Export limit exceeded: 375161 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (375161 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-5532 | 1 Microfocus | 1 Operations Agent | 2025-10-14 | 4.8 Medium |
| Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Operations Agent. The XSS vulnerability could allow an attacker with local admin permissions to manipulate the content of the internal status page of the Agent on the local system. This issue affects Operations Agent: 12.20, 12.21, 12.22, 12.23, 12.24, 12.25, 12.26. | ||||
| CVE-2024-20906 | 1 Oracle | 1 Integrated Lights Out Manager Firmware | 2025-10-14 | 4.8 Medium |
| Vulnerability in the Integrated Lights Out Manager (ILOM) product of Oracle Systems (component: System Management). Supported versions that are affected are 3, 4 and 5. Easily exploitable vulnerability allows high privileged attacker with network access via ICMP to compromise Integrated Lights Out Manager (ILOM). Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Integrated Lights Out Manager (ILOM), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Integrated Lights Out Manager (ILOM) accessible data as well as unauthorized read access to a subset of Integrated Lights Out Manager (ILOM) accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N). | ||||
| CVE-2024-28804 | 1 Italtel | 1 I-mcs Nfv | 2025-10-14 | 7.1 High |
| An issue was discovered in Italtel i-MCS NFV 12.1.0-20211215. Stored Cross-site scripting (XSS) can occur via POST. | ||||
| CVE-2024-28806 | 1 Italtel | 1 I-mcs Nfv | 2025-10-14 | 7.5 High |
| An issue was discovered in Italtel i-MCS NFV 12.1.0-20211215. Remote unauthenticated attackers can upload files at an arbitrary path. | ||||
| CVE-2024-34399 | 1 Bmc | 1 Remedy Mid-tier | 2025-10-14 | 9.8 Critical |
| **UNSUPPORTED WHEN ASSIGNED** An issue was discovered in BMC Remedy Mid Tier 7.6.04. An unauthenticated remote attacker is able to access any user account without using any password. NOTE: This vulnerability only affects products that are no longer supported by the maintainer and the impacted version for this vulnerability is 7.6.04 only. | ||||
| CVE-2024-34398 | 1 Bmc | 1 Remedy Mid-tier | 2025-10-14 | 4.2 Medium |
| An issue was discovered in BMC Remedy Mid Tier 7.6.04. The web application allows stored HTML Injection by authenticated remote attackers. | ||||
| CVE-2024-28805 | 1 Italtel | 1 I-mcs Nfv | 2025-10-14 | 9.1 Critical |
| An issue was discovered in Italtel i-MCS NFV 12.1.0-20211215. There is Incorrect Access Control. | ||||
| CVE-2024-28803 | 1 Italtel | 1 I-mcs Nfv | 2025-10-14 | 6.1 Medium |
| Cross-site scripting (XSS) vulnerability in Italtel S.p.A. i-MCS NFV v.12.1.0-20211215 allows unauthenticated remote attackers to inject arbitrary web script or HTML into HTTP/POST parameter | ||||
| CVE-2024-52949 | 2 Iptraf-ng, Redhat | 2 Iptraf-ng, Enterprise Linux | 2025-10-14 | 7.5 High |
| iptraf-ng 1.2.1 has a stack-based buffer overflow. In src/ifaces.c, the strcpy function consistently fails to control the size, and it is consequently possible to overflow memory on the stack. | ||||
| CVE-2024-0801 | 1 Arcserve | 1 Udp | 2025-10-14 | 7.5 High |
| A denial of service vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in ASNative.dll. | ||||
| CVE-2024-25651 | 2 Delinea, Delinea Pam | 2 Secret Server, Secret Server | 2025-10-14 | 5.3 Medium |
| User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. This allows a remote attacker to determine whether a user is valid because of a difference in responses from the /oauth2/token endpoint. | ||||
| CVE-2025-1534 | 1 Payara | 1 Payara | 2025-10-14 | 5.4 Medium |
| CVE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Payara Platform Payara Server allows : Remote Code Inclusion.This issue affects Payara Server: from 4.1.2.1919.1 before 4.1.2.191.51, from 5.20.0 before 5.68.0, from 6.0.0 before 6.23.0, from 6.2022.1 before 6.2025.2. | ||||
| CVE-2024-25653 | 1 Delinea | 1 Secret Server | 2025-10-14 | 4.3 Medium |
| Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unlimited Admin Mode is enabled, to view system reports and modify custom reports via the Report functionality in the Web UI. | ||||
| CVE-2025-24949 | 1 Joturl | 1 Joturl | 2025-10-14 | 6.5 Medium |
| In JotUrl 2.0, is possible to bypass security requirements during the password change process. | ||||
| CVE-2024-29026 | 1 Owncast Project | 1 Owncast | 2025-10-14 | 8.2 High |
| Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a lenient CORS policy allows attackers to make a cross origin request, reading privileged information. This can be used to leak the admin password. Commit 9215d9ba0f29d62201d3feea9e77dcd274581624 fixes this issue. | ||||
| CVE-2025-5459 | 1 Puppet | 1 Puppet Enterprise | 2025-10-14 | 8.8 High |
| A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versions 2023.8.4 and 2025.4.0. | ||||
| CVE-2024-3325 | 1 Cloud | 1 Jasperreports Server | 2025-10-14 | 7.2 High |
| Vulnerability in Jaspersoft JasperReport Servers.This issue affects JasperReport Servers: from 8.0.4 through 9.0.0. | ||||
| CVE-2025-11342 | 2 Code-projects, Fabian | 2 Online Course Registration, Online Course Registration Site | 2025-10-14 | 4.7 Medium |
| A weakness has been identified in code-projects Online Course Registration 1.0. This impacts an unknown function of the file /admin/edit-course.php. Executing manipulation of the argument coursecode can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. | ||||
| CVE-2025-11347 | 1 Code-projects | 2 Crud Operation System, Student Crud Operation | 2025-10-14 | 7.3 High |
| A vulnerability was found in code-projects Student Crud Operation up to 3.3. This vulnerability affects the function move_uploaded_file of the file add.php of the component Add Student Page/Edit Student Page. Performing manipulation results in unrestricted upload. The attack can be initiated remotely. The exploit has been made public and could be used. | ||||
| CVE-2025-11343 | 1 Code-projects | 2 Crud Operation System, Student Crud Operation | 2025-10-14 | 7.3 High |
| A security vulnerability has been detected in code-projects Student Crud Operation 3.3. Affected is an unknown function of the file delete.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. | ||||