Search

Expected end of text, found '/' (at char 44), (line:1, col:45)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (37214 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2022-32456 1 Digiwin 1 Business Process Management 2024-11-21 9.8 Critical
Digiwin BPM’s function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL command to access, modify, delete database or disrupt service.
CVE-2022-32455 1 F5 11 Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager, Big-ip Analytics and 8 more 2024-11-21 7.5 High
In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when a BIG-IP LTM Client SSL profile is configured on a virtual server to perform client certificate authentication with session tickets enabled, undisclosed requests cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2022-32434 1 Opener Project 1 Opener 2024-11-21 7.8 High
EIPStackGroup OpENer v2.3.0 was discovered to contain a stack overflow via /bin/posix/src/ports/POSIX/OpENer+0x56073d.
CVE-2022-32296 1 Linux 1 Linux Kernel 2024-11-21 3.3 Low
The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occurs because of use of Algorithm 4 ("Double-Hash Port Selection Algorithm") of RFC 6056.
CVE-2022-32278 2 Debian, Xfce 2 Debian Linux, Exo 2024-11-21 8.8 High
XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server.
CVE-2022-32273 1 Opswat 1 Metadefender 2024-11-21 4.3 Medium
As a result of an observable discrepancy in returned messages, OPSWAT MetaDefender Core (MDCore) before 5.1.2 could allow an authenticated user to enumerate filenames on the server.
CVE-2022-32272 1 Opswat 1 Metadefender 2024-11-21 9.8 Critical
OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before 5.6.1 have incorrect access control, resulting in privilege escalation.
CVE-2022-32263 1 Pexip 1 Pexip Infinity 2024-11-21 7.5 High
Pexip Infinity before 28.1 allows remote attackers to trigger a software abort via G.719.
CVE-2022-32245 1 Sap 1 Businessobjects Business Intelligence 2024-11-21 8.2 High
SAP BusinessObjects Business Intelligence Platform (Open Document) - versions 420, 430, allows an unauthenticated attacker to retrieve sensitive information plain text over the network. On successful exploitation, the attacker can view any data available for a business user and put load on the application by an automated attack. Thus, completely compromising confidentiality but causing a limited impact on the availability of the application.
CVE-2022-32195 1 Edx 1 Open Edx 2024-11-21 6.1 Medium
Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL.
CVE-2022-32193 1 Couchbase 1 Couchbase Server 2024-11-21 6.5 Medium
Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.
CVE-2022-32192 1 Couchbase 1 Couchbase Server 2024-11-21 7.5 High
Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.
CVE-2022-32190 2 Golang, Redhat 10 Go, Ceph Storage, Container Native Virtualization and 7 more 2024-11-21 7.5 High
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.
CVE-2022-32189 2 Golang, Redhat 13 Go, Ceph Storage, Container Native Virtualization and 10 more 2024-11-21 7.5 High
A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.
CVE-2022-32173 1 Orchardcore 1 Orchardcore 2024-11-21 5.4 Medium
In OrchardCore rc1-11259 to v1.2.2 vulnerable to HTML injection, allow an authenticated user with an editor security role to inject a persistent HTML modal dialog component into the dashboard that will affect admin users.
CVE-2022-32119 1 Arox 1 School Erp Pro 2024-11-21 8.8 High
Arox School ERP Pro v1.0 was discovered to contain multiple arbitrary file upload vulnerabilities via the Add Photo function at photogalleries.inc.php and the import staff excel function at 1finance_master.inc.php.
CVE-2022-32118 1 Arox 1 School Erp Pro 2024-11-21 6.1 Medium
Arox School ERP Pro v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the dispatchcategory parameter in backoffice.inc.php.
CVE-2022-31830 1 Baidu 1 Kity Minder 2024-11-21 9.1 Critical
Kity Minder v1.3.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the init function at ImageCapture.class.php.
CVE-2022-31827 1 Monstaftp 1 Monstaftp 2024-11-21 9.1 Critical
MonstaFTP v2.10.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the function performFetchRequest at HTTPFetcher.php.
CVE-2022-31793 2 Arris, Inglorion 13 Bgw210, Bgw210 Firmware, Bgw320 and 10 more 2024-11-21 7.5 High
do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and NVG510 devices and Arris-derived BGW210 and BGW320 devices are affected.