Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,215
- Last 24h
- 643
- Critical, 7 days
- 362
- Known exploited
- 1,779
12,795 results · Clear filters · Feed
-
Low 3.3
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in iOS 17.3 and iPadOS 17.…
-
Low 3.5
CodeAstro Online Railway Reservation System pass-profile.php cross site scripting
A vulnerability has been found in CodeAstro Online Railway Reservation System 1.0 and classified as problematic. This vulnerability affects unknown code of the file pass-profile.php. The manipulation of the argument First Name/Last Name/User Name leads to cro…
-
Low 3.5
CodeAstro Internet Banking System pages_client_signup.php redirect
A vulnerability, which was classified as problematic, was found in CodeAstro Internet Banking System 1.0. This affects an unknown part of the file pages_client_signup.php. The manipulation of the argument Client Full Name with the input <meta http-equiv="refr…
-
Low 3.5
LinZhaoguan pb-cms Comment cross site scripting
A vulnerability, which was classified as problematic, has been found in LinZhaoguan pb-cms 2.0. Affected by this issue is some unknown functionality of the component Comment Handler. The manipulation with the input <div onmouseenter="alert("xss)"> leads to cr…
-
Low 3.5
CodeAstro Internet Banking System pages_client_signup.php cross site scripting
A vulnerability classified as problematic was found in CodeAstro Internet Banking System 1.0. Affected by this vulnerability is an unknown functionality of the file pages_client_signup.php. The manipulation of the argument Client Full Name leads to cross site…
-
Low 2.4
go4rayyan Scumblr Task cross site scripting
A vulnerability, which was classified as problematic, has been found in go4rayyan Scumblr up to 2.0.1a. Affected by this issue is some unknown functionality of the component Task Handler. The manipulation leads to cross site scripting. The attack may be launc…
-
Low 3.3
An information disclosure vulnerability was reported in the Lenovo Tab M8 HD that could allow a local application to ga…
-
Low 3.7
FreeRDP integer Overflow leading to Heap Overflow
FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects FreeRDP based clients. FreeRDP based server imp…
-
Low 3.7
changedetection.io API endpoint is not secured with API token
changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint `/api/v1/watch/<uuid>/history` can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch …
-
Low 3.5
code-projects Social Networking Site Message Page message.php cross site scripting
A vulnerability was found in code-projects Social Networking Site 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file message.php of the component Message Page. The manipulation of the argument Story leads to cr…
-
Low 3.5
Jspxcms Survey Label cross site scripting
A vulnerability has been found in Jspxcms 10.2.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Survey Label Handler. The manipulation leads to cross site scripting. The attack can be launched remote…
-
Low 3.5
FactoMineR FactoInvestigate HTML Report Generator cross site scripting
A vulnerability, which was classified as problematic, was found in FactoMineR FactoInvestigate up to 1.9. Affected is an unknown function of the component HTML Report Generator. The manipulation leads to cross site scripting. It is possible to launch the atta…
-
Low 2.4
liuwy-dlsdys zhglxt HTTP POST Request edit cross site scripting
A vulnerability, which was classified as problematic, has been found in liuwy-dlsdys zhglxt 4.7.7. This issue affects some unknown processing of the file /oa/notify/edit of the component HTTP POST Request Handler. The manipulation of the argument notifyTitle …
-
Low 3.1
Byzoro Smart S150 Management Platform Backup File download.php information disclosure
A vulnerability classified as problematic has been found in Byzoro Smart S150 Management Platform V31R02B15. This affects an unknown part of the file /log/download.php of the component Backup File Handler. The manipulation leads to information disclosure. It …
-
Low 3.5
AtroCore AtroPIM Product Series Overview cross site scripting
A vulnerability, which was classified as problematic, was found in AtroCore AtroPIM 1.8.4. This affects an unknown part of the file /#ProductSerie/view/ of the component Product Series Overview. The manipulation leads to cross site scripting. It is possible t…
-
Low 3.0
OAuth2 authorization codes are valid indefinetly in Nextcloud server
Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 OAuth codes are inval…
-
Low 3.1
Open redirect in user_saml via RelayState parameter in Nextcloud User Saml
Nextcloud User Saml is an app for authenticating Nextcloud users using SAML. In affected versions users can be given a link to the Nextcloud server and end up on a uncontrolled thirdparty server. It is recommended that the User Saml app is upgraded to version…
-
Low 3.5
PHPGurukul Company Visitor Management System search-visitor.php cross site scripting
A vulnerability was found in PHPGurukul Company Visitor Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file search-visitor.php. The manipulation leads to cross site scripting. The attack ma…
-
Low —
ferris-says has undefined behavior when not using UTF-8
Affected versions receive a `&[u8]` from the caller through a safe API, and pass it directly to the unsafe `str::from_utf8_unchecked` function. The behavior of `ferris_says::say` is undefined if the bytes from the caller don't happen to be valid UTF-8. The fl…
-
Low 3.3
Binary Planting Attack on Windows Platforms in Creditcoin
Creditcoin is a network that enables cross-blockchain credit transactions. The Windows binary of the Creditcoin node loads a suite of DLLs provided by Microsoft at startup. If a malicious user has access to overwrite the program files directory it is possible…
-
Low 3.7
IBM QRadar information disclosure
IBM QRadar SIEM 7.5 could disclose sensitive email information in responses from offense rules. IBM X-Force ID: 275709.
-
Low 2.7
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC). Suppor…
-
Low 3.7
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Co…
-
Low 2.5
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). S…
-
Low 3.8
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The supported version that is af…
-
Low 2.7
Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall). Supported versions that are affected a…
-
Low 2.3
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported versio…
-
Low 3.0
Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall). Supported versions that are affected a…
-
Low 3.3
Unlinkability broken in ursa when verifiers use malicious keys
Ursa is a cryptographic library for use with blockchains. A weakness in the Hyperledger AnonCreds specification that is not mitigated in the Ursa and AnonCreds implementations is that the Issuer does not publish a key correctness proof demonstrating that a ge…
-
Low 3.5
Jspxcms Document Management Page InfoController.java cross site scripting
A vulnerability was found in Jspxcms 10.2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file src\main\java\com\jspxcms\core\web\back\InfoController.java of the component Document Management Page. The…
-
Low 2.7CVE-2023-2252 Scanner template
Directorist < 7.5.4 - Admin+ LFI
The Directorist WordPress plugin before 7.5.4 is vulnerable to Local File Inclusion as it does not validate the file parameter when importing CSV files.
-
Low 2.3
HCL BigFix OSD Bare Metal Server WebUI is affected by sensitive information disclosure
HCL BigFix Bare OSD Metal Server WebUI version 311.19 or lower can sometimes include sensitive information in a query string which could allow an attacker to execute a malicious attack.
-
Low 2.4
DedeBIZ Website Copyright Setting cross site scripting
A vulnerability, which was classified as problematic, was found in DedeBIZ 6.3.0. This affects an unknown part of the component Website Copyright Setting. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The expl…
-
Low 3.5
code-projects Simple Online Hotel Reservation System Make a Reservation Page add_reserve.php cross site scripting
A vulnerability has been found in code-projects Simple Online Hotel Reservation System 1.0 and classified as problematic. This vulnerability affects unknown code of the file add_reserve.php of the component Make a Reservation Page. The manipulation of the arg…
-
Low 3.5
code-projects Online FIR System registercomplaint.php cross site scripting
A vulnerability was found in code-projects Online FIR System 1.0. It has been classified as problematic. This affects an unknown part of the file registercomplaint.php. The manipulation of the argument Name/Address leads to cross site scripting. It is possibl…
-
Low 2.4
SourceCodester House Rental Management System Manage Invoice Details cross site scripting
A vulnerability has been found in SourceCodester House Rental Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Manage Invoice Details. The manipulation of the argument Invoice lea…
-
Low 2.4
SourceCodester House Rental Management System Manage Tenant Details cross site scripting
A vulnerability, which was classified as problematic, was found in SourceCodester House Rental Management System 1.0. Affected is an unknown function of the component Manage Tenant Details. The manipulation of the argument Name leads to cross site scripting. …
-
Low 2.4
SourceCodester House Rental Management System index.php cross site scripting
A vulnerability, which was classified as problematic, has been found in SourceCodester House Rental Management System 1.0. This issue affects some unknown processing of the file index.php. The manipulation of the argument page leads to cross site scripting. T…
-
Low 2.4
Blood Bank & Donor Management request-received-bydonar.php cross site scripting
A vulnerability, which was classified as problematic, was found in Blood Bank & Donor Management 1.0. This affects an unknown part of the file request-received-bydonar.php. The manipulation leads to cross site scripting. It is possible to initiate the attack …
-
Low 2.4CVE-2024-0230 Public exploit
A session management issue was addressed with improved checks. This issue is fixed in Magic Keyboard Firmware Update 2.…