Export limit exceeded: 95403 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (95403 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-23993 | 1 Pfsense | 2 Pfsense, Pfsense Plus | 2024-11-21 | 6.1 Medium |
| /usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $_REQUEST['pkg_filter'] in a PHP echo call, causing XSS. | ||||
| CVE-2022-23988 | 1 Westguardsolutions | 1 Ws Form | 2024-11-21 | 6.1 Medium |
| The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission | ||||
| CVE-2022-23987 | 1 Westguardsolutions | 1 Ws Form | 2024-11-21 | 4.8 Medium |
| The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | ||||
| CVE-2022-23973 | 1 Asus | 2 Rt-ax56u, Rt-ax56u Firmware | 2024-11-21 | 8.8 High |
| ASUS RT-AX56U’s user profile configuration function is vulnerable to stack-based buffer overflow due to insufficient validation for parameter length. An unauthenticated LAN attacker can execute arbitrary code to perform arbitrary operations or disrupt service. | ||||
| CVE-2022-23942 | 1 Apache | 1 Doris | 2024-11-21 | 7.5 High |
| Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure. | ||||
| CVE-2022-23935 | 1 Exiftool Project | 1 Exiftool | 2024-11-21 | 7.8 High |
| lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\|$/ check, leading to command injection. | ||||
| CVE-2022-23916 | 1 Appleple | 1 A-blog Cms | 2024-11-21 | 6.1 Medium |
| Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x series versions prior to Ver.2.10.44, Ver.2.11.x series versions prior to Ver.2.11.42, and Ver.3.0.x series versions prior to Ver.3.0.1 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors. This vulnerability is different from CVE-2022-24374. | ||||
| CVE-2022-23912 | 1 Accesspressthemes | 1 Ap Custom Testimonial | 2024-11-21 | 6.1 Medium |
| The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting | ||||
| CVE-2022-23907 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-11-21 | 6.1 Medium |
| CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the parameter m1_fmmessage. | ||||
| CVE-2022-23903 | 1 Pearadmin | 1 Pear Admin Think | 2024-11-21 | 5.4 Medium |
| A Cross Site Scripting (XSS) vulnerability exists in pearadmin pear-admin-think <=5.0.6, which allows a login account to access arbitrary functions and cause stored XSS through a fake User-Agent. | ||||
| CVE-2022-23901 | 1 Re2c | 1 Re2c | 2024-11-21 | 9.8 Critical |
| A stack overflow re2c 2.2 exists due to infinite recursion issues in src/dfa/dead_rules.cc. | ||||
| CVE-2022-23900 | 1 Wavlink | 2 Wl-wn531p3, Wl-wn531p3 Firmware | 2024-11-21 | 9.8 Critical |
| A command injection vulnerability in the API of the Wavlink WL-WN531P3 router, version M31G3.V5030.201204, allows an attacker to achieve unauthorized remote code execution via a malicious POST request through /cgi-bin/adm.cgi. | ||||
| CVE-2022-23896 | 1 Admidio | 1 Admidio | 2024-11-21 | 5.4 Medium |
| Admidio 4.1.2 version is affected by stored cross-site scripting (XSS). | ||||
| CVE-2022-23872 | 1 Emlog | 1 Emlog | 2024-11-21 | 4.8 Medium |
| Emlog pro v1.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /admin/configure.php via the parameter footer_info. | ||||
| CVE-2022-23871 | 1 Gibbonedu | 1 Gibbon | 2024-11-21 | 5.4 Medium |
| Multiple cross-site scripting (XSS) vulnerabilities in the component outcomes_addProcess.php of Gibbon CMS v22.0.01 allow attackers to execute arbitrary web scripts or HTML via a crafted payload insterted into the name, category, description parameters. | ||||
| CVE-2022-23869 | 1 Ruoyi | 1 Ruoyi | 2024-11-21 | 6.5 Medium |
| In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the /system/user/resetPwd request. | ||||
| CVE-2022-23850 | 1 Epub2txt Project | 1 Epub2txt | 2024-11-21 | 7.8 High |
| xhtml_translate_entity in xhtml.c in epub2txt (aka epub2txt2) through 2.02 allows a stack-based buffer overflow via a crafted EPUB document. | ||||
| CVE-2022-23837 | 3 Contribsys, Debian, Redhat | 3 Sidekiq, Debian Linux, Satellite | 2024-11-21 | 7.5 High |
| In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users. | ||||
| CVE-2022-23745 | 1 Checkpoint | 1 Capsule Workspace | 2024-11-21 | 7.5 High |
| A potential memory corruption issue was found in Capsule Workspace Android app (running on GrapheneOS). This could result in application crashing but could not be used to gather any sensitive information. | ||||
| CVE-2022-23743 | 1 Checkpoint | 1 Zonealarm | 2024-11-21 | 7.8 High |
| Check Point ZoneAlarm before version 15.8.200.19118 allows a local actor to escalate privileges during the upgrade process. In addition, weak permissions in the ProgramData\CheckPoint\ZoneAlarm\Data\Updates directory allow a local attacker the ability to execute an arbitrary file write, leading to execution of code as local system, in ZoneAlarm versions before v15.8.211.192119 | ||||