Export limit exceeded: 381928 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (381928 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-41034 | 1 Eclipse | 1 Leshan | 2024-11-21 | 6.5 Medium |
| Eclipse Leshan is a device management server and client Java implementation. In affected versions DDFFileParser` and `DefaultDDFFileValidator` (and so `ObjectLoader`) are vulnerable to `XXE Attacks`. A DDF file is a LWM2M format used to store LWM2M object description. Leshan users are impacted only if they parse untrusted DDF files (e.g. if they let external users provide their own model), in that case they MUST upgrade to fixed version. If you parse only trusted DDF file and validate only with trusted xml schema, upgrading is not mandatory. This issue has been fixed in versions 1.5.0 and 2.0.0-M13. Users are advised to upgrade. There are no known workarounds for this vulnerability. | ||||
| CVE-2023-41031 | 1 Juplink | 2 Rx4-1500, Rx4-1500 Firmware | 2024-11-21 | 8 High |
| Command injection in homemng.htm in Juplink RX4-1500 versions V1.0.2, V1.0.3, V1.0.4, and V1.0.5 allows remote authenticated attackers to execute commands via specially crafted requests to the vulnerable endpoint. | ||||
| CVE-2023-41030 | 1 Juplink | 2 Rx4-1500, Rx4-1500 Firmware | 2024-11-21 | 6.3 Medium |
| Hard-coded credentials in Juplink RX4-1500 versions V1.0.2 through V1.0.5 allow unauthenticated attackers to log in to the web interface or telnet service as the 'user' user. | ||||
| CVE-2023-41029 | 1 Juplink | 2 Rx4-1500, Rx4-1500 Firmware | 2024-11-21 | 8 High |
| Command injection vulnerability in the homemng.htm endpoint in Juplink RX4-1500 Wifi router firmware versions V1.0.2, V1.0.3, V1.0.4, and V1.0.5 allows authenticated remote attackers to execute commands as root via specially crafted HTTP requests to the vulnerable endpoint. | ||||
| CVE-2023-41028 | 1 Juplink | 2 Rx4-1500, Rx4-1500 Firmware | 2024-11-21 | 9 Critical |
| A stack-based buffer overflow exists in Juplink RX4-1500, a WiFi router, in versions 1.0.2 through 1.0.5. An authenticated attacker can exploit this vulnerability to achieve code execution as root. | ||||
| CVE-2023-41027 | 1 Juplink | 2 Rx4-1500, Rx4-1500 Firmware | 2024-11-21 | 8 High |
| Credential disclosure in the '/webs/userpasswd.htm' endpoint in Juplink RX4-1500 Wifi router firmware versions V1.0.4 and V1.0.5 allows an authenticated attacker to leak the password for the administrative account via requests to the vulnerable endpoint. | ||||
| CVE-2023-41012 | 2 China Mobile Communications, Chinamobile | 3 China Mobile Intelligent Home Gateway, Intelligent Home Gateway, Intelligent Home Gateway Firmware | 2024-11-21 | 9.8 Critical |
| An issue in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary code via the authentication mechanism. | ||||
| CVE-2023-41011 | 2 China Mobile Communications, Chinamobile | 3 China Mobile Intelligent Home Gateway, Intelligent Home Gateway, Intelligent Home Gateway Firmware | 2024-11-21 | 9.8 Critical |
| Command Execution vulnerability in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary code via the shortcut_telnet.cg component. | ||||
| CVE-2023-41010 | 2 Sichuan Tianyi Kanghe Communication Co Ltd, Tianyisc | 3 China Telecom Tianyi Home Gateway, Tewa-700g, Tewa-700g Firmware | 2024-11-21 | 5.5 Medium |
| Insecure Permissions vulnerability in Sichuan Tianyi Kanghe Communication Co., Ltd China Telecom Tianyi Home Gateway v.TEWA-700G allows a local attacker to obtain sensitive information via the default password parameter. | ||||
| CVE-2023-41009 | 1 Adlered | 1 Bolo-solo | 2024-11-21 | 9.8 Critical |
| File Upload vulnerability in adlered bolo-solo v.2.6 allows a remote attacker to execute arbitrary code via a crafted script to the authorization field in the header. | ||||
| CVE-2023-41005 | 1 Pagekit | 1 Pagekit | 2024-11-21 | 7.8 High |
| An issue in Pagekit pagekit v.1.0.18 alows a remote attacker to execute arbitrary code via thedownloadAction and updateAction functions in UpdateController.php | ||||
| CVE-2023-41000 | 1 Gpac | 1 Gpac | 2024-11-21 | 5.5 Medium |
| GPAC through 2.2.1 has a use-after-free vulnerability in the function gf_bifs_flush_command_list in bifs/memory_decoder.c. | ||||
| CVE-2023-40998 | 1 O-ran-sc | 1 Ric Message Router | 2024-11-21 | 7.5 High |
| Buffer Overflow vulnerability in O-RAN Software Community ric-plt-lib-rmr v.4.9.0 allows a remote attacker to cause a denial of service via the packet size component. | ||||
| CVE-2023-40997 | 1 O-ran-sc | 1 Ric Message Router | 2024-11-21 | 7.5 High |
| Buffer Overflow vulnerability in O-RAN Software Community ric-plt-lib-rmr v.4.9.0 allows a remote attacker to cause a denial of service via a crafted packet. | ||||
| CVE-2023-40989 | 1 Jeecg | 1 Jeecg Boot | 2024-11-21 | 9.8 Critical |
| SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecgboot/jmreport/queryFieldBySql component. | ||||
| CVE-2023-40986 | 1 Webmin | 1 Webmin | 2024-11-21 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability in the Usermin Configuration function of Webmin v2.100 allows attackers to execute arbitrary web sripts or HTML via a crafted payload injected into the Custom field. | ||||
| CVE-2023-40985 | 1 Webmin | 1 Webmin | 2024-11-21 | 5.4 Medium |
| An issue was discovered in Webmin 2.100. The File Manager functionality allows an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing a malicious payload, an attacker can inject arbitrary code, which is then executed within the context of the victim's browser when any file is searched/replaced. | ||||
| CVE-2023-40984 | 1 Webmin | 1 Webmin | 2024-11-21 | 5.4 Medium |
| A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload into the Replace in Results file. | ||||
| CVE-2023-40983 | 1 Webmin | 1 Webmin | 2024-11-21 | 6.1 Medium |
| A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload into the Find in Results file. | ||||
| CVE-2023-40982 | 1 Webmin | 1 Webmin | 2024-11-21 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability in Webmin v2.100 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cloned module name parameter. | ||||