Export limit exceeded: 377116 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (377116 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-39903 | 1 Fujitsu | 1 Software Infrastructure Manager | 2024-11-21 | 5.9 Medium |
| An issue was discovered in Fujitsu Software Infrastructure Manager (ISM) before 2.8.0.061. The ismsnap component (in this specific case at /var/log/fujitsu/ServerViewSuite/ism/FirmwareManagement/FirmwareManagement.log) allows insecure collection and storage of authorization credentials in cleartext. That occurs when users perform any ISM Firmware Repository Address setup test (Test the Connection), or regularly authorize against an already configured remote firmware repository site, as set up in ISM Firmware Repository Address. A privileged attacker is therefore able to potentially gather the associated ismsnap maintenance data, in the same manner as a trusted party allowed to export ismsnap data from ISM. The preconditions for an ISM installation to be generally vulnerable are that the Download Firmware (Firmware Repository Server) function is enabled and configured, and that the character \ (backslash) is used in a user credential (i.e., user/ID or password) of the remote proxy host / firmware repository server. NOTE: this may overlap CVE-2023-39379. | ||||
| CVE-2023-39902 | 2 Nxp, U Boot Secondary Program Loader\/spl\/ | 6 I.mx 8m, I.mx 8m Mini, I.mx 8m Nano and 3 more | 2024-11-21 | 7 High |
| A software vulnerability has been identified in the U-Boot Secondary Program Loader (SPL) before 2023.07 on select NXP i.MX 8M family processors. Under certain conditions, a crafted Flattened Image Tree (FIT) format structure can be used to overwrite SPL memory, allowing unauthenticated software to execute on the target, leading to privilege escalation. This affects i.MX 8M, i.MX 8M Mini, i.MX 8M Nano, and i.MX 8M Plus. | ||||
| CVE-2023-39854 | 1 Atx | 1 Ucrypt | 2024-11-21 | 6.5 Medium |
| The web interface of ATX Ucrypt through 3.5 allows authenticated users (or attackers using default credentials for the admin, master, or user account) to include files via a URL in the /hydra/view/get_cc_url url parameter. There can be resultant SSRF. | ||||
| CVE-2023-39852 | 1 Doctor Appointment System Project | 1 Doctor Appointment System | 2024-11-21 | 9.8 Critical |
| Doctormms v1.0 was discovered to contain a SQL injection vulnerability via the $userid parameter at myAppoinment.php. NOTE: this is disputed by a third party who claims that the userid is a session variable controlled by the server, and thus cannot be used for exploitation. The original reporter counterclaims that this originates from $_SESSION["userid"]=$_POST["userid"] at line 68 in doctors\doctorlogin.php, where userid under POST is not a session variable controlled by the server. | ||||
| CVE-2023-39850 | 1 Schoolmate Project | 1 Schoolmate | 2024-11-21 | 9.8 Critical |
| Schoolmate v1.3 was discovered to contain multiple SQL injection vulnerabilities via the $courseid and $teacherid parameters at DeleteFunctions.php. | ||||
| CVE-2023-39846 | 1 Pantsel | 1 Konga | 2024-11-21 | 9.8 Critical |
| An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token. | ||||
| CVE-2023-39843 | 1 Sulimet | 2 5-in-1 Smart Door Lock, 5-in-1 Smart Door Lock Firmware | 2024-11-21 | 2.4 Low |
| Missing encryption in the RFID tag of Suleve 5-in-1 Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity to the original device. | ||||
| CVE-2023-39842 | 1 Mydigoo | 2 Dg-hamb Smart Home Security System, Dg-hamb Smart Home Security System Firmware | 2024-11-21 | 2.4 Low |
| Missing encryption in the RFID tag of Digoo DG-HAMB Smart Home Security System v1.0 allows attackers to create a cloned tag via brief physical proximity to the original device. | ||||
| CVE-2023-39841 | 1 Etekcity | 2 3-in-1 Smart Door Lock, 3-in-1 Smart Door Lock Firmware | 2024-11-21 | 4.6 Medium |
| Missing encryption in the RFID tag of Etekcity 3-in-1 Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity to the original device. | ||||
| CVE-2023-39834 | 1 Pbootcms | 1 Pbootcms | 2024-11-21 | 9.8 Critical |
| PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via create_function. | ||||
| CVE-2023-39829 | 1 Tenda | 2 A18, A18 Firmware | 2024-11-21 | 7.5 High |
| Tenda A18 V15.13.07.09 was discovered to contain a stack overflow via the wpapsk_crypto2_4g parameter in the fromSetWirelessRepeat function. | ||||
| CVE-2023-39828 | 1 Tenda | 2 A18, A18 Firmware | 2024-11-21 | 7.5 High |
| Tenda A18 V15.13.07.09 was discovered to contain a stack overflow via the security parameter in the formWifiBasicSet function. | ||||
| CVE-2023-39827 | 1 Tenda | 2 A18, A18 Firmware | 2024-11-21 | 7.5 High |
| Tenda A18 V15.13.07.09 was discovered to contain a stack overflow via the rule_info parameter in the formAddMacfilterRule function. | ||||
| CVE-2023-39806 | 1 Idreamsoft | 1 Icms | 2024-11-21 | 9.8 Critical |
| iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the bakupdata function. | ||||
| CVE-2023-39805 | 1 Idreamsoft | 1 Icms | 2024-11-21 | 9.8 Critical |
| iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the where parameter at admincp.php. | ||||
| CVE-2023-39801 | 1 Renault | 2 Easy Link, Zoe Ev 2021 | 2024-11-21 | 4.6 Medium |
| A lack of exception handling in the Renault Easy Link Multimedia System Software Version 283C35519R allows attackers to cause a Denial of Service (DoS) via supplying crafted WMA files when connecting a device to the vehicle's USB plug and play feature. | ||||
| CVE-2023-39796 | 1 Wbce | 1 Wbce Cms | 2024-11-21 | 9.8 Critical |
| SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via the DB_RECORD_TABLE parameter. | ||||
| CVE-2023-39777 | 1 Vbulletin | 1 Vbulletin | 2024-11-21 | 5.4 Medium |
| A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML via the /login.php?do=login url parameter. | ||||
| CVE-2023-39776 | 1 Phpjabbers | 1 Ticket Support Script | 2024-11-21 | 9.8 Critical |
| A File Upload vulnerability in PHPJabbers Ticket Support Script v3.2 allows attackers to execute arbitrary code via uploading a crafted file. | ||||
| CVE-2023-39751 | 1 Tp-link | 3 Tl-wr941nd, Tl-wr941nd V6, Tl-wr941nd V6 Firmware | 2024-11-21 | 9.8 Critical |
| TP-Link TL-WR941ND V6 were discovered to contain a buffer overflow via the pSize parameter at /userRpm/PingIframeRpm. | ||||