Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (93538 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-25508 1 Freetakserver-ui Project 1 Freetakserver-ui 2024-11-21 7.5 High
An access control issue in the component /ManageRoute/postRoute of FreeTAKServer v1.9.8 allows unauthenticated attackers to cause a Denial of Service (DoS) via an unusually large amount of created routes, or create unsafe or false routes for legitimate users.
CVE-2022-25491 1 Hospital Management System Project 1 Hospital Management System 2024-11-21 7.5 High
HMS v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in appointment.php.
CVE-2022-25486 1 Cuppacms 1 Cuppacms 2024-11-21 7.8 High
CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php.
CVE-2022-25485 1 Cuppacms 1 Cuppacms 2024-11-21 7.8 High
CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php.
CVE-2022-25478 1 Realtek 2 Rtsper, Rtsuer 2024-11-21 7.8 High
Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) before 10.0.22000.31274 provides read and write access to the PCI configuration space of the device.
CVE-2022-25471 1 Open-emr 1 Openemr 2024-11-21 8.1 High
An Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zend_modules/public/Installer/register.
CVE-2022-25465 1 Espruino 1 Espruino 2024-11-21 7.8 High
Espruino 2v11 release was discovered to contain a stack buffer overflow via src/jsvar.c in jsvGetNextSibling.
CVE-2022-25462 1 Yafu Project 1 Yafu 2024-11-21 7.5 High
Yafu v2.0 contains a segmentation fault via the component /factor/avx-ecm/vecarith52.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
CVE-2022-25412 1 Max-3000 1 Maxsite Cms 2024-11-21 8.1 High
Maxsite CMS v180 was discovered to contain multiple arbitrary file deletion vulnerabilities in /admin_page/all-files-update-ajax.php via the dir and deletefile parameters.
CVE-2022-25401 1 Cuppacms 1 Cuppacms 2024-11-21 7.5 High
The copy function of the file manager in Cuppa CMS v1.0 allows any file to be copied to the current directory, granting attackers read access to arbitrary files.
CVE-2022-25393 1 Simple Bakery Shop Management Project 1 Simple Bakery Shop Management 2024-11-21 7.5 High
Simple Bakery Shop Management v1.0 was discovered to contain a SQL injection vulnerability via the username parameter.
CVE-2022-25389 1 Dcnglobal 2 Dcme-520, Dcme-520 Firmware 2024-11-21 7.5 High
DCN Firewall DCME-520 was discovered to contain an arbitrary file download vulnerability via the path parameter in the file /audit/log/log_management.php.
CVE-2022-25374 1 Hashicorp 1 Terraform Enterprise 2024-11-21 7.5 High
HashiCorp Terraform Enterprise v202112-1, v202112-2, v202201-1, and v202201-2 were configured to log inbound HTTP requests in a manner that may capture sensitive data. Fixed in v202202-1.
CVE-2022-25372 2 Microsoft, Pritunl 2 Windows, Pritunl-client-electron 2024-11-21 7.8 High
Pritunl Client through 1.2.3019.52 on Windows allows local privilege escalation, related to an ACL entry for CREATOR OWNER in platform_windows.go.
CVE-2022-25366 1 Cryptomator 1 Cryptomator 2024-11-21 7.8 High
Cryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables entitlements. An attacker can exploit this by creating a malicious .dylib file that can be executed via the DYLD_INSERT_LIBRARIES environment variable.
CVE-2022-25365 2 Docker, Microsoft 2 Docker, Windows 2024-11-21 7.8 High
Docker Desktop before 4.5.1 on Windows allows attackers to move arbitrary files. NOTE: this issue exists because of an incomplete fix for CVE-2022-23774.
CVE-2022-25364 1 Gradle 1 Enterprise 2024-11-21 8.1 High
In Gradle Enterprise before 2021.4.2, the default built-in build cache configuration allowed anonymous write access. If this was not manually changed, a malicious actor with network access to the build cache could potentially populate it with manipulated entries that execute malicious code as part of a build. As of 2021.4.2, the built-in build cache is inaccessible-by-default, requiring explicit configuration of its access-control settings before it can be used. (Remote build cache nodes are unaffected as they are inaccessible-by-default.)
CVE-2022-25360 1 Watchguard 1 Fireware 2024-11-21 8.8 High
WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to upload files to arbitrary locations. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.
CVE-2022-25354 1 Set-in Project 1 Set-in 2024-11-21 8.6 High
The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https://security.snyk.io/vuln/SNYK-JS-SETIN-1048049)
CVE-2022-25352 1 Libnested Project 1 Libnested 2024-11-21 7.5 High
The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. **Note:** This vulnerability derives from an incomplete fix for [CVE-2020-28283](https://security.snyk.io/vuln/SNYK-JS-LIBNESTED-1054930)