Export limit exceeded: 387008 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (387008 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2018-7727 | 2 Gdraheim, Redhat | 5 Zziplib, Enterprise Linux, Enterprise Linux Desktop and 2 more | 2025-07-10 | N/A |
| An issue was discovered in ZZIPlib 0.13.68. There is a memory leak triggered in the function zzip_mem_disk_new in memdisk.c, which will lead to a denial of service attack. | ||||
| CVE-2018-7726 | 3 Canonical, Gdraheim, Redhat | 6 Ubuntu Linux, Zziplib, Enterprise Linux and 3 more | 2025-07-10 | N/A |
| An issue was discovered in ZZIPlib 0.13.68. There is a bus error caused by the __zzip_parse_root_directory function of zip.c. Attackers could leverage this vulnerability to cause a denial of service via a crafted zip file. | ||||
| CVE-2017-5979 | 1 Gdraheim | 1 Zziplib | 2025-07-10 | N/A |
| The prescan_entry function in fseeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted ZIP file. | ||||
| CVE-2017-5976 | 2 Debian, Gdraheim | 2 Debian Linux, Zziplib | 2025-07-10 | 5.5 Medium |
| Heap-based buffer overflow in the zzip_mem_entry_extra_block function in memdisk.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file. | ||||
| CVE-2017-5975 | 2 Debian, Gdraheim | 2 Debian Linux, Zziplib | 2025-07-10 | 5.5 Medium |
| Heap-based buffer overflow in the __zzip_get64 function in fetch.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file. | ||||
| CVE-2017-5974 | 2 Debian, Gdraheim | 2 Debian Linux, Zziplib | 2025-07-10 | 5.5 Medium |
| Heap-based buffer overflow in the __zzip_get32 function in fetch.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file. | ||||
| CVE-2024-32231 | 1 Stashapp | 1 Stash | 2025-07-10 | 6.3 Medium |
| Stash up to v0.25.1 was discovered to contain a SQL injection vulnerability via the sort parameter. | ||||
| CVE-2024-45993 | 1 Giflib Project | 1 Giflib | 2025-07-10 | 6.5 Medium |
| Giflib Project v5.2.2 is vulnerable to a heap buffer overflow via gif2rgb. | ||||
| CVE-2024-43346 | 1 Wow-company | 1 Modal Window | 2025-07-10 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wow-Company Modal Window allows Stored XSS.This issue affects Modal Window: from n/a through 6.0.3. | ||||
| CVE-2024-45920 | 1 Solvait | 1 Solvait | 2025-07-10 | 5.4 Medium |
| A Stored Cross-Site Scripting (XSS) vulnerability in Solvait 24.4.2 allows remote attackers to inject malicious scripts into the application. This issue arises due to insufficient input validation and sanitization in "Intrest" feature. | ||||
| CVE-2024-44860 | 1 Solvait | 1 Solvait | 2025-07-10 | 7.5 High |
| An information disclosure vulnerability in the /Letter/PrintQr/ endpoint of Solvait v24.4.2 allows attackers to access sensitive data via a crafted request. | ||||
| CVE-2025-37097 | 1 Hpe | 1 Insight Remote Support | 2025-07-10 | 7.5 High |
| A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service | ||||
| CVE-2024-41659 | 1 Usememos | 1 Memos | 2025-07-10 | 8.1 High |
| memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker to read private information or make privileged changes to the system as the vulnerable user account. This vulnerability is fixed in 0.21.0. | ||||
| CVE-2025-37098 | 1 Hpe | 1 Insight Remote Support | 2025-07-10 | 7.5 High |
| A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646. | ||||
| CVE-2024-46097 | 1 Testlink | 1 Testlink | 2025-07-10 | 8.1 High |
| TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is created, an ID with an incremental value is automatically generated. Using the edit function you can change the tplan_id parameter to another ID. The application does not carry out a check on the user's permissions maing it possible to recover the IDs of all the TestPlans (even the administrative ones) and modify them even with minimal privileges. | ||||
| CVE-2024-25411 | 1 Flatpress | 1 Flatpress | 2025-07-10 | 6.1 Medium |
| A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter in setup.php. | ||||
| CVE-2023-37230 | 1 Loftware | 1 Spectrum | 2025-07-10 | 8.8 High |
| Loftware Spectrum (testDeviceConnection) before 5.1 allows SSRF. | ||||
| CVE-2024-44867 | 1 Phpok | 1 Phpok | 2025-07-10 | 7.5 High |
| phpok v3.0 was discovered to contain an arbitrary file read vulnerability via the component /autoload/file.php. | ||||
| CVE-2025-53006 | 1 Dataease | 1 Dataease | 2025-07-10 | 9.8 Critical |
| DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, in both PostgreSQL and Redshift, apart from parameters like "socketfactory" and "socketfactoryarg", there are also "sslfactory" and "sslfactoryarg" with similar functionality. The difference lies in that "sslfactory" and related parameters need to be triggered after establishing the connection. Other similar parameters include "sslhostnameverifier", "sslpasswordcallback", and "authenticationPluginClassName". This issue has been patched in 2.10.11. | ||||
| CVE-2024-6763 | 2 Eclipse, Redhat | 2 Jetty, Amq Streams | 2025-07-10 | 3.7 Low |
| Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC. Specifically HttpURI and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks. | ||||