Export limit exceeded: 425024 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 111026 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (111026 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-22416 | 1 Juniper | 46 Junos, Mx10, Mx10000 and 43 more | 2025-04-08 | 7.5 High |
| A Buffer Overflow vulnerability in SIP ALG of Juniper Networks Junos OS allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). On all MX Series and SRX Series platform with SIP ALG enabled, when a malformed SIP packet is received, the flow processing daemon (flowd) will crash and restart. This issue affects: Juniper Networks Junos OS on MX Series and SRX Series 20.4 versions prior to 20.4R3-S5; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3-S2; 21.3 versions prior to 21.3R3-S1; 21.4 versions prior to 21.4R3; 22.1 versions prior to 22.1R1-S2, 22.1R2; 22.2 versions prior to 22.2R1-S1, 22.2R2. This issue does not affect Juniper Networks Junos OS versions prior to 20.4R1 on SRX Series. | ||||
| CVE-2025-3299 | 1 Phpgurukul | 1 Men Salon Management System | 2025-04-08 | 7.3 High |
| A vulnerability was found in PHPGurukul Men Salon Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /appointment.php. The manipulation of the argument Name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2024-3778 | 1 Ai3 | 1 Qbibot | 2025-04-08 | 7.2 High |
| The file upload functionality of Ai3 QbiBot does not properly restrict types of uploaded files, allowing remote attackers with administrator privilege to upload files with dangerous type containing malicious code. | ||||
| CVE-2022-42271 | 1 Nvidia | 2 Dgx A100, Dgx A100 Firmware | 2025-04-08 | 8.4 High |
| NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow and cause a denial of service or gain code execution | ||||
| CVE-2024-30645 | 1 Tenda | 3 Ac15, Ac15 Firmware, Ac15v1.0 Firmware | 2025-04-08 | 8 High |
| Tenda AC15V1.0 V15.03.20_multi has a command injection vulnerability via the deviceName parameter. | ||||
| CVE-2024-27521 | 1 Totolink | 2 A3300r, A3300r Firmware | 2025-04-08 | 8.0 High |
| TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote command execution (RCE) vulnerability via multiple parameters in the "setOpModeCfg" function. This security issue allows an attacker to take complete control of the device. In detail, exploitation allows unauthenticated, remote attackers to execute arbitrary system commands with administrative privileges (i.e., as user "root"). | ||||
| CVE-2022-36930 | 1 Zoom | 1 Rooms | 2025-04-08 | 8.8 High |
| Zoom Rooms for Windows installers before version 5.13.0 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain to escalate their privileges to the SYSTEM user. | ||||
| CVE-2024-28404 | 1 Totolink | 2 X2000r, X2000r Firmware | 2025-04-08 | 8 High |
| TOTOLINK X2000R before V1.0.0-B20231213.1013 contains a Stored Cross-site scripting (XSS) vulnerability in MAC Filtering under the Firewall Page. | ||||
| CVE-2024-27705 | 1 Leantime | 1 Leantime | 2025-04-08 | 7.6 High |
| Cross Site Scripting vulnerability in Leantime v3.0.6 allows attackers to execute arbitrary code via upload of crafted PDF file to the files/browse endpoint. | ||||
| CVE-2024-27474 | 1 Leantime | 1 Leantime | 2025-04-08 | 8.8 High |
| Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). This vulnerability allows malicious actors to perform unauthorized actions on behalf of authenticated users, specifically administrators. | ||||
| CVE-2024-22722 | 1 Formtools | 1 Form Tools | 2025-04-08 | 7.2 High |
| Server Side Template Injection (SSTI) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field under the add forms section of the application. | ||||
| CVE-2024-22719 | 1 Formtools | 1 Form Tools | 2025-04-08 | 8.1 High |
| SQL Injection vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary SQL commands via the 'keyword' when searching for a client. | ||||
| CVE-2024-25572 | 2 Ninjaforms, Saturday Drive | 2 Ninja Forms, Ninja Forms | 2025-04-08 | 8.8 High |
| Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. If a website administrator views a malicious page while logging in, unintended operations may be performed. | ||||
| CVE-2022-46623 | 1 Judging Management System Project | 1 Judging Management System | 2025-04-08 | 7.8 High |
| Judging Management System v1.0.0 was discovered to contain a SQL injection vulnerability via the username parameter. | ||||
| CVE-2022-46472 | 1 Helmet Store Showroom Site Project | 1 Helmet Store Showroom Site | 2025-04-08 | 7.2 High |
| Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /hss/classes/Users.php?f=delete. | ||||
| CVE-2022-46370 | 1 Maxum | 1 Rumpus | 2025-04-08 | 7.3 High |
| Rumpus - FTP server version 9.0.7.1 Improper Token Verification– vulnerability may allow bypassing identity verification. | ||||
| CVE-2022-25027 | 1 Rocketsoftware | 1 Trufusion Enterprise | 2025-04-08 | 7.5 High |
| The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authentication and access restricted pages by validating the user's session token when the "Password forgotten?" button is clicked. | ||||
| CVE-2022-25026 | 1 Rocketsoftware | 1 Trufusion Enterprise | 2025-04-08 | 7.5 High |
| A Server-Side Request Forgery (SSRF) in Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to gain access to sensitive resources on the internal network via a crafted HTTP request to /trufusionPortal/upDwModuleProxy. | ||||
| CVE-2017-5242 | 1 Rapid7 | 1 Insightvm | 2025-04-08 | 7.7 High |
| Nexpose and InsightVM virtual appliances downloaded between April 5th, 2017 and May 3rd, 2017 contain identical SSH host keys. Normally, a unique SSH host key should be generated the first time a virtual appliance boots. | ||||
| CVE-2025-3307 | 1 Code-projects | 1 Blood Bank Management System | 2025-04-08 | 7.3 High |
| A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /reset.php. The manipulation of the argument useremail leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | ||||