Export limit exceeded: 16664 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 47335 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (47335 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-27341 | 1 Jfinalcms Project | 1 Jfinalcms | 2024-11-21 | 9.8 Critical |
| JFinalCMS v2.0 was discovered to contain a SQL injection vulnerability via the Article Management function. | ||||
| CVE-2022-27299 | 1 Hospital Management System Project | 1 Hospital Management System | 2024-11-21 | 9.8 Critical |
| Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the component room.php. | ||||
| CVE-2022-27215 | 1 Jenkins | 1 Release Helper | 2024-11-21 | 4.3 Medium |
| A missing permission check in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials. | ||||
| CVE-2022-27211 | 1 Jenkins | 1 Kubernetes Continuous Deploy | 2024-11-21 | 6.5 Medium |
| A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | ||||
| CVE-2022-27209 | 1 Jenkins | 1 Kubernetes Continuous Deploy | 2024-11-21 | 6.5 Medium |
| A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | ||||
| CVE-2022-27205 | 1 Jenkins | 1 Extended Choice Parameter | 2024-11-21 | 4.3 Medium |
| A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. | ||||
| CVE-2022-27199 | 1 Jenkins | 1 Cloudbees Aws Credentials | 2024-11-21 | 4.3 Medium |
| A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token. | ||||
| CVE-2022-27165 | 1 Cszcms | 1 Csz Cms | 2024-11-21 | 9.8 Critical |
| CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Plugin_manager_setstatus | ||||
| CVE-2022-27164 | 1 Cszcms | 1 Csz Cms | 2024-11-21 | 9.8 Critical |
| CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_viewUsers | ||||
| CVE-2022-27163 | 1 Cszcms | 1 Csz Cms | 2024-11-21 | 9.8 Critical |
| CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_editUser | ||||
| CVE-2022-27162 | 1 Cszcms | 1 Csz Cms | 2024-11-21 | 9.8 Critical |
| CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Members_editUser | ||||
| CVE-2022-27161 | 1 Cszcms | 1 Csz Cms | 2024-11-21 | 9.8 Critical |
| Csz Cms 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Members_viewUsers | ||||
| CVE-2022-27134 | 1 B1 | 1 Eosio Batdappboomx | 2024-11-21 | 7.5 High |
| EOSIO batdappboomx v327c04cf has an Access-control vulnerability in the `transfer` function of the smart contract which allows remote attackers to win the cryptocurrency without paying ticket fee via the `std::string memo` parameter. | ||||
| CVE-2022-27127 | 1 Zbzcms | 1 Zbzcms | 2024-11-21 | 6.5 Medium |
| zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php/ajax.php. | ||||
| CVE-2022-27126 | 1 Zbzcms | 1 Zbzcms | 2024-11-21 | 9.8 Critical |
| zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php. | ||||
| CVE-2022-27123 | 1 Employee Performance Evaluation Project | 1 Employee Performance Evaluation | 2024-11-21 | 9.8 Critical |
| Employee Performance Evaluation v1.0 was discovered to contain a SQL injection vulnerability via the email parameter. | ||||
| CVE-2022-27104 | 1 Formalms | 1 Formalms | 2024-11-21 | 9.8 Critical |
| An Unauthenticated time-based blind SQL injection vulnerability exists in Forma LMS prior to v.1.4.3. | ||||
| CVE-2022-27055 | 1 Ecjia | 1 Daojia | 2024-11-21 | 7.5 High |
| ecjia-daojia 1.38.1-20210202629 is vulnerable to information leakage via content/apps/installer/classes/Helper.php. When the web program is installed, a new environment file is created, and the database information is recorded, including the database record password. NOTE: the vendor disputes this because the environment file is in the data directory, which is not intended for access by website visitors (only the statics directory can be accessed by website visitors) | ||||
| CVE-2022-27041 | 1 Os4ed | 1 Opensis | 2024-11-21 | 7.5 High |
| Due to lack of protection, parameter student_id in OpenSIS Classic 8.0 /modules/eligibility/Student.php can be used to inject SQL queries to extract information from databases. | ||||
| CVE-2022-26986 | 1 Impresscms | 1 Impresscms | 2024-11-21 | 7.2 High |
| SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the database used by the application. If misconfigured, an attacker can even upload a malicious web shell to compromise the entire system. | ||||