Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (357696 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-31876 1 Netgear 2 Wnap320, Wnap320 Firmware 2024-11-21 5.3 Medium
netgear wnap320 router WNAP320_V2.0.3_firmware is vulnerable to Incorrect Access Control via /recreate.php, which can leak all users cookies.
CVE-2022-31875 1 Trendnet 2 Tv-ip110wn, Tv-ip110wn Firmware 2024-11-21 6.1 Medium
Trendnet IP-110wn camera fw_tv-ip110wn_v2(1.2.2.68) has an xss vulnerability via the proname parameter in /admin/scheprofile.cgi
CVE-2022-31874 1 Asus 2 Rt-n53, Rt-n53 Firmware 2024-11-21 9.8 Critical
ASUS RT-N53 3.0.0.4.376.3754 has a command injection vulnerability in the SystemCmd parameter of the apply.cgi interface.
CVE-2022-31873 1 Trendnet 2 Tv-ip110wn, Tv-ip110wn Firmware 2024-11-21 6.1 Medium
Trendnet IP-110wn camera fw_tv-ip110wn_v2(1.2.2.68) has an XSS vulnerability via the prefix parameter in /admin/general.cgi.
CVE-2022-31861 1 Thingsboard 1 Thingsboard 2024-11-21 5.4 Medium
Cross site Scripting (XSS) in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs.
CVE-2022-31856 1 Newsletter Module Project 1 Newsletter Module 2024-11-21 9.8 Critical
Newsletter Module v3.x was discovered to contain a SQL injection vulnerability via the zemez_newsletter_email parameter at /index.php.
CVE-2022-31854 1 Codologic 1 Codoforum 2024-11-21 7.2 High
Codoforum v5.1 was discovered to contain an arbitrary file upload vulnerability via the logo change option in the admin panel.
CVE-2022-31849 1 Mercurycom 2 Mipc451-4, Mipc451-4 Firmware 2024-11-21 8.8 High
MERCURY MIPC451-4 1.0.22 Build 220105 Rel.55642n was discovered to contain a remote code execution (RCE) vulnerability which is exploitable via a crafted POST request.
CVE-2022-31847 1 Wavlink 2 Wn579x3, Wn579x3 Firmware 2024-11-21 7.5 High
A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN579 X3 M79X3.V5030.180719 allows attackers to obtain sensitive router information via a crafted POST request.
CVE-2022-31846 1 Wavlink 2 Wn535g3, Wn535g3 Firmware 2024-11-21 7.5 High
A vulnerability in live_mfg.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec cmd function.
CVE-2022-31845 1 Wavlink 2 Wn535g3, Wn535g3 Firmware 2024-11-21 7.5 High
A vulnerability in live_check.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec cmd function.
CVE-2022-31836 1 Beego 1 Beego 2024-11-21 9.8 Critical
The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.
CVE-2022-31830 1 Baidu 1 Kity Minder 2024-11-21 9.1 Critical
Kity Minder v1.3.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the init function at ImageCapture.class.php.
CVE-2022-31827 1 Monstaftp 1 Monstaftp 2024-11-21 9.1 Critical
MonstaFTP v2.10.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the function performFetchRequest at HTTPFetcher.php.
CVE-2022-31814 1 Netgate 1 Pfblockerng 2024-11-21 9.8 Critical
pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected.
CVE-2022-31806 1 Codesys 2 Plcwinnt, Runtime Toolkit 2024-11-21 9.8 Critical
In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no information or prompt to enable password protection at login in case no password is set at the controller.
CVE-2022-31805 1 Codesys 10 Development System, Edge Gateway, Gateway and 7 more 2024-11-21 7.5 High
In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.
CVE-2022-31804 1 Codesys 1 Gateway 2024-11-21 7.5 High
The CODESYS Gateway Server V2 does not verifiy that the size of a request is within expected limits. An unauthenticated attacker may allocate an arbitrary amount of memory, which may lead to a crash of the Gateway due to an out-of-memory condition.
CVE-2022-31803 1 Codesys 1 Gateway 2024-11-21 5.3 Medium
In CODESYS Gateway Server V2 an insufficient check for the activity of TCP client connections allows an unauthenticated attacker to consume all available TCP connections and prevent legitimate users or clients from establishing a new connection to the CODESYS Gateway Server V2. Existing connections are not affected and therefore remain intact.
CVE-2022-31802 1 Codesys 1 Gateway 2024-11-21 9.8 Critical
In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. An attacker may perform authentication by specifying a small password that matches the corresponding part of the longer real CODESYS Gateway password.