Export limit exceeded: 17086 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425852 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,499

Export CSV
CVE-2022-3735

seccome Ehoney signup access control

A vulnerability was found in seccome Ehoney. It has been rated as critical. This issue affects some unknown processing of the file /api/public/signup. The manipulation leads to improper access controls. The identifier VDB-212417 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ehoney Project
Products
Ehoney
CVE-2022-3770

Yunjing CMS upload_img.html unrestricted upload

A vulnerability classified as critical was found in Yunjing CMS. This vulnerability affects unknown code of the file /index/user/upload_img.html. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212500.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Xjyunjing
Products
Yunjing Content Management System
CVE-2022-3771

easyii CMS File Upload Management Upload.php file unrestricted upload

A vulnerability, which was classified as critical, has been found in easyii CMS. This issue affects the function file of the file helpers/Upload.php of the component File Upload Management. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The identifier VDB-212501 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Easyiicms
Products
Easyiicms
CVE-2022-3826

Huaxia ERP Retail Management list information disclosure

A vulnerability was found in Huaxia ERP. It has been classified as problematic. This affects an unknown part of the file /depotHead/list of the component Retail Management. The manipulation of the argument search leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212793 was assigned to this vulnerability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Huaxiaerp
Products
Huaxia Erp
CVE-2022-3944

jerryhanjj ERP Commodity Management inventory.php uploadImages unrestricted upload

A vulnerability was found in jerryhanjj ERP. It has been declared as critical. Affected by this vulnerability is the function uploadImages of the file application/controllers/basedata/inventory.php of the component Commodity Management. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-213451.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Erp Project
Products
Erp
CVE-2022-4272

FeMiner wms unrestricted upload

A vulnerability, which was classified as critical, has been found in FeMiner wms. Affected by this issue is some unknown functionality of the file /product/savenewproduct.php?flag=1. The manipulation of the argument upfile leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214760.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Warehouse Management System Project
Products
Warehouse Management System
CVE-2022-4276

House Rental System POST Request tenant-engine.php unrestricted upload

A vulnerability was found in House Rental System and classified as critical. Affected by this issue is some unknown functionality of the file tenant-engine.php of the component POST Request Handler. The manipulation of the argument id_photo leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214772.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
House Rental System Project
Products
House Rental System
CVE-2022-4280

Dot Tech Smart Campus System findUser information disclosure

A vulnerability, which was classified as problematic, has been found in Dot Tech Smart Campus System. Affected by this issue is some unknown functionality of the file /services/Card/findUser. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-214778 is the identifier assigned to this vulnerability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dottech
Products
Smart Campus System
CVE-2022-4281

Facepay camera.php authorization

A vulnerability has been found in Facepay 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /face-recognition-php/facepay-master/camera.php. The manipulation of the argument userId leads to authorization bypass. The attack can be launched remotely. The identifier VDB-214789 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Facepay Project
Products
Facepay
CVE-2022-3876

Click Studios Passwordstate API authorization

A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This issue affects some unknown processing of the file /api/browserextension/UpdatePassword/ of the component API. The manipulation of the argument PasswordID leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier VDB-216245 was assigned to this vulnerability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Clickstudios
Products
Passwordstate
CVE-2022-4613

Click Studios Passwordstate Browser Extension Provisioning improper authorization

A vulnerability was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as critical. This issue affects some unknown processing of the component Browser Extension Provisioning. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216275.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Clickstudios
Products
Passwordstate
CVE-2014-3534

kernel: s390: ptrace: insufficient sanitization when setting psw mask

arch/s390/kernel/ptrace.c in the Linux kernel before 3.15.8 on the s390 platform does not properly restrict address-space control operations in PTRACE_POKEUSR_AREA requests, which allows local users to obtain read and write access to kernel memory locations, and consequently gain privileges, via a crafted application that makes a ptrace system call.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux
CVE-2016-2066

kernel: integer signedness error in the MSM QDSP6 audio driver

Integer signedness error in the MSM QDSP6 audio driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service (memory corruption) via a crafted application that makes an ioctl call.

CVSS 3.1 · 7.8 High EPSS 1.4% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2014-3558

Validator: JSM bypass via ReflectionHelper

ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager (JSM) restrictions and execute restricted reflection calls via a crafted application.

CVSS 2.0 · 5.0 Medium EPSS 2.9% KEV · Not listed
Vendors
Redhat
Products
Hibernate Validator Jboss Bpms Jboss Brms and 3 more
CVE-2015-3235

foreman: edit_users permission allows changing of admin passwords

Foreman before 1.9.0 allows remote authenticated users with the edit_users permission to edit administrator users and change their passwords via unspecified vectors.

CVSS 2.0 · 6.0 Medium EPSS 1.6% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2016-3857

kernel: privilege escalation in sys_oabi_*() in arm kernel

The kernel in Android before 2016-08-05 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application, aka internal bug 28522518.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2014-3086

JDK: Privilege escalation issue

Unspecified vulnerability in the IBM Java Virtual Machine, as used in IBM WebSphere Real Time 3 before Service Refresh 7 FP1 and other products, allows remote attackers to gain privileges by leveraging the ability to execute code in the context of a security manager.

CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Ibm Redhat
Products
Lotus Domino Lotus Notes Websphere Real Time and 2 more
CVE-2014-3499

docker: systemd socket activation results in privilege escalation

Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Docker Fedoraproject Redhat
Products
Docker Fedora Rhel Extras Other
CVE-2013-4342

xinetd: ignores user and group directives for tcpmux services

xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes these services to be run as root and makes it easier for remote attackers to gain privileges by leveraging another vulnerability in a service.

CVSS 2.0 · 7.6 High EPSS 6.4% KEV · Not listed
Vendors
Redhat Xinetd
Products
Enterprise Linux Xinetd