970 | 2 Anisha, Code-projects | 2 Concert Ticket Ordering System, Concert Ticket Ordering System | 2024-12-02 | 7.3 High |
| A vulnerability classified as critical has been found in code-projects Concert Ticket Ordering System 1.0. Affected is an unknown function of the file /tour(cor).php. The manipulation of the argument mai leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2023-6245 | 1 Dfinity | 1 Candid | 2024-12-02 | 7.5 High |
| The Candid library causes a Denial of Service while parsing a specially crafted payload with 'empty' data type. For example, if the payload is `record { * ; empty }` and the canister interface expects `record { * }` then the Rust candid decoder treats empty as an extra field required by the type. The problem with the type empty is that the candid Rust library wrongly categorizes empty as a recoverable error when skipping the field and thus causing an infinite decoding loop. Canisters using affected versions of candid are exposed to denial of service by causing the decoding to run indefinitely until the canister traps due to reaching maximum instruction limit per execution round. Repeated exposure to the payload will result in degraded performance of the canister. Note: Canisters written in Motoko are unaffected. | ||||
| CVE-2024-45767 | 1 Dell | 1 Openmanage Enterprise | 2024-12-02 | 4.3 Medium |
| Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure. | ||||
| CVE-2024-31248 | 1 Plugins360 | 1 All-in-one Video Gallery | 2024-12-02 | 4.3 Medium |
| Missing Authorization vulnerability in Team Plugins360 All-in-One Video Gallery.This issue affects All-in-One Video Gallery: from n/a through 3.5.2. | ||||
| CVE-2023-36284 | 1 Webkul | 1 Qloapps | 2024-11-29 | 7.5 High |
| An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remote attacker to bypass a web application's authentication and authorization mechanisms and retrieve the contents of an entire database. | ||||
| CVE-2024-11507 | 1 Irfanview | 1 Irfanview | 2024-11-29 | 7.8 High |
| IrfanView DXF File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22177. | ||||
| CVE-2024-11508 | 1 Irfanview | 1 Irfanview | 2024-11-29 | 7.8 High |
| IrfanView DXF File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22184. | ||||