Search

Expected end of text, found '–' (at char 39), (line:1, col:40)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (37280 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2022-2030 1 Zyxel 50 Atp100, Atp100 Firmware, Atp100w and 47 more 2024-11-21 6.5 Medium
A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32 through 5.30, VPN series firmware versions 4.30 through 5.30, USG/ZyWALL series firmware versions 4.11 through 4.72, that could allow an authenticated attacker to access some restricted files on a vulnerable device.
CVE-2022-2029 1 Kromit 1 Titra 2024-11-21 5.4 Medium
Cross-site Scripting (XSS) - DOM in GitHub repository kromitgmbh/titra prior to 0.77.0.
CVE-2022-2028 1 Kromit 1 Titra 2024-11-21 5.4 Medium
Cross-site Scripting (XSS) - Generic in GitHub repository kromitgmbh/titra prior to 0.77.0.
CVE-2022-2027 1 Kromit 1 Titra 2024-11-21 8.0 High
Improper Neutralization of Formula Elements in a CSV File in GitHub repository kromitgmbh/titra prior to 0.77.0.
CVE-2022-2026 1 Kromit 1 Titra 2024-11-21 5.4 Medium
Cross-site Scripting (XSS) - Stored in GitHub repository kromitgmbh/titra prior to 0.77.0.
CVE-2022-2016 1 Facturascripts 1 Facturascripts 2024-11-21 5.4 Medium
Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.1.
CVE-2022-2015 1 Diagrams 1 Drawio 2024-11-21 5.4 Medium
Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 19.0.2.
CVE-2022-2014 1 Diagrams 1 Drawio 2024-11-21 5.4 Medium
Code Injection in GitHub repository jgraph/drawio prior to 19.0.2.
CVE-2022-2013 3 Linux, Microsoft, Octopus 3 Linux Kernel, Windows, Octopus Deploy 2024-11-21 7.5 High
In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental feature flag all new users would have access to the Script Console within their private space.
CVE-2022-29948 1 Lepin Ep-kp001 Project 2 Lepin Ep-kp001, Lepinep-kp001 Firmware 2024-11-21 4.6 Medium
Due to an insecure design, the Lepin EP-KP001 flash drive through KP001_V19 is vulnerable to an authentication bypass attack that enables an attacker to gain access to the stored encrypted data. Normally, the encrypted disk partition with this data is unlocked by entering the correct passcode (6 to 14 digits) via the keypad and pressing the Unlock button. This authentication is performed by an unknown microcontroller. By replacing this microcontroller on a target device with one from an attacker-controlled Lepin EP-KP001 whose passcode is known, it is possible to successfully unlock the target device and read the stored data in cleartext.
CVE-2022-29923 1 Thingsforrestaurants 1 Quick Restaurant Reservations 2024-11-21 5.9 Medium
Cross-site Scripting (XSS) vulnerability in ThingsForRestaurants Quick Restaurant Reservations (WordPress plugin) allows Reflected XSS.This issue affects Quick Restaurant Reservations (WordPress plugin): from n/a through 1.4.1.
CVE-2022-29894 1 Strapi 1 Strapi 2024-11-21 4.8 Medium
Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege.
CVE-2022-29890 1 Octopus 1 Octopus Server 2024-11-21 6.1 Medium
In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link.
CVE-2022-29804 2 Golang, Microsoft 2 Go, Windows 2024-11-21 7.5 High
Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.
CVE-2022-29798 1 Huawei 2 Cv81-wdm, Cv81-wdm Firmware 2024-11-21 7.5 High
There is a denial of service vulnerability in CV81-WDM FW versions 01.70.49.29.46. Successful exploitation could cause denial of service.
CVE-2022-29797 1 Huawei 2 Cv81-wdm, Cv81-wdm Firmware 2024-11-21 9.8 Critical
There is a buffer overflow vulnerability in CV81-WDM FW 01.70.49.29.46. Successful exploitation of this vulnerability may lead to privilege escalation.
CVE-2022-29652 1 Online Sports Complex Booking System Project 1 Online Sports Complex Booking System 2024-11-21 6.1 Medium
Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/classes/Users.php?f=save_client.
CVE-2022-29646 1 Totolink 2 A3100r, A3100r Firmware 2024-11-21 5.3 Medium
An access control issue in TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 allows attackers to obtain sensitive information via a crafted web request.
CVE-2022-29645 1 Totolink 2 A3100r, A3100r Firmware 2024-11-21 9.8 Critical
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a hard coded password for root stored in the component /etc/shadow.sample.
CVE-2022-29644 1 Totolink 2 A3100r, A3100r Firmware 2024-11-21 9.8 Critical
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a hard coded password for the telnet service stored in the component /web_cste/cgi-bin/product.ini.