Search

Expected end of text, found ':' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (380204 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2023-50708 1 Yiiframework 1 Yii2-authclient 2024-11-21 6.1 Medium
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 `state` and OpenID Connect `nonce` is vulnerable for a `timing attack` since it is compared via regular string comparison (instead of `Yii::$app->getSecurity()->compareString()`). Version 2.2.15 contains a patch for the issue. No known workarounds are available.
CVE-2023-50707 1 Efacec 2 Bcu 500, Bcu 500 Firmware 2024-11-21 9.6 Critical
Through the exploitation of active user sessions, an attacker could send custom requests to cause a denial-of-service condition on the device.
CVE-2023-50705 1 Efacec 2 Uc 500e, Uc 500e Firmware 2024-11-21 5.3 Medium
An attacker could create malicious requests to obtain sensitive information about the web server.
CVE-2023-50704 1 Efacec 2 Uc 500e, Uc 500e Firmware 2024-11-21 4.3 Medium
An attacker could construct a URL within the application that causes a redirection to an arbitrary external domain and could be leveraged to facilitate phishing attacks against application users.
CVE-2023-50639 1 Iscute 1 Cute Http File Server 2024-11-21 5.4 Medium
Cross Site Scripting (XSS) vulnerability in CuteHttpFileServer v.1.0 and v.2.0 allows attackers to obtain sensitive information via the file upload function in the home page.
CVE-2023-50628 1 Libming 1 Libming 2024-11-21 9.8 Critical
Buffer Overflow vulnerability in libming version 0.4.8, allows attackers to execute arbitrary code and obtain sensitive information via parser.c component.
CVE-2023-50589 1 Embras 1 Geosiap Erp 2024-11-21 9.8 Critical
Grupo Embras GEOSIAP ERP v2.2.167.02 was discovered to contain a SQL injection vulnerability via the codLogin parameter on the login page.
CVE-2023-50578 1 Mingsoft 1 Mcms 2024-11-21 9.8 Critical
Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.
CVE-2023-50571 1 Jeasy 1 Easy Rules 2024-11-21 7.8 High
easy-rules-mvel v4.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component MVELRule.
CVE-2023-50570 1 Seancfoley 1 Ipaddress 2024-11-21 5.5 Medium
An issue in the component IPAddressBitsDivision of IPAddress v5.1.0 leads to an infinite loop. This is disputed because an infinite loop occurs only for cases in which the developer supplies invalid arguments. The product is not intended to always halt for contrived inputs.
CVE-2023-50566 1 Eyoucms 1 Eyoucms 2024-11-21 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in EyouCMS-V1.6.5-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Public Security Registration Number parameter.
CVE-2023-50564 1 Pluck-cms 1 Pluck 2024-11-21 8.8 High
An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading a crafted ZIP file.
CVE-2023-50563 1 Sem-cms 1 Semcms 2024-11-21 9.8 Critical
Semcms v4.8 was discovered to contain a SQL injection vulnerability via the AID parameter at SEMCMS_Function.php.
CVE-2023-50559 1 Openxiangshan 1 Xiangshan 2024-11-21 5.5 Medium
An issue was discovered in XiangShan v2.1, allows local attackers to obtain sensitive information via the L1D cache.
CVE-2023-50550 1 Layui 1 Layui 2024-11-21 5.4 Medium
layui up to v2.74 was discovered to contain a cross-site scripting (XSS) vulnerability via the data-content parameter.
CVE-2023-50481 1 Blinksocks 1 Blinksocks 2024-11-21 7.5 High
An issue was discovered in blinksocks version 3.3.8, allows remote attackers to obtain sensitive information via weak encryption algorithms in the component /presets/ssr-auth-chain.js.
CVE-2023-50477 1 Nos 1 Nos Client 2024-11-21 9.8 Critical
An issue was discovered in nos client version 0.6.6, allows remote attackers to escalate privileges via getRPCEndpoint.js.
CVE-2023-50473 1 Billahmed 1 Qbit Matui 2024-11-21 5.4 Medium
Cross-Site Scripting (XSS) vulnerability in bill-ahmed qbit-matUI version 1.16.4, allows remote attackers to obtain sensitive information via fixed session identifiers (SID) in index.js file.
CVE-2023-50469 1 Szlbt 2 Lbt-t300-t310, Lbt-t300-t310 Firmware 2024-11-21 9.8 Critical
Shenzhen Libituo Technology Co., Ltd LBT-T300-T310 v2.2.2.6 was discovered to contain a buffer overflow via the ApCliEncrypType parameter at /apply.cgi.
CVE-2023-50466 1 Weintek 2 Cmt2078x, Cmt2078x Firmware 2024-11-21 8.8 High
An authenticated command injection vulnerability in Weintek cMT2078X easyweb Web Version v2.1.3, OS v20220215 allows attackers to execute arbitrary code or access sensitive information via injecting a crafted payload into the HMI Name parameter.