Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (364840 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-38846 1 Espocrm 1 Espocrm 2024-11-21 5.9 Medium
EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP). An attacker may capture the cookie from the insecure channel using MITM attack.
CVE-2022-38845 1 Espocrm 1 Espocrm 2024-11-21 6.1 Medium
Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file containing malicious JavaScript to authenticated user. Any authenticated user importing the crafted CSV file may end up running the malicious JavaScripting in the browser.
CVE-2022-38844 1 Espocrm 1 Espocrm 2024-11-21 8.0 High
CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands. Admin user exporting contacts in CSV file may end up executing the malicious system commands on his system.
CVE-2022-38843 1 Espocrm 1 Espocrm 2024-11-21 8.8 High
EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server. Attacker may execute these malicious files to run unintended code on the server to compromise the server.
CVE-2022-38831 1 Tenda 2 Rx9 Pro, Rx9 Pro Firmware 2024-11-21 9.8 Critical
Tenda RX9_Pro V22.03.02.10 is vulnerable to Buffer Overflow via httpd/SetNetControlList
CVE-2022-38830 1 Tenda 2 Rx9 Pro, Rx9 Pro Firmware 2024-11-21 9.8 Critical
Tenda RX9_Pro V22.03.02.10 is vulnerable to Buffer Overflow via httpd/setIPv6Status.
CVE-2022-38829 1 Tenda 2 Rx9 Pro, Rx9 Pro Firmware 2024-11-21 9.8 Critical
Tenda RX9_Pro V22.03.02.10 is vulnerable to Buffer Overflow via httpd/setMacFilterCfg.
CVE-2022-38828 1 Totolink 2 T6, T6 Firmware 2024-11-21 9.8 Critical
TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi
CVE-2022-38827 1 Totolink 2 T6, T6 Firmware 2024-11-21 9.8 Critical
TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to Buffer Overflow via cstecgi.cgi
CVE-2022-38826 1 Totolink 2 T6, T6 Firmware 2024-11-21 9.8 Critical
In TOTOLINK T6 V4.1.5cu.709_B20210518, there is an execute arbitrary command in cstecgi.cgi.
CVE-2022-38823 1 Totolink 2 T6, T6 Firmware 2024-11-21 9.8 Critical
In TOTOLINK T6 V4.1.5cu.709_B20210518, there is a hard coded password for root in /etc/shadow.sample.
CVE-2022-38817 1 Linuxfoundation 1 Dapr Dashboard 2024-11-21 7.5 High
Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data.
CVE-2022-38814 1 Fiberhome 2 An5506-02-b, An5506-02-b Firmware 2024-11-21 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in the auth_settings component of FiberHome AN5506-02-B vRP2521 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the sncfg_loid text field.
CVE-2022-38812 1 Aerocms Project 1 Aerocms 2024-11-21 6.5 Medium
AeroCMS 0.1.1 is vulnerable to SQL Injection via the author parameter.
CVE-2022-38808 1 Yimihome 1 Ywoa 2024-11-21 8.8 High
ywoa v6.1 is vulnerable to SQL Injection via backend/oa/visual/exportExcel.do interface.
CVE-2022-38796 1 Feehi 1 Feehi Cms 2024-11-21 6.1 Medium
A Host Header Injection vulnerability in Feehi CMS 2.1.1 may allow an attacker to spoof a particular header. This can be exploited by abusing password reset emails.
CVE-2022-38795 1 Gitea 1 Gitea 2024-11-21 6.5 Medium
In Gitea through 1.17.1, repo cloning can occur in the migration function.
CVE-2022-38794 1 Zaver Project 1 Zaver 2024-11-21 7.5 High
Zaver through 2020-12-15 allows directory traversal via the GET /.. substring.
CVE-2022-38792 1 Exotel Project 1 Exotel 2024-11-21 9.8 Critical
The exotel (aka exotel-py) package in PyPI as of 0.1.6 includes a code execution backdoor inserted by a third party.
CVE-2022-38791 3 Fedoraproject, Mariadb, Redhat 4 Fedora, Mariadb, Enterprise Linux and 1 more 2024-11-21 5.5 Medium
In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which allows local users to trigger a deadlock.