Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (331301 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-36443 1 Zebra 1 Enterprise Home Screen 2025-05-30 7.8 High
An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The device allows the administrator to lock some communication channels (wireless and SD card) but it is still possible to use a physical connection (Ethernet cable) without restriction.
CVE-2022-36442 1 Zebra 1 Enterprise Home Screen 2025-05-30 5.5 Medium
An issue was discovered in Zebra Enterprise Home Screen 4.1.19. By using the embedded Google Chrome application, it is possible to install an unauthorized application via a downloaded APK.
CVE-2022-36441 1 Zebra 1 Enterprise Home Screen 2025-05-30 7.1 High
An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The Gboard used by different applications can be used to launch and use several other applications that are restricted by the admin.
CVE-2022-34910 1 Aremis 1 Aremis 4 Nomads 2025-05-30 4.1 Medium
An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It uses a local database to store data and accounts. However, the password is stored in cleartext. Therefore, an attacker can retrieve the passwords of other users that used the same device.
CVE-2022-34909 1 Aremis 1 Aremis 4 Nomads 2025-05-30 7.7 High
An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It allows SQL Injection, by which an attacker can bypass authentication and retrieve data that is stored in the database.
CVE-2022-34908 1 Aremis 1 Aremis 4 Nomads 2025-05-30 8.2 High
An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It possesses an authentication mechanism; however, some features do not require any token or cookie in a request. Therefore, an attacker may send a simple HTTP request to the right endpoint, and obtain authorization to retrieve application data.
CVE-2022-29931 1 Raytion 1 Custom Security Manager 2025-05-30 6.1 Medium
The administration interface of the Raytion Custom Security Manager (Raytion CSM) in Version 7.2.0 allows reflected Cross-site Scripting (XSS).
CVE-2022-24967 1 Blackrainbow 1 Nimbus 2025-05-30 6.5 Medium
Black Rainbow NIMBUS before 3.7.0 allows stored Cross-site Scripting (XSS).
CVE-2022-24447 1 Zohocorp 1 Manageengine Key Manager Plus 2025-05-30 6.5 Medium
An issue was discovered in Zoho ManageEngine Key Manager Plus before 6200. A service exposed by the application allows a user, with the level Operator, to access stored SSL certificates and associated key pairs during export.
CVE-2022-24446 1 Zohocorp 1 Manageengine Key Manager Plus 2025-05-30 4.3 Medium
An issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6. A user, with the level Operator, can see all SSH servers (and user information) even if no SSH server or user is associated to the operator.
CVE-2021-44035 1 Wolterskluwer 1 Teammate Audit Management 2025-05-30 4.4 Medium
Wolters Kluwer TeamMate AM 12.4 Update 1 mishandles attachment uploads, such that an authenticated user may download and execute malicious files.
CVE-2021-43978 1 Allegro 1 Allegro 2025-05-30 7.1 High
Allegro WIndows 3.3.4152.0, embeds software administrator database credentials into its binary files, which allows users to access and modify data using the same credentials.
CVE-2021-42111 1 Rcdevs 1 Openotp Token 2025-05-30 5.5 Medium
An issue was discovered in the RCDevs OpenOTP app 1.4.13 and 1.4.14 for iOS. If it is installed on a jailbroken device, it is possible to retrieve the PIN code used to access the application. The IOS app version 1.4.1631262629 resolves this issue by storing a hash PIN code.
CVE-2021-42110 1 Allegro 1 Allegro 2025-05-30 7.1 High
An issue was discovered in Allegro Windows (formerly Popsy Windows) before 3.3.4156.1. A standard user can escalate privileges to SYSTEM if the FTP module is installed, because of DLL hijacking.
CVE-2021-41320 1 Iongroup 1 Wallstreet Suite 2025-05-30 5.5 Medium
A technical user has hardcoded credentials in Wallstreet Suite TRM 7.4.83 (64-bit edition) with higher privilege than the average authenticated user. NOTE: the vendor disputes this because the password is not hardcoded (it can be changed during installation or at any later time).
CVE-2021-38618 1 Gfos 1 Workforce Management 2025-05-30 7.4 High
In GFOS Workforce Management 4.8.272.1, the login page of application is prone to authentication bypass, allowing anyone (who knows a user's credentials except the password) to get access to an account. This occurs because of JSESSIONID mismanagement.
CVE-2021-38617 1 Eigentech 1 Natural Language Processing 2025-05-30 8.8 High
In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/ user creation endpoint allows a standard user to create a super user account with a defined password. This directly leads to privilege escalation.
CVE-2021-38616 1 Eigentech 1 Natural Language Processing 2025-05-30 7.6 High
In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/{user-guid}/ user edition endpoint could permit any logged-in user to increase their own permissions via a user_permissions array in a PATCH request. A guest user could modify other users' profiles and much more.
CVE-2021-38615 1 Eigentech 1 Natural Language Processing 2025-05-30 6.3 Medium
In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/sso/config/ SSO configuration endpoint allows any logged-in user (guest, standard, or admin) to view and modify information.
CVE-2021-32018 1 Jump-technology 1 Asset Management 2025-05-30 8.5 High
An issue was discovered in JUMP AMS 3.6.0.04.009-2487. The JUMP SOAP API was vulnerable to arbitrary file reading due to an improper limitation of file loading on the server filesystem, aka directory traversal.