Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (119791 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-28199 4 Linux, Microsoft, Nvidia and 1 more 4 Linux Kernel, Windows, Data Plane Development Kit and 1 more 2024-11-21 6.5 Medium
NVIDIA’s distribution of the Data Plane Development Kit (MLNX_DPDK) contains a vulnerability in the network stack, where error recovery is not handled properly, which can allow a remote attacker to cause denial of service and some impact to data integrity and confidentiality.
CVE-2022-28165 1 Broadcom 1 Sannav 2024-11-21 8.8 High
A vulnerability in the role-based access control (RBAC) functionality of the Brocade SANNav before 2.2.0 could allow an authenticated, remote attacker to access resources that they should not be able to access and perform actions that they should not be able to perform. The vulnerability exists because restrictions are not performed on Server side to ensure the user has required permission before processing requests.
CVE-2022-28117 1 Naviwebs 1 Navigate Cms 2024-11-21 4.9 Medium
A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the feed parameter.
CVE-2022-28109 1 Selenium 1 Selenium Grid 2024-11-21 8.8 High
Selenium Selenium Grid (formerly Selenium Standalone Server) Fixed in 4.0.0-alpha-7 is affected by: DNS rebinding. The impact is: execute arbitrary code (remote). The component is: WebDriver endpoint of Selenium Grid / Selenium Standalone Server. The attack vector is: Triggered by browsing to to a malicious remote web server. The WebDriver endpoint of Selenium Server (Grid) is vulnerable to DNS rebinding. This can be used to execute arbitrary code on the machine.
CVE-2022-28096 1 Skycaiji 1 Skycaiji 2024-11-21 7.2 High
Skycaiji v2.4 was discovered to contain a remote code execution (RCE) vulnerability via /SkycaijiApp/admin/controller/Develop.php.
CVE-2022-28076 1 Seacms 1 Seacms 2024-11-21 7.2 High
Seacms v11.6 was discovered to contain a remote command execution (RCE) vulnerability via the Mail Server Settings.
CVE-2022-28052 1 Roothub 1 Roothub 2024-11-21 8.0 High
Directory Traversal vulnerability in file cn/roothub/store/FileSystemStorageService in function store in Roothub 2.6.0 allows remote attackers with low privlege to arbitrarily upload files via /common/upload API, which could lead to remote arbitrary code execution.
CVE-2022-28021 1 Purchase Order Management System Project 1 Purchase Order Management System 2024-11-21 9.8 Critical
Purchase Order Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via /purchase_order/admin/?page=user.
CVE-2022-28005 1 3cx 1 3cx 2024-11-21 9.8 Critical
An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL. An unauthenticated attacker could abuse improperly secured access to arbitrary files on the server (via /Electron/download directory traversal in conjunction with a path component that uses backslash characters), leading to cleartext credential disclosure. Afterwards, the authenticated attacker is able to upload a file that overwrites a 3CX service binary, leading to Remote Code Execution as NT AUTHORITY\SYSTEM on Windows installations. NOTE: this issue exists because of an incomplete fix for CVE-2022-48482.
CVE-2022-27982 1 Ruijienetworks 2 Rg-nbr2100g-e, Rg-nbr2100g-e Firmware 2024-11-21 9.8 Critical
RG-NBR-E Enterprise Gateway RG-NBR2100G-E was discovered to contain a remote code execution (RCE) vulnerability via the fileName parameter at /guest_auth/cfg/upLoadCfg.php.
CVE-2022-27947 1 Netgear 2 R8500, R8500 Firmware 2024-11-21 8.8 High
NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the ipv6_fix.cgi ipv6_wan_ipaddr, ipv6_lan_ipaddr, ipv6_wan_length, or ipv6_lan_length parameter.
CVE-2022-27946 1 Netgear 2 R8500, R8500 Firmware 2024-11-21 8.8 High
NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the sysNewPasswd and sysConfirmPasswd parameters to admin_account.cgi.
CVE-2022-27945 1 Netgear 2 R8500, R8500 Firmware 2024-11-21 8.8 High
NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the sysNewPasswd and sysConfirmPasswd parameters to password.cgi.
CVE-2022-27937 1 Pexip 1 Pexip Infinity 2024-11-21 7.5 High
Pexip Infinity before 27.3 allows remote attackers to trigger excessive resource consumption via H.264.
CVE-2022-27936 1 Pexip 1 Pexip Infinity 2024-11-21 7.5 High
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via H.323.
CVE-2022-27935 1 Pexip 1 Pexip Infinity 2024-11-21 7.5 High
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via Epic Telehealth.
CVE-2022-27934 1 Pexip 1 Pexip Infinity 2024-11-21 7.5 High
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via HTTP.
CVE-2022-27933 1 Pexip 1 Pexip Infinity 2024-11-21 8.2 High
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.
CVE-2022-27932 1 Pexip 1 Pexip Infinity 2024-11-21 7.5 High
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.
CVE-2022-27931 1 Pexip 1 Pexip Infinity 2024-11-21 7.5 High
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.