VYPR

CVEs

8,985 total · page 113 of 180

AllCriticalHighKEV
  • CVE-2023-1725CriMar 30, 2023
    Infoline
    Project Management System
    risk 0.64cvss 9.8epss 0.00

    Server-Side Request Forgery (SSRF) vulnerability in Infoline Project Management System allows Server Side Request Forgery. This issue affects Project Management System: before 4.09.31.125.

  • CVE-2023-1050CriMar 23, 2023
    As Koc Energy
    Web Report System
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in As Koc Energy Web Report System allows SQL Injection. This issue affects Web Report System: before 23.03.10.

  • CVE-2023-1153CriMar 21, 2023
    Pacsrapor
    Pacsrapor
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pacsrapor allows SQL Injection, Command Line Execution through SQL Injection. This issue affects Pacsrapor: before 1.22.

  • CVE-2023-1152CriMar 17, 2023
    Utarit Information Technologies
    Persolus
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Utarit Information Technologies Persolus allows SQL Injection. This issue affects Persolus: before 2.03.93.

  • CVE-2023-28531CriMar 17, 2023
    OpenSSL Project
    OpenSSL
    risk 0.64cvss 9.8epss 0.00

    ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

  • CVE-2023-1198CriMar 10, 2023
    Saysis
    Starcities
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saysis Starcities allows SQL Injection. This issue affects Starcities: through 1.3.

  • CVE-2023-1091CriMar 10, 2023
    Alpata
    Licensed Warehousing Automation System
    risk 0.64cvss 9.8epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alpata Licensed Warehousing Automation System allows Command Line Execution through SQL Injection. This issue affects Licensed Warehousing Automation System: through 2023.1.01.

  • CVE-2023-1251CriMar 9, 2023
    Akinsoft
    Wolvox
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Akinsoft Wolvox. This issue affects Wolvox: before 8.02.03.

  • CVE-2023-1267CriMar 8, 2023
    Ulkem Company
    Pttem Kart
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ulkem Company PtteM Kart. This issue affects PtteM Kart: before 2.1.

  • CVE-2022-3760CriMar 7, 2023
    Mia Technology
    Mia Med
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mia Technology Mia-Med. This issue affects Mia-Med: before 1.0.0.58.

  • CVE-2023-0979CriMar 6, 2023
    Meddata
    Meddatapacs
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MedData MedDataPACS allows SQL Injection. This issue affects MedDataPACS : before 2023-03-03.

  • CVE-2023-0839CriMar 6, 2023
    Promis Process Co.
    Inscada
    risk 0.64cvss 9.8epss 0.00

    Improper Protection for Outbound Error Messages and Alert Signals vulnerability in ProMIS Process Co. InSCADA allows Account Footprinting. This issue affects inSCADA: before 20230115-1.

  • CVE-2021-3854CriMar 2, 2023
    Glox Technology
    Useroam Hotspot
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Glox Technology Useroam Hotspot allows SQL Injection. This issue affects Useroam Hotspot: before 5.1.0.15.

  • CVE-2023-1114CriMar 1, 2023
    Eskom
    e-Belediye
    risk 0.64cvss 9.8epss 0.00

    Missing Authorization vulnerability in Eskom e-Belediye allows Information Elicitation. This issue affects e-Belediye: from 1.0.0.95 before 1.0.0.100.

  • CVE-2023-1064CriMar 1, 2023
    Uzay Baskul
    Weighbridge Automation Software
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Uzay Baskul Weighbridge Automation Software allows SQL Injection. This issue affects Weighbridge Automation Software: before 1.1.

  • CVE-2021-4105CriFeb 24, 2023
    BG-TEK
    COSLAT Firewall
    risk 0.64cvss 9.8epss 0.01

    Improper Handling of Parameters vulnerability in BG-TEK COSLAT Firewall allows Remote Code Inclusion. This issue affects COSLAT Firewall: from 5.24.0.R.20180630 before 5.24.0.R.20210727.

  • CVE-2022-2504CriFeb 23, 2023
    Sdd Computer Software
    Sdd Baro
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SDD Computer Software SDD-Baro allows SQL Injection. This issue affects SDD-Baro: before 2.8.432.

  • CVE-2023-0939CriFeb 23, 2023
    Ntn Information Technologies
    Online Services Software
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NTN Information Technologies Online Services Software allows SQL Injection. This issue affects Online Services Software: before 1.17.

  • CVE-2022-4557CriFeb 12, 2023
    Grup Arge Energy and Control Systems
    Smartpower
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Group Arge Energy and Control Systems Smartpower Web allows SQL Injection. This issue affects Smartpower Web: before 23.01.01.

  • CVE-2022-45088CriFeb 12, 2023
    Grup Arge Energy and Control Systems
    Smartpower
    risk 0.64cvss 9.8epss 0.00

    Improper Input Validation vulnerability in Group Arge Energy and Control Systems Smartpower Web allows PHP Local File Inclusion. This issue affects Smartpower Web: before 23.01.01.

  • CVE-2023-0556CriJan 27, 2023
    Contentstudio
    Contentstudio
    risk 0.64cvss 9.8epss 0.02

    The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to obtain the blog metadata (via the function…

  • CVE-2022-4422CriJan 10, 2023
    Symantec
    System Center
    risk 0.64cvss 9.8epss 0.00

    Call Center System developed by Bulutses Information Technologies before version 3.0 has an unauthenticated Sql Injection vulnerability. This has been fixed in the version 3.0

  • CVE-2022-3792CriJan 10, 2023
    GullsEye
    GullsEye terminal operating system
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GullsEye GullsEye terminal operating system allows SQL Injection. This issue affects GullsEye terminal operating system: from unspecified before 5.0.13.

  • CVE-2022-46393CriDec 15, 2022
    Arm
    MbedTLS
    risk 0.64cvss 9.8epss 0.01

    An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX.

  • CVE-2022-44588CriDec 15, 2022
    WordPress
    Cryptocurrency Widgets Pack
    risk 0.67cvss 9.9epss 0.35

    Unauth. SQL Injection vulnerability in Cryptocurrency Widgets Pack Plugin <=1.8.1 on WordPress.

  • CVE-2022-42699CriDec 6, 2022
    WordPress
    Easy Wp SMTP
    risk 0.60cvss 9.1epss 0.07

    Auth. Remote Code Execution vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress.

  • CVE-2022-32224CriDec 5, 2022
    risk 0.57cvss 9.8epss 0.02

    A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an…

  • CVE-2022-2807CriDec 2, 2022
    Algan Software
    Prens Student Information System
    risk 0.64cvss 9.8epss 0.00

    SQL Injection vulnerability in Algan Software Prens Student Information System allows SQL Injection. This issue affects Prens Student Information System: before 2.1.11.

  • CVE-2022-45047CriNov 16, 2022
    Apache
    Sshd
    risk 0.57cvss 9.8epss 0.06

    Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for…

  • CVE-2022-45063CriNov 10, 2022
    Xterm
    Xterm
    risk 0.65cvss 9.8epss 0.14

    xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.

  • CVE-2022-3708CriOct 28, 2022
    WordPress
    Web Stories
    risk 0.55cvss 9.6epss 0.01

    The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for…

  • CVE-2022-39269CriOct 6, 2022
    Pjsip
    Pjsip
    risk 0.59cvss 9.1epss 0.00

    PJSIP is a free and open source multimedia communication library written in C. When processing certain packets, PJSIP may incorrectly switch from using SRTP media transport to using basic RTP upon SRTP restart, causing the media to be sent insecurely. The vulnerability impacts…

  • CVE-2022-0495CriSep 21, 2022
    Koha
    Koha
    risk 0.61cvss 9.4epss 0.00

    The library automation system product KOHA developed by Parantez Teknoloji before version 19.05.03 has an unauthenticated SQL Injection vulnerability. This has been fixed in the version 19.05.03.01.

  • CVE-2022-2315CriSep 21, 2022
    risk 0.61cvss 9.4epss 0.00

    Database Software Accreditation Tracking/Presentation Module product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2.

  • CVE-2022-2177CriSep 20, 2022
    risk 0.61cvss 9.4epss 0.00

    Kayrasoft product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2.

  • CVE-2022-36323CriAug 10, 2022
    Siemens Foundation
    Scalance Xr 300 Firmware
    risk 0.59cvss 9.1epss 0.01

    Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell.

  • CVE-2022-1277CriJul 29, 2022
    Inavitas
    Solar Log
    risk 0.61cvss 9.4epss 0.00

    Inavitas Solar Log product has an unauthenticated SQL Injection vulnerability.

  • CVE-2021-41556CriJul 28, 2022
    Squirrel Lang
    Squirrel
    risk 0.58cvss 10.0epss 0.01

    sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code Execution. If a victim executes an attacker-controlled squirrel script, it is possible for the attacker to break out of the squirrel script…

  • CVE-2016-1000273criJul 20, 2022
    Javamelody
    Javamelody
    risk 0.52cvss —epss 0.02

    JavaMelody is a monitoring tool for JavaEE applications. Versions prior to 1.61.0 are vulnerable to a cross-site scripting (XSS) attack. This issue was patched in version 1.61.0, and users are recommended to upgrade to the latest version. There are no known workarounds.

  • CVE-2022-2437CriJul 18, 2022
    Slickremix
    Feed Them Social
    risk 0.58cvss 9.8epss 0.12

    The Feed Them Social – for Twitter feed, Youtube and more plugin for WordPress is vulnerable to deserialization of untrusted input via the 'fts_url' parameter in versions up to, and including 2.9.8.5. This makes it possible for unauthenticated attackers to call files using a…

  • CVE-2022-35409CriJul 15, 2022
    Arm
    MbedTLS
    risk 0.59cvss 9.1epss 0.02

    An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an invalid ClientHello message to a DTLS server that causes a heap-based buffer over-read of up to 255 bytes. This can cause a server crash or…

  • CVE-2022-34835CriJun 30, 2022
    Denx
    U Boot
    risk 0.64cvss 9.8epss 0.00

    In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the "i2c md" command enables the corruption of the return address pointer of the do_i2c_md function.

  • CVE-2022-1768CriJun 13, 2022
    WordPress
    Rsvpmaker
    risk 0.71cvss 9.8epss 0.86

    The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user supplied data passed to multiple SQL queries in the ~/rsvpmaker-email.php file. This makes it possible for unauthenticated attackers to…

  • CVE-2022-1505CriMay 10, 2022
    WordPress
    Rsvpmaker
    risk 0.64cvss 9.8epss 0.03

    The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-api-endpoints.php file. This makes it possible for unauthenticated attackers to steal…

  • CVE-2022-1453CriMay 10, 2022
    WordPress
    Rsvpmaker
    risk 0.62cvss 9.8epss 0.61

    The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive…

  • CVE-2022-0992CriApr 19, 2022
    WordPress
    Siteground Security
    risk 0.64cvss 9.8epss 0.04

    The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on initial 2FA set-up that allows unauthenticated and unauthorized users to configure 2FA…

  • CVE-2022-0888CriMar 23, 2022
    WordPress
    Ninja Forms File Uploads
    risk 0.64cvss 9.8epss 0.09

    The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthenticated attackers to…

  • CVE-2022-0715CriMar 9, 2022
    Schneider Electric
    SmartConnect Family
    risk 0.59cvss 9.1epss 0.01

    A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and used to upload malicious firmware. Affected Product: APC Smart-UPS Family: SMT Series (SMT Series ID=18: UPS 09.8 and prior…

  • CVE-2022-0664CriFeb 18, 2022
    risk 0.57cvss 9.8epss 0.00

    Use of Hard-coded Cryptographic Key in Go github.com/gravitl/netmaker prior to 0.8.5,0.9.4,0.10.0,0.10.1.

  • CVE-2022-23305CriJan 18, 2022
    Apache
    Log4j 1.x
    risk 0.57cvss 9.8epss 0.09

    By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering…