Export limit exceeded: 396494 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 396494 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 396494 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 396494 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (100456 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-22915 | 1 Zyxel | 24 Usg 20w-vpn, Usg 20w-vpn Firmware, Usg Flex 100 and 21 more | 2025-02-12 | 7.5 High |
| A buffer overflow vulnerability in the “fbwifi_forward.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.30 through 5.35, USG20(W)-VPN firmware versions 4.30 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote unauthenticated attacker to cause DoS conditions by sending a crafted HTTP request if the Facebook WiFi function were enabled on an affected device. | ||||
| CVE-2023-22914 | 1 Zyxel | 22 Usg Flex 100, Usg Flex 100 Firmware, Usg Flex 100w and 19 more | 2025-02-12 | 7.2 High |
| A path traversal vulnerability in the “account_print.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker with administrator privileges to execute unauthorized OS commands in the “tmp” directory by uploading a crafted file if the hotspot function were enabled. | ||||
| CVE-2023-22913 | 1 Zyxel | 22 Usg Flex 100, Usg Flex 100 Firmware, Usg Flex 100w and 19 more | 2025-02-12 | 8.1 High |
| A post-authentication command injection vulnerability in the “account_operator.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker to modify device configuration data, resulting in denial-of-service (DoS) conditions on an affected device. | ||||
| CVE-2023-27729 | 1 F5 | 1 Njs | 2025-02-12 | 7.5 High |
| Nginx NJS v0.7.10 was discovered to contain an illegal memcpy via the function njs_vmcode_return at src/njs_vmcode.c. | ||||
| CVE-2023-27727 | 1 F5 | 1 Njs | 2025-02-12 | 7.5 High |
| Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_function_frame at src/njs_function.h. | ||||
| CVE-2023-26991 | 1 Swftools | 1 Swftools | 2025-02-12 | 7.8 High |
| SWFTools v0.9.2 was discovered to contain a stack-use-after-scope in the swf_ReadSWF2 function in lib/rfxswf.c. | ||||
| CVE-2023-1522 | 1 Genetec | 1 Security Center | 2025-02-12 | 8.8 High |
| SQL Injection in the Hardware Inventory report of Security Center 5.11.2. | ||||
| CVE-2020-36072 | 1 Tailor Management System Project | 1 Tailor Management System | 2025-02-12 | 8.8 High |
| SQL injection vulnerability found in Tailor Management System v.1 allows a remote attacker to execute arbitrary code via the id parameter. | ||||
| CVE-2020-36071 | 1 Tailor Management System Project | 1 Tailor Management System | 2025-02-12 | 8.8 High |
| SQL injection vulnerability found in Tailor Management System v.1 allows a remote authenticated attacker to execute arbitrary code via the customer parameter of the email.php page. | ||||
| CVE-2020-19678 | 2 Oisf, Pfsense | 3 Suricata, Pfsense, Suricata Package | 2025-02-12 | 7.5 High |
| Directory Traversal vulnerability found in Pfsense v.2.1.3 and Pfsense Suricata v.1.4.6 pkg v.1.0.1 allows a remote attacker to obtain sensitive information via the file parameter to suricata/suricata_logs_browser.php. | ||||
| CVE-2023-21491 | 1 Samsung | 1 Android | 2025-02-12 | 8.5 High |
| Improper access control vulnerability in ThemeManager prior to SMR May-2023 Release 1 allows local attackers to write arbitrary files with system privilege. | ||||
| CVE-2023-21489 | 1 Samsung | 1 Android | 2025-02-12 | 7.1 High |
| Heap out-of-bounds write vulnerability in bootloader prior to SMR May-2023 Release 1 allows a physical attacker to execute arbitrary code. | ||||
| CVE-2023-22917 | 1 Zyxel | 36 Atp100, Atp100 Firmware, Atp100w and 33 more | 2025-02-12 | 7.5 High |
| A buffer overflow vulnerability in the “sdwan_iface_ipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG FLEX 50(W) firmware versions 5.10 through 5.32, USG20(W)-VPN firmware versions 5.10 through 5.32, and VPN series firmware versions 5.00 through 5.35, which could allow a remote unauthenticated attacker to cause a core dump with a request error message on a vulnerable device by uploading a crafted configuration file. | ||||
| CVE-2023-27489 | 1 Kiwitcms | 1 Kiwi Tcms | 2025-02-12 | 7.6 High |
| Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS accepts SVG files uploaded by users which could potentially contain JavaScript code. If SVG images are viewed directly, i.e. not rendered in an HTML page, this JavaScript code could execute. This vulnerability has been fixed by configuring Kiwi TCMS to serve with the Content-Security-Policy HTTP header which blocks inline JavaScript in all modern browsers. This configuration change is provided in version 12.1 and users are advised to upgrade. Users unable to upgrade may set their Content-Security-Policy HTTP header manually. | ||||
| CVE-2023-25550 | 1 Schneider-electric | 1 Struxureware Data Center Expert | 2025-02-12 | 7.2 High |
| A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that allows remote code execution via the “hostname” parameter when maliciously crafted hostname syntax is entered. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior) | ||||
| CVE-2023-1762 | 1 Phpmyfaq | 1 Phpmyfaq | 2025-02-12 | 8.8 High |
| Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||||
| CVE-2023-25554 | 1 Schneider-electric | 1 Struxureware Data Center Expert | 2025-02-12 | 7.8 High |
| A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that allows a local privilege escalation on the appliance when a maliciously crafted Operating System command is entered on the device. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior) | ||||
| CVE-2023-25547 | 1 Schneider-electric | 1 Struxureware Data Center Expert | 2025-02-12 | 8.8 High |
| A CWE-863: Incorrect Authorization vulnerability exists that could allow remote code execution on upload and install packages when a hacker is using a low privileged user account. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior) | ||||
| CVE-2024-3460 | 1 Kioware | 1 Kioware | 2025-02-12 | 7.4 High |
| In KioWare for Windows (versions all through 8.34) it is possible to exit this software and use other already opened applications utilizing a short time window before the forced automatic logout occurs. Then, by using some built-in function of these applications, one may launch any other programs. In order to exploit this vulnerability external applications must be left running when the KioWare software is launched. Additionally, an attacker must know the PIN set for this Kioware instance and also slow down the application with some specific task which extends the usable time window. | ||||
| CVE-2023-28726 | 1 Panasonic | 2 Aiseg2, Aiseg2 Firmware | 2025-02-12 | 7.5 High |
| Panasonic AiSEG2 versions 2.80F through 2.93A allows remote attackers to execute arbitrary OS commands. | ||||