Search

Expected end of text, found '/' (at char 33), (line:1, col:34)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (37254 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2022-42250 1 Oretnom23 1 Simple Cold Storage Management System 2024-11-21 7.2 High
Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/inquiries/view_details.php?id=.
CVE-2022-42249 1 Oretnom23 1 Simple Cold Storage Management System 2024-11-21 7.2 High
Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/storages/view_storage.php?id=.
CVE-2022-42247 1 Pfsense 1 Pfsense 2024-11-21 6.1 Medium
pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the browser.php component. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a file name.
CVE-2022-42243 1 Oretnom23 1 Simple Cold Storage Management System 2024-11-21 7.2 High
Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/storages/manage_storage.php?id=.
CVE-2022-42242 1 Oretnom23 1 Simple Cold Storage Management System 2024-11-21 7.2 High
Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/classes/Master.php?f=delete_booking.
CVE-2022-42241 1 Oretnom23 1 Simple Cold Storage Management System 2024-11-21 7.2 High
Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/classes/Master.php?f=delete_message.
CVE-2022-42183 1 Precisely 1 Spectrum Spatial Analyst 2024-11-21 9.1 Critical
Precisely Spectrum Spatial Analyst 20.01 is vulnerable to Server-Side Request Forgery (SSRF).
CVE-2022-42182 1 Precisely 1 Spectrum Spatial Analyst 2024-11-21 5.3 Medium
Precisely Spectrum Spatial Analyst 20.01 is vulnerable to Directory Traversal.
CVE-2022-42092 1 Backdropcms 1 Backdrop Cms 2024-11-21 7.2 High
Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution. Note: Third parties dispute this and argue that advanced permissions are required.
CVE-2022-42075 1 Wedding Planner Project 1 Wedding Planner 2024-11-21 9.8 Critical
Wedding Planner v1.0 is vulnerable to arbitrary code execution.
CVE-2022-42074 1 Online Diagnostic Lab Management System Project 1 Online Diagnostic Lab Management System 2024-11-21 7.2 High
Online Diagnostic Lab Management System v1.0 is vulnerable to SQL Injection via /diagnostic/editcategory.php?id=.
CVE-2022-42073 1 Online Diagnostic Lab Management System Project 1 Online Diagnostic Lab Management System 2024-11-21 7.2 High
Online Diagnostic Lab Management System v1.0 is vulnerable to SQL Injection via /diagnostic/editclient.php?id=.
CVE-2022-42004 5 Debian, Fasterxml, Netapp and 2 more 20 Debian Linux, Jackson-databind, Oncommand Workflow Automation and 17 more 2024-11-21 7.5 High
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.
CVE-2022-42003 5 Debian, Fasterxml, Netapp and 2 more 23 Debian Linux, Jackson-databind, Oncommand Workflow Automation and 20 more 2024-11-21 7.5 High
In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.
CVE-2022-41716 2 Golang, Microsoft 2 Go, Windows 2024-11-21 6.3 Medium
Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".
CVE-2022-41672 1 Apache 1 Airflow 2024-11-21 8.1 High
In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.
CVE-2022-41574 1 Gradle 1 Enterprise 2024-11-21 7.5 High
An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote attackers to prevent backups from occurring, and send emails with arbitrary text content to the configured installation-administrator contact address, via HTTP access to an accidentally exposed internal endpoint. This is fixed in 2022.3.2.
CVE-2022-41556 2 Fedoraproject, Lighttpd 2 Fedora, Lighttpd 2024-11-21 7.5 High
A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a large amount of anomalous TCP behavior by clients. It is related to RDHUP mishandling in certain HTTP/1.1 chunked situations. Use of mod_fastcgi is, for example, affected. This is fixed in 1.4.67.
CVE-2022-41528 1 Totolink 2 Nr1800x, Nr1800x Firmware 2024-11-21 8.8 High
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg function.
CVE-2022-41527 1 Totolink 2 Nr1800x, Nr1800x Firmware 2024-11-21 8.8 High
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the pppoeUser parameter in the setOpModeCfg function.