Export limit exceeded: 418405 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (46123 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2023-36555 1 Fortinet 1 Fortios 2024-11-21 3.9 Low
An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via the SAML and Security Fabric components.
CVE-2023-36516 1 Thimpress 1 Learnpress 2024-11-21 7.6 High
Missing Authorization vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.3.
CVE-2023-36515 1 Thimpress 1 Learnpress 2024-11-21 7.3 High
Missing Authorization vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.3.
CVE-2023-36387 1 Apache 1 Superset 2024-11-21 5.4 Medium
An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections.
CVE-2023-36339 1 Webboss 1 Webboss.io Cms 2024-11-21 7.5 High
An access control issue in WebBoss.io CMS v3.7.0.1 allows attackers to access the Website Backup Tool via a crafted GET request.
CVE-2023-36311 1 Phpjabbers 1 Document Creator 2024-11-21 9.8 Critical
There is a SQL injection (SQLi) vulnerability in the "column" parameter of index.php in PHPJabbers Document Creator v1.0.
CVE-2023-36293 1 Wmanager 1 Wmanager 2024-11-21 7.5 High
SQL injection vulnerability in wmanager v.1.0.7 and before allows a remote attacker to obtain sensitive information via a crafted script to the company.php component.
CVE-2023-36213 1 Motocms 1 Motocms 2024-11-21 9.8 Critical
SQL injection vulnerability in MotoCMS v.3.4.3 allows a remote attacker to gain privileges via the keyword parameter of the search function.
CVE-2023-36189 1 Langchain 1 Langchain 2024-11-21 7.5 High
SQL injection vulnerability in langchain before v0.0.247 allows a remote attacker to obtain sensitive information via the SQLDatabaseChain component.
CVE-2023-36140 1 Phpjabbers 1 Cleaning Business Software 2024-11-21 9.8 Critical
In PHPJabbers Cleaning Business Software 1.0, there is no encryption on user passwords allowing an attacker to gain access to all user accounts.
CVE-2023-36092 1 Dlink 2 Dir-859, Dir-859 Firmware 2024-11-21 9.8 Critical
Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via via phpcgi_main. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2023-36091 2 D-link, Dlink 3 Dir-895, Dir-895l, Dir-895l Firmware 2024-11-21 9.8 Critical
Authentication Bypass vulnerability in D-Link DIR-895 FW102b07 allows remote attackers to gain escalated privileges via via function phpcgi_main in cgibin. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2023-36090 1 Dlink 2 Dir-885l, Dir-885l Firmware 2024-11-21 9.8 Critical
Authentication Bypass vulnerability in D-Link DIR-885L FW102b01 allows remote attackers to gain escalated privileges via phpcgi. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2023-36089 2 D-link, Dlink 3 Dir-645 Firmware, Dir-645, Dir-645 Firmware 2024-11-21 9.8 Critical
Authentication Bypass vulnerability in D-Link DIR-645 firmware version 1.03 allows remote attackers to gain escalated privileges via function phpcgi_main in cgibin. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2023-36076 1 Pocketmanga 1 Smanga 2024-11-21 9.8 Critical
SQL Injection vulnerability in smanga version 3.1.9 and earlier, allows remote attackers to execute arbitrary code and gain sensitive information via mediaId, mangaId, and userId parameters in php/history/add.php.
CVE-2023-36054 4 Debian, Mit, Netapp and 1 more 8 Debian Linux, Kerberos 5, Active Iq Unified Manager and 5 more 2024-11-21 6.5 Medium
lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.
CVE-2023-36002 1 Proofpoint 1 Insider Threat Management Server 2024-11-21 4.3 Medium
A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected.
CVE-2023-36000 2 Apple, Proofpoint 2 Macos, Insider Threat Management Server 2024-11-21 6.5 Medium
A missing authorization check in the MacOS agent configuration endpoint of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to obtain sensitive information. Successful exploitation requires an attacker to first obtain a valid agent authentication token. All versions before 7.14.3 are affected.
CVE-2023-35998 1 Proofpoint 1 Insider Threat Management Server 2024-11-21 4.6 Medium
A missing authorization check in multiple SOAP endpoints of the Insider Threat Management Server enables an attacker on an adjacent network to read and write unauthorized objects. Successful exploitation requires an attacker to first obtain a valid agent authentication token. All versions before 7.14.3 are affected.
CVE-2023-35983 1 Apple 1 Macos 2024-11-21 5.5 Medium
This issue was addressed with improved data protection. This issue is fixed in macOS Monterey 12.6.8, macOS Ventura 13.5, macOS Big Sur 11.7.9. An app may be able to modify protected parts of the file system.