Export limit exceeded: 378491 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 378491 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (378491 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-24602 | 1 Luocms Project | 1 Luocms | 2024-11-21 | 9.8 Critical |
| Luocms v2.0 is affected by SQL Injection in /admin/news/news_mod.php. | ||||
| CVE-2022-24601 | 1 Luocms Project | 1 Luocms | 2024-11-21 | 7.5 High |
| Luocms v2.0 is affected by SQL Injection in /admin/manager/admin_mod.php. An attacker can obtain sensitive information through SQL injection statements. | ||||
| CVE-2022-24600 | 1 Luocms Project | 1 Luocms | 2024-11-21 | 9.8 Critical |
| Luocms v2.0 is affected by SQL Injection through /admin/login.php. An attacker can log in to the background through SQL injection statements. | ||||
| CVE-2022-24595 | 1 Automotivelinux | 1 Kooky Koi | 2024-11-21 | 9.8 Critical |
| Automotive Grade Linux Kooky Koi 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, and 11.0.5 is affected by Incorrect Access Control in usr/bin/afb-daemon. To exploit the vulnerability, an attacker should send a well-crafted HTTP (or WebSocket) request to the socket listened by the afb-daemon process. No credentials nor user interactions are required. | ||||
| CVE-2022-24594 | 1 Waline | 1 Waline | 2024-11-21 | 5.3 Medium |
| In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address. | ||||
| CVE-2022-24590 | 1 Backdropcms | 1 Backdrop | 2024-11-21 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability in the Add Link function of BackdropCMS v1.21.1 allows attackers to execute arbitrary web scripts or HTML. | ||||
| CVE-2022-24589 | 1 Burden Project | 1 Burden | 2024-11-21 | 6.1 Medium |
| Burden v3.0 was discovered to contain a stored cross-site scripting (XSS) in the Add Category function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the task parameter. | ||||
| CVE-2022-24588 | 1 Flatpress | 1 Flatpress | 2024-11-21 | 5.4 Medium |
| Flatpress v1.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability in the Upload SVG File function. | ||||
| CVE-2022-24587 | 1 Pluxml | 1 Pluxml | 2024-11-21 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability in the component core/admin/medias.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML. | ||||
| CVE-2022-24586 | 1 Pluxml | 1 Pluxml | 2024-11-21 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability in the component /core/admin/categories.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the content and thumbnail parameters. | ||||
| CVE-2022-24585 | 1 Pluxml | 1 Pluxml | 2024-11-21 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability in the component /core/admin/comment.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the author parameter. | ||||
| CVE-2022-24584 | 1 Yubico | 1 Otp | 2024-11-21 | 6.5 Medium |
| Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation server. The Yubico OTP supposedly creates hardware bound second factor credentials. When a user reprograms the OTP functionality by "writing" it on a token using the Yubico Personalization Tool, they can then upload the new configuration to Yubicos OTP validation servers. NOTE: the vendor disputes this because there is no way for a YubiKey device to prevent a user from deciding that a secret value, which is imported into the device, should also be stored elsewhere | ||||
| CVE-2022-24582 | 1 Accounting Journal Management Project | 1 Accounting Journal Management | 2024-11-21 | 5.4 Medium |
| Accounting Journal Management 1.0 is vulnerable to XSS-PHPSESSID-Hijacking. The parameter manage_user from User lists is vulnerable to XSS-Stored and PHPSESSID attacks. The malicious user can attack the system by using the already session which he has from inside and outside of the network. | ||||
| CVE-2022-24581 | 1 Aceware | 1 Aceweb Online Portal | 2024-11-21 | 7.5 High |
| ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server to disclose the username and password hash of the user executing the ACEweb Online software. | ||||
| CVE-2022-24578 | 1 Gpac | 1 Gpac | 2024-11-21 | 7.8 High |
| GPAC 1.0.1 is affected by a heap-based buffer overflow in SFS_AddString () at bifs/script_dec.c. | ||||
| CVE-2022-24577 | 1 Gpac | 1 Gpac | 2024-11-21 | 7.8 High |
| GPAC 1.0.1 is affected by a NULL pointer dereference in gf_utf8_wcslen. (gf_utf8_wcslen is a renamed Unicode utf8_wcslen function.) | ||||
| CVE-2022-24576 | 1 Gpac | 1 Gpac | 2024-11-21 | 5.5 Medium |
| GPAC 1.0.1 is affected by Use After Free through MP4Box. | ||||
| CVE-2022-24575 | 1 Gpac | 1 Gpac | 2024-11-21 | 7.8 High |
| GPAC 1.0.1 is affected by a stack-based buffer overflow through MP4Box. | ||||
| CVE-2022-24574 | 1 Gpac | 1 Gpac | 2024-11-21 | 5.5 Medium |
| GPAC 1.0.1 is affected by a NULL pointer dereference in gf_dump_vrml_field.isra (). | ||||
| CVE-2022-24573 | 1 Element-it | 1 Http Commander | 2024-11-21 | 6.1 Medium |
| A stored cross-site scripting (XSS) vulnerability in the admin interface in Element-IT HTTP Commander 7.0.0 allows unauthenticated users to get admin access by injecting a malicious script in the User-Agent field. | ||||