Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (30371 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-32554 1 Purestorage 2 Purity\/\/fa, Purity\/\/fb 2024-11-21 9.8 Critical
Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure Storage FlashBlade products running Purity//FB 3.3.0, 3.2.0 - 3.2.4, 3.1.0 - 3.1.12, 3.0.x and prior Purity//FB releases are vulnerable to possibly exposed credentials for accessing the product’s management interface. The password may be known outside Pure Storage and could be used on an affected system, if reachable, to execute arbitrary instructions with root privileges. No other Pure Storage products or services are affected. Remediation is available from Pure Storage via a self-serve “opt-in” patch, manual patch application or a software upgrade to an unaffected version of Purity software.
CVE-2022-32548 1 Draytek 136 Vigor1000b, Vigor1000b Firmware, Vigor165 and 133 more 2024-11-21 10 Critical
An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field.
CVE-2022-32533 1 Apache 2 Jetspeed, Portals Jetspeed 2024-11-21 9.8 Critical
Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no updates will be provided for this issue
CVE-2022-32532 1 Apache 1 Shiro 2024-11-21 9.8 Critical
Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
CVE-2022-32456 1 Digiwin 1 Business Process Management 2024-11-21 9.8 Critical
Digiwin BPM’s function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL command to access, modify, delete database or disrupt service.
CVE-2022-32449 1 Totolink 2 Ex300 V2, Ex300 V2 Firmware 2024-11-21 9.8 Critical
TOTOLINK EX300_V2 V4.0.3c.7484 was discovered to contain a command injection vulnerability via the langType parameter in the setLanguageCfg function. This vulnerability is exploitable via a crafted MQTT data packet.
CVE-2022-32429 1 Megatech 2 Msnswitch, Msnswitch Firmware 2024-11-21 9.8 Critical
An authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technologies Inc MSNSwitch MNT.2408 allows unauthenticated attackers to arbitrarily configure settings within the application, leading to remote code execution.
CVE-2022-32417 1 Pbootcms 1 Pbootcms 2024-11-21 9.8 Critical
PbootCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the function parserIfLabel at function.php.
CVE-2022-32413 1 Dice Project 1 Dice 2024-11-21 9.8 Critical
An arbitrary file upload vulnerability in Dice v4.2.0 allows attackers to execute arbitrary code via a crafted file.
CVE-2022-32409 1 Softwarepublico 1 I3geo 2024-11-21 9.8 Critical
A local file inclusion (LFI) vulnerability in the component codemirror.php of Portal do Software Publico Brasileiro i3geo v7.0.5 allows attackers to execute arbitrary PHP code via a crafted HTTP request.
CVE-2022-32386 1 Tendacn 2 Ac23 Ac2100, Ac23 Ac2100 Firmware 2024-11-21 9.8 Critical
Tenda AC23 v16.03.07.44 was discovered to contain a buffer overflow via fromAdvSetMacMtuWan.
CVE-2022-32385 1 Tendacn 2 Ac23 Ac2100, Ac23 Ac2100 Firmware 2024-11-21 9.8 Critical
Tenda AC23 v16.03.07.44 is vulnerable to Stack Overflow that will allow for the execution of arbitrary code (remote).
CVE-2022-32383 1 Tendacn 2 Ac23 Ac2100, Ac23 Ac2100 Firmware 2024-11-21 9.8 Critical
Tenda AC23 v16.03.07.44 was discovered to contain a stack overflow via the AdvSetMacMtuWan function.
CVE-2022-32352 1 Hospital\'s Patient Records Management System Project 1 Hospital\'s Patient Records Management System 2024-11-21 9.8 Critical
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_patient_admission.
CVE-2022-32337 1 Hospital\'s Patient Records Management System Project 1 Hospital\'s Patient Records Management System 2024-11-21 9.8 Critical
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/patients/manage_patient.php?id=.
CVE-2022-32336 1 Fast Food Ordering System Project 1 Fast Food Ordering System 2024-11-21 9.8 Critical
Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/menus/view_menu.php?id=.
CVE-2022-32328 1 Fast Food Ordering System Project 1 Fast Food Ordering System 2024-11-21 9.1 Critical
Fast Food Ordering System v1.0 is vulnerable to Delete any file. via /ffos/classes/Master.php?f=delete_img.
CVE-2022-32324 1 Pdfalto Project 1 Pdfalto 2024-11-21 9.8 Critical
PDFAlto v0.4 was discovered to contain a heap buffer overflow via the component /pdfalto/src/pdfalto.cc.
CVE-2022-32311 1 Ingredient Stock Management System Project 1 Ingredient Stock Management System 2024-11-21 9.8 Critical
Ingredient Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /isms/admin/stocks/view_stock.php.
CVE-2022-32310 1 Ingredient Stock Management System Project 1 Ingredient Stock Management System 2024-11-21 9.8 Critical
An access control issue in Ingredient Stock Management System v1.0 allows attackers to take over user accounts via a crafted POST request to /isms/classes/Users.php.