Export limit exceeded: 35344 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (35344 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-27576 | 1 Apache | 1 Openmeetings | 2025-02-13 | 7.5 High |
| If was found that the NetTest web service can be used to overload the bandwidth of a Apache OpenMeetings server. This issue was addressed in Apache OpenMeetings 6.0.0 | ||||
| CVE-2021-26919 | 1 Apache | 1 Druid | 2025-02-13 | 8.8 High |
| Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Druid server processes. This issue was addressed in Apache Druid 0.20.2 | ||||
| CVE-2021-25646 | 1 Apache | 1 Druid | 2025-02-13 | 8.8 High |
| Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process. | ||||
| CVE-2021-25329 | 4 Apache, Debian, Oracle and 1 more | 15 Tomcat, Debian Linux, Agile Plm and 12 more | 2025-02-13 | 7.0 High |
| The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue. | ||||
| CVE-2020-17526 | 1 Apache | 1 Airflow | 2025-02-13 | 7.7 High |
| Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config. | ||||
| CVE-2020-13936 | 4 Apache, Debian, Oracle and 1 more | 22 Velocity Engine, Wss4j, Debian Linux and 19 more | 2025-02-13 | 8.8 High |
| An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2. | ||||
| CVE-2019-4036 | 1 Ibm | 1 Security Access Manager | 2025-02-13 | 7.5 High |
| IBM Security Access Manager Appliance could allow unauthenticated attacker to cause a denial of service in the reverse proxy component. IBM X-Force ID: 156159. | ||||
| CVE-2023-28342 | 1 Zohocorp | 1 Manageengine Adselfservice Plus | 2025-02-13 | 7.5 High |
| Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API. | ||||
| CVE-2024-36857 | 2 Homebrew, Janhq | 2 Jan, Jan | 2025-02-13 | 7.5 High |
| Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface. | ||||
| CVE-2024-24198 | 1 Pymumu | 1 Smartdns | 2025-02-13 | 7.5 High |
| smartdns commit 54b4dc was discovered to contain a misaligned address at smartdns/src/util.c. | ||||
| CVE-2024-24195 | 2 Robdns, Robertdavidgraham | 2 Robdns, Robdns | 2025-02-13 | 7.5 High |
| robdns commit d76d2e6 was discovered to contain a misaligned address at /src/zonefile-insertion.c. | ||||
| CVE-2022-35797 | 1 Microsoft | 2 Windows 10, Windows 11 | 2025-02-13 | 6.1 Medium |
| Windows Hello Security Feature Bypass Vulnerability | ||||
| CVE-2022-35795 | 1 Microsoft | 10 Windows 10, Windows 11, Windows 7 and 7 more | 2025-02-13 | 7.8 High |
| Windows Error Reporting Service Elevation of Privilege Vulnerability | ||||
| CVE-2022-35794 | 1 Microsoft | 5 Windows 10, Windows 11, Windows Server 2016 and 2 more | 2025-02-13 | 8.1 High |
| Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability | ||||
| CVE-2023-26817 | 1 Pgyer | 1 Codefever | 2025-02-12 | 8.8 High |
| codefever before 2023.2.7-commit-b1c2e7f was discovered to contain a remote code execution (RCE) vulnerability via the component /controllers/api/user.php. | ||||
| CVE-2022-35784 | 1 Microsoft | 1 Azure Site Recovery Vmware To Azure | 2025-02-12 | 6.5 Medium |
| Azure Site Recovery Elevation of Privilege Vulnerability | ||||
| CVE-2022-35783 | 1 Microsoft | 1 Azure Site Recovery Vmware To Azure | 2025-02-12 | 4.4 Medium |
| Azure Site Recovery Elevation of Privilege Vulnerability | ||||
| CVE-2025-20892 | 1 Samsung | 1 Android | 2025-02-12 | 5.9 Medium |
| Protection Mechanism Failure in bootloader prior to SMR Jan-2025 Release 1 allows physical attackers to allow to execute fastboot command. User interaction is required for triggering this vulnerability. | ||||
| CVE-2025-0802 | 1 Mayurik | 1 Best Employee Management System | 2025-02-12 | 7.3 High |
| A vulnerability classified as critical was found in SourceCodester Best Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/View_user.php of the component Administrative Endpoint. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2024-45626 | 1 Apache | 1 James Server | 2025-02-12 | 6.5 Medium |
| Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service. Users are recommended to upgrade to version 3.7.6 and 3.8.2, which fix this issue. | ||||