Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (322987 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-22938 2 Microsoft, Vmware 3 Windows, Horizon, Workstation 2024-11-21 6.5 Medium
VMware Workstation (16.x prior to 16.2.2) and Horizon Client for Windows (5.x prior to 5.5.3) contains a denial-of-service vulnerability in the Cortado ThinPrint component. The issue exists in TrueType font parser. A malicious actor with access to a virtual machine or remote desktop may exploit this issue to trigger a denial-of-service condition in the Thinprint service running on the host machine where VMware Workstation or Horizon Client for Windows is installed.
CVE-2022-22934 1 Saltstack 1 Salt 2024-11-21 8.8 High
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.
CVE-2022-22932 2 Apache, Redhat 2 Karaf, Jboss Fuse 2024-11-21 5.3 Medium
Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder. The risk is low as obr:* commands are not very used and the entry is set by user. This has been fixed in revision: https://gitbox.apache.org/repos/asf?p=karaf.git;h=36a2bc4 https://gitbox.apache.org/repos/asf?p=karaf.git;h=52b70cf Mitigation: Apache Karaf users should upgrade to 4.2.15 or 4.3.6 or later as soon as possible, or use correct path. JIRA Tickets: https://issues.apache.org/jira/browse/KARAF-7326
CVE-2022-22931 1 Apache 1 James 2024-11-21 4.3 Medium
Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).
CVE-2022-22930 1 Mingsoft 1 Mcms 2024-11-21 9.8 Critical
A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code via a crafted payload.
CVE-2022-22929 1 Mingsoft 1 Mcms 2024-11-21 9.8 Critical
MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute arbitrary code via a crafted ZIP file.
CVE-2022-22928 1 Mingsoft 1 Mcms 2024-11-21 9.8 Critical
MCMS v5.2.4 was discovered to have a hardcoded shiro-key, allowing attackers to exploit the key and execute arbitrary code.
CVE-2022-22922 1 Tp-link 2 Tl-wa850re, Tl-wa850re Firmware 2024-11-21 9.8 Critical
TP-Link TL-WA850RE Wi-Fi Range Extender before v6_200923 was discovered to use highly predictable and easily detectable session keys, allowing attackers to gain administrative privileges.
CVE-2022-22919 1 Adenza 1 Axiomsl Controllerview 2024-11-21 6.1 Medium
Adenza AxiomSL ControllerView through 10.8.1 allows redirection for SSO login URLs.
CVE-2022-22916 1 Zoneland 1 O2oa 2024-11-21 9.8 Critical
O2OA v6.4.7 was discovered to contain a remote code execution (RCE) vulnerability via /x_program_center/jaxrs/invoke.
CVE-2022-22914 1 Ovidentia 1 Ovidentia 2024-11-21 7.5 High
An incorrect access control issue in the component FileManager of Ovidentia CMS 6.0 allows authenticated attackers to to view and download content in the upload directory via path traversal.
CVE-2022-22912 1 Plist Project 1 Plist 2024-11-21 9.8 Critical
Prototype pollution vulnerability via .parse() in Plist before v3.0.4 allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution.
CVE-2022-22909 1 Digitaldruid 1 Hoteldruid 2024-11-21 8.8 High
HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a crafted payload into the name field under the Create New Room module.
CVE-2022-22908 1 Sangfor 1 Vdi Client 2024-11-21 5.5 Medium
SangforCSClient.exe in Sangfor VDI Client 5.4.2.1006 allows attackers, when they are able to read process memory, to discover the contents of the Username and Password fields.
CVE-2022-22901 1 Jerryscript 1 Jerryscript 2024-11-21 5.5 Medium
There is an Assertion in 'context_p->next_scanner_info_p->type == SCANNER_TYPE_FUNCTION' failed at parser_parse_function_arguments in /js/js-parser.c of JerryScript commit a6ab5e9.
CVE-2022-22899 1 Coreftp 1 Core Ftp 2024-11-21 5.5 Medium
Core FTP / SFTP Server v2 Build 725 was discovered to allow unauthenticated attackers to cause a Denial of Service (DoS) via a crafted packet through the SSH service.
CVE-2022-22897 1 Apollotheme 1 Ap Pagebuilder 2024-11-21 9.8 Critical
A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop allows unauthenticated attackers to exfiltrate database data.
CVE-2022-22895 1 Jerryscript 1 Jerryscript 2024-11-21 7.8 High
Jerryscript 3.0.0 was discovered to contain a heap-buffer-overflow via ecma_utf8_string_to_number_by_radix in /jerry-core/ecma/base/ecma-helpers-conversion.c.
CVE-2022-22894 1 Jerryscript 1 Jerryscript 2024-11-21 7.8 High
Jerryscript 3.0.0 was discovered to contain a stack overflow via ecma_lcache_lookup in /jerry-core/ecma/base/ecma-lcache.c.
CVE-2022-22893 1 Jerryscript 1 Jerryscript 2024-11-21 7.8 High
Jerryscript 3.0.0 was discovered to contain a stack overflow via vm_loop.lto_priv.304 in /jerry-core/vm/vm.c.