Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (356032 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-37801 1 Tenda 2 Ac1206, Ac1206 Firmware 2024-11-21 9.8 Critical
Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the list parameter at the function formSetQosBand.
CVE-2022-37800 1 Tenda 2 Ac1206, Ac1206 Firmware 2024-11-21 9.8 Critical
Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the list parameter at the function fromSetRouteStatic.
CVE-2022-37799 1 Tenda 2 Ac1206, Ac1206 Firmware 2024-11-21 9.8 Critical
Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the time parameter at the function setSmartPowerManagement.
CVE-2022-37798 1 Tenda 2 Ac1206, Ac1206 Firmware 2024-11-21 9.8 Critical
Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the list parameter at the function formSetVirtualSer.
CVE-2022-37797 2 Debian, Lighttpd 2 Debian Linux, Lighttpd 2024-11-21 7.5 High
In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.
CVE-2022-37796 1 Oretnom23 1 Simple Online Book Store System 2024-11-21 5.4 Medium
In Simple Online Book Store System 1.0 in /admin_book.php the Title, Author, and Description parameters are vulnerable to Cross Site Scripting(XSS).
CVE-2022-37794 1 Library Management System Project 1 Library Management System 2024-11-21 9.8 Critical
In Library Management System 1.0 the /card/in-card.php file id_no parameters are vulnerable to SQL injection.
CVE-2022-37783 1 Craftcms 1 Craft Cms 2024-11-21 7.5 High
All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFT_CSRF_TOKEN and a HTML hidden field called CRAFT_CSRF_TOKEN to avoid Cross Site Request Forgery attacks. The CRAFT_CSRF_TOKEN cookie discloses the password hash in without encoding it whereas the corresponding HTML hidden field discloses the users' password hash in a masked manner, which can be decoded by using public functions of the YII framework.
CVE-2022-37781 1 Fdkaac Project 1 Fdkaac 2024-11-21 7.8 High
fdkaac v1.0.3 was discovered to contain a heap buffer overflow via __interceptor_memcpy.part.46 at /sanitizer_common/sanitizer_common_interceptors.inc.
CVE-2022-37779 1 Phicomm 8 Fir151b, Fir151b Firmware, Fir300b and 5 more 2024-11-21 7.2 High
Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers V3.0.1.17 were discovered to contain a remote command execution (RCE) vulnerability via the sendnum parameter of the ping function.
CVE-2022-37778 1 Phicomm 8 Fir151b, Fir151b Firmware, Fir300b and 5 more 2024-11-21 7.2 High
Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers V3.0.1.17 were discovered to contain a remote command execution (RCE) vulnerability via the current_time parameter of the time function.
CVE-2022-37777 1 Phicomm 8 Fir151b, Fir151b Firmware, Fir300b and 5 more 2024-11-21 7.2 High
Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers 3.0.1.17 and earlier were discovered to contain a remote command execution (RCE) vulnerability via the trHops parameter of the tracert function.
CVE-2022-37775 1 Genesys 1 Pureconnect 2024-11-21 6.1 Medium
Genesys PureConnect Interaction Web Tools Chat Service (up to at least 26- September- 2019) allows XSS within the Printable Chat History via the participant -> name JSON POST parameter.
CVE-2022-37771 2 Iobit, Microsoft 2 Malware Fighter, Windows 2024-11-21 6.7 Medium
IObit Malware Fighter v9.2 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to modify processes within the application and escalate privileges to SYSTEM via a crafted executable.
CVE-2022-37770 1 Jpeg 1 Libjpeg 2024-11-21 6.5 Medium
libjpeg commit 281daa9 was discovered to contain a segmentation fault via LineMerger::GetNextLowpassLine at linemerger.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.
CVE-2022-37769 1 Jpeg 1 Libjpeg 2024-11-21 6.5 Medium
libjpeg commit 281daa9 was discovered to contain a segmentation fault via HuffmanDecoder::Get at huffmandecoder.hpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.
CVE-2022-37768 1 Jpeg 1 Libjpeg 2024-11-21 7.5 High
libjpeg commit 281daa9 was discovered to contain an infinite loop via the component Frame::ParseTrailer.
CVE-2022-37767 1 Pebbletemplates 1 Pebble Templates 2024-11-21 9.8 Critical
Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the vendor disputes this because input to the Pebble templating engine is intended to include arbitrary Java code, and thus either the input should not arrive from an untrusted source, or else the application using the engine should apply restrictions to the input. The engine is not responsible for validating the input.
CVE-2022-37734 2 Graphql-java Project, Redhat 4 Graphql-java, Openshift Application Runtimes, Quarkus and 1 more 2024-11-21 7.5 High
graphql-java before19.0 is vulnerable to Denial of Service. An attacker can send a malicious GraphQL query that consumes CPU resources. The fixed versions are 19.0 and later, 18.3, and 17.4, and 0.0.0-2022-07-26T05-45-04-226aabd9.
CVE-2022-37731 1 Ftcms 1 Ftcms 2024-11-21 6.1 Medium
ftcms 2.1 poster.PHP has a XSS vulnerability. The attacker inserts malicious JavaScript code into the web page, causing the user / administrator to trigger malicious code when accessing.