Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (84806 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-26210 1 Totolink 12 A3000ru, A3000ru Firmware, A3100r and 9 more 2024-11-21 9.8 Critical
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setUpgradeFW, via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2022-26209 1 Totolink 12 A3000ru, A3000ru Firmware, A3100r and 9 more 2024-11-21 9.8 Critical
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setUploadSetting, via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2022-26208 1 Totolink 12 A3000ru, A3000ru Firmware, A3100r and 9 more 2024-11-21 9.8 Critical
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setWebWlanIdx, via the webWlanIdx parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2022-26207 1 Totolink 12 A3000ru, A3000ru Firmware, A3100r and 9 more 2024-11-21 9.8 Critical
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setDiagnosisCfg, via the ipDoamin parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2022-26206 1 Totolink 12 A3000ru, A3000ru Firmware, A3100r and 9 more 2024-11-21 9.8 Critical
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setLanguageCfg, via the langType parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2022-26205 1 Marky Project 1 Marky 2024-11-21 9.8 Critical
Marky commit 3686565726c65756e was discovered to contain a remote code execution (RCE) vulnerability via the Display text fields. This vulnerability allows attackers to execute arbitrary code via injection of a crafted payload.
CVE-2022-26197 1 Joget 1 Joget Dx 2024-11-21 5.4 Medium
Joget DX 7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Datalist table.
CVE-2022-26189 1 Totolink 2 N600r, N600r Firmware 2024-11-21 9.8 Critical
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the langType parameter in the login interface.
CVE-2022-26188 1 Totolink 2 N600r, N600r Firmware 2024-11-21 9.8 Critical
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSyncWithHost.
CVE-2022-26187 1 Totolink 2 N600r, N600r Firmware 2024-11-21 9.8 Critical
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function.
CVE-2022-26186 1 Totolink 2 N600r, N600r Firmware 2024-11-21 9.8 Critical
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the exportOvpn interface at cstecgi.cgi.
CVE-2022-26181 1 Dropbox 1 Lepton 2024-11-21 7.8 High
Dropbox Lepton v1.2.1-185-g2a08b77 was discovered to contain a heap-buffer-overflow in the function aligned_dealloc():src/lepton/bitops.cc:108.
CVE-2022-26155 1 Cherwell 1 Cherwell Service Management 2024-11-21 6.1 Medium
An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. XSS can occur via a payload in the SAMLResponse parameter of the HTTP request body.
CVE-2022-26151 1 Citrix 1 Xenmobile Server 2024-11-21 7.2 High
Citrix XenMobile Server 10.12 through RP11, 10.13 through RP7, and 10.14 through RP4 allows Command Injection.
CVE-2022-26147 1 Quectel 2 Rg502q-ea, Rg502q-ea Firmware 2024-11-21 9.8 Critical
The Quectel RG502Q-EA modem before 2022-02-23 allow OS Command Injection.
CVE-2022-26146 1 Tricentis 1 Qtest 2024-11-21 5.4 Medium
Tricentis qTest before 10.4 allows stored XSS by an authenticated attacker.
CVE-2022-26144 1 Mantisbt 1 Mantisbt 2024-11-21 6.1 Medium
An XSS issue was discovered in MantisBT before 2.25.3. Improper escaping of a Plugin name allows execution of arbitrary code (if CSP allows it) in manage_plugin_page.php and manage_plugin_uninstall.php when a crafted plugin is installed.
CVE-2022-26130 1 F5 11 Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager, Big-ip Analytics and 8 more 2024-11-21 5.3 Medium
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when an Active mode-enabled FTP profile is configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing active FTP data channel connections. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVE-2022-26119 1 Fortinet 1 Fortisiem 2024-11-21 7.8 High
A improper authentication vulnerability in Fortinet FortiSIEM before 6.5.0 allows a local attacker with CLI access to perform operations on the Glassfish server directly via a hardcoded password.
CVE-2022-26114 1 Fortinet 1 Fortimail 2024-11-21 5.4 Medium
An improper neutralization of input during web page generation vulnerability [CWE-79] in the Webmail of FortiMail before 7.2.0 may allow an unauthenticated attacker to trigger a cross-site scripting (XSS) attack via sending specially crafted mail messages.