Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (29888 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2024-8322 1 Ivanti 1 Endpoint Manager 2024-09-12 4.3 Medium
Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker to access restricted functionality.
CVE-2024-41173 1 Beckhoff 2 Ipc Diagnostics Package, Twincat\/bsd 2024-09-12 7.8 High
The IPC-Diagnostics package included in TwinCAT/BSD is vulnerable to a local authentication bypass by a low privileged attacker.
CVE-2023-50315 1 Ibm 1 Websphere Application Server 2024-09-11 5.3 Medium
IBM WebSphere Application Server 8.5 and 9.0 could allow an attacker with access to the network to conduct spoofing attacks. An attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information. IBM X-Force ID: 274714.
CVE-2024-7569 1 Ivanti 1 Neurons For Itsm 2024-09-06 9.6 Critical
An information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows an unauthenticated attacker to obtain the OIDC client secret via debug information.
CVE-2024-45392 1 Salesagility 1 Suitecrm 2024-09-06 7.7 High
SuiteCRM is an open-source customer relationship management (CRM) system. Prior to version 7.14.5 and 8.6.2, insufficient access control checks allow a threat actor to delete records via the API. Versions 7.14.5 and 8.6.2 contain a patch for the issue.
CVE-2024-45096 1 Ibm 1 Aspera Faspex 2024-09-06 6.5 Medium
IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user with access to the package to obtain sensitive information through a directory listing.
CVE-2024-36068 1 Rubrik 2 Cdm, Cloud Data Management 2024-09-05 7.5 High
An incorrect access control vulnerability in Rubrik CDM versions prior to 9.1.2-p1, 9.0.3-p6 and 8.1.3-p12, allows an attacker with network access to execute arbitrary code.
CVE-2024-34637 1 Samsung 1 Android 2024-09-05 6.2 Medium
Improper access control in WindowManagerService prior to SMR Sep-2024 Release 1 in Android 12, and SMR Jun-2024 Release 1 in Android 13 and Android 14 allows local attackers to bypass restrictions on starting services from the background.
CVE-2024-34640 1 Samsung 1 Android 2024-09-05 3.3 Low
Improper access control vulnerability in BGProtectManager prior to SMR Sep-2024 Release 1 allows local attackers to bypass restriction of process expiration.
CVE-2024-34643 1 Samsung 1 Android 2024-09-05 4.4 Medium
Improper access control in key input related function in Dressroom prior to SMR Sep-2024 Release 1 allows local attackers to access protected data. User interaction is required for triggering this vulnerability.
CVE-2024-34644 1 Samsung 1 Android 2024-09-05 4.4 Medium
Improper access control in item selection related in Dressroom prior to SMR Sep-2024 Release 1 allows local attackers to access protected data. User interaction is required for triggering this vulnerability.
CVE-2024-34646 1 Samsung 1 Android 2024-09-05 6.6 Medium
Improper access control in DualDarManagerProxy prior to SMR Sep-2024 Release 1 allows local attackers to cause local permanent denial of service.
CVE-2024-34649 1 Samsung 1 Android 2024-09-05 2.4 Low
Improper access control in new Dex Mode in multitasking framework prior to SMR Sep-2024 Release 1 allows physical attackers to temporarily access an unlocked screen.
CVE-2024-38482 1 Dell 1 Cloudlink 2024-09-05 6.6 Medium
CloudLink, versions 7.1.x and 8.x, contain an Improper check or handling of Exceptional Conditions Vulnerability in Cluster Component. A highly privileged malicious user with remote access could potentially exploit this vulnerability, leading to execute unauthorized actions and retrieve sensitive information from the database.
CVE-2024-45522 1 Linen 1 Linen 2024-09-05 9.1 Critical
Linen before cd37c3e does not verify that the domain is linen.dev or www.linen.dev when resetting a password. This occurs in create in apps/web/pages/api/forgot-password/index.ts.
CVE-2024-45587 1 Symphonyfintech 2 Xts Mobile Trader, Xts Web Trader 2024-09-04 8.8 High
This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Transaction module of vulnerable application. An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to compromise of other user accounts.
CVE-2024-45586 1 Symphonyfintech 2 Xts Mobile Trader, Xts Web Trader 2024-09-04 8.8 High
This vulnerability exists due to improper access controls on APIs in the Authentication module of Symphony XTS Web Trading and Mobile Trading platforms (version 2.0.0.1_P160). An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized account take over belonging to other users.
CVE-2024-41518 2 Feripro, Mecodia 2 Feripro, Feripro 2024-09-03 7.5 High
An Incorrect Access Control vulnerability in "/admin/programm/<program_id>/export/statistics" in Feripro <= v2.2.3 allows remote attackers to export an XLSX file with information about registrations and participants.
CVE-2024-43377 1 Umbraco 1 Umbraco Cms 2024-09-03 5.4 Medium
Umbraco CMS is an ASP.NET CMS. An authenticated user can access a few unintended endpoints. This issue is fixed in 14.1.2.
CVE-2024-42340 1 Cyberark 1 Identity 2024-08-30 8.3 High
CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security