Export limit exceeded: 358285 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (358285 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-29943 | 1 Talend | 1 Administration Center | 2024-11-21 | 6.5 Medium |
| Talend Administration Center has a vulnerability that allows an authenticated user to use XML External Entity (XXE) processing to achieve read access as root on the remote filesystem. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x in TPS-5201. Earlier versions of Talend Administration Center may also be impacted; users are encouraged to update to a supported version. | ||||
| CVE-2022-29942 | 1 Talend | 1 Administration Center | 2024-11-21 | 6.5 Medium |
| Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' functionality to perform SSRF HTTP GET requests on URLs in the internal network. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x in TPS-5201. Earlier versions of Talend Administration Center may also be impacted; users are encouraged to update to a supported version. | ||||
| CVE-2022-29940 | 1 Librehealth | 1 Librehealth Ehr | 2024-11-21 | 5.4 Medium |
| In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters formseq and formid in interface\orders\find_order_popup.php leads to multiple cross-site scripting (XSS) vulnerabilities. | ||||
| CVE-2022-29939 | 1 Librehealth | 1 Librehealth Ehr | 2024-11-21 | 5.4 Medium |
| In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters debug and InsId in interface\billing\sl_eob_process.php leads to multiple cross-site scripting (XSS) vulnerabilities. | ||||
| CVE-2022-29938 | 1 Librehealth | 1 Librehealth Ehr | 2024-11-21 | 8.8 High |
| In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameter payment_id in interface\billing\new_payment.php via interface\billing\payment_master.inc.php leads to SQL injection. | ||||
| CVE-2022-29937 | 1 Usu | 1 Oracle Optimization | 2024-11-21 | 8.8 High |
| USU Oracle Optimization before 5.17.5 allows authenticated DataCollection users to achieve agent root access because some common OS commands are blocked but (for example) an OS command for base64 decoding is not blocked. NOTE: this is not an Oracle Corporation product. | ||||
| CVE-2022-29936 | 1 Usu | 1 Oracle Optimization | 2024-11-21 | 8.8 High |
| USU Oracle Optimization before 5.17 allows authenticated quantum users to achieve remote code execution because of /v2/quantum/save-data-upload-big-file Java deserialization. NOTE: this is not an Oracle Corporation product. | ||||
| CVE-2022-29935 | 1 Usu | 1 Oracle Optimization | 2024-11-21 | 7.5 High |
| USU Oracle Optimization before 5.17.5 allows attackers to discover the quantum credentials via an agent-installer download. NOTE: this is not an Oracle Corporation product. | ||||
| CVE-2022-29934 | 1 Usu | 1 Oracle Optimization | 2024-11-21 | 7.8 High |
| USU Oracle Optimization before 5.17.5 lacks Polkit authentication, which allows smartcollector users to achieve root access via pkexec. NOTE: this is not an Oracle Corporation product. | ||||
| CVE-2022-29933 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | 8.8 High |
| Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must send X-Forwarded-Host to the /index.php?p=admin/actions/users/send-password-reset-email URI. NOTE: the vendor's position is that a customer can already work around this by adjusting the configuration (i.e., by not using the default configuration). | ||||
| CVE-2022-29932 | 1 Primeur | 1 Spazio | 2024-11-21 | 7.5 High |
| The HTTP Server in PRIMEUR SPAZIO 2.5.1.954 (File Transfer) allows an unauthenticated attacker to obtain sensitive data (related to the content of transferred files) via a crafted HTTP request. | ||||
| CVE-2022-29930 | 1 Jetbrains | 1 Ktor | 2024-11-21 | 8.7 High |
| SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. The issue was fixed in Ktor version 2.0.1. | ||||
| CVE-2022-29929 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | 3.7 Low |
| In JetBrains TeamCity before 2022.04 potential XSS via Referrer header was possible | ||||
| CVE-2022-29928 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | 4.4 Medium |
| In JetBrains TeamCity before 2022.04 leak of secrets in TeamCity agent logs was possible | ||||
| CVE-2022-29927 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | 4.6 Medium |
| In JetBrains TeamCity before 2022.04 reflected XSS on the Build Chain Status page was possible | ||||
| CVE-2022-29925 | 1 Fujielectric | 1 V-sft | 2024-11-21 | 7.8 High |
| Access of uninitialized pointer vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file. | ||||
| CVE-2022-29923 | 1 Thingsforrestaurants | 1 Quick Restaurant Reservations | 2024-11-21 | 5.9 Medium |
| Cross-site Scripting (XSS) vulnerability in ThingsForRestaurants Quick Restaurant Reservations (WordPress plugin) allows Reflected XSS.This issue affects Quick Restaurant Reservations (WordPress plugin): from n/a through 1.4.1. | ||||
| CVE-2022-29908 | 1 Fabasoft | 1 Fabasoft Cloud Enterprise Client | 2024-11-21 | 7.8 High |
| The folioupdate service in Fabasoft Cloud Enterprise Client 22.4.0043 allows Local Privilege Escalation. | ||||
| CVE-2022-29907 | 1 Mediawiki | 1 Mediawiki | 2024-11-21 | 6.1 Medium |
| The Nimbus skin for MediaWiki through 1.37.2 (before 6f9c8fb868345701d9544a54d9752515aace39df) allows XSS in Advertise link messages. | ||||
| CVE-2022-29906 | 1 Mediawiki | 1 Mediawiki | 2024-11-21 | 9.8 Critical |
| The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf9f66) omits a check for the quizadmin user. | ||||