Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (356024 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-24660 1 Goldshell 1 Goldshell Miner Firmware 2024-11-21 7.5 High
The debug interface of Goldshell ASIC Miners v2.2.1 and below was discovered to be exposed publicly on the web interface, allowing attackers to access passwords and other sensitive information in plaintext.
CVE-2022-24659 1 Goldshell 1 Goldshell Miner Firmware 2024-11-21 7.5 High
Goldshell ASIC Miners v2.2.1 and below was discovered to contain a path traversal vulnerability which allows unauthenticated attackers to retrieve arbitrary files from the device.
CVE-2022-24657 1 Goldshell 1 Goldshell Miner Firmware 2024-11-21 9.8 Critical
Goldshell ASIC Miners v2.1.x was discovered to contain hardcoded credentials which allow attackers to remotely connect via the SSH protocol (port 22).
CVE-2022-24656 1 Hexoeditor Project 1 Hexoeditor 2024-11-21 6.1 Medium
HexoEditor 1.1.8 is affected by Cross Site Scripting (XSS). By putting a common XSS payload in a markdown file, if opened with the app, will execute several times.
CVE-2022-24655 1 Netgear 8 Cax80, Cax80 Firmware, Dc112a and 5 more 2024-11-21 7.8 High
A stack overflow vulnerability exists in the upnpd service in Netgear EX6100v1 201.0.2.28, CAX80 2.1.2.6, and DC112A 1.0.0.62, which may lead to the execution of arbitrary code without authentication.
CVE-2022-24654 1 Intelbras 2 Ata 200, Ata 200 Firmware 2024-11-21 5.4 Medium
Authenticated stored cross-site scripting (XSS) vulnerability in "Field Server Address" field in INTELBRAS ATA 200 Firmware 74.19.10.21 allows attackers to inject JavaScript code through a crafted payload.
CVE-2022-24652 1 Sentcms 1 Sentcms 2024-11-21 9.8 Critical
sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in php code execution in /admin/upload/upload.
CVE-2022-24651 1 Sentcms 1 Sentcms 2024-11-21 9.8 Critical
sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in PHP code execution through /user/upload/upload.
CVE-2022-24647 1 Cuppacms 1 Cuppacms 2024-11-21 8.1 High
Cuppa CMS v1.0 was discovered to contain an arbitrary file deletion vulnerability via the unlink() function.
CVE-2022-24646 1 Phpgurukul 1 Hospital Management System 2024-11-21 7.5 High
Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/contact.php via the txtMsg parameters.
CVE-2022-24644 1 Zzinc 2 Keymouse, Keymouse Firmware 2024-11-21 8.8 High
ZZ Inc. KeyMouse Windows 3.08 and prior is affected by a remote code execution vulnerability during an unauthenticated update. To exploit this vulnerability, a user must trigger an update of an affected installation of KeyMouse.
CVE-2022-24643 1 Open-emr 1 Openemr 2024-11-21 5.4 Medium
A stored cross-site scripting (XSS) issue was discovered in the OpenEMR Hospital Information Management System version 6.0.0.
CVE-2022-24637 1 Openwebanalytics 1 Open Web Analytics 2024-11-21 9.8 Critical
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.
CVE-2022-24633 1 Filecloud 1 Filecloud 2024-11-21 5.3 Medium
All versions of FileCloud prior to 21.3 are vulnerable to user enumeration. The vulnerability exists in the parameter "path" passing "/SHARED/<username>". A malicious actor could identify the existence of users by requesting share information on specified share paths.
CVE-2022-24620 1 Piwigo 1 Piwigo 2024-11-21 5.4 Medium
Piwigo version 12.2.0 is vulnerable to stored cross-site scripting (XSS), which can lead to privilege escalation. In this way, admin can steal webmaster's cookies to get the webmaster's access.
CVE-2022-24618 1 Heimdalsecurity 1 Heimdal Premium Security 2024-11-21 7.8 High
Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, which allows unprivileged local users to elevate privileges to SYSTEM via the "Browse For Folder" window accessible by triggering a "Repair" on the MSI package located in C:\Windows\Installer.
CVE-2022-24615 1 Zip4j Project 1 Zip4j 2024-11-21 5.5 Medium
zip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash. This could be used to mount a denial of service attack against services that use zip4j library.
CVE-2022-24612 1 Eyesofnetwork 1 Eyesofnetwork 2024-11-21 5.4 Medium
An authenticated user can upload an XML file containing an XSS via the ITSM module of EyesOfNetwork 5.3.11, resulting in a stored XSS.
CVE-2022-24611 1 Silabs 10 Sd3502, Sd3502 Firmware, Sd3503 and 7 more 2024-11-21 6.5 Medium
Denial of Service (DoS) in the Z-Wave S0 NonceGet protocol specification in Silicon Labs Z-Wave 500 series allows local attackers to block S0/S2 protected Z-Wave network via crafted S0 NonceGet Z-Wave packages, utilizing included but absent NodeIDs.
CVE-2022-24610 1 Alecto 2 Dvc-215ip, Dvc-215ip Firmware 2024-11-21 8.6 High
Settings/network settings/wireless settings on the Alecto DVC-215IP camera version 63.1.1.173 and below shows the Wi-Fi passphrase hidden, but by editing/removing the style of the password field the password becomes visible which grants access to an internal network connected to the camera.