cve.bz

Matching records, newest first, page 65

Filter
  1. 8.8CVE-2022-37190ExploitEPSS 46%

    CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE). An authenticated user can control both parameters (action and function) from "/api/index.php.

  2. 9.8CVE-2022-35413ExploitEPSS 18%

    WAPPLES through 6.0 has a hardcoded systemi account. A threat actor could use this account to access the system configuration and confidential information (such as SSL keys) via an HTTPS request to the /webapi/ URI on port 443 or 5001.

  3. 7.8CVE-2022-37969KEVEPSS 28%

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

  4. 8.8CVE-2022-37961EPSS 51%

    Microsoft SharePoint Server Remote Code Execution Vulnerability

  5. 8.1CVE-2022-37958EPSS 86%

    SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability

  6. 7.8CVE-2022-37957EPSS 14%

    Windows Kernel Elevation of Privilege Vulnerability

  7. 7.8CVE-2022-37954EPSS 45%

    DirectX Graphics Kernel Elevation of Privilege Vulnerability

  8. 8.8CVE-2022-35823EPSS 54%

    Microsoft SharePoint Remote Code Execution Vulnerability

  9. 7.8CVE-2022-35803EPSS 24%

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

  10. 7.8CVE-2022-34729EPSS 11%

    Windows GDI Elevation of Privilege Vulnerability

  11. 9.8CVE-2022-34721EPSS 76%

    Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability

  12. 9.8CVE-2022-34718EPSS 55%

    Windows TCP/IP Remote Code Execution Vulnerability

  13. 8.1CVE-2022-33679EPSS 11%

    Windows Kerberos Elevation of Privilege Vulnerability

  14. 9.8CVE-2022-37860EPSS 80%

    The web configuration interface of the TP-Link M7350 V3 with firmware version 190531 is affected by a pre-authentication command injection vulnerability.

  15. 6.1CVE-2022-39810EPSS 58%

    An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console under /carbon/ndatasource/validateconnection/ajaxprocessor.jsp via the driver p…

  16. 9.8CVE-2022-25765EPSS 43%

    The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized.

  17. 8.8CVE-2022-36100EPSS 74%

    XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform. Starting with version 1.7 in XWiki Platform Applications Tag and prior to 13.10.6 and 14.4 in XWiki Platform Tag UI, the tag…

  18. 8.8CVE-2022-36099EPSS 76%

    XWiki Platform Wiki UI Main Wiki is software for managing subwikis on XWiki Platform, a generic wiki platform. Starting with version 5.3-milestone-2 and prior to versions 13.10.6 and 14.4, it's possible to inject arbitrary wiki syntax incl…

  19. 9.0CVE-2022-36098EPSS 72%

    XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or gro…

  20. 6.1CVE-2022-36097EPSS 58%

    XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform. Starting with version 14.0-rc-1 and prior to 14.4-rc-1, it's possible to store JavaScript in an attachment n…

  21. 9.0CVE-2022-36096EPSS 60%

    The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6 and 14.3, it's possible to store JavaScript which will be e…

  22. 9.0CVE-2022-36094EPSS 65%

    XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyon…

  23. 8.8CVE-2022-30079EPSS 25%

    Command injection vulnerability was discovered in Netgear R6200 v2 firmware through R6200v2-V1.0.3.12 via binary /sbin/acos_service that could allow remote authenticated attackers the ability to modify values in the vulnerable parameter.

  24. 9.1CVE-2022-27593KEVExploitEPSS 88%

    An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the fo…

  25. 10.0CVE-2022-36067EPSS 48%

    vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sand…

  26. 8.2CVE-2022-2633ExploitEPSS 36%

    The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the ~/public/video.php file in versions up to, and including 2.6.0. This make…

  27. 9.8CVE-2022-31814ExploitEPSS 92%

    pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected.

  28. 9.8CVE-2022-36642ExploitEPSS 13%

    A local file disclosure vulnerability in /appConfig/userDB.json of Telos Alliance Omnia MPX Node through 1.0.0-1.4.9 allows attackers to access users credentials which makes him able to gain initial access to the control panel with high pr…

  29. 7.5CVE-2022-25813EPSS 67%

    In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page. Then a party manager needs to list the…

  30. 9.8CVE-2022-37130EPSS 27%

    In D-Link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img a command injection vulnerability occurs in /goform/Diagnosis, after the condition is met, setnum will be spliced into v10 by snprintf, and the system will be executed, resulti…

  31. 7.5CVE-2022-36620EPSS 24%

    D-link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img is vulnerable to Buffer Overflow via /goform/addRouting.

  32. 9.8CVE-2022-37128EPSS 22%

    In D-Link DIR-816 A2_v1.10CNB04.img the network can be initialized without authentication via /goform/wizard_end.

  33. 7.5CVE-2022-37122ExploitEPSS 24%

    Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter t…

  34. 8.8CVE-2022-1552EPSS 17%

    A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amc…

  35. 9.8CVE-2022-36553ExploitEPSS 97%

    Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi.

  36. 8.8CVE-2022-38772EPSS 78%

    Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that lead to remote code …

  37. 9.8CVE-2022-32548EPSS 34%

    An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field.

  38. 9.8CVE-2022-22897ExploitEPSS 14%

    A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop allows unauthenticated attackers to exfiltrate database data.

  39. 9.8CVE-2022-34668ExploitEPSS 12%

    NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confiden…

  40. 9.8CVE-2022-36572EPSS 23%

    Sinsiu Sinsiu Enterprise Website System v1.1.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /upload/admin.php?/deal/.

  41. 9.8CVE-2022-38555EPSS 10%

    Linksys E1200 v1.0.04 is vulnerable to Buffer Overflow via ej_get_web_page_name.

  42. 9.8CVE-2022-37056EPSS 11%

    D-Link GO-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 is vulnerable to Command Injection via /cgibin, hnap_main,

  43. 9.8CVE-2022-37055KEVEPSS 56%

    D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,

  44. 9.8CVE-2022-37057EPSS 26%

    D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Command Injection via cgibin, ssdpcgi_main.

  45. 7.5CVE-2022-36537KEVExploitEPSS 95%

    ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.

  46. 9.8CVE-2022-31499ExploitEPSS 65%

    Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo. NOTE: this issue exists because of an incomplete fix for CVE-2019-7256.

  47. 9.8CVE-2022-37159EPSS 27%

    Claroline 13.5.7 and prior is vulnerable to Remote code execution via arbitrary file upload.

  48. 9.8CVE-2022-37070EPSS 10%

    H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a command injection vulnerability via the param parameter at DelL2tpLNSList.

  49. 7.8CVE-2022-36510EPSS 11%

    H3C GR2200 MiniGR1A0V100R014 was discovered to contain a command injection vulnerability via the param parameter at DelL2tpLNSList.

  50. 7.8CVE-2022-36509EPSS 11%

    H3C GR3200 MiniGR1B0V100R014 was discovered to contain a command injection vulnerability via the param parameter at DelL2tpLNSList.