Total
210374 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-23778 | 1 Fortinet | 1 Fortiweb | 2023-02-28 | N/A | 6.5 MEDIUM |
| A relative path traversal vulnerability [CWE-23] in FortiWeb version 7.0.1 and below, 6.4 all versions, 6.3 all versions, 6.2 all versions may allow an authenticated user to obtain unauthorized access to files and data via specifically crafted web requests. | |||||
| CVE-2014-125088 | 1 Qt-users | 1 Silk | 2023-02-28 | N/A | 6.1 MEDIUM |
| A vulnerability was found in qt-users-jp silk 0.0.1. It has been declared as problematic. This vulnerability affects unknown code of the file contents/root/examples/header.qml. The manipulation of the argument model.key/model.value leads to cross site scripting. The attack can be initiated remotely. The name of the patch is bbc5d6eeea800025ef29edda3fd3c57836239eae. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-221488. | |||||
| CVE-2013-10019 | 1 Oclc | 1 Oaicat | 2023-02-28 | N/A | 9.8 CRITICAL |
| A vulnerability was found in OCLC-Research OAICat 1.5.61. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The attack may be initiated remotely. Upgrading to version 1.5.62 is able to address this issue. The name of the patch is 6cc65501869fa663bcd24a70b63f41f5cfe6b3e1. It is recommended to upgrade the affected component. The identifier VDB-221489 was assigned to this vulnerability. | |||||
| CVE-2023-23779 | 1 Fortinet | 1 Fortiweb | 2023-02-28 | N/A | 8.8 HIGH |
| Multiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.19 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests. | |||||
| CVE-2015-10080 | 1 Nrel | 1 Api Umbrella | 2023-02-28 | N/A | 6.1 MEDIUM |
| A vulnerability was found in NREL api-umbrella-web 0.7.1. It has been classified as problematic. This affects an unknown part of the component Admin Data Table Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 0.8.0 is able to address this issue. The name of the patch is f53a9fb87e10c457f0f3dd4f2af24d3b2f21b3ca. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221487. | |||||
| CVE-2023-23781 | 1 Fortinet | 1 Fortiweb | 2023-02-28 | N/A | 8.8 HIGH |
| A stack-based buffer overflow vulnerability [CWE-121] in FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.19 and below SAML server configuration may allow an authenticated attacker to achieve arbitrary code execution via specifically crafted XML files. | |||||
| CVE-2023-23780 | 1 Fortinet | 1 Fortiweb | 2023-02-28 | N/A | 8.8 HIGH |
| A stack-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, Fortinet FortiWeb version 6.3.6 through 6.3.19, Fortinet FortiWeb 6.4 all versions allows attacker to escalation of privilege via specifically crafted HTTP requests. | |||||
| CVE-2023-23784 | 1 Fortinet | 1 Fortiweb | 2023-02-28 | N/A | 6.5 MEDIUM |
| A relative path traversal in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to information disclosure via specially crafted web requests. | |||||
| CVE-2020-12413 | 1 Mozilla | 2 Firefox, Firefox Esr | 2023-02-28 | N/A | 5.9 MEDIUM |
| The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites. | |||||
| CVE-2022-21216 | 1 Intel | 132 Atom C5310, Atom C5310 Firmware, Atom C5315 and 129 more | 2023-02-28 | N/A | 6.8 MEDIUM |
| Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon Scalable Processors may allow a privileged user to potentially enable escalation of privilege via adjacent network access. | |||||
| CVE-2022-2113 | 1 Inventree Project | 1 Inventree | 2023-02-28 | 3.5 LOW | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.7.2. | |||||
| CVE-2022-2112 | 1 Inventree Project | 1 Inventree | 2023-02-28 | 6.8 MEDIUM | 8.8 HIGH |
| Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2. | |||||
| CVE-2022-2111 | 1 Inventree Project | 1 Inventree | 2023-02-28 | 6.5 MEDIUM | 8.8 HIGH |
| Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2. | |||||
| CVE-2021-35261 | 1 Bearadmin Project | 1 Bearadmin | 2023-02-28 | N/A | 9.8 CRITICAL |
| File Upload Vulnerability in Yupoxion BearAdmin before commit 10176153528b0a914eb4d726e200fd506b73b075 allows attacker to execute arbitrary remote code via the Upfile function of the extend/tools/Ueditor endpoint. | |||||
| CVE-2022-25905 | 1 Intel | 1 Oneapi Data Analytics Library | 2023-02-28 | N/A | 7.3 HIGH |
| Uncontrolled search path element in the Intel(R) oneAPI Data Analytics Library (oneDAL) before version 2021.5 for Intel(R) oneAPI Base Toolkit may allow an authenticated user to potentially enable escalation of privilege via local access. | |||||
| CVE-2019-16348 | 1 Libwav Project | 1 Libwav | 2023-02-28 | 4.3 MEDIUM | 6.5 MEDIUM |
| marc-q libwav through 2017-04-20 has a NULL pointer dereference in gain_file() at wav_gain.c. | |||||
| CVE-2018-21016 | 2 Debian, Gpac | 2 Debian Linux, Gpac | 2023-02-28 | 4.3 MEDIUM | 6.5 MEDIUM |
| audio_sample_entry_AddBox() at isomedia/box_code_base.c in GPAC 0.7.1 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file. | |||||
| CVE-2018-21015 | 2 Debian, Gpac | 2 Debian Linux, Gpac | 2023-02-28 | 4.3 MEDIUM | 6.5 MEDIUM |
| AVC_DuplicateConfig() at isomedia/avc_ext.c in GPAC 0.7.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file. There is "cfg_new->AVCLevelIndication = cfg->AVCLevelIndication;" but cfg could be NULL. | |||||
| CVE-2016-10961 | 1 Inkthemes | 1 Colorway | 2023-02-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| The colorway theme before 3.4.2 for WordPress has XSS via the contactName parameter. | |||||
| CVE-2019-16294 | 2 Notepad-plus-plus, Scintilla | 2 Notepad\+\+, Scintilla | 2023-02-28 | 6.8 MEDIUM | 7.8 HIGH |
| SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafted .ml file. | |||||