Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (10484 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-23524 1 Ontraport 1 Pilotpress 2024-11-21 5.3 Medium
Missing Authorization vulnerability in ONTRAPORT Inc. PilotPress.This issue affects PilotPress: from n/a through 2.0.30.
CVE-2024-23521 1 Happyforms 1 Happyforms 2024-11-21 5.3 Medium
Missing Authorization vulnerability in Happyforms.This issue affects Happyforms: from n/a through 1.25.10.
CVE-2024-23504 1 Wpmanageninja 1 Ninja Tables 2024-11-21 5.3 Medium
Missing Authorization vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.5.
CVE-2024-23503 1 Wpmanageninja 1 Ninja Tables 2024-11-21 4.3 Medium
Missing Authorization vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.6.
CVE-2024-22296 1 Code4recovery 1 12 Step Meeting List 2024-11-21 4.3 Medium
Missing Authorization vulnerability in Code for Recovery 12 Step Meeting List.This issue affects 12 Step Meeting List: from n/a through 3.14.28.
CVE-2024-21751 1 Yoginetwork 1 Rabbitloader 2024-11-21 5.4 Medium
Missing Authorization vulnerability in RabbitLoader.This issue affects RabbitLoader: from n/a through 2.19.13.
CVE-2024-21748 1 Icegram 1 Icegram Express 2024-11-21 4.3 Medium
Missing Authorization vulnerability in Icegram.This issue affects Icegram: from n/a through 3.1.21.
CVE-2024-20828 1 Samsung 1 Internet 2024-11-21 2.4 Low
Improper authorization verification vulnerability in Samsung Internet prior to version 24.0 allows physical attackers to access files downloaded in SecretMode without proper authentication.
CVE-2024-0160 1 Dell 30 G3 3500, G3 3500 Firmware, G5 5500 and 27 more 2024-11-21 6.8 Medium
Dell Client Platform contains an incorrect authorization vulnerability. An attacker with physical access to the system could potentially exploit this vulnerability by bypassing BIOS authorization to modify settings in the BIOS.
CVE-2023-7047 2 Devolutions, Microsoft 2 Remote Desktop Manager, Windows 2024-11-21 4.4 Medium
Inadequate validation of permissions when employing remote tools and macros via the context menu within Devolutions Remote Desktop Manager versions 2023.3.31 and earlier permits a user to initiate a connection without proper execution rights via the remote tools feature. This affects only SQL data sources.
CVE-2023-6564 1 Gitlab 1 Gitlab 2024-11-21 6.5 Medium
An issue has been discovered in GitLab EE Premium and Ultimate affecting versions 16.4.3, 16.5.3, and 16.6.1. In projects using subgroups to define who can push and/or merge to protected branches, there may have been instances in which subgroup members with the Developer role were able to push or merge to protected branches.
CVE-2023-6542 1 Sap 1 Emarsys Sdk 2024-11-21 7.1 High
Due to lack of proper authorization checks in Emarsys SDK for Android, an attacker can call a particular activity and can forward himself web pages and/or deep links without any validation directly from the host application. On successful attack, an attacker could navigate to arbitrary URL including application deep links on the device.
CVE-2023-6355 1 Gallagher 2 Controller 7000, Controller 7000 Firmware 2024-11-21 6.8 Medium
Incorrect selection of fuse values in the Controller 7000 platform allows an attacker to bypass some protection mechanisms to enable local debug. This issue affects: Gallagher Controller 7000 9.00 prior to vCR9.00.231204b (distributed in 9.00.1507 (MR1)), 8.90 prior to vCR8.90.231204a (distributed in 8.90.1620 (MR2)), 8.80 prior to vCR8.80.231204a (distributed in 8.80.1369 (MR3)), 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)).
CVE-2023-6038 1 H2o 1 H2o 2024-11-21 7.5 High
A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3.
CVE-2023-6020 1 Ray Project 1 Ray 2024-11-21 7.5 High
LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication.
CVE-2023-6001 1 Yugabyte 1 Yugabytedb 2024-11-21 5.3 Medium
Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment.
CVE-2023-5949 1 Wpmudev 1 Smartcrawl 2024-11-21 7.5 High
The SmartCrawl WordPress plugin before 3.8.3 does not prevent unauthorised users from accessing password-protected posts' content.
CVE-2023-5862 1 Hamza417 1 Inure 2024-11-21 3.3 Low
Missing Authorization in GitHub repository hamza417/inure prior to Build95.
CVE-2023-5799 1 Thimpress 1 Wp Hotel Booking 2024-11-21 5.4 Medium
The WP Hotel Booking WordPress plugin before 2.0.8 does not have proper authorisation when deleting a package, allowing Contributor and above roles to delete posts that do no belong to them
CVE-2023-5737 1 Webtoffee 1 Backup And Migration 2024-11-21 4.3 Medium
The WordPress Backup & Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update some plugin settings.