Export limit exceeded: 378307 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found ':' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (378307 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2023-43141 1 Totolink 4 A3700r, A3700r Firmware, N600r and 1 more 2024-11-21 9.8 Critical
TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control.
CVE-2023-43139 1 Franfinance 1 Franfinance 2024-11-21 9.8 Critical
An issue in franfinance before v.2.0.27 allows a remote attacker to execute arbitrary code via the validation.php, and controllers/front/validation.php components.
CVE-2023-43138 2 Tp-link, Tplink 3 Tl-er5120g, Tl-er5120g Firmware, Tl-er5120g 2024-11-21 8.8 High
TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds NAPT rules after authentication, and the rule name has an injection point.
CVE-2023-43137 2 Tp-link, Tplink 3 Tl-er5120g, Tl-er5120g Firmware, Tl-er5120g 2024-11-21 8.8 High
TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds ACL rules after authentication, and the rule name parameter has injection points.
CVE-2023-43135 1 Tp-link 3 Er5120g, Tl-er5120g, Tl-er5120g Firmware 2024-11-21 9.8 Critical
There is an unauthorized access vulnerability in TP-LINK ER5120G 4.0 2.0.0 Build 210817 Rel.80868n, which allows attackers to obtain sensitive information of the device without authentication, obtain user tokens, and ultimately log in to the device backend management.
CVE-2023-43134 1 Netis-systems 3 360r, 360r Firmware, 360rac1200 2024-11-21 9.8 Critical
There is an unauthorized access vulnerability in Netis 360RAC1200 v1.3.4517, which allows attackers to obtain sensitive information of the device without authentication, obtain user tokens, and ultimately log in to the device backend management.
CVE-2023-43132 1 Szvone 1 Vmqphp 2024-11-21 6.5 Medium
szvone vmqphp <=1.13 is vulnerable to SQL Injection. Unauthorized remote users can use sql injection attacks to obtain the hash of the administrator password.
CVE-2023-43131 1 Maxiguvenlik 1 General Device Manager 2024-11-21 9.8 Critical
General Device Manager 2.5.2.2 is vulnerable to Buffer Overflow.
CVE-2023-43130 2 D-link, Dlink 3 Dir-806 1200m11ac, Dir-806, Dir-806 Firmware 2024-11-21 9.8 Critical
D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection.
CVE-2023-43129 2 D-link, Dlink 3 Dir-806 1200m11ac, Dir-806, Dir-806 Firmware 2024-11-21 9.8 Critical
D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of REMOTE_PORT parameters.
CVE-2023-43128 2 D-link, Dlink 4 Dir-806 1200m11ac, Dir806a1 Fw100cnb11, Dir-806 and 1 more 2024-11-21 9.8 Critical
D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of HTTP_ST parameters.
CVE-2023-43125 1 F5 2 Big-ip Access Policy Manager, Big-ip Access Policy Manager Client 2024-11-21 6.8 Medium
BIG-IP APM clients may send IP traffic outside of the VPN tunnel.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVE-2023-43124 1 F5 2 Big-ip Access Policy Manager, Big-ip Access Policy Manager Client 2024-11-21 5.3 Medium
BIG-IP APM clients may send IP traffic outside of the VPN tunnel.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVE-2023-43122 1 Samsung 18 Exynos 1080, Exynos 1080 Firmware, Exynos 1280 and 15 more 2024-11-21 4.8 Medium
Samsung Mobile Processor and Wearable Processor (Exynos 980, 850, 1080, 2100, 2200, 1280, 1380, 1330, and W920) allow Information Disclosure in the Bootloader.
CVE-2023-43121 1 Extremenetworks 1 Exos 2024-11-21 7.5 High
A Directory Traversal vulnerability discovered in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, before 22.7, and before 31.7.2 allows attackers to read arbitrary files.
CVE-2023-43120 1 Extremenetworks 1 Exos 2024-11-21 8.8 High
An issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, before 22.7 and before 31.7.1 allows attackers to gain escalated privileges via crafted HTTP request.
CVE-2023-43119 1 Extremenetworks 1 Exos 2024-11-21 9.8 Critical
An Access Control issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, also fixed in 22.7, 31.7.2 allows attackers to gain escalated privileges using crafted telnet commands via Redis server.
CVE-2023-43118 1 Extremenetworks 1 Exos 2024-11-21 8.8 High
Cross Site Request Forgery (CSRF) vulnerability in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, fixed in 31.7.2 and 32.5.1.5 allows attackers to run arbitrary code and cause other unspecified impacts via /jsonrpc API.
CVE-2023-43116 1 Buildkite 1 Elastic Ci Stack 2024-11-21 7.8 High
A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions script.
CVE-2023-43115 3 Artifex, Fedoraproject, Redhat 4 Ghostscript, Fedora, Enterprise Linux and 1 more 2024-11-21 8.8 High
In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the IJS device, or change the IjsServer parameter, after SAFER has been activated. NOTE: it is a documented risk that the IJS server can be specified on a gs command line (the IJS device inherently must execute a command to start the IJS server).