Export limit exceeded: 40800 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (40800 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-1935 | 1 Gitlab | 1 Gitlab | 2024-11-21 | 6.5 Medium |
| Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1 allowed an attacker already in possession of a valid Project Trigger Token to misuse it from any location even when IP address restrictions were configured | ||||
| CVE-2022-1931 | 1 Trudesk Project | 1 Trudesk | 2024-11-21 | 8.1 High |
| Incorrect Synchronization in GitHub repository polonel/trudesk prior to 1.2.3. | ||||
| CVE-2022-1905 | 1 E-dynamics | 1 Events Made Easy | 2024-11-21 | 9.8 Critical |
| The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection | ||||
| CVE-2022-1903 | 1 Armemberplugin | 1 Armember | 2024-11-21 | 8.1 High |
| The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username | ||||
| CVE-2022-1883 | 1 Camptocamp | 1 Terraboard | 2024-11-21 | 8.8 High |
| SQL Injection in GitHub repository camptocamp/terraboard prior to 2.2.0. | ||||
| CVE-2022-1869 | 1 Google | 1 Chrome | 2024-11-21 | 6.5 Medium |
| Type Confusion in V8 in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||||
| CVE-2022-1848 | 1 Erudika | 1 Para | 2024-11-21 | 5.3 Medium |
| Business Logic Errors in GitHub repository erudika/para prior to 1.45.11. | ||||
| CVE-2022-1809 | 1 Radare | 1 Radare2 | 2024-11-21 | 7.8 High |
| Access of Uninitialized Pointer in GitHub repository radareorg/radare2 prior to 5.7.0. | ||||
| CVE-2022-1801 | 1 Very Simple Contact Form Project | 1 Very Simple Contact Form | 2024-11-21 | 7.5 High |
| The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden input fields and as plain text in the page, making it very easy for bots to bypass the captcha check, rendering the page a likely target for spam bots. | ||||
| CVE-2022-1800 | 1 Soflyy | 1 Export Any Wordpress Data To Xml\/csv | 2024-11-21 | 7.2 High |
| The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data before using it in a database query, leading to an SQL injection vulnerability. | ||||
| CVE-2022-1786 | 2 Linux, Netapp | 11 Linux Kernel, H300s, H300s Firmware and 8 more | 2024-11-21 | 7.8 High |
| A use-after-free flaw was found in the Linux kernel’s io_uring subsystem in the way a user sets up a ring with IORING_SETUP_IOPOLL with more than one task completing submissions on this ring. This flaw allows a local user to crash or escalate their privileges on the system. | ||||
| CVE-2022-1777 | 1 Filr Project | 1 Filr | 2024-11-21 | 8.8 High |
| The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any authenticated users, such as subscriber. They are are protected with a nonce, however the nonce is leaked on the dashboard. This could allow them to upload arbitrary HTML files as well as delete all files or arbitrary ones. | ||||
| CVE-2022-1731 | 1 Allgeier | 1 Metasonic Doc Webclient | 2024-11-21 | 9.8 Critical |
| Metasonic Doc WebClient 7.0.14.0 / 7.0.12.0 / 7.0.3.0 is vulnerable to a SQL injection attack in the username field. SSO or System authentication are required to be enabled for vulnerable conditions to exist. | ||||
| CVE-2022-1706 | 2 Fedoraproject, Redhat | 5 Fedora, Enterprise Linux, Ignition and 2 more | 2024-11-21 | 6.5 Medium |
| A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets. The highest threat from this vulnerability is to data confidentiality. Possible workaround is to not put secrets in the Ignition config. | ||||
| CVE-2022-1692 | 1 Dwbooster | 1 Cp Image Store With Slideshow | 2024-11-21 | 9.8 Critical |
| The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embed, allowing unauthenticated users to perform an SQL injection attack | ||||
| CVE-2022-1691 | 1 Realtyworkstation | 1 Realty Workstation | 2024-11-21 | 4.9 Medium |
| The Realty Workstation WordPress plugin before 1.0.15 does not sanitise and escape the trans_edit parameter before using it in a SQL statement when an agent edit a transaction, leading to an SQL injection | ||||
| CVE-2022-1690 | 1 Datainterlock | 1 Note Press | 2024-11-21 | 2.7 Low |
| The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the ids from the bulk actions before using them in a SQL statement in an admin page, leading to an SQL injection | ||||
| CVE-2022-1689 | 1 Datainterlock | 1 Note Press | 2024-11-21 | 2.7 Low |
| The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the Update parameter before using it in a SQL statement when updating a note via the admin dashboard, leading to an SQL injection | ||||
| CVE-2022-1688 | 1 Datainterlock | 1 Note Press | 2024-11-21 | 2.7 Low |
| The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the id parameter before using it in various SQL statement via the admin dashboard, leading to SQL Injections | ||||
| CVE-2022-1687 | 1 Logo Slider Project | 1 Logo Slider | 2024-11-21 | 2.7 Low |
| The Logo Slider WordPress plugin through 1.4.8 does not sanitise and escape the lsp_slider_id parameter before using it in a SQL statement via the Manage Slider Images admin page, leading to an SQL Injection | ||||