Export limit exceeded: 361935 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 361935 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (361935 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-26189 | 1 Totolink | 2 N600r, N600r Firmware | 2024-11-21 | 9.8 Critical |
| TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the langType parameter in the login interface. | ||||
| CVE-2022-26188 | 1 Totolink | 2 N600r, N600r Firmware | 2024-11-21 | 9.8 Critical |
| TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSyncWithHost. | ||||
| CVE-2022-26187 | 1 Totolink | 2 N600r, N600r Firmware | 2024-11-21 | 9.8 Critical |
| TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function. | ||||
| CVE-2022-26186 | 1 Totolink | 2 N600r, N600r Firmware | 2024-11-21 | 9.8 Critical |
| TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the exportOvpn interface at cstecgi.cgi. | ||||
| CVE-2022-26184 | 2 Microsoft, Python-poetry | 2 Windows, Poetry | 2024-11-21 | 9.8 Critical |
| Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS. | ||||
| CVE-2022-26183 | 2 Microsoft, Pnpm | 2 Windows, Pnpm | 2024-11-21 | 8.8 High |
| PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS. | ||||
| CVE-2022-26181 | 1 Dropbox | 1 Lepton | 2024-11-21 | 7.8 High |
| Dropbox Lepton v1.2.1-185-g2a08b77 was discovered to contain a heap-buffer-overflow in the function aligned_dealloc():src/lepton/bitops.cc:108. | ||||
| CVE-2022-26180 | 1 Qdpm | 1 Qdpm | 2024-11-21 | 8.8 High |
| qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI. | ||||
| CVE-2022-26174 | 1 Beekeeperstudio | 1 Beekeeper-studio | 2024-11-21 | 9.8 Critical |
| A remote code execution (RCE) vulnerability in Beekeeper Studio v3.2.0 allows attackers to execute arbitrary code via a crafted payload injected into the display fields. | ||||
| CVE-2022-26173 | 1 Jforum | 1 Jforum | 2024-11-21 | 8.8 High |
| JForum v2.8.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via http://target_host:port/jforum-2.8.0/jforum.page, which allows attackers to arbitrarily add admin accounts. | ||||
| CVE-2022-26171 | 1 Bank Management System Project | 1 Bank Management System | 2024-11-21 | 9.8 Critical |
| Bank Management System v1.o was discovered to contain a SQL injection vulnerability via the email parameter. | ||||
| CVE-2022-26170 | 1 Simple Mobile Comparison Website Project | 1 Simple Mobile Comparison Website | 2024-11-21 | 9.8 Critical |
| Simple Mobile Comparison Website v1.0 was discovered to contain a SQL injection vulnerability via the search parameter. | ||||
| CVE-2022-26169 | 1 Air Cargo Management System Project | 1 Air Cargo Management System | 2024-11-21 | 9.8 Critical |
| Air Cargo Management System v1.0 was discovered to contain a SQL injection vulnerability via the ref_code parameter. | ||||
| CVE-2022-26159 | 1 Ametys | 1 Ametys | 2024-11-21 | 5.3 Medium |
| The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/<domain>/en.xml (and similar pathnames for other languages), which contain all characters typed by all users, including the content of private pages. For example, a private page may contain usernames, e-mail addresses, and possibly passwords. | ||||
| CVE-2022-26158 | 1 Cherwell | 1 Cherwell Service Management | 2024-11-21 | 6.1 Medium |
| An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. It accepts and reflects arbitrary domains supplied via a client-controlled Host header. Injection of a malicious URL in the Host: header of the HTTP Request results in a 302 redirect to an attacker-controlled page. | ||||
| CVE-2022-26157 | 1 Cherwell | 1 Cherwell Service Management | 2024-11-21 | 5.3 Medium |
| An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. The ASP.NET_Sessionid cookie is not protected by the Secure flag. This makes it prone to interception by an attacker if traffic is sent over unencrypted channels. | ||||
| CVE-2022-26156 | 1 Cherwell | 1 Cherwell Service Management | 2024-11-21 | 6.1 Medium |
| An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. Injection of a malicious payload within the RelayState= parameter of the HTTP request body results in the hijacking of the form action. Form-action hijacking vulnerabilities arise when an application places user-supplied input into the action URL of an HTML form. An attacker can use this vulnerability to construct a URL that, if visited by another application user, will modify the action URL of a form to point to the attacker's server. | ||||
| CVE-2022-26155 | 1 Cherwell | 1 Cherwell Service Management | 2024-11-21 | 6.1 Medium |
| An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. XSS can occur via a payload in the SAMLResponse parameter of the HTTP request body. | ||||
| CVE-2022-26151 | 1 Citrix | 1 Xenmobile Server | 2024-11-21 | 7.2 High |
| Citrix XenMobile Server 10.12 through RP11, 10.13 through RP7, and 10.14 through RP4 allows Command Injection. | ||||
| CVE-2022-26149 | 1 Modx | 1 Revolution | 2024-11-21 | 7.2 High |
| MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator. | ||||