Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
73,094 matching · page 1409/1462Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2021-38296(opens NVD record) | High | 7.5 | Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later | Mar 10, 2022 |
| CVE-2022-24753(opens NVD record) | High | 7.7 | Stripe CLI is a command-line tool for the Stripe eCommerce platform. A vulnerability in Stripe CLI exists on Windows when certain commands are run in a directory where an attacker has planted files. The commands are `stripe login`, `stripe config -e`, `stripe community`, and `stripe open`. MacOS and Linux are unaffected. An attacker who successfully exploits the vulnerability can run arbitrary code in the context of the current user. The update addresses the vulnerability by throwing an error in these situations before the code can run.Users are advised to upgrade to version 1.7.13. There are no known workarounds for this issue. | Mar 9, 2022 |
| CVE-2022-24919(opens NVD record) | Low | 3.7 | An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks. | Mar 9, 2022 |
| CVE-2022-24918(opens NVD record) | Low | 3.7 | An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks. | Mar 9, 2022 |
| CVE-2022-24917(opens NVD record) | Low | 3.7 | An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks. | Mar 9, 2022 |
| CVE-2022-24349(opens NVD record) | Medium | 4.6 | An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attack can be implemented with the help of social engineering and expiration of a number of factors - an attacker should have authorized access to the Zabbix Frontend and allowed network connection between a malicious server and victim’s computer, understand attacked infrastructure, be recognized by the victim as a trustee and use trusted communication channel. | Mar 9, 2022 |
| CVE-2022-0022(opens NVD record) | Medium | 4.1 | Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not created with a sufficient level of computational effort, which allows for password cracking attacks on accounts in normal (non-FIPS-CC) operational mode. An attacker must have access to the account password hashes to take advantage of this weakness and can acquire those hashes if they are able to gain access to the PAN-OS software configuration. Fixed versions of PAN-OS software use a secure cryptographic algorithm for account password hashes. This issue does not impact Prisma Access firewalls. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.21; All versions of PAN-OS 9.0; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11; PAN-OS 10.0 versions earlier than PAN-OS 10.0.7. | Mar 9, 2022 |
| CVE-2022-24526(opens NVD record) | Medium | 6.1 | Visual Studio Code Spoofing Vulnerability | Mar 9, 2022 |
| CVE-2022-24525(opens NVD record) | High | 7.0 | Windows Update Stack Elevation of Privilege Vulnerability | Mar 9, 2022 |
| CVE-2022-24522(opens NVD record) | Medium | 6.5 | Skype Extension for Chrome Information Disclosure Vulnerability | Mar 9, 2022 |
| CVE-2022-24520(opens NVD record) | High | 7.2 | Azure Site Recovery Remote Code Execution Vulnerability | Mar 9, 2022 |
| CVE-2022-24519(opens NVD record) | Medium | 6.5 | Azure Site Recovery Elevation of Privilege Vulnerability | Mar 9, 2022 |
| CVE-2022-24518(opens NVD record) | Medium | 6.5 | Azure Site Recovery Elevation of Privilege Vulnerability | Mar 9, 2022 |
| CVE-2022-24517(opens NVD record) | High | 7.2 | Azure Site Recovery Remote Code Execution Vulnerability | Mar 9, 2022 |
| CVE-2022-24515(opens NVD record) | Medium | 6.5 | Azure Site Recovery Elevation of Privilege Vulnerability | Mar 9, 2022 |
| CVE-2022-24512(opens NVD record) | Medium | 6.3 | .NET and Visual Studio Remote Code Execution Vulnerability | Mar 9, 2022 |
| CVE-2022-24511(opens NVD record) | Medium | 5.5 | Microsoft Office Word Tampering Vulnerability | Mar 9, 2022 |
| CVE-2022-24510(opens NVD record) | High | 7.8 | Microsoft Office Visio Remote Code Execution Vulnerability | Mar 9, 2022 |
| CVE-2022-24509(opens NVD record) | High | 7.8 | Microsoft Office Visio Remote Code Execution Vulnerability | Mar 9, 2022 |
| CVE-2022-24508(opens NVD record) | High | 8.8 | Win32 File Enumeration Remote Code Execution Vulnerability | Mar 9, 2022 |
| CVE-2022-24507(opens NVD record) | High | 7.8 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Mar 9, 2022 |
| CVE-2022-24506(opens NVD record) | Medium | 6.5 | Azure Site Recovery Elevation of Privilege Vulnerability | Mar 9, 2022 |
| CVE-2022-24505(opens NVD record) | High | 7.0 | Windows ALPC Elevation of Privilege Vulnerability | Mar 9, 2022 |
| CVE-2022-24503(opens NVD record) | Medium | 5.4 | Remote Desktop Protocol Client Information Disclosure Vulnerability | Mar 9, 2022 |
| CVE-2022-24502(opens NVD record) | Medium | 4.3 | Windows HTML Platforms Security Feature Bypass Vulnerability | Mar 9, 2022 |
| CVE-2022-24501(opens NVD record) | High | 7.8 | VP9 Video Extensions Remote Code Execution Vulnerability | Mar 9, 2022 |
| CVE-2022-24471(opens NVD record) | High | 7.2 | Azure Site Recovery Remote Code Execution Vulnerability | Mar 9, 2022 |
| CVE-2022-24470(opens NVD record) | High | 7.2 | Azure Site Recovery Remote Code Execution Vulnerability | Mar 9, 2022 |
| CVE-2022-24469(opens NVD record) | High | 8.1 | Azure Site Recovery Elevation of Privilege Vulnerability | Mar 9, 2022 |
| CVE-2022-24468(opens NVD record) | High | 7.2 | Azure Site Recovery Remote Code Execution Vulnerability | Mar 9, 2022 |
| CVE-2022-24467(opens NVD record) | High | 7.2 | Azure Site Recovery Remote Code Execution Vulnerability | Mar 9, 2022 |
| CVE-2022-24465(opens NVD record) | Low | 3.3 | Microsoft Intune Portal for iOS Security Feature Bypass Vulnerability | Mar 9, 2022 |
| CVE-2022-24464(opens NVD record) | High | 7.5 | .NET and Visual Studio Denial of Service Vulnerability | Mar 9, 2022 |
| CVE-2022-24463(opens NVD record) | Medium | 6.5 | Microsoft Exchange Server Spoofing Vulnerability | Mar 9, 2022 |
| CVE-2022-24462(opens NVD record) | Medium | 5.5 | Microsoft Word Security Feature Bypass Vulnerability | Mar 9, 2022 |
| CVE-2022-24461(opens NVD record) | High | 7.8 | Microsoft Office Visio Remote Code Execution Vulnerability | Mar 9, 2022 |
| CVE-2022-24460(opens NVD record) | High | 7.0 | Tablet Windows User Interface Application Elevation of Privilege Vulnerability | Mar 9, 2022 |
| CVE-2022-24459(opens NVD record) | High | 7.8 | Windows Fax and Scan Service Elevation of Privilege Vulnerability | Mar 9, 2022 |
| CVE-2022-24457(opens NVD record) | High | 7.8 | HEIF Image Extensions Remote Code Execution Vulnerability | Mar 9, 2022 |
| CVE-2022-24456(opens NVD record) | High | 7.8 | HEVC Video Extensions Remote Code Execution Vulnerability | Mar 9, 2022 |
| CVE-2022-24455(opens NVD record) | High | 7.8 | Windows CD-ROM Driver Elevation of Privilege Vulnerability | Mar 9, 2022 |
| CVE-2022-24454(opens NVD record) | High | 7.8 | Windows Security Support Provider Interface Elevation of Privilege Vulnerability | Mar 9, 2022 |
| CVE-2022-24453(opens NVD record) | High | 7.8 | HEVC Video Extensions Remote Code Execution Vulnerability | Mar 9, 2022 |
| CVE-2022-24452(opens NVD record) | High | 7.8 | HEVC Video Extensions Remote Code Execution Vulnerability | Mar 9, 2022 |
| CVE-2022-24451(opens NVD record) | High | 7.8 | VP9 Video Extensions Remote Code Execution Vulnerability | Mar 9, 2022 |
| CVE-2022-23301(opens NVD record) | High | 7.8 | HEVC Video Extensions Remote Code Execution Vulnerability | Mar 9, 2022 |
| CVE-2022-23300(opens NVD record) | High | 7.8 | Raw Image Extension Remote Code Execution Vulnerability | Mar 9, 2022 |
| CVE-2022-23299(opens NVD record) | High | 7.8 | Windows PDEV Elevation of Privilege Vulnerability | Mar 9, 2022 |
| CVE-2022-23298(opens NVD record) | High | 7.0 | Windows NT OS Kernel Elevation of Privilege Vulnerability | Mar 9, 2022 |
| CVE-2022-23297(opens NVD record) | Medium | 5.5 | Windows NT Lan Manager Datagram Receiver Driver Information Disclosure Vulnerability | Mar 9, 2022 |