Export limit exceeded: 373598 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (373598 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-1850 | 1 Filegator | 1 Filegator | 2024-11-21 | 8.1 High |
| Path Traversal in GitHub repository filegator/filegator prior to 7.8.0. | ||||
| CVE-2022-1849 | 1 Filegator | 1 Filegator | 2024-11-21 | 5.4 Medium |
| Session Fixation in GitHub repository filegator/filegator prior to 7.8.0. | ||||
| CVE-2022-1848 | 1 Erudika | 1 Para | 2024-11-21 | 5.3 Medium |
| Business Logic Errors in GitHub repository erudika/para prior to 1.45.11. | ||||
| CVE-2022-1847 | 1 Rotating Posts Project | 1 Rotating Posts | 2024-11-21 | 4.3 Medium |
| The Rotating Posts WordPress plugin through 1.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | ||||
| CVE-2022-1846 | 1 Tiny Contact Form Project | 1 Tiny Contact Form | 2024-11-21 | 4.3 Medium |
| The Tiny Contact Form WordPress plugin through 0.7 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | ||||
| CVE-2022-1845 | 1 Wp Post Styling Project | 1 Wp Post Styling | 2024-11-21 | 4.3 Medium |
| The WP Post Styling WordPress plugin before 1.3.1 does not have CSRF checks in various actions, which could allow attackers to make a logged in admin delete plugin's data, update the settings, add new entries and more via CSRF attacks | ||||
| CVE-2022-1844 | 1 Wp-sentry Project | 1 Wp-sentry | 2024-11-21 | 4.3 Medium |
| The WP Sentry WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well | ||||
| CVE-2022-1843 | 1 Mailpress Project | 1 Mailpress | 2024-11-21 | 6.5 Medium |
| The MailPress WordPress plugin through 7.2.1 does not have CSRF checks in various places, which could allow attackers to make a logged in admin change the settings, purge log files and more via CSRF attacks | ||||
| CVE-2022-1842 | 1 Openbook Book Data Project | 1 Openbook Book Data | 2024-11-21 | 4.3 Medium |
| The OpenBook Book Data WordPress plugin through 3.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well | ||||
| CVE-2022-1841 | 1 Zephyrproject | 1 Zephyr | 2024-11-21 | 7.2 High |
| In subsys/net/ip/tcp.c , function tcp_flags , when the incoming parameter flags is ECN or CWR , the buf will out-of-bounds write a byte zero. | ||||
| CVE-2022-1833 | 1 Redhat | 1 Amq Broker | 2024-11-21 | 8.8 High |
| A flaw was found in AMQ Broker Operator 7.9.4 installed via UI using OperatorHub where a low-privilege user that has access to the namespace where the AMQ Operator is deployed has access to clusterwide edit rights by checking the secrets. The service account used for building the Operator gives more permission than expected and an attacker could benefit from it. This requires at least an already compromised low-privilege account or insider attack. | ||||
| CVE-2022-1832 | 1 Capa Protect Project | 1 Capa Protect | 2024-11-21 | 6.5 Medium |
| The CaPa Protect WordPress plugin through 0.5.8.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable the applied protection. | ||||
| CVE-2022-1831 | 1 Wplite Project | 1 Wplite | 2024-11-21 | 6.5 Medium |
| The WPlite WordPress plugin through 1.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | ||||
| CVE-2022-1830 | 1 Amazon Einzeltitellinks Project | 1 Amazon Einzeltitellinks | 2024-11-21 | 6.5 Medium |
| The Amazon Einzeltitellinks WordPress plugin through 1.3.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping | ||||
| CVE-2022-1829 | 1 Inline Google Maps Project | 1 Inline Google Maps | 2024-11-21 | 6.5 Medium |
| The Inline Google Maps WordPress plugin through 5.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping | ||||
| CVE-2022-1828 | 1 Pdf24 Articles To Pdf Project | 1 Pdf24 Articles To Pdf | 2024-11-21 | 6.5 Medium |
| The PDF24 Articles To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | ||||
| CVE-2022-1827 | 1 Pdf24 Articles To Pdf Project | 1 Pdf24 Articles To Pdf | 2024-11-21 | 6.5 Medium |
| The PDF24 Article To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | ||||
| CVE-2022-1826 | 1 Cross-linker Project | 1 Cross-linker | 2024-11-21 | 6.5 Medium |
| The Cross-Linker WordPress plugin through 3.0.1.9 does not have CSRF check in place when creating Cross-Links, which could allow attackers to make a logged in admin perform such action via a CSRF attack | ||||
| CVE-2022-1825 | 1 Collectiveaccess | 1 Providence | 2024-11-21 | 5.4 Medium |
| Cross-site Scripting (XSS) - Reflected in GitHub repository collectiveaccess/providence prior to 1.8. | ||||
| CVE-2022-1824 | 1 Mcafee | 1 Consumer Product Removal Tool | 2024-11-21 | 7.9 High |
| An uncontrolled search path vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local attacker to perform a sideloading attack by using a specific file name. This could result in the user gaining elevated permissions and being able to execute arbitrary code as there were insufficient checks on the executable being signed by McAfee. | ||||