Export limit exceeded: 372852 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (372852 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-31300 | 1 Angtech | 1 Haraj | 2024-11-21 | 5.4 Medium |
| A cross-site scripting vulnerability in the DM Section component of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request. | ||||
| CVE-2022-31299 | 1 Angtech | 1 Haraj | 2024-11-21 | 6.1 Medium |
| Haraj v3.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the User Upgrade Form. | ||||
| CVE-2022-31298 | 1 Angtech | 1 Haraj | 2024-11-21 | 5.4 Medium |
| A cross-site scripting vulnerability in the ads comment section of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request. | ||||
| CVE-2022-31296 | 1 Online Discussion Forum Project | 1 Online Discussion Forum | 2024-11-21 | 9.8 Critical |
| Online Discussion Forum Site 1 was discovered to contain a blind SQL injection vulnerability via the component /odfs/posts/view_post.php. | ||||
| CVE-2022-31291 | 2 Debian, Genivi | 2 Debian Linux, Diagnostic Log And Trace | 2024-11-21 | 7.5 High |
| An issue in dlt_config_file_parser.c of dlt-daemon v2.18.8 allows attackers to cause a double free via crafted TCP packets. | ||||
| CVE-2022-31290 | 1 Withknown | 1 Known | 2024-11-21 | 5.4 Medium |
| A cross-site scripting (XSS) vulnerability in Known v1.2.2+2020061101 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Your Name text field. | ||||
| CVE-2022-31287 | 1 Axiosys | 1 Bento4 | 2024-11-21 | 5.5 Medium |
| An issue was discovered in Bento4 v1.2. There is an allocation size request error in /Ap4RtpAtom.cpp. | ||||
| CVE-2022-31285 | 1 Axiosys | 1 Bento4 | 2024-11-21 | 5.5 Medium |
| An issue was discovered in Bento4 1.2. The allocator is out of memory in /Source/C++/Core/Ap4Array.h. | ||||
| CVE-2022-31282 | 1 Axiosys | 1 Bento4 | 2024-11-21 | 5.5 Medium |
| Bento4 MP4Dump v1.2 was discovered to contain a segmentation violation via an unknown address at /Source/C++/Core/Ap4DataBuffer.cpp:175. | ||||
| CVE-2022-31277 | 1 Mi | 2 Xiaomi Lamp 1, Xiaomi Lamp 1 Firmware | 2024-11-21 | 8.8 High |
| Xiaomi Lamp 1 v2.0.4_0066 was discovered to be vulnerable to replay attacks. This allows attackers to to bypass the expected access restrictions and gain control of the switch and other functions via a crafted POST request. | ||||
| CVE-2022-31273 | 1 17ido | 1 Topidp3000 Topsec Operating System | 2024-11-21 | 9.8 Critical |
| An issue in TopIDP3000 Topsec Operating System tos_3.3.005.665b.15_smpidp allows attackers to perform a brute-force attack via a crafted session_id cookie. | ||||
| CVE-2022-31269 | 1 Nortekcontrol | 2 Emerge E3, Emerge E3 Firmware | 2024-11-21 | 8.2 High |
| Nortek Linear eMerge E3-Series devices through 0.32-09c place admin credentials in /test.txt that allow an attacker to open a building's doors. (This occurs in situations where the CVE-2019-7271 default credentials have been changed.) | ||||
| CVE-2022-31268 | 1 Gitblit | 1 Gitblit | 2024-11-21 | 7.5 High |
| A Path Traversal vulnerability in Gitblit 1.9.3 can lead to reading website files via /resources//../ (e.g., followed by a WEB-INF or META-INF pathname). | ||||
| CVE-2022-31267 | 1 Gitblit | 1 Gitblit | 2024-11-21 | 9.8 Critical |
| Gitblit 1.9.2 allows privilege escalation via the Config User Service: a control character can be placed in a profile data field, such as an emailAddress%3Atext 'attacker@example.com\n\trole = "#admin"' value. | ||||
| CVE-2022-31265 | 1 Wargaming | 1 World Of Warships | 2024-11-21 | 8.8 High |
| The replay feature in the client in Wargaming World of Warships 0.11.4 allows remote attackers to execute code when a user launches a replay from an untrusted source. | ||||
| CVE-2022-31264 | 1 Solanalabs | 1 Rbpf | 2024-11-21 | 7.5 High |
| Solana solana_rbpf before 0.2.29 has an addition integer overflow via invalid ELF program headers. elf.rs has a panic via a malformed eBPF program. | ||||
| CVE-2022-31263 | 1 Joinmastodon | 1 Mastodon | 2024-11-21 | 5.3 Medium |
| app/models/user.rb in Mastodon before 3.5.0 allows a bypass of e-mail restrictions. | ||||
| CVE-2022-31262 | 1 Gog | 1 Galaxy | 2024-11-21 | 7.8 High |
| An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to insufficient folder permissions, an attacker can hijack the %ProgramData%\GOG.com folder structure and change the GalaxyCommunication service executable to a malicious file, resulting in code execution as SYSTEM. | ||||
| CVE-2022-31261 | 1 Morpheusdata | 1 Morpheus | 2024-11-21 | 7.5 High |
| An XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful attack requires a SAML identity provider to be configured. In order to exploit the vulnerability, the attacker must know the unique SAML callback ID of the configured identity source. A remote attacker can send a request crafted with an XXE payload to invoke a malicious DTD hosted on a system that they control. This results in reading local files that the application has access to. | ||||
| CVE-2022-31260 | 1 Montala | 1 Resourcespace | 2024-11-21 | 6.5 Medium |
| In Montala ResourceSpace through 9.8 before r19636, csv_export_results_metadata.php allows attackers to export collection metadata via a non-NULL k value. | ||||