Export limit exceeded: 380324 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (380324 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-28936 | 1 Apache | 1 Openmeetings | 2024-11-21 | 5.3 Medium |
| Attacker can access arbitrary recording/room Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0 | ||||
| CVE-2023-28935 | 1 Apache | 1 Unstructured Information Management Architecture | 2024-11-21 | 8.8 High |
| ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache UIMA DUCC. When using the "Distributed UIMA Cluster Computing" (DUCC) module of Apache UIMA, an authenticated user that has the permissions to modify core entities can cause command execution as the system user that runs the web process. As the "Distributed UIMA Cluster Computing" module for UIMA is retired, we do not plan to release a fix for this issue. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2023-28933 | 1 Stpetedesign | 1 Call Now Accessibility Button | 2024-11-21 | 5.9 Medium |
| Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in StPeteDesign Call Now Accessibility Button plugin <= 1.1 versions. | ||||
| CVE-2023-28931 | 1 Never5 | 1 Post Connector | 2024-11-21 | 5.9 Medium |
| Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Never5 Post Connector plugin <= 1.0.9 versions. | ||||
| CVE-2023-28930 | 1 Robinphillips | 1 Mobile Banner | 2024-11-21 | 4.3 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in Robin Phillips Mobile Banner plugin <= 1.5 versions. | ||||
| CVE-2023-28899 | 1 Skoda-auto | 2 Superb 3, Superb 3 Firmware | 2024-11-21 | 4.7 Medium |
| By sending a specific reset UDS request via OBDII port of Skoda vehicles, it is possible to cause vehicle engine shutdown and denial of service of other vehicle components even when the vehicle is moving at a high speed. No safety critical functions affected. | ||||
| CVE-2023-28898 | 1 Skoda-auto | 2 Superb 3, Superb 3 Firmware | 2024-11-21 | 5.3 Medium |
| The Real-Time Streaming Protocol implementation in the MIB3 infotainment incorrectly handles requests to /logs URI, when the id parameter equals to zero. This issue allows an attacker connected to the in-vehicle Wi-Fi network to cause denial-of-service of the infotainment system, when the certain preconditions are met. Vulnerability discovered on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022. | ||||
| CVE-2023-28896 | 1 Preh | 2 Mib3, Mib3 Firmware | 2024-11-21 | 3.3 Low |
| Access to critical Unified Diagnostics Services (UDS) of the Modular Infotainment Platform 3 (MIB3) infotainment is transmitted via Controller Area Network (CAN) bus in a form that can be easily decoded by attackers with physical access to the vehicle. Vulnerability discovered on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022. | ||||
| CVE-2023-28892 | 1 Malwarebytes | 1 Adwcleaner | 2024-11-21 | 7.8 High |
| Malwarebytes AdwCleaner 8.4.0 runs as Administrator and performs an insecure file delete operation on C:\AdwCleaner\Logs\AdwCleaner_Debug.log in which the target location is user-controllable, allowing a non-admin user to escalate privileges to SYSTEM via a symbolic link. | ||||
| CVE-2023-28884 | 1 Misp-project | 1 Misp | 2024-11-21 | 6.1 Medium |
| In MISP 2.4.169, app/Lib/Tools/CustomPaginationTool.php allows XSS in the community index. | ||||
| CVE-2023-28876 | 1 Afian | 1 Filerun | 2024-11-21 | 4.3 Medium |
| A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files uploaded by other users. | ||||
| CVE-2023-28875 | 1 Afian | 1 Filerun | 2024-11-21 | 5.4 Medium |
| A Stored XSS issue in shared files download terms in Filerun Update 20220202 allows attackers to inject JavaScript code that is executed when a user follows the crafted share link. | ||||
| CVE-2023-28874 | 1 Seafile | 1 Seafile | 2024-11-21 | 6.1 Medium |
| The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sites. | ||||
| CVE-2023-28873 | 1 Seafile | 1 Seafile | 2024-11-21 | 5.4 Medium |
| An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor. | ||||
| CVE-2023-28872 | 1 Ncp-e | 1 Secure Enterprise Client | 2024-11-21 | 8.8 High |
| Support Assistant in NCP Secure Enterprise Client before 13.10 allows attackers to execute DLL files with SYSTEM privileges by creating a symbolic link from a %LOCALAPPDATA%\Temp\NcpSupport* location. | ||||
| CVE-2023-28871 | 1 Ncp-e | 1 Secure Enterprise Client | 2024-11-21 | 4.3 Medium |
| Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to read registry information of the operating system by creating a symbolic link. | ||||
| CVE-2023-28870 | 1 Ncp-e | 1 Secure Enterprise Client | 2024-11-21 | 6.5 Medium |
| Insecure File Permissions in Support Assistant in NCP Secure Enterprise Client before 12.22 allow attackers to write to configuration files from low-privileged user accounts. | ||||
| CVE-2023-28868 | 1 Ncp-e | 1 Secure Enterprise Client | 2024-11-21 | 8.1 High |
| Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to delete arbitrary files on the operating system by creating a symbolic link. | ||||
| CVE-2023-28864 | 1 Progress | 1 Chef Infra Server | 2024-11-21 | 5.5 Medium |
| Progress Chef Infra Server before 15.7 allows a local attacker to exploit a /var/opt/opscode/local-mode-cache/backup world-readable temporary backup path to access sensitive information, resulting in the disclosure of all indexed node data, because OpenSearch credentials are exposed. (The data typically includes credentials for additional systems.) The attacker must wait for an admin to run the "chef-server-ctl reconfigure" command. | ||||
| CVE-2023-28863 | 1 Ami | 1 Megarac Sp-x | 2024-11-21 | 9.1 Critical |
| AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verification of Data Authenticity. | ||||