Export limit exceeded: 94687 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (94687 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-25323 | 1 Zerof | 1 Web Server | 2024-11-21 | 6.1 Medium |
| ZEROF Web Server 2.0 allows /admin.back XSS. | ||||
| CVE-2022-25321 | 1 Cerebrate-project | 1 Cerebrate | 2024-11-21 | 6.1 Medium |
| An issue was discovered in Cerebrate through 1.4. XSS could occur in the bookmarks component. | ||||
| CVE-2022-25317 | 1 Cerebrate-project | 1 Cerebrate | 2024-11-21 | 6.1 Medium |
| An issue was discovered in Cerebrate through 1.4. genericForm allows reflected XSS in form descriptions via a user-controlled description. | ||||
| CVE-2022-25309 | 2 Gnu, Redhat | 2 Fribidi, Enterprise Linux | 2024-11-21 | 5.5 Medium |
| A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a specially crafted file to the Fribidi application with the '--caprtl' option, leading to a crash and causing a denial of service. | ||||
| CVE-2022-25308 | 2 Gnu, Redhat | 2 Fribidi, Enterprise Linux | 2024-11-21 | 7.8 High |
| A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially crafted file to the Fribidi application, which leads to a possible memory leak or a denial of service. | ||||
| CVE-2022-25304 | 2 Asyncua Project, Opcua Project | 2 Asyncua, Opcua | 2024-11-21 | 7.5 High |
| All versions of package opcua; all versions of package asyncua are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk. | ||||
| CVE-2022-25303 | 1 Whoogle-search Project | 1 Whoogle-search | 2024-11-21 | 5.4 Medium |
| The package whoogle-search before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via the query string parameter q. In the case where it does not contain the http string, it is used to build the error_message that is then rendered in the error.html template, using the [flask.render_template](https://flask.palletsprojects.com/en/2.1.x/api/flask.render_template) function. However, the error_message is rendered using the [| safe filter](https://jinja.palletsprojects.com/en/3.1.x/templates/working-with-automatic-escaping), meaning the user input is not escaped. | ||||
| CVE-2022-25293 | 1 Watchguard | 1 Fireware | 2024-11-21 | 8.8 High |
| A systemd stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execute arbitrary code by initiating a firmware update with a malicious upgrade image. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2. | ||||
| CVE-2022-25292 | 1 Watchguard | 1 Fireware | 2024-11-21 | 8.8 High |
| A wgagent stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execute arbitrary code by initiating a firmware update with a malicious upgrade image. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2. | ||||
| CVE-2022-25269 | 1 Passwork | 1 Passwork | 2024-11-21 | 6.1 Medium |
| Passwork On-Premise Edition before 4.6.13 has multiple XSS issues. | ||||
| CVE-2022-25263 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | 9.8 Critical |
| JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. | ||||
| CVE-2022-25261 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | 6.1 Medium |
| JetBrains TeamCity before 2021.2.2 was vulnerable to reflected XSS. | ||||
| CVE-2022-25259 | 1 Jetbrains | 1 Hub | 2024-11-21 | 6.1 Medium |
| JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS. | ||||
| CVE-2022-25256 | 6 Hpe, Ibm, Linux and 3 more | 6 Hp-ux Ipfilter, Aix, Linux Kernel and 3 more | 2024-11-21 | 6.1 Medium |
| SAS Web Report Studio 4.4 allows XSS. /SASWebReportStudio/logonAndRender.do has two parameters: saspfs_request_backlabel_list and saspfs_request_backurl_list. The first one affects the content of the button placed in the top left. The second affects the page to which the user is directed after pressing the button, e.g., a malicious web page. In addition, the second parameter executes JavaScript, which means XSS is possible by adding a javascript: URL. | ||||
| CVE-2022-25238 | 1 Silverstripe | 1 Framework | 2024-11-21 | 5.4 Medium |
| Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitise_server_side contig is not set to true in project code. | ||||
| CVE-2022-25234 | 1 Omron | 1 Cx-programmer | 2024-11-21 | 7.8 High |
| Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. This vulnerability is different from CVE-2022-21124. | ||||
| CVE-2022-25231 | 1 Node-opcua Project | 1 Node-opcua | 2024-11-21 | 7.5 High |
| The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) by sending a specifically crafted OPC UA message with a special OPC UA NodeID, when the requested memory allocation exceeds the v8’s memory limit. | ||||
| CVE-2022-25229 | 1 Popcorn Time Project | 1 Popcorn Time | 2024-11-21 | 5.4 Medium |
| Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Server(s)' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands. | ||||
| CVE-2022-25224 | 1 Proton Project | 1 Proton | 2024-11-21 | 5.4 Medium |
| Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an attacker to host JavaScript code in the malicious link in order to trigger an XSS attack. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands. | ||||
| CVE-2022-25221 | 1 Money Transfer Management System Project | 1 Money Transfer Management System | 2024-11-21 | 6.1 Medium |
| Money Transfer Management System Version 1.0 allows an attacker to inject JavaScript code in the URL and then trick a user into visit the link in order to execute JavaScript code. | ||||