Export limit exceeded: 10754 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (10754 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-30670 | 2 Adobe, Microsoft | 2 Robohelp Server, Windows | 2024-11-21 | 8.8 High |
| RoboHelp Server earlier versions than RHS 11 Update 3 are affected by an Improper Authorization vulnerability which could lead to privilege escalation. An authenticated attacker could leverage this vulnerability to achieve full administrator privileges. Exploitation of this issue does not require user interaction. | ||||
| CVE-2022-30624 | 1 Chcnav | 2 P5e Gnss, P5e Gnss Firmware | 2024-11-21 | 6.8 Medium |
| Browsing the admin.html page allows the user to reset the admin password. Also appears in the JS code for the password. | ||||
| CVE-2022-30623 | 1 Chcnav | 2 P5e Gnss, P5e Gnss Firmware | 2024-11-21 | 5.9 Medium |
| The server checks the user's cookie in a non-standard way, and a value is entered in the cookie value name of the status and its value is set to true to bypass the identification with the system using a username and password. | ||||
| CVE-2022-30270 | 1 Motorola | 2 Ace1000, Ace1000 Firmware | 2024-11-21 | 9.8 Critical |
| The Motorola ACE1000 RTU through 2022-05-02 has default credentials. It exposes an SSH interface on port 22/TCP. This interface is used for remote maintenance and for SFTP file-transfer operations that are part of engineering software functionality. Access to this interface is controlled by 5 preconfigured accounts (root, abuilder, acelogin, cappl, ace), all of which come with default credentials. Although the ACE1000 documentation mentions the root, abuilder and acelogin accounts and instructs users to change the default credentials, the cappl and ace accounts remain undocumented and thus are unlikely to have their credentials changed. | ||||
| CVE-2022-30238 | 1 Schneider-electric | 4 Wiser Smart Eer21000, Wiser Smart Eer21000 Firmware, Wiser Smart Eer21001 and 1 more | 2024-11-21 | 8.3 High |
| A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to take over the admin account when an attacker hijacks a session. Affected Products: Wiser Smart, EER21000 & EER21001 (V4.5 and prior) | ||||
| CVE-2022-30034 | 1 Flower Project | 1 Flower | 2024-11-21 | 8.6 High |
| Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes. | ||||
| CVE-2022-2901 | 1 Chatwoot | 1 Chatwoot | 2024-11-21 | 7.1 High |
| Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8. | ||||
| CVE-2022-2787 | 1 Debian | 2 Debian Linux, Schroot | 2024-11-21 | 4.3 Medium |
| Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session. | ||||
| CVE-2022-2675 | 1 Unitree | 2 Go 1, Go 1 Firmware | 2024-11-21 | 6.5 Medium |
| Using off-the-shelf commodity hardware, the Unitree Go 1 robotics platform version H0.1.7 and H0.1.9 (using firmware version 0.1.35) can be powered down by an attacker within normal RF range without authentication. Other versions may be affected, such as the A1. | ||||
| CVE-2022-2631 | 1 Tooljet | 1 Tooljet | 2024-11-21 | 8.8 High |
| Improper Access Control in GitHub repository tooljet/tooljet prior to v1.19.0. | ||||
| CVE-2022-2595 | 1 Kromit | 1 Titra | 2024-11-21 | 10.0 Critical |
| Improper Authorization in GitHub repository kromitgmbh/titra prior to 0.79.1. | ||||
| CVE-2022-2553 | 4 Clusterlabs, Debian, Fedoraproject and 1 more | 5 Booth, Debian Linux, Fedora and 2 more | 2024-11-21 | 6.5 Medium |
| The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster. | ||||
| CVE-2022-2393 | 2 Pki-core Project, Redhat | 4 Pki-core, Certificate System, Enterprise Linux and 1 more | 2024-11-21 | 5.7 Medium |
| A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled. This flaw allows an authenticated attacker on the adjacent network to impersonate another user within the scope of the domain, but they would not be able to decrypt message content. | ||||
| CVE-2022-2303 | 1 Gitlab | 1 Gitlab | 2024-11-21 | 4.3 Medium |
| An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for group members to bypass 2FA enforcement enabled at the group level by using Resource Owner Password Credentials grant to obtain an access token without using 2FA. | ||||
| CVE-2022-2302 | 1 Lenze | 6 C520, C520 Firmware, C550 and 3 more | 2024-11-21 | 9.8 Critical |
| Multiple Lenze products of the cabinet series skip the password verification upon second login. After a user has been logged on to the device once, a remote attacker can get full access without knowledge of the password. | ||||
| CVE-2022-2225 | 1 Cloudflare | 1 Warp | 2024-11-21 | 8.1 High |
| By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to bypass configured Zero Trust security policies (e.g. Secure Web Gateway policies) and features such as 'Lock WARP switch'. | ||||
| CVE-2022-2193 | 1 Hypr | 1 Hypr Server | 2024-11-21 | 7.5 High |
| Insecure Direct Object Reference vulnerability in HYPR Server before version 6.14.1 allows remote authenticated attackers to add a FIDO2 authenticator to arbitrary accounts via parameter tampering in the Device Manager page. This issue affects: HYPR Server versions prior to 6.14.1. | ||||
| CVE-2022-2133 | 1 Miniorange | 1 Oauth Single Sign On | 2024-11-21 | 5.3 Medium |
| The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address. | ||||
| CVE-2022-2031 | 1 Samba | 1 Samba | 2024-11-21 | 8.8 High |
| A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password, can exploit this flaw to obtain and use tickets to other services. | ||||
| CVE-2022-29865 | 1 Opcfoundation | 1 Ua .net Standard Stack | 2024-11-21 | 7.5 High |
| OPC UA .NET Standard Stack allows a remote attacker to bypass the application authentication check via crafted fake credentials. | ||||