Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (357827 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-46080 1 Nexxtsolutions 2 Nebula1200-ac, Nebula1200-ac Firmware 2024-11-21 9.8 Critical
Nexxt Nebula 1200-AC 15.03.06.60 allows authentication bypass and command execution by using the HTTPD service to enable TELNET.
CVE-2022-46025 1 Totolink 2 N200re V5, N200re V5 Firmware 2024-11-21 9.1 Critical
Totolink N200RE_V5 V9.3.5u.6255_B20211224 is vulnerable to Incorrect Access Control. The device allows remote attackers to obtain Wi-Fi system information, such as Wi-Fi SSID and Wi-Fi password, without logging into the management page.
CVE-2022-45919 3 Linux, Netapp, Redhat 14 Linux Kernel, H300s, H300s Firmware and 11 more 2024-11-21 7.0 High
An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.
CVE-2022-45918 1 Ilias 1 Ilias 2024-11-21 6.5 Medium
ILIAS before 7.16 allows External Control of File Name or Path.
CVE-2022-45886 3 Linux, Netapp, Redhat 14 Linux Kernel, H300s, H300s Firmware and 11 more 2024-11-21 7.0 High
An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a .disconnect versus dvb_device_open race condition that leads to a use-after-free.
CVE-2022-45884 3 Linux, Netapp, Redhat 14 Linux Kernel, H300s, H300s Firmware and 11 more 2024-11-21 7.0 High
An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops.
CVE-2022-45877 1 Openharmony 1 Openharmony 2024-11-21 8.3 High
OpenHarmony-v3.1.4 and prior versions had an vulnerability. PIN code is transmitted to the peer device in plain text during cross-device authentication, which reduces the difficulty of man-in-the-middle attacks.
CVE-2022-45868 1 H2database 1 H2 2024-11-21 8.4 High
The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that." Nonetheless, the issue was fixed in 2.2.220.
CVE-2022-45861 1 Fortinet 2 Fortios, Fortiproxy 2024-11-21 6.4 Medium
An access of uninitialized pointer vulnerability [CWE-824] in the SSL VPN portal of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.11 and FortiProxy version 7.2.0 through 7.2.1, version 7.0.0 through 7.0.7 and before 2.0.11 allows a remote authenticated attacker to crash the sslvpn daemon via an HTTP GET request.
CVE-2022-45860 1 Fortinet 2 Fortinac, Fortinac-f 2024-11-21 5 Medium
A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in device registration page may allow an unauthenticated attacker to perform password spraying attacks with an increased chance of success.
CVE-2022-45859 1 Fortinet 2 Fortinac, Fortinac-f 2024-11-21 3.9 Low
An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions, 8.7.0 all versions may allow a local attacker with system access to retrieve users' passwords.
CVE-2022-45858 1 Fortinet 1 Fortinac 2024-11-21 3.8 Low
A use of a weak cryptographic algorithm vulnerability [CWE-327] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.0 all versions, 8.8.0 all versions, 8.7.0 all versions may increase the chances of an attacker to have access to sensitive information or to perform man-in-the-middle attacks.
CVE-2022-45857 1 Fortinet 1 Fortimanager 2024-11-21 6 Medium
An incorrect user management vulnerability [CWE-286] in the FortiManager version 6.4.6 and below VDOM creation component may allow an attacker to access a FortiGate without a password via newly created VDOMs after the super_admin account is deleted.
CVE-2022-45855 1 Apache 1 Ambari 2024-11-21 8 High
SpringEL injection in the metrics source in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.
CVE-2022-45848 1 Contest-gallery 1 Contest Gallery 2024-11-21 6.1 Medium
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Contest Gallery plugin <= 13.1.0.9 on WordPress.
CVE-2022-45828 1 Nootheme 1 Noo Timetable 2024-11-21 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in NooTheme Noo Timetable plugin <= 2.1.3 versions.
CVE-2022-45827 1 Galleryplugins 1 Video Contest 2024-11-21 5.9 Medium
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GalleryPlugins Video Contest plugin <= 3.2 versions.
CVE-2022-45823 1 Video Contest Wordpress Project 1 Video Contest Wordpress 2024-11-21 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in GalleryPlugins Video Contest WordPress plugin <= 3.2 versions.
CVE-2022-45821 1 Nootheme 1 Noo Timetable 2024-11-21 6.5 Medium
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in NooTheme Noo Timetable plugin <= 2.1.3 versions.
CVE-2022-45816 1 Dev4press 1 Gd Bbpress Attachments 2024-11-21 4.8 Medium
Auth. Stored Cross-Site Scripting (XSS) vulnerability in GD bbPress Attachments plugin <= 4.3.1 on WordPress.