Export limit exceeded: 374231 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (374231 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-2897 | 1 Measuresoft | 2 Scadapro Client, Scadapro Server | 2025-04-16 | 7.8 High |
| Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow privilege escalation.. | ||||
| CVE-2022-2894 | 1 Measuresoft | 1 Scadapro Server | 2025-04-16 | 7.8 High |
| Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls. The controls may allow seven untrusted pointer deference instances while processing a specific project file. | ||||
| CVE-2022-2896 | 1 Measuresoft | 1 Scadapro Server | 2025-04-16 | 7.8 High |
| Measuresoft ScadaPro Server (All Versions) allows use after free while processing a specific project file. | ||||
| CVE-2022-2979 | 1 Omron | 1 Cx-programmer | 2025-04-16 | 7.8 High |
| Opening a specially crafted file could cause the affected product to fail to release its memory reference potentially resulting in arbitrary code execution. | ||||
| CVE-2022-36385 | 1 Contechealth | 2 Cms8000, Cms8000 Firmware | 2025-04-16 | 6.8 Medium |
| A threat actor with momentary access to the device can plug in a USB drive and perform a malicious firmware update, resulting in permanent changes to device functionality. No authentication or controls are in place to prevent a threat actor from maliciously modifying firmware and performing a drive-by attack to load the firmware on any CMS8000 device. | ||||
| CVE-2022-2333 | 1 Honeywell | 1 Softmaster | 2025-04-16 | 8.8 High |
| If an attacker manages to trick a valid user into loading a malicious DLL, the attacker may be able to achieve code execution in Honeywell SoftMaster version 4.51 application’s context and permissions. | ||||
| CVE-2022-3263 | 1 Measuresoft | 1 Scadapro Server | 2025-04-16 | 7.8 High |
| The security descriptor of Measuresoft ScadaPro Server version 6.7 has inconsistent permissions, which could allow a local user with limited privileges to modify the service binary path and start malicious commands with SYSTEM privileges. | ||||
| CVE-2022-3397 | 1 Omron | 1 Cx-programmer | 2025-04-16 | 7.8 High |
| OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code. | ||||
| CVE-2022-3398 | 1 Omron | 1 Cx-programmer | 2025-04-16 | 7.8 High |
| OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code. | ||||
| CVE-2022-3396 | 1 Omron | 1 Cx-programmer | 2025-04-16 | 7.8 High |
| OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code. | ||||
| CVE-2021-27406 | 1 Perfact | 1 Openvpn-client | 2025-04-16 | 8.8 High |
| An attacker can take leverage on PerFact OpenVPN-Client versions 1.4.1.0 and prior to send the config command from any application running on the local host machine to force the back-end server into initializing a new open-VPN instance with arbitrary open-VPN configuration. This could result in the attacker achieving execution with privileges of a SYSTEM user. | ||||
| CVE-2022-1738 | 1 Fujielectric | 1 D300win | 2025-04-16 | 8.7 High |
| Fuji Electric D300win prior to version 3.7.1.17 is vulnerable to an out-of-bounds read, which could allow an attacker to leak sensitive data from the process memory. | ||||
| CVE-2022-2069 | 1 Siemens | 2 Jt2go, Teamcenter Visualization | 2025-04-16 | 7.8 High |
| The APDFL.dll in Siemens JT2Go prior to V13.3.0.5 and Siemens Teamcenter Visualization prior to V14.0.0.2 contains an out of bounds write past the fixed-length heap-based buffer while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process. | ||||
| CVE-2022-40965 | 1 Deltaww | 1 Diaenergie | 2025-04-16 | 8.7 High |
| The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PostEnergyType API. | ||||
| CVE-2022-41555 | 1 Deltaww | 1 Diaenergie | 2025-04-16 | 8.7 High |
| The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PutLineMessageSetting API. | ||||
| CVE-2022-40967 | 1 Deltaww | 1 Diaenergie | 2025-04-16 | 8.8 High |
| The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckIoTHubNameExisted. A low-privileged authenticated attacker could exploit this issue to inject arbitrary SQL queries. | ||||
| CVE-2022-41701 | 1 Deltaww | 1 Diaenergie | 2025-04-16 | 8.7 High |
| The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PutShift API. | ||||
| CVE-2022-41773 | 1 Deltaww | 1 Diaenergie | 2025-04-16 | 8.8 High |
| The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckDIACloud. A low-privileged authenticated attacker could exploit this issue to inject arbitrary SQL queries. | ||||
| CVE-2022-41133 | 1 Deltaww | 1 Diaenergie | 2025-04-16 | 8.8 High |
| The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in GetDIAE_line_message_settingsListParameters. A low-privileged authenticated attacker could exploit this issue to inject arbitrary SQL queries. | ||||
| CVE-2022-41651 | 1 Deltaww | 1 Diaenergie | 2025-04-16 | 8.7 High |
| The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the SetPF API. | ||||