| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-46311 | Hig | 0.49 | 7.5 | 0.00 | Dec 20, 2022 | The contacts component has a free (undefined) provider vulnerability. Successful exploitation of this vulnerability may affect data integrity. | ||
| CVE-2022-46310 | Hig | 0.49 | 7.5 | 0.00 | Dec 20, 2022 | The TelephonyProvider module has a vulnerability in obtaining values.Successful exploitation of this vulnerability may affect data confidentiality. | ||
| CVE-2022-41599 | Hig | 0.49 | 7.5 | 0.00 | Dec 20, 2022 | The system service has a vulnerability that causes incorrect return values. Successful exploitation of this vulnerability may affect data confidentiality. | ||
| CVE-2022-41596 | Hig | 0.49 | 7.5 | 0.00 | Dec 20, 2022 | The system tool has inconsistent serialization and deserialization. Successful exploitation of this vulnerability will cause unauthorized startup of components. | ||
| CVE-2022-41591 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | The backup module has a path traversal vulnerability. Successful exploitation of this vulnerability causes unauthorized access to other system files. | ||
| CVE-2022-38733 | Hig | 0.56 | 8.6 | 0.01 | Dec 20, 2022 | OnCommand Insight versions 7.3.1 through 7.3.14 are susceptible to an authentication bypass vulnerability in the Data Warehouse component. | ||
| CVE-2022-23542 | Hig | 0.50 | 7.7 | 0.01 | Dec 20, 2022 | OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered that OpenFGA version 0.3.0 is vulnerable to authorization bypass under certain conditions. This issue has been patched in… | ||
| CVE-2021-46856 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | The multi-screen collaboration module has a path traversal vulnerability. Successful exploitation of this vulnerability may affect data confidentiality. | ||
| CVE-2022-46914 | Hig | 0.57 | 8.8 | 0.01 | Dec 20, 2022 | An issue in the firmware update process of TP-LINK TL-WA801N / TL-WA801ND V1 v3.12.16 and earlier allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image. | ||
| CVE-2022-46912 | Hig | 0.57 | 8.8 | 0.01 | Dec 20, 2022 | An issue in the firmware update process of TP-Link TL-WR841N / TL-WA841ND V7 3.13.9 and earlier allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image. | ||
| CVE-2022-46910 | Hig | 0.57 | 8.8 | 0.01 | Dec 20, 2022 | An issue in the firmware update process of TP-Link TL-WA901ND V1 up to v3.11.2 and TL-WA901N V2 up to v3.12.16 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image. | ||
| CVE-2022-46435 | Hig | 0.57 | 8.8 | 0.01 | Dec 20, 2022 | An issue in the firmware update process of TP-Link TL-WR941ND V2/V3 up to 3.13.9 and TL-WR941ND V4 up to 3.12.8 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image. | ||
| CVE-2022-46434 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | An issue in the firmware update process of TP-Link TL-WA7510N v1 v3.12.6 and earlier allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image. | ||
| CVE-2022-46432 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | An exploitable firmware modification vulnerability was discovered on TP-Link TL-WR743ND V1. An attacker can conduct a MITM (Man-in-the-Middle) attack to modify the user-uploaded firmware image and bypass the CRC check, allowing attackers to execute arbitrary code or cause a… | ||
| CVE-2022-46424 | Hig | 0.53 | 8.1 | 0.01 | Dec 20, 2022 | An exploitable firmware modification vulnerability was discovered on the Netgear XWN5001 Powerline 500 WiFi Access Point. An attacker can conduct a MITM (Man-in-the-Middle) attack to modify the user-uploaded firmware image and bypass the CRC check, allowing attackers to execute… | ||
| CVE-2022-46423 | Hig | 0.53 | 8.1 | 0.00 | Dec 20, 2022 | An exploitable firmware modification vulnerability was discovered on the Netgear WNR2000v1 router. An attacker can conduct a MITM (Man-in-the-Middle) attack to modify the user-uploaded firmware image and bypass the CRC check, allowing attackers to execute arbitrary code or cause… | ||
| CVE-2022-38873 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | D-Link devices DAP-2310 v2.10rc036 and earlier, DAP-2330 v1.06rc020 and earlier, DAP-2360 v2.10rc050 and earlier, DAP-2553 v3.10rc031 and earlier, DAP-2660 v1.15rc093 and earlier, DAP-2690 v3.20rc106 and earlier, DAP-2695 v1.20rc119_beta31 and earlier, DAP-3320 v1.05rc027 beta… | ||
| CVE-2022-4515 | Hig | 0.51 | 7.8 | 0.01 | Dec 20, 2022 | A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c… | ||
| CVE-2022-46076 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | D-Link DIR-869 DIR869Ax_FW102B15 is vulnerable to Authentication Bypass via phpcgi. | ||
| CVE-2022-46551 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the time parameter at /goform/saveParentControlInfo. | ||
| CVE-2022-46550 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the urls parameter at /goform/saveParentControlInfo. | ||
| CVE-2022-46549 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceId parameter at /goform/saveParentControlInfo. | ||
| CVE-2022-46548 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/DhcpListClient. | ||
| CVE-2022-46547 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/VirtualSer. | ||
| CVE-2022-46546 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the entrys parameter at /goform/RouteStatic. | ||
| CVE-2022-46545 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/NatStaticSetting. | ||
| CVE-2022-46544 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the cmdinput parameter at /goform/exeCommand. | ||
| CVE-2022-46543 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the mitInterface parameter at /goform/addressNat. | ||
| CVE-2022-46542 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/addressNat. | ||
| CVE-2022-46541 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the ssid parameter at /goform/fast_setting_wifi_set. | ||
| CVE-2022-46540 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the entrys parameter at /goform/addressNat. | ||
| CVE-2022-46539 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the security_5g parameter at /goform/WifiBasicSet. | ||
| CVE-2022-46537 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the security parameter at /goform/WifiBasicSet. | ||
| CVE-2022-46536 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the limitSpeedUp parameter at /goform/SetClientState. | ||
| CVE-2022-46535 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceId parameter at /goform/SetClientState. | ||
| CVE-2022-46534 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the speed_dir parameter at /goform/SetSpeedWan. | ||
| CVE-2022-46533 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the limitSpeed parameter at /goform/SetClientState. | ||
| CVE-2022-46532 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceMac parameter at /goform/addWifiMacFilter. | ||
| CVE-2022-46531 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceId parameter at /goform/addWifiMacFilter. | ||
| CVE-2022-46530 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the mac parameter at /goform/GetParentControlInfo. | ||
| CVE-2022-45666 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the list parameter in the formwrlSSIDset function. | ||
| CVE-2022-45665 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the funcpara1 parameter in the formSetCfm function. | ||
| CVE-2022-45942 | Hig | 0.59 | 8.8 | 0.22 | Dec 20, 2022 | A Remote Code Execution (RCE) vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4. | ||
| CVE-2022-25940 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | All versions of package lite-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters that the decodeURI() function is unable to parse. | ||
| CVE-2022-25931 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code. | ||
| CVE-2022-25904 | Hig | 0.49 | 7.5 | 0.01 | Dec 20, 2022 | All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify properties of the Object.prototype.Consolidate when using the function safeEval. This is because the function uses vm variable, leading an attacker to modify… | ||
| CVE-2022-25171 | Hig | 0.41 | 7.4 | 0.02 | Dec 20, 2022 | The package p4 before 0.0.7 are vulnerable to Command Injection via the run() function due to improper input sanitization | ||
| CVE-2022-47578 | Hig | 0.46 | 7.1 | 0.01 | Dec 20, 2022 | An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the… | ||
| CVE-2022-47577 | Hig | 0.46 | 7.1 | 0.01 | Dec 20, 2022 | An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the… | ||
| CVE-2022-46403 | Hig | 0.56 | 8.6 | 0.01 | Dec 19, 2022 | The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) mishandles reject messages. |
- risk 0.49cvss 7.5epss 0.00
The contacts component has a free (undefined) provider vulnerability. Successful exploitation of this vulnerability may affect data integrity.
- risk 0.49cvss 7.5epss 0.00
The TelephonyProvider module has a vulnerability in obtaining values.Successful exploitation of this vulnerability may affect data confidentiality.
- risk 0.49cvss 7.5epss 0.00
The system service has a vulnerability that causes incorrect return values. Successful exploitation of this vulnerability may affect data confidentiality.
- risk 0.49cvss 7.5epss 0.00
The system tool has inconsistent serialization and deserialization. Successful exploitation of this vulnerability will cause unauthorized startup of components.
- risk 0.49cvss 7.5epss 0.01
The backup module has a path traversal vulnerability. Successful exploitation of this vulnerability causes unauthorized access to other system files.
- risk 0.56cvss 8.6epss 0.01
OnCommand Insight versions 7.3.1 through 7.3.14 are susceptible to an authentication bypass vulnerability in the Data Warehouse component.
- risk 0.50cvss 7.7epss 0.01
OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered that OpenFGA version 0.3.0 is vulnerable to authorization bypass under certain conditions. This issue has been patched in…
- risk 0.49cvss 7.5epss 0.01
The multi-screen collaboration module has a path traversal vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.
- risk 0.57cvss 8.8epss 0.01
An issue in the firmware update process of TP-LINK TL-WA801N / TL-WA801ND V1 v3.12.16 and earlier allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image.
- risk 0.57cvss 8.8epss 0.01
An issue in the firmware update process of TP-Link TL-WR841N / TL-WA841ND V7 3.13.9 and earlier allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image.
- risk 0.57cvss 8.8epss 0.01
An issue in the firmware update process of TP-Link TL-WA901ND V1 up to v3.11.2 and TL-WA901N V2 up to v3.12.16 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image.
- risk 0.57cvss 8.8epss 0.01
An issue in the firmware update process of TP-Link TL-WR941ND V2/V3 up to 3.13.9 and TL-WR941ND V4 up to 3.12.8 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image.
- risk 0.49cvss 7.5epss 0.01
An issue in the firmware update process of TP-Link TL-WA7510N v1 v3.12.6 and earlier allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image.
- risk 0.49cvss 7.5epss 0.01
An exploitable firmware modification vulnerability was discovered on TP-Link TL-WR743ND V1. An attacker can conduct a MITM (Man-in-the-Middle) attack to modify the user-uploaded firmware image and bypass the CRC check, allowing attackers to execute arbitrary code or cause a…
- risk 0.53cvss 8.1epss 0.01
An exploitable firmware modification vulnerability was discovered on the Netgear XWN5001 Powerline 500 WiFi Access Point. An attacker can conduct a MITM (Man-in-the-Middle) attack to modify the user-uploaded firmware image and bypass the CRC check, allowing attackers to execute…
- risk 0.53cvss 8.1epss 0.00
An exploitable firmware modification vulnerability was discovered on the Netgear WNR2000v1 router. An attacker can conduct a MITM (Man-in-the-Middle) attack to modify the user-uploaded firmware image and bypass the CRC check, allowing attackers to execute arbitrary code or cause…
- risk 0.49cvss 7.5epss 0.01
D-Link devices DAP-2310 v2.10rc036 and earlier, DAP-2330 v1.06rc020 and earlier, DAP-2360 v2.10rc050 and earlier, DAP-2553 v3.10rc031 and earlier, DAP-2660 v1.15rc093 and earlier, DAP-2690 v3.20rc106 and earlier, DAP-2695 v1.20rc119_beta31 and earlier, DAP-3320 v1.05rc027 beta…
- risk 0.51cvss 7.8epss 0.01
A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c…
- risk 0.49cvss 7.5epss 0.01
D-Link DIR-869 DIR869Ax_FW102B15 is vulnerable to Authentication Bypass via phpcgi.
- risk 0.49cvss 7.5epss 0.01
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the time parameter at /goform/saveParentControlInfo.
- risk 0.49cvss 7.5epss 0.01
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the urls parameter at /goform/saveParentControlInfo.
- risk 0.49cvss 7.5epss 0.01
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceId parameter at /goform/saveParentControlInfo.
- risk 0.49cvss 7.5epss 0.01
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/DhcpListClient.
- risk 0.49cvss 7.5epss 0.01
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/VirtualSer.
- risk 0.49cvss 7.5epss 0.01
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the entrys parameter at /goform/RouteStatic.
- risk 0.49cvss 7.5epss 0.01
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/NatStaticSetting.
- risk 0.49cvss 7.5epss 0.01
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the cmdinput parameter at /goform/exeCommand.
- risk 0.49cvss 7.5epss 0.01
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the mitInterface parameter at /goform/addressNat.
- risk 0.49cvss 7.5epss 0.01
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/addressNat.
- risk 0.49cvss 7.5epss 0.01
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the ssid parameter at /goform/fast_setting_wifi_set.
- risk 0.49cvss 7.5epss 0.01
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the entrys parameter at /goform/addressNat.
- risk 0.49cvss 7.5epss 0.01
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the security_5g parameter at /goform/WifiBasicSet.
- risk 0.49cvss 7.5epss 0.01
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the security parameter at /goform/WifiBasicSet.
- risk 0.49cvss 7.5epss 0.01
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the limitSpeedUp parameter at /goform/SetClientState.
- risk 0.49cvss 7.5epss 0.01
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceId parameter at /goform/SetClientState.
- risk 0.49cvss 7.5epss 0.01
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the speed_dir parameter at /goform/SetSpeedWan.
- risk 0.49cvss 7.5epss 0.01
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the limitSpeed parameter at /goform/SetClientState.
- risk 0.49cvss 7.5epss 0.01
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceMac parameter at /goform/addWifiMacFilter.
- risk 0.49cvss 7.5epss 0.01
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceId parameter at /goform/addWifiMacFilter.
- risk 0.49cvss 7.5epss 0.01
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the mac parameter at /goform/GetParentControlInfo.
- risk 0.49cvss 7.5epss 0.01
Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the list parameter in the formwrlSSIDset function.
- risk 0.49cvss 7.5epss 0.01
Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the funcpara1 parameter in the formSetCfm function.
- risk 0.59cvss 8.8epss 0.22
A Remote Code Execution (RCE) vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4.
- risk 0.49cvss 7.5epss 0.01
All versions of package lite-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters that the decodeURI() function is unable to parse.
- risk 0.49cvss 7.5epss 0.01
All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code.
- risk 0.49cvss 7.5epss 0.01
All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify properties of the Object.prototype.Consolidate when using the function safeEval. This is because the function uses vm variable, leading an attacker to modify…
- risk 0.41cvss 7.4epss 0.02
The package p4 before 0.0.7 are vulnerable to Command Injection via the run() function due to improper input sanitization
- risk 0.46cvss 7.1epss 0.01
An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the…
- risk 0.46cvss 7.1epss 0.01
An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the…
- risk 0.56cvss 8.6epss 0.01
The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) mishandles reject messages.