cve.bz

Matching records, newest first, page 69

Filter
  1. 7.5CVE-2021-40661ExploitEPSS 6.1%

    A remote, unauthenticated, directory traversal vulnerability was identified within the web interface used by IND780 Advanced Weighing Terminals Build 8.0.07 March 19, 2018 (SS Label 'IND780_8.0.07'), Version 7.2.10 June 18, 2012 (SS Label …

  2. 6.1CVE-2022-3766ExploitEPSS 8.3%

    Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8.

  3. 5.4CVE-2022-43170ExploitEPSS 1.1%

    A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_configure/index) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a craft…

  4. 5.4CVE-2022-43169ExploitEPSS 1.2%

    A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature (/index.php?module=users_groups/users_groups) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted …

  5. 5.4CVE-2022-43167ExploitEPSS 1.2%

    A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_alerts) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload…

  6. 5.4CVE-2022-43166ExploitEPSS 1.1%

    A stored cross-site scripting (XSS) vulnerability in the Global Entities feature (/index.php?module=entities/entities) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload inje…

  7. 5.4CVE-2022-43165ExploitEPSS 1.1%

    A stored cross-site scripting (XSS) vulnerability in the Global Variables feature (/index.php?module=global_vars/vars) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload inje…

  8. 5.4CVE-2022-43164ExploitEPSS 1.1%

    A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload inject…

  9. 9.1CVE-2022-31678ExploitEPSS 9.4%

    VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information d…

  10. 7.5CVE-2022-38870ExploitEPSS 4.0%

    Free5gc v3.2.1 is vulnerable to Information disclosure.

  11. 9.8CVE-2022-38580ExploitEPSS 16%

    Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).

  12. 7.2CVE-2022-38108ExploitEPSS 67%

    SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.

  13. 9.8CVE-2022-42233ExploitEPSS 43%

    Tenda 11N with firmware version V5.07.33_cn suffers from an Authentication Bypass vulnerability.

  14. 5.4CVE-2022-41358ExploitEPSS 4.5%

    A stored cross-site scripting (XSS) vulnerability in Garage Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the categoriesName parameter in createCategories.php.

  15. 6.1CVE-2022-43018ExploitEPSS 1.8%

    OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email function.

  16. 6.1CVE-2022-43017ExploitEPSS 1.8%

    OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component.

  17. 6.1CVE-2022-43016ExploitEPSS 1.8%

    OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback component.

  18. 6.1CVE-2022-43015ExploitEPSS 1.7%

    OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the entriesPerPage parameter.

  19. 6.1CVE-2022-43014ExploitEPSS 1.7%

    OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parameter.

  20. 5.4CVE-2022-43185ExploitEPSS 1.2%

    A stored cross-site scripting (XSS) vulnerability in the Configuration/Holidays module of Rukovoditel v3.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter.

  21. 9.8CVE-2016-20017KEVExploitEPSS 66%

    D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.

  22. 9.8CVE-2016-20016ExploitEPSS 86%

    MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI. A remote unauthenticated attacker can execute arbitrary operating system commands as root. This vulnerabilit…

  23. 9.8CVE-2022-21587KEVExploitEPSS 98%

    Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attack…

  24. 9.8CVE-2022-41544ExploitEPSS 14%

    GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited_file parameter in admin/theme-edit.php.

  25. 9.8CVE-2022-40684KEVExploitEPSS >99.9%

    An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 an…

  26. 6.1CVE-2022-22242ExploitEPSS 3.4%

    A Cross-site Scripting (XSS) vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker to run malicious scripts reflected off of J-Web to the victim's browser in the context of their session withi…

  27. 7.8CVE-2022-3569ExploitEPSS 0.8%

    Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a local privilege escalation issue in versions 9.0.0 and prior, where the 'zimbra' user can effectively coerce postfix into running arbitrary co…

  28. 7.2CVE-2022-3552ExploitEPSS 44%

    Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1.

  29. 9.8CVE-2022-42149ExploitEPSS 2.7%

    kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\OnlinePreviewController.java.

  30. 9.9CVE-2022-2992ExploitEPSS 86%

    A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.

  31. 9.9CVE-2022-2884ExploitEPSS 76%

    A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint

  32. 5.4CVE-2022-3506ExploitEPSS 1.6%

    Cross-site Scripting (XSS) - Stored in GitHub repository barrykooij/related-posts-for-wp prior to 2.1.3.

  33. 6.1CVE-2022-41473ExploitEPSS 1.4%

    RPCMS v3.0.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Search function.

  34. 9.8CVE-2022-42889ExploitEPSS >99.9%

    Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.common…

  35. 7.8CVE-2022-41034ExploitEPSS 67%

    Visual Studio Code Remote Code Execution Vulnerability

  36. 5.4CVE-2022-40047ExploitEPSS 1.4%

    Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php.

  37. 7.5CVE-2022-3358ExploitEPSS 4.0%

    OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mecha…

  38. 5.4CVE-2022-39291ExploitEPSS 7.1%

    ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of zoneminder are subject to a vulnerability which allows users with "View" system permissions to inject new data into the logs stored by Z…

  39. 6.5CVE-2022-39290ExploitEPSS 7.9%

    ZoneMinder is a free, open source Closed-circuit television software application. In affected versions authenticated users can bypass CSRF keys by modifying the request supplied to the Zoneminder web application. These modifications includ…

  40. 5.4CVE-2022-39285ExploitEPSS 5.1%

    ZoneMinder is a free, open source Closed-circuit television software application The file parameter is vulnerable to a cross site scripting vulnerability (XSS) by backing out of the current "tr" "td" brackets. This then allows a malicious …

  41. 5.3CVE-2022-3124ExploitEPSS 8.3%

    The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to chang…

  42. 7.5CVE-2022-38817ExploitEPSS 3.9%

    Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data.

  43. 6.5CVE-2022-36551ExploitEPSS 6.9%

    A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Furthermore, self-registration is e…

  44. 8.0CVE-2022-41082KEVExploitEPSS >99.9%

    Microsoft Exchange Server Remote Code Execution Vulnerability

  45. 8.8CVE-2022-41040KEVExploitEPSS >99.9%

    Microsoft Exchange Server Elevation of Privilege Vulnerability

  46. 6.1CVE-2022-35155ExploitEPSS 2.6%

    Bus Pass Management System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the searchdata parameter.

  47. 6.1CVE-2022-40879ExploitEPSS 1.3%

    kkFileView v4.1.0 is vulnerable to Cross Site Scripting (XSS) via the parameter 'errorMsg.'

  48. 7.5CVE-2019-5797ExploitEPSS 3.4%

    Double free in DOMStorage in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

  49. 9.6CVE-2022-40083ExploitEPSS 3.2%

    Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF).

  50. 8.2CVE-2022-39258ExploitEPSS 1.8%

    mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place to steal Swagger a…