Export limit exceeded: 49908 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (49933 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-48585 | 1 Sciencelogic | 1 Sl1 | 2024-11-21 | 8.8 High |
| A SQL injection vulnerability exists in the “admin brand portal” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database. | ||||
| CVE-2022-48584 | 1 Sciencelogic | 1 Sl1 | 2024-11-21 | 8.8 High |
| A command injection vulnerability exists in the download and convert report feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system. | ||||
| CVE-2022-48583 | 1 Sciencelogic | 1 Sl1 | 2024-11-21 | 8.8 High |
| A command injection vulnerability exists in the dashboard scheduler feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system. | ||||
| CVE-2022-48582 | 1 Sciencelogic | 1 Sl1 | 2024-11-21 | 8.8 High |
| A command injection vulnerability exists in the ticket report generate feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system. | ||||
| CVE-2022-48581 | 1 Sciencelogic | 1 Sl1 | 2024-11-21 | 8.8 High |
| A command injection vulnerability exists in the “dash export” feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system. | ||||
| CVE-2022-48580 | 1 Sciencelogic | 1 Sl1 | 2024-11-21 | 8.8 High |
| A command injection vulnerability exists in the ARP ping device tool feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system. | ||||
| CVE-2022-48579 | 1 Rarlab | 1 Unrar | 2024-11-21 | 7.5 High |
| UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains. | ||||
| CVE-2022-48564 | 3 Netapp, Python, Redhat | 4 Active Iq Unified Manager, Python, Enterprise Linux and 1 more | 2024-11-21 | 6.5 Medium |
| read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format. | ||||
| CVE-2022-48560 | 3 Debian, Python, Redhat | 4 Debian Linux, Python, Enterprise Linux and 1 more | 2024-11-21 | 7.5 High |
| A use-after-free exists in Python through 3.9 via heappushpop in heapq. | ||||
| CVE-2022-47351 | 2 Google, Unisoc | 10 Android, S8000, T606 and 7 more | 2024-11-21 | 4.4 Medium |
| In camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed | ||||
| CVE-2022-47350 | 2 Google, Unisoc | 12 Android, S8000, Sc9863a and 9 more | 2024-11-21 | 4.4 Medium |
| In camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed | ||||
| CVE-2022-46782 | 1 Stormshield | 1 Ssl Vpn Client | 2024-11-21 | 7.8 High |
| An issue was discovered in Stormshield SSL VPN Client before 3.2.0. A logged-in user, able to only launch the VPNSSL Client, can use the OpenVPN instance to execute malicious code as administrator on the local machine. | ||||
| CVE-2022-46724 | 1 Apple | 2 Ipados, Iphone Os | 2024-11-21 | 2.4 Low |
| This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 16.4 and iPadOS 16.4. A person with physical access to an iOS device may be able to view the last image used in Magnifier from the lock screen. | ||||
| CVE-2022-46722 | 1 Apple | 1 Macos | 2024-11-21 | 5.5 Medium |
| A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13. An app may be able to modify protected parts of the file system. | ||||
| CVE-2022-46651 | 1 Apache | 1 Airflow | 2024-11-21 | 6.5 Medium |
| Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability. | ||||
| CVE-2022-46485 | 1 Ngsurvey | 1 Ngsurvey | 2024-11-21 | 7.5 High |
| Data Illusion Survey Software Solutions ngSurvey version 2.4.28 and below is vulnerable to Denial of Service if a survey contains a "Text Field", "Comment Field" or "Contact Details". | ||||
| CVE-2022-46484 | 1 Ngsurvey | 1 Ngsurvey | 2024-11-21 | 7.5 High |
| Information disclosure in password protected surveys in Data Illusion Survey Software Solutions NGSurvey v2.4.28 and below allows attackers to view the password to access and arbitrarily submit surveys. | ||||
| CVE-2022-45821 | 1 Nootheme | 1 Noo Timetable | 2024-11-21 | 6.5 Medium |
| Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in NooTheme Noo Timetable plugin <= 2.1.3 versions. | ||||
| CVE-2022-45199 | 1 Python | 1 Pillow | 2024-11-21 | 7.5 High |
| Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL. | ||||
| CVE-2022-45198 | 1 Python | 1 Pillow | 2024-11-21 | 7.5 High |
| Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification). | ||||