Export limit exceeded: 351254 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 19010 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 29923 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (29923 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2022-35521 1 Wavlink 10 Wn530h4, Wn530h4 Firmware, Wn531p3 and 7 more 2024-11-21 9.8 Critical
WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 firewall.cgi has no filtering on parameters: remoteManagementEnabled, blockPortScanEnabled, pingFrmWANFilterEnabled and blockSynFloodEnabled, which leads to command injection in page /man_security.shtml.
CVE-2022-35520 1 Wavlink 10 Wn530h4, Wn530h4 Firmware, Wn531p3 and 7 more 2024-11-21 9.8 Critical
WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 api.cgi has no filtering on parameter ufconf, and this is a hidden parameter which doesn't appear in POST body, but exist in cgi binary. This leads to command injection in page /ledonoff.shtml.
CVE-2022-35519 1 Wavlink 10 Wn530h4, Wn530h4 Firmware, Wn531p3 and 7 more 2024-11-21 9.8 Critical
WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 firewall.cgi has no filtering on parameter add_mac, which leads to command injection in page /cli_black_list.shtml.
CVE-2022-35517 1 Wavlink 10 Wn530h4, Wn530h4 Firmware, Wn531p3 and 7 more 2024-11-21 8.8 High
WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameters: web_pskValue, wl_Method, wlan_ssid, EncrypType, rwan_ip, rwan_mask, rwan_gateway, ppp_username, ppp_passwd and ppp_setver, which leads to command injection in page /wizard_router_mesh.shtml.
CVE-2022-34894 1 Jetbrains 1 Hub 2024-11-21 3.5 Low
In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services
CVE-2022-34869 1 Allied-telesis 2 Centrecom Ar260s, Centrecom Ar260s Firmware 2024-11-21 8.8 High
Undocumented hidden command that can be executed from the telnet function of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticated attacker to execute an arbitrary OS command.
CVE-2022-34635 1 Openhwgroup 1 Cva6 2024-11-21 9.8 Critical
The mstatus.sd field in CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a does not update when the mstatus.fs field is set to Dirty.
CVE-2022-34453 1 Dell 2 Xtremio X2, Xtremio X2 Firmware 2024-11-21 7.6 High
Dell XtremIO X2 XMS versions prior to 6-4-1.11 contain an improper access control vulnerability. A remote read only user could potentially exploit this vulnerability to perform add/delete QoS policies which are disabled by default.
CVE-2022-34298 1 Openidentityplatform 1 Openam 2024-11-21 5.3 Medium
The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."
CVE-2022-34175 1 Jenkins 1 Jenkins 2024-11-21 7.5 High
Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fragments containing sensitive information, bypassing any permission checks in the corresponding view.
CVE-2022-34102 1 Crestron 1 Airmedia 2024-11-21 8.8 High
Insufficient access control vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39, in which a user can pause the uninstallation of an executable to gain a SYSTEM level command prompt.
CVE-2022-34066 1 Texercise Project 1 Texercise 2024-11-21 9.8 Critical
The Texercise package in PyPI v0.0.1 to v0.0.12 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVE-2022-34065 1 Rondolu-yt-concate Project 1 Rondolu-yt-concate 2024-11-21 9.8 Critical
The Rondolu-YT-Concate package in PyPI v0.1.0 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVE-2022-34064 1 Zibal Project 1 Zibal 2024-11-21 9.8 Critical
The Zibal package in PyPI v1.0.0 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVE-2022-34061 1 Catly Translate Project 1 Catly Translate 2024-11-21 9.8 Critical
The Catly-Translate package in PyPI v0.0.3 to v0.0.5 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVE-2022-34060 1 Togglee 1 Togglee 2024-11-21 9.8 Critical
The Togglee package in PyPI version v0.0.8 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVE-2022-34059 1 Sixfab-tool Project 1 Sixfab-tool 2024-11-21 9.8 Critical
The Sixfab-Tool in PyPI v0.0.2 to v0.0.3 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVE-2022-34057 1 Scoptrial Project 1 Scoptrial 2024-11-21 9.8 Critical
The Scoptrial package in PyPI version v0.0.5 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVE-2022-33990 1 Dproxy-nexgen Project 1 Dproxy-nexgen 2024-11-21 7.5 High
Misinterpretation of special domain name characters in dproxy-nexgen (aka dproxy nexgen) leads to cache poisoning because domain names and their associated IP addresses are cached in their misinterpreted form.
CVE-2022-33932 1 Dell 1 Emc Powerscale Onefs 2024-11-21 5.3 Medium
Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain an unprotected primary channel vulnerability. An unauthenticated network malicious attacker may potentially exploit this vulnerability, leading to a denial of filesystem services.