Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (29863 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2017-20160 1 Flitto 1 Express-param 2024-11-21 6.3 Medium
A vulnerability was found in flitto express-param up to 0.x. It has been classified as critical. This affects an unknown part of the file lib/fetchParams.js. The manipulation leads to improper handling of extra parameters. It is possible to initiate the attack remotely. Upgrading to version 1.0.0 is able to address this issue. The identifier of the patch is db94f7391ad0a16dcfcba8b9be1af385b25c42db. It is recommended to upgrade the affected component. The identifier VDB-217149 was assigned to this vulnerability.
CVE-2017-18920 1 Mattermost 1 Mattermost Server 2024-11-21 9.8 Critical
An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy.
CVE-2016-20014 1 Pam Tacplus Project 1 Pam Tacplus 2024-11-21 9.8 Critical
In pam_tacplus.c in pam_tacplus before 1.4.1, pam_sm_acct_mgmt does not zero out the arep data structure.
CVE-2016-20012 2 Netapp, Openbsd 5 Clustered Data Ontap, Hci Management Node, Ontap Select Deploy Administration Utility and 2 more 2024-11-21 5.3 Medium
OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not recognize user enumeration as a vulnerability for this product
CVE-2016-20008 1 Rest\/json Project 1 Rest\/json 2024-11-21 7.5 High
The REST/JSON project 7.x-1.x for Drupal allows session enumeration, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.
CVE-2016-20003 1 Rest\/json Project 1 Rest\/json 2024-11-21 7.5 High
The REST/JSON project 7.x-1.x for Drupal allows user enumeration, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.
CVE-2015-1853 2 Redhat, Tuxfamily 2 Enterprise Linux, Chrony 2024-11-21 6.5 Medium
chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers with knowledge of NTP peering to cause a denial of service (inability to synchronize) via random timestamps in crafted NTP data packets.
CVE-2014-8183 2 Redhat, Theforeman 3 Satellite, Satellite Capsule, Foreman 2024-11-21 7.4 High
It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations.
CVE-2014-5138 1 Iii 1 Sierra 2024-11-21 7.5 High
Innovative Interfaces Sierra Library Services Platform 1.2_3 does not properly handle query strings with multiple instances of the same parameter, which allows remote attackers to bypass parameter validation via unspecified vectors, possibly related to the Webpac Pro submodule.
CVE-2014-2680 1 Xmind 1 Xmind 2024-11-21 8.1 High
The update process in Xmind 3.4.1 and earlier allow remote attackers to execute arbitrary code via a man-in-the-middle attack.
CVE-2014-125036 1 Ansible-ntp Project 1 Ansible-ntp 2024-11-21 2.6 Low
A vulnerability, which was classified as problematic, has been found in drybjed ansible-ntp. Affected by this issue is some unknown functionality of the file meta/main.yml. The manipulation leads to insufficient control of network message volume. The attack can only be done within the local network. The complexity of an attack is rather high. The exploitation is known to be difficult. The patch is identified as ed4ca2cf012677973c220cdba36b5c60bfa0260b. It is recommended to apply a patch to fix this issue. VDB-217190 is the identifier assigned to this vulnerability.
CVE-2014-0021 3 Chrony Project, Debian, Fedoraproject 3 Chrony, Debian Linux, Fedora 2024-11-21 7.5 High
Chrony before 1.29.1 has traffic amplification in cmdmon protocol
CVE-2013-3629 1 Ispconfig 1 Ispconfig 2024-11-21 8.8 High
ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution
CVE-2013-2009 1 Automattic 1 Wp Super Cache 2024-11-21 8.8 High
WordPress WP Super Cache Plugin 1.2 has Remote PHP Code Execution
CVE-2013-1924 1 Skill 1 Commerce Skrill 2024-11-21 7.5 High
Commerce Skrill (Formerly Moneybookers) has an Access bypass vulnerability in all versions prior to 7.x-1.2
CVE-2013-1202 1 Cisco 1 Ace Application Control Engine Module A2 2024-11-21 7.5 High
Cisco ACE A2(3.6) allows log retention DoS.
CVE-2007-6745 2 Clamav, Debian 2 Clamav, Debian Linux 2024-11-21 9.8 Critical
clamav 0.91.2 suffers from a floating point exception when using ScanOLE2.
CVE-2007-3732 1 Linux 1 Linux Kernel 2024-11-21 5.5 Medium
In Linux 2.6 before 2.6.23, the TRACE_IRQS_ON function in iret_exc calls a C function without ensuring that the segments are set properly. The kernel's %fs needs to be restored before the call in TRACE_IRQS_ON and before enabling interrupts, so that "current" references work. Without this, "current" used in the window between iret_exc and the middle of error_code where %fs is reset, would crash.
CVE-2004-2776 1 Goscript Project 1 Goscript 2024-11-20 9.8 Critical
go.cgi in GoScript 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) query string or (2) artarchive parameter.
CVE-2024-52428 1 Scripteo 2 Ads Booster, Ads Booster By Ads Pro 2024-11-20 8.1 High
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Scripteo Ads Booster by Ads Pro allows PHP Local File Inclusion.This issue affects Ads Booster by Ads Pro: from n/a through 1.12.