Search

Expected end of text, found ':' (at char 28), (line:1, col:29)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (29317 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2022-30126 3 Apache, Oracle, Redhat 3 Tika, Primavera Unifier, Jboss Fuse 2024-11-21 5.5 Medium
In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.2 and 2.4.0
CVE-2022-30110 1 Jirafeau 1 Jirafeau 2024-11-21 6.1 Medium
The file preview functionality in Jirafeau < 4.4.0, which is enabled by default, could be exploited for cross site scripting. An attacker could upload image/svg+xml files containing JavaScript. When someone visits the File Preview URL for this file, the JavaScript inside of this image/svg+xml file will be executed in the users' browser.
CVE-2022-30105 1 Belkin 2 N300, N300 Firmware 2024-11-21 9.8 Critical
In Belkin N300 Firmware 1.00.08, the script located at /setting_hidden.asp, which is accessible before and after configuring the device, exhibits multiple remote command injection vulnerabilities. The following parameters in the [form name] form; [list vulnerable parameters], are not properly sanitized after being submitted to the web interface in a POST request. With specially crafted parameters, it is possible to inject a an OS command which will be executed with root privileges, as the web interface, and all processes on the device, run as root.
CVE-2022-30075 1 Tp-link 2 Archer Ax50, Archer Ax50 Firmware 2024-11-21 8.8 High
In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validation.
CVE-2022-30073 1 Wbce 1 Wbce Cms 2024-11-21 5.4 Medium
WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via /admin/users/save.php.
CVE-2022-30072 1 Wbce 1 Wbce Cms 2024-11-21 5.4 Medium
WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via \admin\pages\sections_save.php namesection2 parameters.
CVE-2022-30067 2 Gimp, Redhat 2 Gimp, Enterprise Linux 2024-11-21 5.5 Medium
GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Through a crafted XCF file, the program will allocate for a huge amount of memory, resulting in insufficient memory or program crash.
CVE-2022-30055 2 Mersenne, Microsoft 2 Prime95, Windows 2024-11-21 9.8 Critical
Prime95 30.7 build 9 suffers from a Buffer Overflow vulnerability that could lead to Remote Code Execution.
CVE-2022-30054 1 Covid 19 Travel Pass Management Project 1 Covid 19 Travel Pass Management 2024-11-21 9.8 Critical
In Covid 19 Travel Pass Management 1.0, the code parameter is vulnerable to SQL injection attacks.
CVE-2022-30052 1 Home Clean Service System Project 1 Home Clean Service System 2024-11-21 9.8 Critical
In Home Clean Service System 1.0, the password parameter is vulnerable to SQL injection attacks.
CVE-2022-30050 1 Sir 1 Gnuboard 2024-11-21 6.1 Medium
Gnuboard 5.55 and 5.56 is vulnerable to Cross Site Scripting (XSS) via bbs/member_confirm.php.
CVE-2022-30049 1 Ruifang-tech 1 Rebuild 2024-11-21 7.5 High
A Server-Side Request Forgery (SSRF) in Rebuild v2.8.3 allows attackers to obtain the real IP address and scan Intranet information via the fileurl parameter.
CVE-2022-30045 1 Ezxml Project 1 Ezxml 2024-11-21 6.5 Medium
An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_decode() performs incorrect memory handling while parsing crafted XML files, leading to a heap out-of-bounds read.
CVE-2022-30034 1 Flower Project 1 Flower 2024-11-21 8.6 High
Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes.
CVE-2022-30033 1 Tenda 2 Tx9 Pro, Tx9 Pro Firmware 2024-11-21 7.5 High
Tenda TX9 Pro V22.03.02.10 is vulnerable to Buffer Overflow via the functtion setIPv6Status() in httpd module.
CVE-2022-30018 1 Mobotix 1 Mxcontrolcenter 2024-11-21 8.8 High
Mobotix Control Center (MxCC) through 2.5.4.5 has Insufficiently Protected Credentials, Storing Passwords in a Recoverable Format via the MxCC.ini config file. The credential storage method in this software enables an attacker/user of the machine to gain admin access to the software and gain access to recordings/recording locations.
CVE-2022-30013 1 Totaljs 1 Total.js 2024-11-21 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in the upload function of totaljs CMS 3.4.5 allows attackers to execute arbitrary web scripts via a JavaScript embedded PDF file.
CVE-2022-30012 1 Hospital Management System Project 1 Hospital Management System 2024-11-21 7.5 High
In the POST request of the appointment.php page of HMS v.0, there are SQL injection vulnerabilities in multiple parameters, and database information can be obtained through injection.
CVE-2022-30011 1 Hospital Management System Project 1 Hospital Management System 2024-11-21 9.8 Critical
In HMS 1.0 when requesting appointment.php through POST, multiple parameters can lead to a SQL injection vulnerability.
CVE-2022-30007 1 Gxcms Project 1 Gxcms 2024-11-21 7.2 High
GXCMS V1.5 has a file upload vulnerability in the background. The vulnerability is the template management page. You can edit any template content and then rename to PHP suffix file, after calling PHP file can control the server.