Search

Expected end of text, found '/' (at char 24), (line:1, col:25)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (19927 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2022-31213 2 Dbus-broker Project, Redhat 2 Dbus-broker, Enterprise Linux 2024-11-21 7.5 High
An issue was discovered in dbus-broker before 31. Multiple NULL pointer dereferences can be found when supplying a malformed XML config file.
CVE-2022-31212 2 Dbus-broker Project, Redhat 2 Dbus-broker, Enterprise Linux 2024-11-21 7.5 High
An issue was discovered in dbus-broker before 31. It depends on c-uitl/c-shquote to parse the DBus service's Exec line. c-shquote contains a stack-based buffer over-read if a malicious Exec line is supplied.
CVE-2022-31211 1 Infiray 2 Iray-a8z3, Iray-a8z3 Firmware 2024-11-21 9.8 Critical
An issue was discovered in Infiray IRAY-A8Z3 1.0.957. There is a blank root password for TELNET by default.
CVE-2022-31210 1 Infiray 2 Iray-a8z3, Iray-a8z3 Firmware 2024-11-21 9.8 Critical
An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The binary file /usr/local/sbin/webproject/set_param.cgi contains hardcoded credentials to the web application. Because these accounts cannot be deactivated or have their passwords changed, they are considered to be backdoor accounts.
CVE-2022-31209 1 Infiray 2 Iray-a8z3, Iray-a8z3 Firmware 2024-11-21 9.8 Critical
An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The firmware contains a potential buffer overflow by calling strcpy() without checking the string length beforehand.
CVE-2022-31208 1 Infiray 2 Iray-a8z3, Iray-a8z3 Firmware 2024-11-21 8.8 High
An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The webserver contains an endpoint that can execute arbitrary commands by manipulating the cmd_string URL parameter.
CVE-2022-31202 1 Monitoringsoft 1 Softguard Web 2024-11-21 6.5 Medium
The export function in SoftGuard Web (SGW) before 5.1.5 allows directory traversal to read an arbitrary local file via export or man.tcl.
CVE-2022-31201 1 Monitoringsoft 1 Softguard Web 2024-11-21 5.4 Medium
SoftGuard Web (SGW) before 5.1.5 allows HTML injection.
CVE-2022-30982 1 Gentics 1 Gentics Cms 2024-11-21 5.4 Medium
An issue was discovered in Gentics CMS before 5.43.1. There is stored XSS in the profile description and in the username.
CVE-2022-30981 1 Gentics 1 Gentics Cms 2024-11-21 8.8 High
An issue was discovered in Gentics CMS before 5.43.1. By uploading a malicious ZIP file, an attacker is able to deserialize arbitrary data and hence can potentially achieve Java code execution.
CVE-2022-30972 1 Jenkins 1 Storage Configs 2024-11-21 8.8 High
A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local XML file (e.g., archived artifacts) that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
CVE-2022-30971 1 Jenkins 1 Storable Configs 2024-11-21 8.8 High
Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-30970 1 Jenkins 1 Autocomplete Parameter 2024-11-21 5.4 Medium
Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsafe manner from Javascript embedded in view definitions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-30969 1 Jenkins 1 Autocomplete Parameter 2024-11-21 8.8 High
A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitrary code without sandbox protection if the victim is an administrator.
CVE-2022-30968 1 Jenkins 1 Vboxwrapper 2024-11-21 5.4 Medium
Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-30967 1 Jenkins 1 Selection Tasks 2024-11-21 5.4 Medium
Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-30966 1 Jenkins 1 Random String Parameter 2024-11-21 5.4 Medium
Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-30965 1 Jenkins 1 Promoted Builds 2024-11-21 5.4 Medium
Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-30964 1 Jenkins 1 Multiselect Parameter 2024-11-21 5.4 Medium
Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-30963 1 Jenkins 1 Jdk Parameter 2024-11-21 5.4 Medium
Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.