Export limit exceeded: 35214 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (35214 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-5726 | 2 Apple, Mozilla | 4 Macos, Firefox, Firefox Esr and 1 more | 2024-11-21 | 4.3 Medium |
| A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. *Note: This issue only affected macOS operating systems. Other operating systems are unaffected.* This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1. | ||||
| CVE-2023-5720 | 1 Quarkus | 1 Quarkus | 2024-11-21 | 7.7 High |
| A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application. | ||||
| CVE-2023-5671 | 1 Hp | 1 Print And Scan Doctor | 2024-11-21 | 7.8 High |
| HP Print and Scan Doctor for Windows may potentially be vulnerable to escalation of privilege. HP is releasing software updates to mitigate the potential vulnerability. | ||||
| CVE-2023-5654 | 1 Facebook | 1 React-devtools | 2024-11-21 | 6.5 Medium |
| The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch(). The URL is not validated or sanitised before it is fetched, thus allowing a malicious web page to arbitrarily fetch URL’s via the victim's browser. | ||||
| CVE-2023-5642 | 1 Advantech | 1 R-seenet | 2024-11-21 | 9.8 Critical |
| Advantech R-SeeNet v2.4.23 allows an unauthenticated remote attacker to read from and write to the snmpmon.ini file, which contains sensitive information. | ||||
| CVE-2023-5595 | 1 Gpac | 1 Gpac | 2024-11-21 | 5.5 Medium |
| Denial of Service in GitHub repository gpac/gpac prior to 2.3.0-DEV. | ||||
| CVE-2023-5575 | 1 Devolutions | 1 Devolutions Server | 2024-11-21 | 6.5 Medium |
| Improper access control in the permission inheritance in Devolutions Server 2022.3.13.0 and earlier allows an attacker that compromised a low privileged user to access entries via a specific combination of permissions in the entry and in its parent. | ||||
| CVE-2023-5559 | 1 10web | 1 10web Booster | 2024-11-21 | 9.1 Critical |
| The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading to denial of service. | ||||
| CVE-2023-5551 | 2 Fedoraproject, Moodle | 3 Extra Packages For Enterprise Linux, Fedora, Moodle | 2024-11-21 | 3.3 Low |
| Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups. | ||||
| CVE-2023-5543 | 2 Fedoraproject, Moodle | 3 Extra Packages For Enterprise Linux, Fedora, Moodle | 2024-11-21 | 3.3 Low |
| When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity. This could provide unintended access to the original meeting. | ||||
| CVE-2023-5522 | 1 Mattermost | 1 Mattermost | 2024-11-21 | 4.3 Medium |
| Mattermost Mobile fails to limit the maximum number of Markdown elements in a post allowing an attacker to send a post with hundreds of emojis to a channel and freeze the mobile app of users when viewing that particular channel. | ||||
| CVE-2023-5449 | 1 Hp | 58 E22 G4 Fhd, E22 G4 Fhd Firmware, E23 G4 Fhd and 55 more | 2024-11-21 | 3.3 Low |
| A potential security vulnerability has been identified in certain HP Displays supporting the Theft Deterrence feature which may allow a monitor’s Theft Deterrence to be deactivated. | ||||
| CVE-2023-5409 | 1 Hp | 4 T430 Thin Client, T430 Thin Client Firmware, T638 Thin Client and 1 more | 2024-11-21 | 6.8 Medium |
| HP is aware of a potential security vulnerability in HP t430 and t638 Thin Client PCs. These models may be susceptible to a physical attack, allowing an untrusted source to tamper with the system firmware using a publicly disclosed private key. HP is providing recommended guidance for customers to reduce exposure to the potential vulnerability. | ||||
| CVE-2023-5365 | 1 Hp | 1 Life | 2024-11-21 | 9.8 Critical |
| HP LIFE Android Mobile application is potentially vulnerable to escalation of privilege and/or information disclosure. | ||||
| CVE-2023-5353 | 1 Salesagility | 1 Suitecrm | 2024-11-21 | 6.5 Medium |
| Improper Access Control in GitHub repository salesagility/suitecrm prior to 7.14.1. | ||||
| CVE-2023-5333 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 4.3 Medium |
| Mattermost fails to deduplicate input IDs allowing a simple user to cause the application to consume excessive resources and possibly crash by sending a specially crafted request to /api/v4/users/ids with multiple identical IDs. | ||||
| CVE-2023-5332 | 2 Gitlab, Hashicorp | 2 Gitlab, Consul | 2024-11-21 | 5.9 Medium |
| Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE. | ||||
| CVE-2023-5310 | 1 Silabs | 3 Z-wave Long Range 700, Z-wave Long Range 800, Z-wave Software Development Kit | 2024-11-21 | 5.7 Medium |
| A denial of service vulnerability exists in all Silicon Labs Z-Wave controller and endpoint devices running Z-Wave SDK v7.20.3 (Gecko SDK v4.3.3) and earlier. This attack can be carried out only by devices on the network sending a stream of packets to the device. | ||||
| CVE-2023-5256 | 1 Drupal | 1 Drupal | 2024-11-21 | 7.5 High |
| In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected. | ||||
| CVE-2023-5239 | 1 Cleantalk | 1 Security \& Malware Scan | 2024-11-21 | 7.5 High |
| The Security & Malware scan by CleanTalk WordPress plugin before 2.121 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass bruteforce protection. | ||||