Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (88023 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2023-34934 1 H3c 3 Magic, Magic B1st, Magic B1st Firmware 2024-11-27 7.5 High
A stack overflow in the Edit_BasicSSID_5G function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVE-2023-34936 1 H3c 3 Magic, Magic B1st, Magic B1st Firmware 2024-11-27 7.5 High
A stack overflow in the UpdateMacClone function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVE-2023-34937 1 H3c 3 Magic, Magic B1st, Magic B1st Firmware 2024-11-27 7.5 High
A stack overflow in the UpdateSnat function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVE-2023-37254 1 Mediawiki 1 Mediawiki 2024-11-27 6.1 Medium
An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. XSS can occur in Special:CargoQuery via a crafted page item when using the default format.
CVE-2024-27313 1 Zohocorp 1 Manageengine Pam360 2024-11-27 6.3 Medium
Zoho ManageEngine PAM360 is vulnerable to Stored XSS vulnerability. This vulnerability is applicable only in the version 6610.
CVE-2023-3311 1 Online-shopping-system-advanced Project 1 Online-shopping-system-advanced 2024-11-27 2.4 Low
A vulnerability, which was classified as problematic, was found in PuneethReddyHC online-shopping-system-advanced 1.0. This affects an unknown part of the file addsuppliers.php. The manipulation of the argument First name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231807.
CVE-2023-44389 1 Zope 1 Zope 2024-11-27 3.1 Low
Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 are affected. Patches will be released with Zope versions 4.8.11 and 5.8.6.
CVE-2023-33905 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2024-11-27 4.4 Medium
In iwnpi server, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2023-33336 1 Sophos 1 Web Appliance 2024-11-27 4.8 Medium
Reflected cross site scripting (XSS) vulnerability was discovered in Sophos Web Appliance v4.3.9.1 that allows for arbitrary code to be inputted via the double quotes.
CVE-2023-34840 1 Angular-ui-notification Project 1 Angular-ui-notification 2024-11-27 6.1 Medium
angular-ui-notification v0.1.0, v0.2.0, and v0.3.6 was discovered to contain a cross-site scripting (XSS) vulnerability.
CVE-2023-48315 1 Microsoft 1 Azure Rtos Netx Duo 2024-11-27 8.8 High
Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execution due to memory overflow vulnerabilities in Azure RTOS NETX Duo. The affected components include processes/functions related to ftp and sntp in RTOS v6.2.1 and below. The fixes have been included in NetX Duo release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-26613 2 D-link, Dlink 3 Dir-823g, Dir-823g, Dir-823g Firmware 2024-11-27 9.8 Critical
An OS command injection vulnerability in D-Link DIR-823G firmware version 1.02B05 allows unauthorized attackers to execute arbitrary operating system commands via a crafted GET request to EXCU_SHELL.
CVE-2023-34734 1 Secnet 1 Annet Ac Centralized Management Platform 2024-11-27 4.8 Medium
Annet AC Centralized Management Platform 1.02.040 is vulnerable to Stored Cross-Site Scripting (XSS) .
CVE-2023-36143 1 Maxprintisp 2 Maxlink 1200g, Maxlink 1200g Firmware 2024-11-27 8.8 High
Maxprint Maxlink 1200G v3.4.11E has an OS command injection vulnerability in the "Diagnostic tool" functionality of the device.
CVE-2023-50924 1 Engelsystem 1 Engelsystem 2024-11-27 7.3 High
Englesystem is a shift planning system for chaos events. Engelsystem prior to v3.4.1 performed insufficient validation of user supplied data for the DECT number, mobile number, and work-log comment fields. The values of those fields would be displayed in corresponding log overviews, allowing the injection and execution of Javascript code in another user's context. This vulnerability enables an authenticated user to inject Javascript into other user's sessions. The injected JS will be executed during normal usage of the system when viewing, e.g., overview pages. This issue has been fixed in version 3.4.1.
CVE-2023-36146 1 Multilaser 2 Re170, Re170 Firmware 2024-11-27 5.4 Medium
A Stored Cross-Site Scripting (XSS) vulnerability was found in Multilaser RE 170 using firmware 2.2.6733.
CVE-2023-37298 1 Joplin Project 1 Joplin 2024-11-27 6.1 Medium
Joplin before 2.11.5 allows XSS via a USE element in an SVG document.
CVE-2023-37299 1 Joplin Project 1 Joplin 2024-11-27 6.1 Medium
Joplin before 2.11.5 allows XSS via an AREA element of an image map.
CVE-2023-1695 1 Huawei 2 Emui, Harmonyos 2024-11-27 7.5 High
Vulnerability of failures to capture exceptions in the communication framework. Successful exploitation of this vulnerability may cause features to perform abnormally.
CVE-2023-49119 1 Weseek 1 Growi 2024-11-27 5.4 Medium
Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.