CVE Vulnerability Database
Search and browse 394,627 CVE records with CVSS scores, EPSS exploit predictions, CISA KEV status and whether the Vulnix engine has a detection for them.
25,073 records from 2022Clear filters
- CVE-2022-48194High 8.8Dec 30, 2022TP-Link TL-WR902AC devices through V3 0.9.1 allow remote authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) by uploading a crafted firmware update because the signature check is inadequate.
- CVE-2022-44137High 7.2Dec 30, 2022SourceCodester Sanitization Management System 1.0 is vulnerable to SQL Injection.
- CVE-2022-36437Critical 9.1Dec 29, 2022The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.
- CVE-2022-30519Medium 6.1Dec 29, 2022XSS in signing form in Reprise Software RLM License Administration v14.2BL4 allows remote attacker to inject arbitrary code via password field.
- CVE-2022-38212High 7.5Dec 29, 2022Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38203.
- CVE-2022-38211High 7.5Dec 29, 2022Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.9.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38212.
- CVE-2022-38210Medium 6.1Dec 29, 2022There is a reflected HTML injection vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below that may allow a remote, unauthenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser.
- CVE-2022-38209Medium 6.1Dec 29, 2022There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could execute arbitrary JavaScript code in the victim’s browser.
- CVE-2022-38208Medium 6.1Dec 29, 2022There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.
- CVE-2022-38207Medium 6.1Dec 29, 2022There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and 10.7.1 which may allow a remote remote, unauthenticated attacker to create a crafted link which when clicked which could execute arbitrary JavaScript code in the victim’s browser.
- CVE-2022-38206Medium 6.1Dec 29, 2022There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote remote, unauthenticated attacker to create a crafted link which when clicked could execute arbitrary JavaScript code in the victim’s browser.
- CVE-2022-38205High 7.5Dec 29, 2022In some non-default installations of Esri Portal for ArcGIS versions 10.9.1 and below, a directory traversal issue may allow a remote, unauthenticated attacker to traverse the file system and lead to the disclosure of sensitive data (not customer-published content).
- CVE-2022-38204Medium 6.1Dec 29, 2022There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and 10.7.1 which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.
- CVE-2022-38203High 7.5Dec 29, 2022Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38212.
- CVE-2022-46181Medium 5.4Dec 29, 2022Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Versions prior to 2.2.2 contain an XSS vulnerability that allows authenticated users to upload .html files. An attacker could execute client side scripts **if** another user opened a link. The attacker could potentially take over the account of the user that clicked the link. The Gotify UI won't natively expose such a malicious link, so an attacker has to get the user to open the malicious link in a context outside of Gotify. The vulnerability has been fixed in version 2.2.2. As a workaround, you can block access to non image files via a reverse proxy in the `./image` directory.
- CVE-2022-46178High 8.8Dec 29, 2022MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.1 allow users to upload a file, but do not validate the file name, which may lead to upload file to any path. The vulnerability has been fixed in v2.5.1. There are no workarounds.
- CVE-2022-4851Medium 5.3Dec 29, 2022Improper Handling of Values in GitHub repository usememos/memos prior to 0.9.1.
- CVE-2022-4850Medium 6.5Dec 29, 2022Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
- CVE-2022-4849Medium 6.5Dec 29, 2022Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
- CVE-2022-4848Medium 5.7Dec 29, 2022Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
- CVE-2022-4847Medium 6.5Dec 29, 2022Incorrectly Specified Destination in a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
- CVE-2022-4846Medium 6.5Dec 29, 2022Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
- CVE-2022-4845Medium 4.3Dec 29, 2022Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
- CVE-2022-4844High 8.8Dec 29, 2022Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
- CVE-2022-4843High 7.5Dec 29, 2022NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.8.2.