Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (30435 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-37452 2 Debian, Exim 2 Debian Linux, Exim 2024-11-21 9.8 Critical
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.
CVE-2022-37425 2 Linux, Opennebula 2 Linux Kernel, Opennebula 2024-11-21 9.9 Critical
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in OpenNebula OpenNebula core on Linux allows Remote Code Inclusion.
CVE-2022-37300 1 Schneider-electric 70 Ecostruxure Control Expert, Ecostruxure Process Expert, Modicon M340 Bmxp341000 and 67 more 2024-11-21 9.8 Critical
A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and write mode to the controller when communicating over Modbus. Affected Products: EcoStruxure Control Expert Including all Unity Pro versions (former name of EcoStruxure Control Expert) (V15.0 SP1 and prior), EcoStruxure Process Expert, Including all versions of EcoStruxure Hybrid DCS (former name of EcoStruxure Process Expert) (V2021 and prior), Modicon M340 CPU (part numbers BMXP34*) (V3.40 and prior), Modicon M580 CPU (part numbers BMEP* and BMEH*) (V3.20 and prior).
CVE-2022-37266 1 Stealjs 1 Steal 2024-11-21 9.8 Critical
Prototype pollution vulnerability in function extend in babel.js in stealjs steal 2.2.4 via the key variable in babel.js.
CVE-2022-37264 1 Stealjs 1 Steal 2024-11-21 9.8 Critical
Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js.
CVE-2022-37258 1 Stealjs 1 Steal 2024-11-21 9.8 Critical
Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js.
CVE-2022-37257 1 Stealjs 1 Steal 2024-11-21 9.8 Critical
Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the requestedVersion variable in npm-convert.js.
CVE-2022-37242 1 Altn 1 Security Gateway For Email Servers 2024-11-21 9.8 Critical
MDaemon Technologies SecurityGateway for Email Servers 8.5.2, is vulnerable to HTTP Response splitting via the data parameter.
CVE-2022-37240 1 Altn 1 Security Gateway For Email Servers 2024-11-21 9.8 Critical
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to HTTP Response splitting via the format parameter.
CVE-2022-37223 1 Jflyfox 1 Jfinal Cms 2024-11-21 9.8 Critical
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/role/list.
CVE-2022-37203 1 Jflyfox 1 Jfinal Cms 2024-11-21 9.8 Critical
JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.
CVE-2022-37199 1 Jflyfox 1 Jfinal Cms 2024-11-21 9.8 Critical
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list.
CVE-2022-37181 1 72crm 1 Wukong Crm 2024-11-21 9.8 Critical
72crm 9.0 has an Arbitrary file upload vulnerability.
CVE-2022-37176 1 Tendacn 2 Ac6, Ac6 Firmware 2024-11-21 9.8 Critical
Tenda AC6(AC1200) v5.0 Firmware v02.03.01.114 and below contains a vulnerability which allows attackers to remove the Wi-Fi password and force the device into open security mode via a crafted packet sent to goform/setWizard.
CVE-2022-37175 1 Tenda 2 Ac15, Ac15 Firmware 2024-11-21 9.8 Critical
Tenda ac15 firmware V15.03.05.18 httpd server has stack buffer overflow in /goform/formWifiBasicSet.
CVE-2022-37164 1 Ontrack Project 1 Ontrack 2024-11-21 9.8 Critical
Inoda OnTrack v3.4 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user passwords are hashed without a salt or pepper making it much easier for tools like hashcat to crack the hashes.
CVE-2022-37163 1 Ihatetobudget Project 1 Ihatetobudget 2024-11-21 9.8 Critical
Bminusl IHateToBudget v1.5.7 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user passwords are hashed without a salt or pepper making it much easier for tools like hashcat to crack the hashes.
CVE-2022-37159 1 Claroline 1 Claroline 2024-11-21 9.8 Critical
Claroline 13.5.7 and prior is vulnerable to Remote code execution via arbitrary file upload.
CVE-2022-37158 1 Iocoder 1 Ruoyi-vue-pro 2024-11-21 9.8 Critical
RuoYi v3.8.3 has a Weak password vulnerability in the management system.
CVE-2022-37152 1 Online Diagnostic Lab Management System Project 1 Online Diagnostic Lab Management System 2024-11-21 9.8 Critical
An issue was discovered in Online Diagnostic Lab Management System 1.0, There is a SQL injection vulnerability via "dob" parameter in "/classes/Users.php?f=save_client"