Export limit exceeded: 349412 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (25296 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-41971 | 1 Nextcloud | 1 Nextcloud Talk | 2025-04-23 | 4.8 Medium |
| Nextcould Talk android is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0, guests can continue to receive video streams from a call after being removed from a conversation. An attacker would be able to see videos on a call in a public conversation after being removed from that conversation, provided that they were removed while being in the call. Versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0 contain patches for the issue. No known workarounds are available. | ||||
| CVE-2022-46158 | 1 Prestashop | 1 Prestashop | 2025-04-23 | 5.3 Medium |
| PrestaShop is an open-source e-commerce solution. Versions prior to 1.7.8.8 did not properly restrict host filesystem access for users. Users may have been able to view the contents of the upload directory without appropriate permissions. This issue has been addressed and users are advised to upgrade to version 1.7.8.8. There are no known workarounds for this issue. | ||||
| CVE-2022-23497 | 1 Freshrss | 1 Freshrss | 2025-04-23 | 6.5 Medium |
| FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords (brypt with cost 9, salted) of FreshRSS Web interface. If the API is used, the configuration might contain a hashed password (brypt with cost 9, salted) of the GReader API, and a hashed password (MD5 salted) of the Fever API. Users should update to version 1.20.2 or edge. Users unable to upgrade can apply the patch manually or delete the file `./FreshRSS/p/ext.php`. | ||||
| CVE-2023-41097 | 1 Silabs | 1 Gecko Software Development Kit | 2025-04-23 | 4.6 Medium |
| An Observable Timing Discrepancy, Covert Timing Channel vulnerability in Silabs GSDK on ARM potentially allows Padding Oracle Crypto Attack on CBC PKCS7.This issue affects GSDK: through 4.4.0. | ||||
| CVE-2022-45113 | 1 Sixapart | 1 Movable Type | 2025-04-23 | 6.5 Medium |
| Improper validation of syntactic correctness of input vulnerability exist in Movable Type series. Having a user to access a specially crafted URL may allow a remote unauthenticated attacker to set a specially crafted URL to the Reset Password page and conduct a phishing attack. Affected products/versions are as follows: Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5301 and earlier (Movable Type Advanced 7 Series), Movable Type 6.8.7 and earlier (Movable Type 6 Series), Movable Type Advanced 6.8.7 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.53 and earlier, and Movable Type Premium Advanced 1.53 and earlier. | ||||
| CVE-2022-38123 | 1 Secomea | 1 Gatemanager | 2025-04-23 | 8.7 High |
| Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager interface. This issue affects: Secomea GateManager versions prior to 10.0. | ||||
| CVE-2023-7094 | 1 Netentsec | 1 Application Security Gateway | 2025-04-23 | 5.3 Medium |
| A vulnerability classified as problematic was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected by this vulnerability is an unknown functionality of the file /protocol/nsasg6.0.tgz. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248941 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2022-43901 | 1 Ibm | 1 Websphere Automation For Ibm Cloud Pak For Watson Aiops | 2025-04-23 | 5.7 Medium |
| IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps 1.4.3 could disclose sensitive information. An authenticated local attacker could exploit this vulnerability to possibly gain information to other IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps components. IBM X-Force ID: 240829. | ||||
| CVE-2022-39897 | 1 Google | 1 Android | 2025-04-23 | 4.4 Medium |
| Exposure of Sensitive Information vulnerability in kernel prior to SMR Dec-2022 Release 1 allows attackers to access the kernel address information via log. | ||||
| CVE-2022-39904 | 1 Google | 1 Android | 2025-04-23 | 3.3 Low |
| Exposure of Sensitive Information vulnerability in Samsung Settings prior to SMR Dec-2022 Release 1 allows local attackers to access the Network Access Identifier via log. | ||||
| CVE-2022-39913 | 1 Google | 1 Android | 2025-04-23 | 6.8 Medium |
| Exposure of Sensitive Information to an Unauthorized Actor in Persona Manager prior to Android T(13) allows local attacker to access user profiles information. | ||||
| CVE-2022-39914 | 1 Google | 1 Android | 2025-04-23 | 4 Medium |
| Exposure of Sensitive Information from an Unauthorized Actor vulnerability in Samsung DisplayManagerService prior to Android T(13) allows local attacker to access connected DLNA device information. | ||||
| CVE-2022-3907 | 1 Clerk | 1 Clerk.io | 2025-04-23 | 7.5 High |
| The Clerk WordPress plugin before 4.0.0 is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operators to verify API keys against the ones stored in the site options. | ||||
| CVE-2022-2827 | 1 Ami | 1 Megarac Sp-x | 2025-04-23 | 7.5 High |
| AMI MegaRAC User Enumeration Vulnerability | ||||
| CVE-2022-46825 | 1 Jetbrains | 1 Intellij Idea | 2025-04-23 | 4 Medium |
| In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects. | ||||
| CVE-2025-32958 | 2025-04-23 | 9.8 Critical | ||
| Adept is a language for general purpose programming. Prior to commit a1a41b7, the remoteBuild.yml workflow file uses actions/upload-artifact@v4 to upload the mac-standalone artifact. This artifact is a zip of the current directory, which includes the automatically generated .git/config file containing the run's GITHUB_TOKEN. Seeing as the artifact can be downloaded prior to the end of the workflow, there is a few seconds where an attacker can extract the token from the artifact and use it with the Github API to push malicious code or rewrite release commits in the AdeptLanguage/Adept repository. This issue has been patched in commit a1a41b7. | ||||
| CVE-2025-23174 | 2025-04-23 | 7.5 High | ||
| CWE-200: Exposure of Sensitive Information to an Unauthorized Actor | ||||
| CVE-2022-34881 | 3 Hitachi, Linux, Microsoft | 3 Jp1\/automatic Operation, Linux Kernel, Windows | 2025-04-23 | 3.3 Low |
| Generation of Error Message Containing Sensitive Information vulnerability in Hitachi JP1/Automatic Operation allows local users to gain sensitive information. This issue affects JP1/Automatic Operation: from 10-00 through 10-54-03, from 11-00 before 11-51-09, from 12-00 before 12-60-01. | ||||
| CVE-2024-20034 | 2 Google, Mediatek | 20 Android, Mt6761, Mt6765 and 17 more | 2025-04-22 | 7.2 High |
| In battery, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08488849; Issue ID: ALPS08488849. | ||||
| CVE-2022-39903 | 1 Google | 1 Android | 2025-04-22 | 4 Medium |
| Improper access control vulnerability in RCS call prior to SMR Dec-2022 Release 1 allows local attackers to access RCS incoming call number. | ||||