Export limit exceeded: 23971 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 48989 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 88023 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (88023 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-26847 | 1 Opencats | 1 Opencats | 2025-02-11 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the state parameter at opencats/index.php?m=candidates. | ||||
| CVE-2023-26846 | 1 Opencats | 1 Opencats | 2025-02-11 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the city parameter at opencats/index.php?m=candidates. | ||||
| CVE-2023-26554 | 1 Ntp | 1 Ntp | 2025-02-11 | 5.6 Medium |
| mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. | ||||
| CVE-2023-26553 | 1 Ntp | 1 Ntp | 2025-02-11 | 5.6 Medium |
| mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. | ||||
| CVE-2023-26552 | 1 Ntp | 1 Ntp | 2025-02-11 | 5.6 Medium |
| mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. | ||||
| CVE-2023-26551 | 1 Ntp | 1 Ntp | 2025-02-11 | 5.6 Medium |
| mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. | ||||
| CVE-2023-26064 | 1 Lexmark | 217 6500e, B2236, B2338 and 214 more | 2025-02-11 | 9.8 Critical |
| Certain Lexmark devices through 2023-02-19 have an Out-of-bounds Write. | ||||
| CVE-2023-24721 | 1 Liveaction | 1 Livesp | 2025-02-11 | 5.4 Medium |
| A cross-site scripting (XSS) vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary web scripts or HTML. | ||||
| CVE-2023-24181 | 1 Openwrt | 1 Luci | 2025-02-11 | 5.4 Medium |
| LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /openvpn/pageswitch.htm. | ||||
| CVE-2023-23572 | 1 Epson | 100 Esifnw1, Esifnw1 Firmware, Esnsb1 and 97 more | 2025-02-11 | 4.8 Medium |
| Cross-site scripting vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script. [Note] Web Config is the software that allows users to check the status and change the settings of SEIKO EPSON printers/network interface via a web browser. According to SEIKO EPSON CORPORATION, it is also called as Remote Manager in some products. Web Config is pre-installed in some printers/network interface provided by SEIKO EPSON CORPORATION. For the details of the affected product names/model numbers, refer to the information provided by the vendor. | ||||
| CVE-2023-23277 | 1 Snippet Box Project | 1 Snippet Box | 2025-02-11 | 6.1 Medium |
| Snippet-box 1.0.0 is vulnerable to Cross Site Scripting (XSS). Remote attackers can render arbitrary web script or HTML from the "Snippet code" form field. | ||||
| CVE-2023-1122 | 1 Ibenic | 1 Simple Giveaways | 2025-02-11 | 4.8 Medium |
| The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its Giveaways options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2023-0893 | 1 Dcac | 1 Time Sheets | 2025-02-11 | 4.8 Medium |
| The Time Sheets WordPress plugin before 1.29.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2023-0363 | 1 Nlb-creations | 1 Scheduled Announcements Widget | 2025-02-11 | 5.4 Medium |
| The Scheduled Announcements Widget WordPress plugin before 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | ||||
| CVE-2023-27492 | 2 Envoyproxy, Redhat | 2 Envoy, Service Mesh | 2025-02-11 | 4.8 Medium |
| Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the Lua filter is vulnerable to denial of service. Attackers can send large request bodies for routes that have Lua filter enabled and trigger crashes. As of versions versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy no longer invokes the Lua coroutine if the filter has been reset. As a workaround for those whose Lua filter is buffering all requests/ responses, mitigate by using the buffer filter to avoid triggering the local reply in the Lua filter. | ||||
| CVE-2023-1799 | 1 Eyoucms | 1 Eyoucms | 2025-02-11 | 3.5 Low |
| A vulnerability, which was classified as problematic, was found in EyouCMS up to 1.5.4. This affects an unknown part of the file login.php. The manipulation of the argument tag_tag leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224751. | ||||
| CVE-2024-53966 | 1 Adobe | 1 Experience Manager | 2025-02-11 | 5.4 Medium |
| Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | ||||
| CVE-2024-53965 | 1 Adobe | 1 Experience Manager | 2025-02-11 | 5.4 Medium |
| Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access a manipulated link or input data into a vulnerable page. | ||||
| CVE-2024-53964 | 1 Adobe | 1 Experience Manager | 2025-02-11 | 5.4 Medium |
| Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | ||||
| CVE-2024-53963 | 1 Adobe | 1 Experience Manager | 2025-02-11 | 5.4 Medium |
| Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access a manipulated link or input data into a vulnerable page. | ||||