Export limit exceeded: 109460 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (109460 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-2946 | 1 Open-emr | 1 Openemr | 2025-01-14 | 8.1 High |
| Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1. | ||||
| CVE-2020-9236 | 1 Huawei | 1 Fusioncompute | 2025-01-14 | 8.8 High |
| There is an improper interface design vulnerability in Huawei product. A module interface of the impated product does not deal with some operations properly. Attackers can exploit this vulnerability to perform malicious operatation to compromise module service. (Vulnerability ID: HWPSIRT-2020-05010) This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2020-9236. | ||||
| CVE-2022-48681 | 1 Huawei | 2 Egrt-00, Egrt-00 Firmware | 2025-01-14 | 7.2 High |
| Some Huawei smart speakers have a memory overflow vulnerability. Successful exploitation of this vulnerability may cause certain functions to fail. | ||||
| CVE-2023-2942 | 1 Open-emr | 1 Openemr | 2025-01-14 | 8.1 High |
| Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.1. | ||||
| CVE-2023-2943 | 1 Open-emr | 1 Openemr | 2025-01-14 | 8.8 High |
| Code Injection in GitHub repository openemr/openemr prior to 7.0.1. | ||||
| CVE-2023-33192 | 1 Tweedegolf | 1 Ntpd-rs | 2025-01-14 | 7.5 High |
| ntpd-rs is an NTP implementation written in Rust. ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the server expects. The server also crashes when it is not configured to handle NTS packets. The issue was caused by improper slice indexing. The indexing operations were replaced by safer alternatives that do not crash the ntpd-rs server process but instead properly handle the error condition. A patch was released in version 0.3.3. | ||||
| CVE-2023-32686 | 1 Kiwitcms | 1 Kiwi Tcms | 2025-01-14 | 8.1 High |
| Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded. The upload validation checks were not robust enough which left the possibility of an attacker to circumvent them and upload a potentially dangerous file. Exploiting this flaw, a combination of files could be uploaded so that they work together to circumvent the existing Content-Security-Policy and allow execution of arbitrary JavaScript in the browser. This issue has been patched in version 12.3. | ||||
| CVE-2022-24628 | 1 Audiocodes | 1 Device Manager Express | 2025-01-14 | 7.2 High |
| An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is authenticated SQL injection in the id parameter of IPPhoneFirmwareEdit.php. | ||||
| CVE-2021-27825 | 1 Mercurycom | 2 Mac1200r, Mac1200r Firmware | 2025-01-14 | 7.5 High |
| A directory traversal vulnerability on Mercury MAC1200R devices allows attackers to read arbitrary files via a web-static/ URL. | ||||
| CVE-2023-30253 | 1 Dolibarr | 1 Dolibarr Erp\/crm | 2025-01-14 | 8.8 High |
| Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data. | ||||
| CVE-2023-29742 | 1 Bestweather Project | 1 Bestweather | 2025-01-14 | 7.8 High |
| An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a code execution attack by manipulating the database. | ||||
| CVE-2023-29740 | 1 Amdroidapp | 1 Alarm Clock For Heavy Sleepers | 2025-01-14 | 7.5 High |
| An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause a denial of service attack by manipulating the database. | ||||
| CVE-2023-29738 | 1 Wavekeyboard | 1 Wave Animated Keyboard Emoji | 2025-01-14 | 7.8 High |
| An issue found in Wave Animated Keyboard Emoji v.1.70.7 for Android allows a local attacker to cause code execution and escalation of Privileges via the database files. | ||||
| CVE-2023-28344 | 2 Faronics, Microsoft | 2 Insight, Windows | 2025-01-14 | 7.1 High |
| An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application allows unauthenticated attackers to view constantly updated screenshots of student desktops and to submit falsified screenshots on behalf of students. Attackers are able to view screenshots of student desktops without their consent. These screenshots may potentially contain sensitive/personal data. Attackers can also rapidly submit falsified images, hiding the actual contents of student desktops from the Teacher Console. | ||||
| CVE-2022-47525 | 1 Fox-it | 2 Fox Datadiode, Fox Datadiode Firmware | 2025-01-14 | 7.5 High |
| Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a Divide-by-Zero vulnerability in the packet parser. A remote attacker could leverage this vulnerability to cause a denial-of-service. Exploitation of this issue does not require user interaction. | ||||
| CVE-2022-47029 | 1 Actionlauncher | 1 Action Launcher | 2025-01-14 | 7.8 High |
| An issue was found in Action Launcher v50.5 allows an attacker to escalate privilege via modification of the intent string to function update. | ||||
| CVE-2023-27988 | 1 Zyxel | 6 Nas326, Nas326 Firmware, Nas540 and 3 more | 2025-01-14 | 7.2 High |
| The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device remotely. | ||||
| CVE-2023-2950 | 1 Open-emr | 1 Openemr | 2025-01-14 | 8.1 High |
| Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1. | ||||
| CVE-2024-2980 | 1 Tenda | 2 Fh1202, Fh1202 Firmware | 2025-01-14 | 8.8 High |
| A vulnerability, which was classified as critical, has been found in Tenda FH1202 1.2.0.14(408). This issue affects the function formexeCommand of the file /goform/execCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258149 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2024-2981 | 1 Tenda | 2 Fh1202, Fh1202 Firmware | 2025-01-14 | 8.8 High |
| A vulnerability, which was classified as critical, was found in Tenda FH1202 1.2.0.14(408). Affected is the function form_fast_setting_wifi_set of the file /goform/fast_setting_wifi_set. The manipulation of the argument ssid leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-258150 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | ||||