Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (42958 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-31301 1 Angtech 1 Haraj 2024-11-21 5.4 Medium
Haraj v3.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Post Ads component.
CVE-2022-31300 1 Angtech 1 Haraj 2024-11-21 5.4 Medium
A cross-site scripting vulnerability in the DM Section component of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.
CVE-2022-31299 1 Angtech 1 Haraj 2024-11-21 6.1 Medium
Haraj v3.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the User Upgrade Form.
CVE-2022-31298 1 Angtech 1 Haraj 2024-11-21 5.4 Medium
A cross-site scripting vulnerability in the ads comment section of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.
CVE-2022-31290 1 Withknown 1 Known 2024-11-21 5.4 Medium
A cross-site scripting (XSS) vulnerability in Known v1.2.2+2020061101 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Your Name text field.
CVE-2022-31269 1 Nortekcontrol 2 Emerge E3, Emerge E3 Firmware 2024-11-21 8.2 High
Nortek Linear eMerge E3-Series devices through 0.32-09c place admin credentials in /test.txt that allow an attacker to open a building's doors. (This occurs in situations where the CVE-2019-7271 default credentials have been changed.)
CVE-2022-31210 1 Infiray 2 Iray-a8z3, Iray-a8z3 Firmware 2024-11-21 9.8 Critical
An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The binary file /usr/local/sbin/webproject/set_param.cgi contains hardcoded credentials to the web application. Because these accounts cannot be deactivated or have their passwords changed, they are considered to be backdoor accounts.
CVE-2022-31201 1 Monitoringsoft 1 Softguard Web 2024-11-21 5.4 Medium
SoftGuard Web (SGW) before 5.1.5 allows HTML injection.
CVE-2022-31200 1 Atmail 1 Atmail 2024-11-21 6.1 Medium
Atmail 5.62 allows XSS via the mail/parse.php?file=html/$this-%3ELanguage/help/filexp.html&FirstLoad=1&HelpFile=file.html Search Terms field.
CVE-2022-30997 1 Yokogawa 4 Stardom Fcj, Stardom Fcj Firmware, Stardom Fcn and 1 more 2024-11-21 7.2 High
Use of hard-coded credentials vulnerability exists in STARDOM FCN Controller and FCJ Controller R4.10 to R4.31, which may allow an attacker with an administrative privilege to read/change configuration settings or update the controller with tampered firmware.
CVE-2022-30991 3 Acronis, Linux, Microsoft 3 Cyber Protect, Linux Kernel, Windows 2024-11-21 6.1 Medium
HTML injection via report name. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240
CVE-2022-30982 1 Gentics 1 Gentics Cms 2024-11-21 5.4 Medium
An issue was discovered in Gentics CMS before 5.43.1. There is stored XSS in the profile description and in the username.
CVE-2022-30970 1 Jenkins 1 Autocomplete Parameter 2024-11-21 5.4 Medium
Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsafe manner from Javascript embedded in view definitions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-30968 1 Jenkins 1 Vboxwrapper 2024-11-21 5.4 Medium
Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-30967 1 Jenkins 1 Selection Tasks 2024-11-21 5.4 Medium
Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-30965 1 Jenkins 1 Promoted Builds 2024-11-21 5.4 Medium
Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-30964 1 Jenkins 1 Multiselect Parameter 2024-11-21 5.4 Medium
Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-30963 1 Jenkins 1 Jdk Parameter 2024-11-21 5.4 Medium
Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-30962 1 Jenkins 1 Global Variable String Parameter 2024-11-21 5.4 Medium
Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-30961 1 Jenkins 1 Autocomplete Parameter 2024-11-21 5.4 Medium
Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.