Search

Expected end of text, found '.' (at char 38), (line:1, col:39)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (333860 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2005-4890 3 Debian, Redhat, Sudo Project 4 Debian Linux, Shadow, Enterprise Linux and 1 more 2024-11-21 7.8 High
There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process.
CVE-2005-3590 1 Gnu 1 Glibc 2024-11-21 N/A
The getgrouplist function in the GNU C library (glibc) before version 2.3.5, when invoked with a zero argument, writes to the passed pointer even if the specified array size is zero, leading to a buffer overflow and potentially allowing attackers to corrupt memory.
CVE-2005-3056 1 Twiki 1 Twiki 2024-11-21 9.8 Critical
TWiki allows arbitrary shell command execution via the Include function
CVE-2005-2354 1 Nvu 1 Nvu 2024-11-20 9.8 Critical
Nvu 0.99+1.0pre uses an old copy of Mozilla XPCOM which can result in multiple security issues.
CVE-2005-2352 1 Gs-gpl Project 1 Gs-gpl 2024-11-20 8.1 High
I race condition in Temp files was found in gs-gpl before 8.56 addons scripts.
CVE-2005-2351 2 Debian, Mutt 2 Debian Linux, Mutt 2024-11-20 5.5 Medium
Mutt before 1.5.20 patch 7 allows an attacker to cause a denial of service via a series of requests to mutt temporary files.
CVE-2005-2350 1 Websieve Project 1 Websieve 2024-11-20 6.1 Medium
Cross-site scripting (XSS) vulnerability in websieve v0.62 allows remote attackers to inject arbitrary web script or HTML code in the web user interface.
CVE-2005-2349 1 Zoo Project 1 Zoo 2024-11-20 7.5 High
Zoo 2.10 has Directory traversal
CVE-2005-10002 1 Wp-plugins 1 Secure Files 2024-11-20 5.5 Medium
A vulnerability, which was classified as critical, was found in almosteffortless secure-files Plugin up to 1.1 on WordPress. Affected is the function sf_downloads of the file secure-files.php. The manipulation of the argument downloadfile leads to path traversal. Upgrading to version 1.2 is able to address this issue. The name of the patch is cab025e5fc2bcdad8032d833ebc38e6bd2a13c92. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-243804.
CVE-2004-2779 1 Underbit 1 Libid3tag 2024-11-20 N/A
id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service (DoS).
CVE-2004-2776 1 Goscript Project 1 Goscript 2024-11-20 9.8 Critical
go.cgi in GoScript 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) query string or (2) artarchive parameter.
CVE-2003-5003 1 Ibm 1 Iss Blackice Pc Protection 2024-11-20 5 Medium
A vulnerability was found in ISS BlackICE PC Protection. It has been rated as problematic. Affected by this issue is the Update Handler. The manipulation with an unknown input leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVE-2003-5002 1 Ibm 1 Iss Blackice Pc Protection 2024-11-20 3.7 Low
A vulnerability was found in ISS BlackICE PC Protection. It has been declared as problematic. Affected by this vulnerability is the component Update Handler which allows cleartext transmission of data. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVE-2003-5001 1 Ibm 1 Iss Blackice Pc Protection 2024-11-20 5.3 Medium
A vulnerability was found in ISS BlackICE PC Protection and classified as critical. Affected by this issue is the component Cross Site Scripting Detection. The manipulation as part of POST/PUT/DELETE/OPTIONS Request leads to privilege escalation. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVE-2003-1605 1 Haxx 1 Curl 2024-11-20 N/A
curl 7.x before 7.10.7 sends CONNECT proxy credentials to the remote server.
CVE-2002-2444 1 Snoopy Project 1 Snoopy 2024-11-20 9.8 Critical
Snoopy before 2.0.0 has a security hole in exec cURL
CVE-2002-2439 1 Gnu 1 Gcc 2024-11-20 7.8 High
Integer overflow in the new[] operator in gcc before 4.8.0 allows attackers to have unspecified impacts.
CVE-2002-2438 1 Linux 1 Linux Kernel 2024-11-20 7.5 High
TCP firewalls could be circumvented by sending a SYN Packets with other flags (like e.g. RST flag) set, which was not correctly discarded by the Linux TCP stack after firewalling.
CVE-1999-0199 1 Gnu 1 Glibc 2024-11-20 9.8 Critical
manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree's root, which might allow attackers to access a dangling pointer in an application whose developer was unaware of a documentation update from 1999.
CVE-2024-9356 1 Yotpo 1 Yotpo 2024-11-20 6.1 Medium
The Yotpo: Product & Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'yotpo_user_email' and 'yotpo_user_name' parameters in all versions up to, and including, 1.7.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.