Total
286780 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-22219 | 2025-03-13 | 6.8 Medium | ||
| VMware Aria Operations for Logs contains a stored cross-site scripting vulnerability. A malicious actor with non-administrative privileges may be able to inject a malicious script that (can perform stored cross-site scripting) may lead to arbitrary operations as admin user. | ||||
| CVE-2024-6613 | 2025-03-13 | 5.5 Medium | ||
| The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces. This vulnerability affects Firefox < 128 and Thunderbird < 128. | ||||
| CVE-2024-52723 | 1 Totolink | 2 X6000r, X6000r Firmware | 2025-03-13 | 9.8 Critical |
| In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering. An attacker can achieve arbitrary command execution by constructing the payload. | ||||
| CVE-2024-50808 | 1 Seacms | 1 Seacms | 2025-03-13 | 8.8 High |
| SeaCms 13.1 is vulnerable to code injection in the notification module of the member message notification module in the backend user module, due to unsafe handling of the "notify" variable in admin_notify.php. | ||||
| CVE-2024-4381 | 1 Wielebenwir | 1 Commonsbooking | 2025-03-13 | 4.8 Medium |
| The CB (legacy) WordPress plugin through 0.9.4.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2024-46958 | 2 Linux, Nextcloud | 2 Linux Kernel, Desktop | 2025-03-13 | 9.1 Critical |
| In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or world readable. This is fixed in 3.13.4. | ||||
| CVE-2024-46557 | 1 Draytek | 2 Vigor3910, Vigor3910 Firmware | 2025-03-13 | 7.5 High |
| Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. | ||||
| CVE-2024-44819 | 1 Zzcms | 1 Zzcms | 2025-03-13 | 6.1 Medium |
| Cross Site Scripting vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information via a crafted script to the pagename parameter of the admin/del.php component. | ||||
| CVE-2024-44228 | 1 Apple | 1 Xcode | 2025-03-13 | 7.5 High |
| This issue was addressed with improved permissions checking. This issue is fixed in Xcode 16. An app may be able to inherit Xcode permissions and access user data. | ||||
| CVE-2024-42056 | 1 Retool | 1 Retool | 2025-03-13 | 6.5 Medium |
| Retool (self-hosted enterprise) through 3.40.0 inserts resource authentication credentials into sent data. Credentials for users with "Use" permissions can be discovered (by an authenticated attacker) via the /api/resources endpoint. The earliest affected version is 3.18.1. | ||||
| CVE-2024-40777 | 1 Apple | 7 Ipad Os, Ipados, Iphone Os and 4 more | 2025-03-13 | 3.3 Low |
| An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 17.6 and iPadOS 17.6, watchOS 10.6, tvOS 17.6, visionOS 1.3, macOS Sonoma 14.6. Processing a maliciously crafted file may lead to unexpected app termination. | ||||
| CVE-2024-40717 | 1 Veeam | 1 Backup And Replication | 2025-03-13 | N/A |
| A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution (RCE) by updating existing jobs. These jobs can be configured to run pre- and post-scripts, which can be located on a network share and are executed with elevated privileges by default. The user can update a job and schedule it to run almost immediately, allowing arbitrary code execution on the server. | ||||
| CVE-2024-40039 | 1 Idccms Project | 1 Idccms | 2025-03-13 | 8.8 High |
| idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userGroup_deal.php?mudi=del | ||||
| CVE-2024-3628 | 1 Faktorystudios | 1 Easyevent | 2025-03-13 | 3.8 Low |
| The EasyEvent WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed | ||||
| CVE-2024-3516 | 2 Fedoraproject, Google | 2 Fedora, Chrome | 2025-03-13 | 8.8 High |
| Heap buffer overflow in ANGLE in Google Chrome prior to 123.0.6312.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2024-37768 | 1 B1ackc4t | 1 14finger | 2025-03-13 | 9.1 Critical |
| 14Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id. | ||||
| CVE-2024-37632 | 1 Totolink | 2 A3700r, A3700r Firmware | 2025-03-13 | 6.5 Medium |
| TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via the password parameter in function loginAuth . | ||||
| CVE-2024-35284 | 2025-03-13 | 5.4 Medium | ||
| A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient input validation. | ||||
| CVE-2024-35102 | 1 Vitec | 1 Exterity Avediaserver | 2025-03-13 | 8.8 High |
| Insecure Permissions vulnerability in VITEC AvediaServer (Model avsrv-m8105) 8.6.2-1 allows a remote attacker to escalate privileges via a crafted script. | ||||
| CVE-2024-33764 | 1 Sammycage | 1 Lunasvg | 2025-03-13 | 5.5 Medium |
| lunasvg v2.3.9 was discovered to contain a stack-overflow at lunasvg/source/element.h. | ||||