CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 13/04/2022 |
| CVE-2022-24785 | HIGH7.5 | Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2 | 04/04/2022 |
| CVE-2022-0778 | HIGH7.5 | The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded i | 15/03/2022 |
| CVE-2022-23990 | HIGH7.5 | Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. | 26/01/2022 |
| CVE-2022-23852 | CRITICAL9.8 | Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES. | 24/01/2022 |
| CVE-2022-0130 | HIGH8.1 | Tenable.sc versions 5.14.0 through 5.19.1 were found to contain a remote code execution vulnerability which could allow a remote, unauthenticated attacker to execute code under special circumstances. An attacker would first have to stage a specific file type in the web server root of the Tenable.sc host prior to remote | 14/01/2022 |
| CVE-2022-22827 | HIGH8.8 | storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | 10/01/2022 |
| CVE-2022-22826 | HIGH8.8 | nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | 10/01/2022 |
| CVE-2022-22825 | HIGH8.8 | lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | 10/01/2022 |
| CVE-2022-22824 | CRITICAL9.8 | defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | 10/01/2022 |
| CVE-2022-22823 | CRITICAL9.8 | build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | 10/01/2022 |
| CVE-2022-22822 | CRITICAL9.8 | addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | 10/01/2022 |
| CVE-2021-46143 | HIGH7.8 | In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. | 06/01/2022 |
| CVE-2021-45960 | HIGH8.8 | In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory). | 01/01/2022 |
| CVE-2021-44790 | CRITICAL9.8 | A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier. | 20/12/2021 |
| CVE-2021-44224 | HIGH8.2 | A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affect | 20/12/2021 |
| CVE-2021-21707 | MEDIUM5.3 | In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreti | 29/11/2021 |
| CVE-2021-20135 | MEDIUM6.7 | Nessus versions 8.15.2 and earlier were found to contain a local privilege escalation vulnerability which could allow an authenticated, local administrator to run specific executables on the Nessus Agent host. Tenable has included a fix for this issue in Nessus 10.0.0. The installation files can be obtained from the Te | 03/11/2021 |