Search

Expected end of text, found '.' (at char 23), (line:1, col:24)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (330487 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-42939 1 Yzncms 1 Yzncms 2024-08-31 4.6 Medium
A cross-site scripting (XSS) vulnerability in the component /index/index.html of YZNCMS v1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the configured remarks text field.
CVE-2022-4538 2024-08-30 N/A
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error and is not a valid vulnerability. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE-2022-4528 2024-08-30 N/A
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error and is not a valid vulnerability. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE-2022-4412 2024-08-30 N/A
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error and is not a valid vulnerability. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE-2024-42379 2024-08-30 N/A
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2022-4540 2024-08-30 N/A
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error and is not a valid vulnerability. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE-2022-4530 2024-08-30 N/A
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error and is not a valid vulnerability. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE-2022-4424 2024-08-30 N/A
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error and is not a valid vulnerability. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE-2024-42337 1 Cyberark 1 Identity 2024-08-30 4.3 Medium
CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVE-2024-42338 1 Cyberark 1 Identity 2024-08-30 4.3 Medium
CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVE-2024-42340 1 Cyberark 1 Identity 2024-08-30 8.3 High
CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security
CVE-2024-42339 1 Cyberark 1 Identity 2024-08-30 4.3 Medium
CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVE-2024-38869 1 Zohocorp 4 Manageengine Endpoint Central, Manageengine Servicedesk Plus, Manageengine Servicedesk Plus Msp and 1 more 2024-08-30 8.3 High
Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint Central: before 11.3.2416.04 and before 11.3.2400.25.
CVE-2024-41889 1 Pimax 2 Pitool, Play 2024-08-30 8.8 High
Multiple Pimax products accept WebSocket connections from unintended endpoints. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker.
CVE-2024-6118 1 Hamastar 1 Meetinghub Paperless Meetings 2024-08-30 9.1 Critical
A Plaintext Storage of a Password vulnerability in ebooknote function in Hamastar MeetingHub Paperless Meetings 2021 allows remote attackers to obtain the other users’ credentials and gain access to the product via an XML file.
CVE-2024-6117 1 Hamastar 1 Meetinghub Paperless Meetings 2024-08-30 8.8 High
A Unrestricted upload of file with dangerous type vulnerability in meeting management function in Hamastar MeetingHub Paperless Meetings 2021 allows remote authenticated users to perform arbitrary system commands via a crafted ASP file.
CVE-2024-45232 2 In2code, Typo3 2 Powermail, Typo3 2024-08-30 7.3 High
An issue was discovered in powermail extension through 12.3.5 for TYPO3. It fails to validate the mail parameter of the confirmationAction, resulting in Insecure Direct Object Reference (IDOR). An unauthenticated attacker can use this to display the user-submitted data of all forms persisted by the extension. This can only be exploited when the extension is configured to save submitted form data to the database (plugin.tx_powermail.settings.db.enable=1), which however is the default setting of the extension. The fixed versions are 7.5.0, 8.5.0, 10.9.0, and 12.4.0
CVE-2024-45233 2 In2code, Typo3 2 Powermail, Typo3 2024-08-30 7.3 High
An issue was discovered in powermail extension through 12.3.5 for TYPO3. Several actions in the OutputController can directly be called, due to missing or insufficiently implemented access checks, resulting in Broken Access Control. Depending on the configuration of the Powermail Frontend plugins, an unauthenticated attacker can exploit this to edit, update, delete, or export data of persisted forms. This can only be exploited when the Powermail Frontend plugins are used. The fixed versions are 7.5.0, 8.5.0, 10.9.0, and 12.4.0.
CVE-2024-38795 1 Cridio 1 Listingpro 2024-08-30 9.3 Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro allows SQL Injection.This issue affects ListingPro: from n/a through 2.9.4.
CVE-2024-39620 1 Cridio 1 Listingpro 2024-08-30 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro allows SQL Injection.This issue affects ListingPro: from n/a through 2.9.4.