Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (1394 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-3373 1 Rsm Design 1 Web Template 2024-09-30 N/A
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RSM Design Website Template allows SQL Injection.This issue affects Website Template: before 1.2.
CVE-2024-6981 1 Omntec 1 Proteus Tank Monitoring 2024-09-30 9.8 Critical
OMNTEC Proteus Tank Monitoring OEL8000III Series could allow an attacker to perform administrative actions without proper authentication.
CVE-2024-22170 1 Westerndigital 10 My Cloud Dl2100 Firmware, My Cloud Dl4100 Firmware, My Cloud Ex2100 Firmware and 7 more 2024-09-30 N/A
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Western Digital My Cloud ddns-start on Linux allows Overflow Buffers.This issue affects My Cloud: before 5.29.102.
CVE-2024-47088 1 Apexsoftcell 2 Ld Dp Back Office, Ld Geo 2024-09-26 9.8 Critical
This vulnerability exists in Apex Softcell LD Geo due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack on login OTP, which could lead to gain unauthorized access to other user accounts.
CVE-2024-5958 2 Eliz Software, Elizsoftware 2 Panel, Panel 2024-09-26 8.8 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eliz Software Panel allows Command Line Execution through SQL Injection.This issue affects Panel: before v2.3.24.
CVE-2024-5959 1 Elizsoftware 1 Panel 2024-09-26 5.4 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Eliz Software Panel allows Stored XSS.This issue affects Panel: before v2.3.24.
CVE-2024-7735 1 Exnet Informatics Software 1 Ferry Reservation System 2024-09-26 N/A
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Exnet Informatics Software Ferry Reservation System allows SQL Injection.This issue affects Ferry Reservation System: before 240805-002.
CVE-2024-4657 1 Talentsoftware 1 Bap Automation 2024-09-26 N/A
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software BAP Automation allows Stored XSS.This issue affects BAP Automation: before 30840.
CVE-2024-6877 2 Eliz Software, Elizsoftware 2 Panel, Panel 2024-09-25 6.1 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Eliz Software Panel allows Reflected XSS.This issue affects Panel: before v2.3.24.
CVE-2024-7609 1 Vidco 1 Voc Tester 2024-09-23 7.5 High
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Vidco Software VOC TESTER allows Path Traversal.This issue affects VOC TESTER: before 12.34.8.
CVE-2024-8752 3 Beijerelectronics, Microsoft, Smart-hmi 3 Webiq, Windows, Webiq 2024-09-20 7.5 High
The Windows version of WebIQ 2.15.9 is affected by a directory traversal vulnerability that allows remote attackers to read any file on the system.
CVE-2024-7098 2 Sfs, Sfs Consulting 2 Winsure, Wwwinsure 2024-09-20 9.8 Critical
Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection.This issue affects ww.Winsure: before 4.6.2.
CVE-2024-6401 2 Sfs, Sfs Consulting 2 Insuree Gl, Insuree Gl 2024-09-20 9.8 Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting InsureE GL allows SQL Injection.This issue affects InsureE GL: before 4.6.2.
CVE-2024-7104 2 Sfs, Sfs Consulting 2 Winsure, Wwwinsure 2024-09-20 9.8 Critical
Improper Control of Generation of Code ('Code Injection') vulnerability in SFS Consulting ww.Winsure allows Code Injection.This issue affects ww.Winsure: before 4.6.2.
CVE-2024-7873 1 Veribilim Software 1 Veribase Order Management 2024-09-20 N/A
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, CWE - 83 Improper Neutralization of Script in Attributes in a Web Page vulnerability in Veribilim Software Veribase Order allows Stored XSS, Cross-Site Scripting (XSS), Exploit Script-Based APIs, XSS Through HTTP Headers.This issue affects Veribase Order: before v4.010.3.
CVE-2024-7785 2024-09-20 N/A
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ece Software Electronic Ticket System allows Reflected XSS, Cross-Site Scripting (XSS).This issue affects Electronic Ticket System: before 2024.08.
CVE-2024-8986 2024-09-20 5.5 Medium
The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running `git remote get-url origin`. If credentials are included in the repository URI (for instance, to allow for fetching of private dependencies), the final binary will contain the full URI, including said credentials.
CVE-2024-45790 1 Reedos 1 Aim-star 2024-09-18 9.8 Critical
This vulnerability exists in Reedos aiM-Star version 2.0.1 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user passwords, which could lead to gain unauthorized access and compromise other user accounts.
CVE-2024-6919 2 Nac, Nac Telecommunication Systems 2 Nacpremium, Nacpremium 2024-09-17 9.8 Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Blind SQL Injection.This issue affects NACPremium: through 01082024.
CVE-2024-8695 1 Docker 2 Desktop, Docker Desktop 2024-09-13 9.8 Critical
A remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before 4.34.2.