Export limit exceeded: 417680 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 17807 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (17807 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-50710 | 1 Hono | 1 Hono | 2024-11-21 | 4.2 Medium |
| Hono is a web framework written in TypeScript. Prior to version 3.11.7, clients may override named path parameter values from previous requests if the application is using TrieRouter. So, there is a risk that a privileged user may use unintended parameters when deleting REST API resources. TrieRouter is used either explicitly or when the application matches a pattern that is not supported by the default RegExpRouter. Version 3.11.7 includes the change to fix this issue. As a workaround, avoid using TrieRouter directly. | ||||
| CVE-2023-50447 | 3 Debian, Python, Redhat | 8 Debian Linux, Pillow, Ansible Automation Platform and 5 more | 2024-11-21 | 8.1 High |
| Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter). | ||||
| CVE-2023-50266 | 1 Bazarr | 1 Bazarr | 2024-11-21 | 5.3 Medium |
| Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get() without any sanitization, which leads to a blind server-side request forgery (SSRF). This issue allows for crafting GET requests to internal and external resources on behalf of the server. 1.3.1 contains a partial fix, which limits the vulnerability to HTTP/HTTPS protocols. | ||||
| CVE-2023-50165 | 1 Pega | 1 Platform | 2024-11-21 | 8.5 High |
| Pega Platform versions 8.2.1 to Infinity 23.1.0 are affected by an Generated PDF issue that could expose file contents. | ||||
| CVE-2023-4977 | 1 Librenms | 1 Librenms | 2024-11-21 | 5.4 Medium |
| Code Injection in GitHub repository librenms/librenms prior to 23.9.0. | ||||
| CVE-2023-4878 | 1 Instantcms | 1 Instantcms | 2024-11-21 | 5.4 Medium |
| Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1-git. | ||||
| CVE-2023-4769 | 1 Zohocorp | 1 Manageengine Desktop Central | 2024-11-21 | 6.6 Medium |
| A SSRF vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0, specifically the /smtpConfig.do component. This vulnerability could allow an authenticated attacker to launch targeted attacks, such as a cross-port attack, service enumeration and other attacks via HTTP requests. | ||||
| CVE-2023-4768 | 1 Zohocorp | 1 Manageengine Desktop Central | 2024-11-21 | 6.1 Medium |
| A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via the fileName parameter in /STATE_ID/1613157927228/InvSWMetering.pdf. | ||||
| CVE-2023-4767 | 1 Zohocorp | 1 Manageengine Desktop Central | 2024-11-21 | 6.1 Medium |
| A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via the fileName parameter in /STATE_ID/1613157927228/InvSWMetering.csv. | ||||
| CVE-2023-4651 | 1 Instantcms | 1 Instantcms | 2024-11-21 | 5.4 Medium |
| Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1. | ||||
| CVE-2023-4624 | 1 Bookstackapp | 1 Bookstack | 2024-11-21 | 2.4 Low |
| Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08. | ||||
| CVE-2023-4467 | 1 Poly | 2 Trio 8800, Trio 8800 Firmware | 2024-11-21 | 6.2 Medium |
| A vulnerability was found in Poly Trio 8800 7.2.6.0019 and classified as critical. Affected by this issue is some unknown functionality of the component Test Automation Mode. The manipulation leads to backdoor. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249260. | ||||
| CVE-2023-4291 | 1 Frauscher | 1 Frauscher Diagnostic System 101 | 2024-11-21 | 9.8 Critical |
| Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a remote code execution (RCE) vulnerability via manipulated parameters of the web interface without authentication. This could lead to a full compromise of the FDS101 device. | ||||
| CVE-2023-4195 | 2 Agentejo, Cockpit-hq | 2 Cockpit, Cockpit | 2024-11-21 | 8.8 High |
| PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3. | ||||
| CVE-2023-4041 | 1 Silabs | 1 Gecko Bootloader | 2024-11-21 | 9.8 Critical |
| Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon Labs Gecko Bootloader on ARM (Firmware Update File Parser modules) allows Code Injection, Authentication Bypass.This issue affects "Standalone" and "Application" versions of Gecko Bootloader. | ||||
| CVE-2023-49795 | 1 Mindsdb | 1 Mindsdb | 2024-11-21 | 6.5 Medium |
| MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a server-side request forgery vulnerability in `file.py`. This can lead to limited information disclosure. Users should use MindsDB's `staging` branch or v23.11.4.1, which contain a fix for the issue. | ||||
| CVE-2023-49515 | 1 Tp-link | 4 Tapo C200, Tapo C200 Firmware, Tapo Tc70 and 1 more | 2024-11-21 | 4.6 Medium |
| Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware v.1.3.4 and fixed in v.1.3.11 allows a physically proximate attacker to obtain sensitive information via a connection to the UART pin components. | ||||
| CVE-2023-49391 | 1 Free5gc | 1 Free5gc | 2024-11-21 | 7.5 High |
| An issue was discovered in free5GC version 3.3.0, allows remote attackers to execute arbitrary code and cause a denial of service (DoS) on AMF component via crafted NGAP message. | ||||
| CVE-2023-49313 | 1 Horsicq | 1 Xmachoviewer | 2024-11-21 | 9.8 Critical |
| A dylib injection vulnerability in XMachOViewer 0.04 allows attackers to compromise integrity. By exploiting this, unauthorized code can be injected into the product's processes, potentially leading to remote control and unauthorized access to sensitive user data. | ||||
| CVE-2023-49093 | 1 Htmlunit | 1 Htmlunit | 2024-11-21 | 9.8 Critical |
| HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage. This vulnerability has been patched in version 3.9.0 | ||||