CVE Arsenal Intel

CVE-2022-42149

Software Genérico General ⚡ nuclei

9.8

CRITICAL

EPSS

42.8%

2022 0 PoCs

kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\OnlinePreviewController.java.

nuclei -t CVE-2022-42149.yaml ⎘

🔍 GCVE ⚔ EDB

CVE-2022-29303

🔥 KEV Software Genérico Web ⚡ nuclei

9.8

CRITICAL

EPSS

94.4%

2022 5 PoCs

SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.

nuclei -t CVE-2022-29303.yaml ⎘

↗ PoC 1 ↗ PoC 2 ↗ PoC 3 ↗ PoC 4 ↗ PoC 5 🔍 GCVE ⚔ EDB

CVE-2022-22954

🔥 KEV VMware Workspace ONE Access and Identity Manager General ⚡ nuclei

9.8

CRITICAL

EPSS

94.4%

2022 36 PoCs

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.

nuclei -t CVE-2022-22954.yaml ⎘

↗ PoC 1 ↗ PoC 2 ↗ PoC 3 ↗ PoC 4 ↗ PoC 5 ↗ PoC 6 +30 más 🔍 GCVE ⚔ EDB

CVE-2022-24627

Software Genérico Web Database ⚡ nuclei

9.8

CRITICAL

EPSS

48.7%

2022 0 PoCs

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL injection in the p parameter of the process_login.php login form.

nuclei -t CVE-2022-24627.yaml ⎘

🔍 GCVE ⚔ EDB

CVE-2022-40624

Software Genérico Web ⚡ nuclei

9.8

CRITICAL

EPSS

84.7%

2022 1 PoC

pfSense pfBlockerNG through 2.1.4_27 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header, a different vulnerability than CVE-2022-31814.

nuclei -t CVE-2022-40624.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2022-41352

🔥 KEV Software Genérico General ⚡ nuclei

9.8

CRITICAL

EPSS

94.1%

2022 8 PoCs

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.

nuclei -t CVE-2022-41352.yaml ⎘

↗ PoC 1 ↗ PoC 2 ↗ PoC 3 ↗ PoC 4 ↗ PoC 5 ↗ PoC 6 +2 más 🔍 GCVE ⚔ EDB

CVE-2022-32772

AVideo Web ⚡ nuclei

9.6

CRITICAL

EPSS

7.8%

2022 CWE-79 1 PoC

A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the "msg" parameter which is inserted into the document with insufficient sanitization.

nuclei -t CVE-2022-32772.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2022-2733

openemr/openemr Web ⚡ nuclei

9.6

CRITICAL

EPSS

91.7%

2022 CWE-79 1 PoC

Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.

nuclei -t CVE-2022-2733.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2022-32771

AVideo Web ⚡ nuclei

9.6

CRITICAL

EPSS

10.0%

2022 CWE-79 1 PoC

A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the "success" parameter which is inserted into the document with insufficient sanitization.

nuclei -t CVE-2022-32771.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2022-1883

camptocamp/terraboard Database ⚡ nuclei

9.6

CRITICAL

EPSS

62.0%

2022 CWE-89 1 PoC

SQL Injection in GitHub repository camptocamp/terraboard prior to 2.2.0.

nuclei -t CVE-2022-1883.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2022-32770

AVideo Web ⚡ nuclei

9.6

CRITICAL

EPSS

14.4%

2022 CWE-79 1 PoC

A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the "toast" parameter which is inserted into the document with insufficient sanitization.

nuclei -t CVE-2022-32770.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2022-40083

Software Genérico General ⚡ nuclei

9.6

CRITICAL

EPSS

58.8%

2022 0 PoCs

Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF).

nuclei -t CVE-2022-40083.yaml ⎘

🔍 GCVE ⚔ EDB

CVE-2022-26833

OAS Platform Web ⚡ nuclei

9.4

CRITICAL

EPSS

92.1%

2022 CWE-306 1 PoC

An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this vulnerability.

nuclei -t CVE-2022-26833.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2022-0660

microweber/microweber General ⚡ nuclei

9.4

CRITICAL

EPSS

7.5%

2022 CWE-209 1 PoC

Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.

nuclei -t CVE-2022-0660.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2022-47615

LearnPress – WordPress LMS Plugin Web Windows ⚡ nuclei

9.3

CRITICAL

EPSS

83.0%

2022 1 PoC

Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.

nuclei -t CVE-2022-47615.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2022-33965

WP Visitor Statistics (WordPress plugin) Web Database Windows ⚡ nuclei

9.3

CRITICAL

EPSS

42.7%

2022 CWE-89 0 PoCs

Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin <= 5.7 at WordPress.

nuclei -t CVE-2022-33965.yaml ⎘

🔍 GCVE ⚔ EDB

CVE-2022-23131

🔥 KEV Frontend General ⚡ nuclei

9.1

CRITICAL

EPSS

94.0%

2022 CWE-290 22 PoCs

In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).

nuclei -t CVE-2022-23131.yaml ⎘

↗ PoC 1 ↗ PoC 2 ↗ PoC 3 ↗ PoC 4 ↗ PoC 5 ↗ PoC 6 +16 más 🔍 GCVE ⚔ EDB

CVE-2022-0482

alextselegidis/easyappointments General ⚡ nuclei

9.1

CRITICAL

EPSS

90.8%

2022 CWE-359 4 PoCs

Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.

nuclei -t CVE-2022-0482.yaml ⎘

↗ PoC 1 ↗ PoC 2 ↗ PoC 3 ↗ PoC 4 🔍 GCVE ⚔ EDB

CVE-2022-31678

VMware Cloud Foundation (NSX-V) Cloud ⚡ nuclei

9.1

CRITICAL

EPSS

86.0%

2022 1 PoC

VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information disclosure.

nuclei -t CVE-2022-31678.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2022-1162

GitLab DevOps Windows ⚡ nuclei

9.1

CRITICAL

EPSS

87.6%

2022 3 PoCs

A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts

nuclei -t CVE-2022-1162.yaml ⎘

↗ PoC 1 ↗ PoC 2 ↗ PoC 3 🔍 GCVE ⚔ EDB