cve.bz

Matching records, newest first, page 68

Filter
  1. 5.4CVE-2022-44951ExploitEPSS 1.0%

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/forms&entities_id=24. This vulnerability allows attackers to execute arbitrary we…

  2. 5.4CVE-2022-44950ExploitEPSS 1.0%

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. This vulnerability allows attackers to execute arbitrary web …

  3. 5.4CVE-2022-44949ExploitEPSS 1.0%

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. This vulnerability allows attackers to execute arbitrary web …

  4. 5.4CVE-2022-44948ExploitEPSS 1.0%

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Entities Group feature at/index.php?module=entities/entities_groups. This vulnerability allows attackers to execute arbitrary web scripts…

  5. 5.4CVE-2022-44947ExploitEPSS 1.1%

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature at /index.php?module=entities/listing_types&entities_id=24. This vulnerability allows attackers to execute arbitrar…

  6. 5.4CVE-2022-44946ExploitEPSS 1.1%

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability allows attackers to execute arbitrary web scri…

  7. 5.4CVE-2022-44944ExploitEPSS 1.1%

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Announcement function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability allows attackers to execute arbitrary …

  8. 9.8CVE-2022-44291ExploitEPSS 4.1%

    webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php.

  9. 9.8CVE-2022-44290ExploitEPSS 4.1%

    webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in deleteapprovalstages.php.

  10. 9.8CVE-2022-1471ExploitEPSS 99.5%

    SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor …

  11. 4.3CVE-2022-41413ExploitEPSS 2.2%

    perfSONAR v4.x <= v4.4.5 was discovered to contain a Cross-Site Request Forgery (CSRF) which is triggered when an attacker injects crafted input into the Search function.

  12. 8.6CVE-2022-41412ExploitEPSS 4.7%

    An issue in the graphData.cgi component of perfSONAR v4.4.5 and prior allows attackers to access sensitive data and execute Server-Side Request Forgery (SSRF) attacks.

  13. 7.5CVE-2022-44356ExploitEPSS 3.1%

    WAVLINK Quantum D4G (WL-WN531G3) running firmware versions M31G3.V5030.201204 and M31G3.V5030.200325 has an access control issue which allows unauthenticated attackers to download configuration data and log files.

  14. 8.8CVE-2022-3768ExploitEPSS 4.1%

    The WPSmartContracts WordPress plugin before 1.3.12 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author

  15. 9.8CVE-2022-45933ExploitEPSS 52%

    KubeView through 0.1.31 allows attackers to obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authentication, and retrieves certificate files that can be used for authentication as kube-admin. NOTE: the…

  16. 5.4CVE-2022-45038ExploitEPSS 1.1%

    A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Footer field.

  17. 5.4CVE-2022-45037ExploitEPSS 1.1%

    A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name field.

  18. 8.8CVE-2021-43258ExploitEPSS 12%

    CartView.php in ChurchInfo 1.3.0 allows attackers to achieve remote code execution through insecure uploads. This requires authenticated access tot he ChurchInfo application. Once authenticated, a user can add names to their cart, and comp…

  19. 4.8CVE-2022-42095ExploitEPSS 2.2%

    Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page content.

  20. 4.8CVE-2022-42094ExploitEPSS 2.8%

    Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.

  21. 4.8CVE-2022-42096ExploitEPSS 2.2%

    Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content.

  22. 7.8CVE-2022-37197ExploitEPSS 1.1%

    IOBit IOTransfer V4 is vulnerable to Unquoted Service Path.

  23. 9.8CVE-2022-41840ExploitEPSS 5.7%

    Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin <= 2.7.7 on WordPress.

  24. 8.8CVE-2022-44384ExploitEPSS 5.7%

    An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file.

  25. 7.5CVE-2022-43140ExploitEPSS 2.1%

    kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile. This vulnerability allows attackers to force the application to make arbitrary…

  26. 9.8CVE-2022-40881ExploitEPSS 31%

    SolarView Compact 6.00 was discovered to contain a command injection vulnerability via network_test.php

  27. 9.8CVE-2022-43781ExploitEPSS 98%

    There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerab…

  28. 9.8CVE-2022-3980ExploitEPSS 13%

    An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4.

  29. 4.9CVE-2022-40843ExploitEPSS 29%

    The Tenda AC1200 V-W15Ev2 V15.11.0.10(1576) router is vulnerable to improper authorization / improper session management that allows the router login page to be bypassed. This leads to authenticated attackers having the ability to read the…

  30. 6.1CVE-2022-42118ExploitEPSS 1.3%

    A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject a…

  31. 9.8CVE-2022-37109ExploitEPSS 49%

    patrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is vulnerable to Incorrect Access Control. Access to the password.txt file is not properly restricted as it is in the root directory served by StaticFil…

  32. 6.1CVE-2021-40272ExploitEPSS 1.3%

    OP5 Monitor 8.3.1, 8.3.2, and OP5 8.3.3 are vulnerable to Cross Site Scripting (XSS).

  33. 6.1CVE-2022-3578ExploitEPSS 1.2%

    The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

  34. 6.1CVE-2022-3484ExploitEPSS 1.2%

    The WPB Show Core WordPress plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.

  35. 9.8CVE-2022-3477ExploitEPSS 5.1%

    The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to …

  36. 8.8CVE-2022-40127ExploitEPSS 86%

    A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior…

  37. 9.1CVE-2022-44727ExploitEPSS 3.2%

    The EU Cookie Law GDPR (Banner + Blocker) module before 2.1.3 for PrestaShop allows SQL Injection via a cookie ( lgcookieslaw or __lglaw ).

  38. 6.5CVE-2022-38121ExploitEPSS 4.7%

    UPSMON PRO configuration file stores user password in plaintext under public user directory. A remote attacker with general user privilege can access all users‘ and administrators' account names and passwords via this unprotected configura…

  39. 6.5CVE-2022-38120ExploitEPSS 7.7%

    UPSMON PRO’s has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to bypass authentication and access arbitrary system files.

  40. 9.8CVE-2022-3481ExploitEPSS 5.3%

    The WooCommerce Dropshipping WordPress plugin before 4.4 does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection

  41. 6.1CVE-2022-3869ExploitEPSS 1.8%

    Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2.

  42. 8.8CVE-2022-43571ExploitEPSS 19%

    In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component.

  43. 6.1CVE-2022-42749ExploitEPSS 1.3%

    CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attack…

  44. 6.1CVE-2022-42748ExploitEPSS 1.3%

    CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against X…

  45. 6.1CVE-2022-42747ExploitEPSS 1.3%

    CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS atta…

  46. 6.1CVE-2022-42746ExploitEPSS 1.4%

    CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS a…

  47. 8.8CVE-2022-3800ExploitEPSS 3.1%

    A vulnerability, which was classified as critical, has been found in IBAX go-ibax. Affected by this issue is some unknown functionality of the file /api/v2/open/rowsInfo. The manipulation of the argument table_name leads to sql injection. …

  48. 9.8CVE-2022-40471ExploitEPSS 28%

    Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload functionality in users.php

  49. 9.8CVE-2022-3254ExploitEPSS 6.6%

    The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users and when a specific premium modul…

  50. 6.1CVE-2022-2627ExploitEPSS 1.3%

    The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, leading to a Reflected Cross-Site Scripting.