Export limit exceeded: 373698 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (373698 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-1165 | 1 Plugin-planet | 1 Blackhole For Bad Bots | 2024-11-21 | 9.1 Critical |
| The Blackhole for Bad Bots WordPress plugin before 3.3.2 uses headers such as CF-CONNECTING-IP, CLIENT-IP etc to determine the IP address of requests hitting the blackhole URL, which allows them to be spoofed. This could result in blocking arbitrary IP addresses, such as legitimate/good search engine crawlers / bots. This could also be abused by competitors to cause damage related to visibility in search engines, can be used to bypass arbitrary blocks caused by this plugin, block any visitor or even the administrator and even more. | ||||
| CVE-2022-1164 | 1 Wztechno | 1 Wyzi | 2024-11-21 | 6.1 Medium |
| The Wyzi Theme was affected by reflected XSS vulnerabilities in the business search feature | ||||
| CVE-2022-1163 | 1 Mineweb | 1 Minewebcms | 2024-11-21 | 4.8 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository mineweb/minewebcms prior to next. | ||||
| CVE-2022-1162 | 1 Gitlab | 1 Gitlab | 2024-11-21 | 9.1 Critical |
| A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts | ||||
| CVE-2022-1160 | 2 Fedoraproject, Vim | 2 Fedora, Vim | 2024-11-21 | 7.8 High |
| heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.4647. | ||||
| CVE-2022-1158 | 3 Fedoraproject, Linux, Redhat | 8 Fedora, Linux Kernel, Enterprise Linux and 5 more | 2024-11-21 | 7.8 High |
| A flaw was found in KVM. When updating a guest's page table entry, vm_pgoff was improperly used as the offset to get the page's pfn. As vaddr and vm_pgoff are controllable by user-mode processes, this flaw allows unprivileged local users on the host to write outside the userspace region and potentially corrupt the kernel, resulting in a denial of service condition. | ||||
| CVE-2022-1157 | 1 Gitlab | 1 Gitlab | 2024-11-21 | 2.6 Low |
| Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 of GitLab CE/EE causes potential sensitive values in invalid URLs to be logged | ||||
| CVE-2022-1156 | 1 Books \& Papers Project | 1 Books \& Papers | 2024-11-21 | 4.8 Medium |
| The Books & Papers WordPress plugin through 0.20210223 does not escape its Custom DB prefix settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed | ||||
| CVE-2022-1155 | 1 Snipeitapp | 1 Snipe-it | 2024-11-21 | 7.4 High |
| Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10. | ||||
| CVE-2022-1154 | 5 Debian, Fedoraproject, Oracle and 2 more | 5 Debian Linux, Fedora, Communications Cloud Native Core Network Exposure Function and 2 more | 2024-11-21 | 7.8 High |
| Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646. | ||||
| CVE-2022-1152 | 1 Menubar | 1 Menubar | 2024-11-21 | 5.4 Medium |
| The Menubar WordPress plugin before 5.8 does not sanitise and escape the command parameter before outputting it back in the response via the menubar AJAX action (available to any authenticated users), leading to a Reflected Cross-Site Scripting | ||||
| CVE-2022-1148 | 1 Gitlab | 1 Gitlab | 2024-11-21 | 5.3 Medium |
| Improper authorization in GitLab Pages included with GitLab CE/EE affecting all versions from 11.5 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to steal a user's access token on an attacker-controlled private GitLab Pages website and reuse that token on the victim's other private websites | ||||
| CVE-2022-1146 | 1 Google | 1 Chrome | 2024-11-21 | 6.5 Medium |
| Inappropriate implementation in Resource Timing in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to leak cross-origin data via a crafted HTML page. | ||||
| CVE-2022-1145 | 1 Google | 1 Chrome | 2024-11-21 | 7.5 High |
| Use after free in Extensions in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific user interaction and profile destruction. | ||||
| CVE-2022-1144 | 1 Google | 1 Chrome | 2024-11-21 | 8.8 High |
| Use after free in WebUI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via specific input into DevTools. | ||||
| CVE-2022-1143 | 1 Google | 1 Chrome | 2024-11-21 | 8.8 High |
| Heap buffer overflow in WebUI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via specific input into DevTools. | ||||
| CVE-2022-1142 | 1 Google | 1 Chrome | 2024-11-21 | 8.8 High |
| Heap buffer overflow in WebUI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via specific input into DevTools. | ||||
| CVE-2022-1141 | 1 Google | 1 Chrome | 2024-11-21 | 8.8 High |
| Use after free in File Manager in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via specific user gesture. | ||||
| CVE-2022-1139 | 1 Google | 1 Chrome | 2024-11-21 | 6.5 Medium |
| Inappropriate implementation in Background Fetch API in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to leak cross-origin data via a crafted HTML page. | ||||
| CVE-2022-1138 | 1 Google | 1 Chrome | 2024-11-21 | 6.5 Medium |
| Inappropriate implementation in Web Cursor in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who had compromised the renderer process to obscure the contents of the Omnibox (URL bar) via a crafted HTML page. | ||||