Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (30435 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-38771 1 Transtek 1 Mojodat Fixed Asset Management 2024-11-21 9.8 Critical
The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to send SCRIPT tags as injected input to the API request.
CVE-2022-38768 1 Transtek 1 Mojodat Fixed Asset Management 2024-11-21 9.8 Critical
The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to bypass authorization.
CVE-2022-38667 1 Crowcpp 1 Crow 2024-11-21 9.8 Critical
HTTP applications (servers) based on Crow through 1.0+4 may allow a Use-After-Free and code execution when HTTP pipelining is used. The HTTP parser supports HTTP pipelining, but the asynchronous Connection layer is unaware of HTTP pipelining. Specifically, the Connection layer is unaware that it has begun processing a later request before it has finished processing an earlier request.
CVE-2022-38652 1 Vmware 1 Hyperic Agent 2024-11-21 9.9 Critical
A remote insecure deserialization vulnerability exixsts in VMWare Hyperic Agent 5.8.6. Exploitation of this vulnerability enables a malicious authenticated user to run arbitrary code or malware within a Hyperic Agent instance and its host operating system with the privileges of the Hyperic Agent process (often SYSTEM on Windows platforms). NOTE: prior exploitation of CVE-2022-38650 results in the disclosure of the authentication material required to exploit this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2022-38650 1 Vmware 1 Hyperic Server 2024-11-21 10.0 Critical
A remote unauthenticated insecure deserialization vulnerability exists in VMware Hyperic Server 5.8.6. Exploitation of this vulnerability enables a malicious party to run arbitrary code or malware within Hyperic Server and the host operating system with the privileges of the Hyperic server process. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2022-38638 1 Casbin 1 Casdoor 2024-11-21 9.1 Critical
Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource.
CVE-2022-38637 1 Hospital Management System Project 1 Hospital Management System 2024-11-21 9.8 Critical
Hospital Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the Username and Password parameters on the Login page.
CVE-2022-38621 1 Doufox 1 Doufox 2024-11-21 9.8 Critical
Doufox v0.0.4 was discovered to contain a remote code execution (RCE) vulnerability via the edit file page. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-38557 1 Dlink 2 Dir-845l, Dir-845l Firmware 2024-11-21 9.8 Critical
D-Link DIR845L v1.00-v1.03 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh.
CVE-2022-38556 1 Trendnet 2 Tew733gr, Tew733gr Firmware 2024-11-21 9.8 Critical
Trendnet TEW733GR v1.03B01 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh.
CVE-2022-38555 1 Linksys 2 E1200, E1200 Firmware 2024-11-21 9.8 Critical
Linksys E1200 v1.0.04 is vulnerable to Buffer Overflow via ej_get_web_page_name.
CVE-2022-38545 1 Valine.js 1 Valine 2024-11-21 9.6 Critical
Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request.
CVE-2022-38542 1 Archerydms 1 Archery 2024-11-21 9.8 Critical
Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the kill_session interface. The project has released an update, please upgrade to v1.9.0 and above.
CVE-2022-38541 1 Archerydms 1 Archery 2024-11-21 9.8 Critical
Archery v1.8.3 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_time and stop_time parameters in the my2sql interface.
CVE-2022-38540 1 Archerydms 1 Archery 2024-11-21 9.8 Critical
Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the create_kill_session interface.
CVE-2022-38539 1 Archerydms 1 Archery 2024-11-21 9.8 Critical
Archery v1.7.5 to v1.8.5 was discovered to contain a SQL injection vulnerability via the where parameter at /archive/apply.
CVE-2022-38538 1 Archerydms 1 Archery 2024-11-21 9.8 Critical
Archery v1.7.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the checksum parameter in the report module.
CVE-2022-38537 1 Archerydms 1 Archery 2024-11-21 9.8 Critical
Archery v1.4.5 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_file, end_file, start_time, and stop_time parameters in the binlog2sql interface.
CVE-2022-38394 1 Allied-telesis 2 Centrecom Ar260s, Centrecom Ar260s Firmware 2024-11-21 9.8 Critical
Use of hard-coded credentials for the telnet server of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote unauthenticated attacker to execute an arbitrary OS command.
CVE-2022-38352 1 Thinkphp 1 Thinkphp 2024-11-21 9.8 Critical
ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache. This vulnerability allows attackers to execute arbitrary code via a crafted payload.