Export limit exceeded: 341797 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (341797 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-39331 | 2 Nodejs, Redhat | 2 Node.js, Enterprise Linux | 2025-11-03 | 7.5 High |
| A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. | ||||
| CVE-2023-38552 | 3 Fedoraproject, Nodejs, Redhat | 3 Fedora, Node.js, Enterprise Linux | 2025-11-03 | 7.5 High |
| When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js. | ||||
| CVE-2023-38522 | 1 Apache | 1 Traffic Server | 2025-11-03 | 7.5 High |
| Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue. | ||||
| CVE-2023-38473 | 2 Avahi, Redhat | 3 Avahi, Enterprise Linux, Rhel Eus | 2025-11-03 | 6.2 Medium |
| A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function. | ||||
| CVE-2023-38472 | 2 Avahi, Redhat | 3 Avahi, Enterprise Linux, Rhel Eus | 2025-11-03 | 6.2 Medium |
| A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function. | ||||
| CVE-2023-38471 | 2 Avahi, Redhat | 3 Avahi, Enterprise Linux, Rhel Eus | 2025-11-03 | 6.2 Medium |
| A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function. | ||||
| CVE-2023-38470 | 2 Avahi, Redhat | 3 Avahi, Enterprise Linux, Rhel Eus | 2025-11-03 | 6.2 Medium |
| A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function. | ||||
| CVE-2023-38469 | 2 Avahi, Redhat | 3 Avahi, Enterprise Linux, Rhel Eus | 2025-11-03 | 6.2 Medium |
| A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record. | ||||
| CVE-2023-38371 | 1 Ibm | 2 Security Access Manager, Security Verify Access Docker | 2025-11-03 | 5.9 Medium |
| IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 261198. | ||||
| CVE-2023-38370 | 1 Ibm | 2 Security Access Manager, Security Verify Access Docker | 2025-11-03 | 7.5 High |
| IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1, under certain configurations, could allow a user on the network to install malicious packages. IBM X-Force ID: 261197. | ||||
| CVE-2023-38369 | 1 Ibm | 1 Security Access Manager Container | 2025-11-03 | 6.2 Medium |
| IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 does not require that docker images should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 261196. | ||||
| CVE-2023-38368 | 1 Ibm | 2 Security Access Manager, Security Verify Access Docker | 2025-11-03 | 5.5 Medium |
| IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could disclose sensitive information to a local user to do improper permission controls. IBM X-Force ID: 261195. | ||||
| CVE-2023-38267 | 1 Ibm | 2 Security Verify Access, Security Verify Access Docker | 2025-11-03 | 6.2 Medium |
| IBM Security Access Manager Appliance (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could allow a local user to possibly elevate their privileges due to sensitive configuration information being exposed. IBM X-Force ID: 260584. | ||||
| CVE-2023-37903 | 2 Redhat, Vm2 Project | 3 Acm, Multicluster Engine, Vm2 | 2025-11-03 | 9.8 Critical |
| vm2 is an open source vm/sandbox for Node.js. In vm2 for versions up to and including 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code. This may result in Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox. There are no patches and no known workarounds. Users are advised to find an alternative software. | ||||
| CVE-2023-34424 | 2025-11-03 | 4.4 Medium | ||
| Improper input validation in firmware for some Intel(R) CSME may allow a privileged user to potentially enable denial of service via local access. | ||||
| CVE-2023-33865 | 1 Renderdoc | 1 Renderdoc | 2025-11-03 | 7.8 High |
| RenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the /tmp/RenderDoc directory regardless of ownership. | ||||
| CVE-2023-33864 | 1 Renderdoc | 1 Renderdoc | 2025-11-03 | 9.8 Critical |
| StreamReader::ReadFromExternal in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow. It uses uint32_t(m_BufferSize-m_InputSize) even though m_InputSize can exceed m_BufferSize. | ||||
| CVE-2023-33863 | 1 Renderdoc | 1 Renderdoc | 2025-11-03 | 9.8 Critical |
| SerialiseValue in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow. 0xffffffff is sign-extended to 0xffffffffffffffff (SIZE_MAX) and then there is an attempt to add 1. | ||||
| CVE-2023-33850 | 4 Hp, Ibm, Linux and 1 more | 6 Hp-ux, Aix, Cics Tx and 3 more | 2025-11-03 | 7.5 High |
| IBM GSKit-Crypto could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial messages for decryption, an attacker could exploit this vulnerability to obtain sensitive information. | ||||
| CVE-2023-32727 | 1 Zabbix | 1 Zabbix Server | 2025-11-03 | 6.8 Medium |
| An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server. | ||||