VYPR

CVEs

131,065 total · page 1445 of 2,622

AllCriticalHighKEV
  • CVE-2022-46860HigNov 6, 2023
    Kaizencoders
    Short URL
    risk 0.55cvss 8.5epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in KaizenCoders Short URL allows SQL Injection.This issue affects Short URL: from n/a through 1.6.4.

  • CVE-2022-46849HigNov 6, 2023
    WordPress
    Coming Soon Page – Responsive Coming Soon & Maintenance Mode
    risk 0.49cvss 7.6epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Weblizar Coming Soon Page – Responsive Coming Soon & Maintenance Mode allows SQL Injection.This issue affects Coming Soon Page – Responsive Coming Soon & Maintenance Mode:…

  • CVE-2022-45373HigNov 6, 2023
    Veronalabs
    Slimstat Analytics
    risk 0.50cvss 8.8epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jason Crouse, VeronaLabs Slimstat Analytics allows SQL Injection.This issue affects Slimstat Analytics: from n/a through 5.0.4.

  • CVE-2023-38407HigNov 6, 2023
    Frrouting
    Frrouting
    risk 0.00cvss 7.5epss 0.01

    bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing.

  • CVE-2023-32837HigNov 6, 2023
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    In video, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08235273; Issue ID: ALPS08250357.

  • CVE-2023-32832HigNov 6, 2023
    Google
    Android
    risk 0.46cvss 7.0epss 0.00

    In video, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08235273; Issue ID: ALPS08235273.

  • CVE-2023-20702HigNov 6, 2023
    Mediatek
    5G NRLC
    risk 0.49cvss 7.5epss 0.01

    In 5G NRLC, there is a possible invalid memory access due to lack of error handling. This could lead to remote denial of service, if UE received invalid 1-byte rlc sdu, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID:…

  • CVE-2023-46382HigNov 4, 2023
    Loytec
    LINX-151
    risk 0.49cvss 7.5epss 0.03

    LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) use cleartext HTTP for login.

  • CVE-2023-46381HigNov 4, 2023
    Loytec
    LINX-151
    risk 0.54cvss 8.2epss 0.09

    LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) lack authentication for the preinstalled version of LWEB-802 via an lweb802_pre/ URI. An unauthenticated attacker can edit any project (or create a new project)…

  • CVE-2023-46380HigNov 4, 2023
    Loytec
    LINX-151
    risk 0.49cvss 7.5epss 0.03

    LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) send password-change requests via cleartext HTTP.

  • CVE-2023-40215HigNov 4, 2023
    Superwhite
    Demon Image Annotation
    risk 0.49cvss 7.6epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Demonisblack demon image annotation allows SQL Injection.This issue affects demon image annotation: from n/a through 5.1.

  • CVE-2023-35910HigNov 4, 2023
    Quasar Form
    Quasar Form
    risk 0.55cvss 8.5epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nucleus_genius Quasar form free – Contact Form Builder for WordPress allows SQL Injection.This issue affects Quasar form free – Contact Form Builder for WordPress: from n/a…

  • CVE-2023-32741HigNov 4, 2023
    IT Path Solutions PVT LTD
    Contact Form to Any API
    risk 0.49cvss 7.6epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IT Path Solutions PVT LTD Contact Form to Any API allows SQL Injection.This issue affects Contact Form to Any API: from n/a through 1.1.2.

  • CVE-2023-36677HigNov 3, 2023
    Smartypantsplugins
    Sp Project \& Document Manager
    risk 0.54cvss 8.3epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager allows SQL Injection.This issue affects SP Project & Document Manager: from n/a through 4.67.

  • CVE-2023-47235HigNov 3, 2023
    Frrouting
    Frrouting
    risk 0.00cvss 7.5epss 0.01

    An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw outcome.

  • CVE-2023-47234HigNov 3, 2023
    Frrouting
    Frrouting
    risk 0.00cvss 7.5epss 0.01

    An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path attributes).

  • CVE-2023-41726HigNov 3, 2023
    Ivanti
    Avalanche
    risk 0.51cvss 7.8epss 0.01

    Ivanti Avalanche Incorrect Default Permissions allows Local Privilege Escalation Vulnerability

  • CVE-2023-41725HigNov 3, 2023
    Ivanti
    Avalanche
    risk 0.51cvss 7.8epss 0.01

    Ivanti Avalanche EnterpriseServer Service Unrestricted File Upload Local Privilege Escalation Vulnerability

  • CVE-2022-44569HigNov 3, 2023
    Ivanti
    Automation
    risk 0.51cvss 7.8epss 0.01

    A locally authenticated attacker with low privileges can bypass authentication due to insecure inter-process communication.

  • CVE-2022-43555HigNov 3, 2023
    Ivanti
    Avalanche
    risk 0.51cvss 7.8epss 0.00

    Ivanti Avalanche Printer Device Service Missing Authentication Local Privilege Escalation Vulnerability

  • CVE-2022-43554HigNov 3, 2023
    Ivanti
    Avalanche
    risk 0.51cvss 7.8epss 0.00

    Ivanti Avalanche Smart Device Service Missing Authentication Local Privilege Escalation Vulnerability

  • CVE-2023-3893HigNov 3, 2023
    Cri O
    Csi Proxy
    risk 0.50cvss 8.8epss 0.02

    A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes running kubernetes-csi-proxy may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes running …

  • CVE-2023-39299HigNov 3, 2023
    Qnap
    Music Station
    risk 0.49cvss 7.5epss 0.01

    A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following versions: Music…

  • CVE-2023-34179HigNov 3, 2023
    Groundhogg
    Groundhogg
    risk 0.49cvss 7.6epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Groundhogg Inc. Groundhogg allows SQL Injection.This issue affects Groundhogg: from n/a through 2.7.11.

  • CVE-2023-32508HigNov 3, 2023
    Cagewebdev
    Order Your Posts Manually
    risk 0.49cvss 7.6epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rolf van Gelder Order Your Posts Manually allows SQL Injection.This issue affects Order Your Posts Manually: from n/a through 2.2.5.

  • CVE-2023-32121HigNov 3, 2023
    Highfivery
    Zero Spam For Wordpress
    risk 0.49cvss 7.6epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Highfivery LLC Zero Spam for WordPress allows SQL Injection.This issue affects Zero Spam for WordPress: from n/a through 5.4.4.

  • CVE-2023-25990HigNov 3, 2023
    Themeum
    Tutor Lms
    risk 0.46cvss 7.1epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a through 2.1.10.

  • CVE-2023-25800HigNov 3, 2023
    Themeum
    Tutor Lms
    risk 0.53cvss 8.1epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a through 2.2.0.

  • CVE-2023-25700HigNov 3, 2023
    Themeum
    Tutor Lms
    risk 0.53cvss 8.2epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a through 2.1.10.

  • CVE-2022-46818HigNov 3, 2023
    Gopiplus
    Email Posts To Subscribers
    risk 0.53cvss 8.2epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gopi Ramasamy Email posts to subscribers allows SQL Injection.This issue affects Email posts to subscribers: from n/a through 6.2.

  • CVE-2023-46947HigNov 3, 2023
    Subrion
    Subrion
    risk 0.57cvss 8.8epss 0.02

    Subrion 4.2.1 has a remote command execution vulnerability in the backend.

  • CVE-2023-26015HigNov 3, 2023
    WordPress
    MapPress Maps for WordPress
    risk 0.46cvss 7.1epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Chris Richardson MapPress Maps for WordPress mappress-google-maps-for-wordpress allows SQL Injection.This issue affects MapPress Maps for WordPress: from n/a through 2.85.4.

  • CVE-2022-47445HigNov 3, 2023
    Web X
    Be Popia Compliant
    risk 0.53cvss 8.2epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Web-X Be POPIA Compliant be-popia-compliant allows SQL Injection.This issue affects Be POPIA Compliant: from n/a through 1.2.0.

  • CVE-2022-46859HigNov 3, 2023
    Spiffyplugins
    Spiffy Calendar
    risk 0.55cvss 8.5epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a through 4.9.1.

  • CVE-2022-46808HigNov 3, 2023
    Reputeinfosystems
    Armember
    risk 0.53cvss 8.2epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Repute Infosystems ARMember armember-membership allows SQL Injection.This issue affects ARMember: from n/a through 3.4.11.

  • CVE-2022-45805HigNov 3, 2023
    Paytm
    Payment Gateway
    risk 0.53cvss 8.2epss 0.02

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paytm Paytm Payment Gateway paytm-payments allows SQL Injection.This issue affects Paytm Payment Gateway: from n/a through 2.7.3.

  • CVE-2023-4591HigNov 3, 2023
    WPN XM Serverstack
    WPN-XM Serverstack
    risk 0.49cvss 7.5epss 0.01

    A local file inclusion vulnerability has been found in WPN-XM Serverstack affecting version 0.8.6, which would allow an unauthenticated user to perform a local file inclusion (LFI) via the /tools/webinterface/index.php?page parameter by sending a GET request. This vulnerability…

  • CVE-2023-41652HigNov 3, 2023
    Carrcommunications
    Rsvpmaker
    risk 0.53cvss 8.2epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David F. Carr RSVPMaker rsvpmaker allows SQL Injection.This issue affects RSVPMaker: from n/a through 10.6.6.

  • CVE-2023-34383HigNov 3, 2023
    Leevio
    WP Project Manager
    risk 0.55cvss 8.5epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP Project Manager wedevs-project-manager allows SQL Injection.This issue affects WP Project Manager: from n/a through 2.6.0.

  • CVE-2023-1476HigNov 3, 2023
    Linux
    Kernel
    risk 0.00cvss 7.0epss 0.00

    A use-after-free flaw was found in the Linux kernel’s mm/mremap memory address space accounting source code. This issue occurs due to a race condition between rmap walk and mremap, allowing a local user to crash the system or potentially escalate their privileges on the system.

  • CVE-2023-5824HigNov 3, 2023
    Squid Cache
    Squid
    risk 0.49cvss 7.5epss 0.03

    A flaw was found in Squid. The limits applied for validation of HTTP response headers are applied before caching. However, Squid may grow a cached HTTP response header beyond the configured maximum size, causing a stall or crash of the worker process when a large header is…

  • CVE-2023-46848HigNov 3, 2023
    Squid Cache
    Squid
    risk 0.57cvss 8.6epss 0.11

    Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native input.

  • CVE-2023-46847HigNov 3, 2023
    Squid Cache
    Squid
    risk 0.63cvss 8.6epss 0.79

    Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.

  • CVE-2023-1194HigNov 3, 2023
    Linux
    Kernel
    risk 0.46cvss 7.1epss 0.01

    An out-of-bounds (OOB) memory read flaw was found in parse_lease_state in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel. When an attacker sends the CREATE command with a malformed payload to KSMBD, due to a missing check of `NameOffset` in…

  • CVE-2023-41357HigNov 3, 2023
    Galaxy Software Services Corporation
    Vitals Esp
    risk 0.57cvss 8.8epss 0.01

    Galaxy Software Services Corporation Vitals ESP is an online knowledge base management portal, it has insufficient filtering and validation during file upload. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload and execute…

  • CVE-2023-41344HigNov 3, 2023
    Ncsist
    Mobile Device Manager
    risk 0.49cvss 7.5epss 0.01

    NCSIST ManageEngine Mobile Device Manager(MDM) APP's special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and read arbitrary system files.

  • CVE-2023-41353HigNov 3, 2023
    Chunghwa Telecom
    NOKIA G-040W-Q
    risk 0.57cvss 8.8epss 0.01

    Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of weak password requirements. A remote attacker with regular user privilege can easily infer the administrator password from system information after logging system, resulting in admin access and performing arbitrary system…

  • CVE-2023-41352HigNov 3, 2023
    Chunghwa Telecom
    NOKIA G-040W-Q
    risk 0.47cvss 7.2epss 0.02

    Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate…

  • CVE-2023-45024HigNov 3, 2023
    Bestpractical
    Request Tracker
    risk 0.49cvss 7.5epss 0.01

    Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder.

  • CVE-2023-44271HigNov 3, 2023
    Python (programming language)
    Pillow
    risk 0.42cvss 7.5epss 0.01

    An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw…