35,538 results · Clear filters · Feed
-
Unscored —CVE-2022-29727 Public exploit
Survey Sparrow Enterprise Survey Software 2022 has a Stored cross-site scripting (XSS) vulnerability in the Signup para…
-
Unscored —CVE-2022-28601 Public exploit
A Two-Factor Authentication (2FA) bypass vulnerability in "Simple 2FA Plugin for Moodle" by LMS Doctor allows remote at…
-
High 8.8
Visual Studio Code Remote Code Execution Vulnerability
Visual Studio Code Remote Code Execution Vulnerability
-
High 7.5CVE-2022-29117 Public exploit
.NET and Visual Studio Denial of Service Vulnerability
.NET and Visual Studio Denial of Service Vulnerability
-
Critical 9.8
Windows Network File System Remote Code Execution Vulnerability
Windows Network File System Remote Code Execution Vulnerability
-
High 8.8CVE-2022-26927 Public exploit
Windows Graphics Component Remote Code Execution Vulnerability
Windows Graphics Component Remote Code Execution Vulnerability
-
High 8.8
Active Directory Domain Services Elevation of Privilege Vulnerability
Active Directory Domain Services Elevation of Privilege Vulnerability
KEV Aug 18, 2022 -
High 8.1
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
-
Unscored —CVE-2022-20120 Public exploit
Product: AndroidVersions: Android kernelAndroid ID: A-203213034References: N/A
-
Unscored —CVE-2022-20009 Public exploit
In various functions of the USB gadget subsystem, there is a possible out of bounds write due to a missing bounds check…
-
Unscored —CVE-2022-20007 Public exploit
In startActivityForAttachedApplicationIfNeeded of RootWindowContainer.java, there is a possible way to overlay an app t…
-
Unscored —CVE-2022-20005 Public exploit
In validateApkInstallLocked of PackageInstallerSession.java, there is a way to force a mismatch between running code an…
-
Unscored —CVE-2022-20004 Public exploit
In checkSlicePermission of SliceManagerService.java, it is possible to access any slice URI due to improper input valid…
-
Unscored —CVE-2021-39670 Public exploit
In setStream of WallpaperManager.java, there is a possible way to cause a permanent DoS due to improper input validatio…
-
High 7.5
Metform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information Disclosure
The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attacker to view all API keys and secrets of integrated third-party …
-
Unscored —CVE-2022-28986 Public exploit
LMS Doctor Simple 2 Factor Authentication Plugin For Moodle Affected: 2021072900 has an Insecure direct object referenc…
-
Unscored —CVE-2022-28906 Public exploit
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the langtype parame…
-
Unscored —CVE-2022-30524 Public exploit
There is an invalid memory access in the TextLine class in TextOutputDev.cc in Xpdf 4.0.4 because the text extractor mi…
-
Unscored —CVE-2022-27412 Public exploit
Explore CMS v1.0 was discovered to contain a SQL injection vulnerability via a /page.php?id= request.
-
Unscored —CVE-2022-27308 Public exploit
A stored cross-site scripting (XSS) vulnerability in PHProjekt PhpSimplyGest v1.3.0 allows attackers to execute arbitra…
-
Unscored —
Popup Maker < 1.16.5 - Admin+ Stored Cross-Site Scripting
The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
-
Medium 6.8CVE-2022-1631 Public exploit
Users Account Pre-Takeover or Users Account Takeover. in microweber/microweber
Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no email confirmation, an attacker can easily create an account in the application using the Victim’s E…
-
Unscored —
pyscriptjs (aka PyScript Demonstrator) in PyScript through 2022-05-04 allows a remote user to read Python source code.
-
Critical 9.8
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) …
KEV Aug 9, 2022 -
Critical 9.8
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 1…
KEV May 10, 2022 -
Unscored —
Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter.
-
Unscored —
College Management System v1.0 was discovered to contain a SQL injection vulnerability via the course_code parameter.
-
Unscored —CVE-2021-42183 Public exploit
MasaCMS 7.2.1 is affected by a path traversal vulnerability in /index.cfm/_api/asset/image/.
-
Unscored —CVE-2021-45783 Public exploit
Bookeen Notea Firmware BK_R_1.0.5_20210608 is affected by a directory traversal vulnerability that allows an attacker t…
-
Critical 9.4CVE-2022-1592 Public exploit
Server-Side Request Forgery in scout in clinical-genomics/scout
Server-Side Request Forgery in scout in GitHub repository clinical-genomics/scout prior to v4.42. An attacker could make the application perform arbitrary requests to fishing steal cookie, request to private area, or lead to xss...
-
High 8.1CVE-2022-24903 Public exploit
Buffer overflow in TCP syslog server (receiver) components in rsyslog
Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. This can result in a segfault or some other malfunction. As of our understanding, this vulnerability…
-
Unscored —CVE-2022-30292 Public exploit
Heap-based buffer overflow in sqbaselib.cpp in SQUIRREL 3.2 due to lack of a certain sq_reservestack call.
-
Medium 6.1
MantisBT vulnerable to XSS via unescaped output in browser_search_plugin.php
An XSS issue was discovered in browser_search_plugin.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.
-
Unscored —CVE-2022-28099 Public exploit
Poultry Farm Management System v1.0 was discovered to contain a SQL injection vulnerability via the Item parameter at /…
-
Unscored —
A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.19…
-
Unscored —CVE-2022-27413 Public exploit
Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the adminname parameter in …
-
Critical 9.8
The c_rehash script allows command injection
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitra…
-
Unscored —
A Remote Code Execution (RCE) vulnerability exists in Pixelimity 1.0 via admin/admin-ajax.php?action=install_theme.
-
Unscored —
MitraStar GPT-2541GNAC-N1 (HGU) 100VNZ0b33 devices allow remote authenticated users to obtain root access by executing …
-
Critical 9.8CVE-2022-28118 Public exploit
RCE in SiteServer CMS
SiteServer CMS v7.x allows attackers to execute arbitrary code via a crafted plug-in.