Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (30289 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-24606 1 Luocms Project 1 Luocms 2024-11-21 9.8 Critical
Luocms v2.0 is affected by SQL Injection in /admin/news/sort_ok.php.
CVE-2022-24605 1 Luocms Project 1 Luocms 2024-11-21 9.8 Critical
Luocms v2.0 is affected by SQL Injection in /admin/link/link_ok.php.
CVE-2022-24604 1 Luocms Project 1 Luocms 2024-11-21 9.8 Critical
Luocms v2.0 is affected by SQL Injection in /admin/link/link_mod.php.
CVE-2022-24603 1 Luocms Project 1 Luocms 2024-11-21 9.8 Critical
Luocms v2.0 is affected by SQL Injection in /admin/news/sort_mod.php.
CVE-2022-24602 1 Luocms Project 1 Luocms 2024-11-21 9.8 Critical
Luocms v2.0 is affected by SQL Injection in /admin/news/news_mod.php.
CVE-2022-24600 1 Luocms Project 1 Luocms 2024-11-21 9.8 Critical
Luocms v2.0 is affected by SQL Injection through /admin/login.php. An attacker can log in to the background through SQL injection statements.
CVE-2022-24595 1 Automotivelinux 1 Kooky Koi 2024-11-21 9.8 Critical
Automotive Grade Linux Kooky Koi 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, and 11.0.5 is affected by Incorrect Access Control in usr/bin/afb-daemon. To exploit the vulnerability, an attacker should send a well-crafted HTTP (or WebSocket) request to the socket listened by the afb-daemon process. No credentials nor user interactions are required.
CVE-2022-24571 1 Car Driving School Management System Project 1 Car Driving School Management System 2024-11-21 9.8 Critical
Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access.
CVE-2022-24568 1 Xxyopen 1 Novel-plus 2024-11-21 9.8 Critical
Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery (SSRF) via user-supplied crafted input.
CVE-2022-24553 1 Zfaka Project 1 Zfaka 2024-11-21 9.8 Critical
An issue was found in Zfaka <= 1.4.5. The verification of the background file upload function check is not strict, resulting in remote command execution.
CVE-2022-24552 1 Starwindsoftware 2 Nas, San 2024-11-21 9.8 Critical
A flaw was found in the REST API in StarWind Stack. REST command, which manipulates a virtual disk, doesn’t check input parameters. Some of them go directly to bash as part of a script. An attacker with non-root user access can inject arbitrary data into the command that will be executed with root privileges. This affects StarWind SAN and NAS v0.2 build 1633.
CVE-2022-24449 1 Rt-solar 1 Solar Appscreener 2024-11-21 9.8 Critical
Solar appScreener through 3.10.4, when a valid license is not present, allows XXE and SSRF attacks via a crafted XML document.
CVE-2022-24442 1 Jetbrains 1 Youtrack 2024-11-21 9.8 Critical
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
CVE-2022-24437 1 Git-pull-or-clone Project 1 Git-pull-or-clone 2024-11-21 9.8 Critical
The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath parameter passed to it may be a command-line argument to the git clone command and result in arbitrary command injection.
CVE-2022-24422 1 Dell 1 Idrac9 2024-11-21 9.6 Critical
Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.10.00, contain an improper authentication vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to gain access to the VNC Console.
CVE-2022-24405 1 Open-xchange 1 Ox App Suite 2024-11-21 9.8 Critical
OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API.
CVE-2022-24340 1 Jetbrains 1 Teamcity 2024-11-21 9.8 Critical
In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible.
CVE-2022-24331 1 Jetbrains 1 Teamcity 2024-11-21 9.8 Critical
In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible.
CVE-2022-24313 1 Schneider-electric 1 Interactive Graphical Scada System Data Server 2024-11-21 9.8 Critical
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leading to remote code execution when an attacker sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior)
CVE-2022-24312 1 Schneider-electric 1 Interactive Graphical Scada System Data Server 2024-11-21 9.8 Critical
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by adding at end of file or create a new file in the context of the Data Server potentially leading to remote code execution when an attacker sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior)