Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (361579 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-34836 1 Abb 1 Zenon 2024-11-21 5.9 Medium
Relative Path Traversal vulnerability in ABB Zenon 8.20 allows the user to access files on the Zenon system and user also can add own log messages and e.g., flood the log entries. An attacker who successfully exploit the vulnerability could access the Zenon runtime activities such as the start and stop of various activity and the last error code etc.
CVE-2022-34834 1 Vermeg 1 Agile Reporter 2024-11-21 4.8 Medium
An issue was discovered in VERMEG AgileReporter 21.3. Attackers can gain privileges via an XSS payload in an Add Comment action to the Activity log.
CVE-2022-34833 1 Vermeg 1 Agile Reporter 2024-11-21 5.4 Medium
An issue was discovered in VERMEG AgileReporter 21.3. An admin can enter an XSS payload in the Analysis component.
CVE-2022-34832 1 Vermeg 1 Agile Reporter 2024-11-21 6.5 Medium
An issue was discovered in VERMEG AgileReporter 21.3. XXE can occur via an XML document to the Analysis component.
CVE-2022-34831 1 Primekey 1 Ejbca 2024-11-21 9.8 Critical
An issue was discovered in Keyfactor PrimeKey EJBCA before 7.9.0, related to possible inconsistencies in DNS identifiers submitted in an ACME order and the corresponding CSR submitted during finalization. During the ACME enrollment process, an order is submitted containing an identifier for one or multiple dnsNames. These are validated properly in the ACME challenge. However, if the validation passes, a non-compliant client can include additional dnsNames the CSR sent to the finalize endpoint, resulting in EJBCA issuing a certificate including the identifiers that were not validated. This occurs even if the certificate profile is configured to not allow a DN override by the CSR.
CVE-2022-34829 1 Zohocorp 1 Manageengine Adselfservice Plus 2024-11-21 7.5 High
Zoho ManageEngine ADSelfService Plus before 6203 allows a denial of service (application restart) via a crafted payload to the Mobile App Deployment API.
CVE-2022-34826 1 Couchbase 1 Couchbase Server 2024-11-21 5.9 Medium
In Couchbase Server 7.1.x before 7.1.1, an encrypted Private Key passphrase may be leaked in the logs.
CVE-2022-34818 1 Jenkins 1 Failed Job Deactivator 2024-11-21 4.3 Medium
Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing attackers with Overall/Read permission to disable jobs.
CVE-2022-34817 1 Jenkins 1 Failed Job Deactivator 2024-11-21 4.3 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier allows attackers to disable jobs.
CVE-2022-34816 1 Jenkins 1 Hpe Network Virtualization 2024-11-21 6.5 Medium
Jenkins HPE Network Virtualization Plugin 1.0 stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34815 1 Jenkins 1 Request Rename Or Delete 2024-11-21 4.3 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier allows attackers to accept pending requests, thereby renaming or deleting jobs.
CVE-2022-34814 1 Jenkins 1 Request Rename Or Delete 2024-11-21 4.3 Medium
Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view an administrative configuration page listing pending requests.
CVE-2022-34813 1 Jenkins 1 Xpath Configuration Viewer 2024-11-21 4.3 Medium
A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to create and delete XPath expressions.
CVE-2022-34812 1 Jenkins 1 Xpath Configuration Viewer 2024-11-21 4.3 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers to create and delete XPath expressions.
CVE-2022-34811 1 Jenkins 1 Xpath Configuration Viewer 2024-11-21 4.3 Medium
A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to access the XPath Configuration Viewer page.
CVE-2022-34810 1 Jenkins 1 Rqm 2024-11-21 6.5 Medium
A missing check in Jenkins RQM Plugin 2.8 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2022-34809 1 Jenkins 1 Rqm 2024-11-21 6.5 Medium
Jenkins RQM Plugin 2.8 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34808 1 Jenkins 1 Cisco Spark 2024-11-21 4.3 Medium
Jenkins Cisco Spark Plugin 1.1.1 and earlier stores bearer tokens unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34807 1 Jenkins 1 Elasticsearch Query 2024-11-21 6.5 Medium
Jenkins Elasticsearch Query Plugin 1.2 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34806 1 Jenkins 1 Jigomerge 2024-11-21 6.5 Medium
Jenkins Jigomerge Plugin 0.9 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.