VYPR

CVEs

130,206 total · page 1707 of 2,605

AllCriticalHighKEV
  • CVE-2022-30473HigMay 26, 2022
    Tenda
    AC Series Router
    risk 0.49cvss 7.5epss 0.01

    Tenda AC Series Router AC18_V15.03.05.19(6318) has a stack-based buffer overflow vulnerability in function form_fast_setting_wifi_set

  • CVE-2022-24418HigMay 26, 2022
    Dell
    BIOS
    risk 0.49cvss 7.5epss 0.00

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.

  • CVE-2022-24417HigMay 26, 2022
    Dell
    BIOS
    risk 0.49cvss 7.5epss 0.00

    Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.

  • CVE-2022-24414HigMay 26, 2022
    Dell
    CloudLink
    risk 0.49cvss 7.6epss 0.01

    Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. These request parameters can get logged in reverse proxies and server logs. Attackers may potentially use these tokens to access CloudLink server. Tokens should not be used in request URL…

  • CVE-2022-1886HigMay 26, 2022
    Vim
    Vim
    risk 0.51cvss 7.8epss 0.01

    Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

  • CVE-2022-29689HigMay 26, 2022
    Cscms
    music portal system
    risk 0.47cvss 7.2epss 0.01

    CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/singer/del.

  • CVE-2022-29688HigMay 26, 2022
    Cscms
    Cscms
    risk 0.47cvss 7.2epss 0.01

    CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/singer/hy.

  • CVE-2022-29687HigMay 26, 2022
    Cscms
    Cscms
    risk 0.47cvss 7.2epss 0.01

    CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/user/level_del.

  • CVE-2022-29686HigMay 26, 2022
    Cscms
    music portal system
    risk 0.47cvss 7.2epss 0.01

    CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/lists/zhuan.

  • CVE-2022-29685HigMay 26, 2022
    Cscms
    Cscms
    risk 0.57cvss 8.8epss 0.01

    CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/User/level_sort.

  • CVE-2022-29684HigMay 26, 2022
    Cscms
    music portal system
    risk 0.47cvss 7.2epss 0.01

    CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Label/js_del.

  • CVE-2022-29683HigMay 26, 2022
    Cscms
    Cscms
    risk 0.47cvss 7.2epss 0.01

    CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Label/page_del.

  • CVE-2022-29682HigMay 26, 2022
    Cscms
    Cscms
    risk 0.47cvss 7.2epss 0.01

    CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/vod/admin/topic/del.

  • CVE-2022-29681HigMay 26, 2022
    Cscms
    Cscms
    risk 0.47cvss 7.2epss 0.01

    CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Links/del.

  • CVE-2022-29680HigMay 26, 2022
    Cscms
    Cscms
    risk 0.47cvss 7.2epss 0.01

    CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/user/zu_del.

  • CVE-2022-29676HigMay 26, 2022
    Cscms
    Cscms
    risk 0.47cvss 7.2epss 0.01

    CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/lists/zhuan.

  • CVE-2022-29670HigMay 26, 2022
    Cscms
    music portal system
    risk 0.47cvss 7.2epss 0.01

    CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/del.

  • CVE-2022-29669HigMay 26, 2022
    Cscms
    music portal system
    risk 0.57cvss 8.8epss 0.01

    CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/lists/zhuan.

  • CVE-2022-29667HigMay 26, 2022
    Cscms
    music portal system
    risk 0.57cvss 8.8epss 0.01

    CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via /admin.php/pic/admin/pic/hy. This vulnerability is exploited via restoring deleted photos.

  • CVE-2022-29666HigMay 26, 2022
    Cscms
    music portal system
    risk 0.47cvss 7.2epss 0.01

    CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/lists/zhuan.

  • CVE-2022-29665HigMay 26, 2022
    Cscms
    Cscms
    risk 0.47cvss 7.2epss 0.01

    CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/topic/save.

  • CVE-2022-29664HigMay 26, 2022
    Cscms
    music portal system
    risk 0.57cvss 8.8epss 0.01

    CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/pl_save.

  • CVE-2022-29663HigMay 26, 2022
    Cscms
    Cscms
    risk 0.47cvss 7.2epss 0.01

    CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/hy.

  • CVE-2022-29662HigMay 26, 2022
    Cscms
    music portal system
    risk 0.47cvss 7.2epss 0.01

    CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/news/save.

  • CVE-2022-29661HigMay 26, 2022
    Cscms
    music portal system
    risk 0.47cvss 7.2epss 0.01

    CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/save.

  • CVE-2022-29721HigMay 26, 2022
    74cmsSE
    74cmsSE
    risk 0.49cvss 7.5epss 0.01

    74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/jobfairol/resumelist.

  • CVE-2022-29720HigMay 26, 2022
    74cmsSE
    74cmsSE
    risk 0.49cvss 7.5epss 0.01

    74cmsSE v3.5.1 was discovered to contain an arbitrary file read vulnerability via the component \index\controller\Download.php.

  • CVE-2021-40317HigMay 26, 2022
    Piwigo
    Piwigo
    risk 0.57cvss 8.8epss 0.01

    Piwigo 11.5.0 is affected by a SQL injection vulnerability via admin.php and the id parameter.

  • CVE-2021-42860HigMay 26, 2022
    Mini-XML
    Mini-XML
    risk 0.49cvss 7.5epss 0.01

    A stack buffer overflow exists in Mini-XML v3.2. When inputting an unformed XML string to the mxmlLoadString API, it will cause a stack-buffer-overflow in mxml_string_getc:2611. NOTE: it is unclear whether this input is allowed by the API specification

  • CVE-2021-42859HigMay 26, 2022
    Mini-XML
    Mini-XML
    risk 0.49cvss 7.5epss 0.01

    A memory leak issue was discovered in Mini-XML v3.2 that could cause a denial of service. NOTE: testing reports are inconsistent, with some testers seeing the issue in both the 3.2 release and in the October 2021 development code, but others not seeing the issue in the 3.2…

  • CVE-2022-29252HigMay 25, 2022
    Cryptpad
    Xwiki
    risk 0.41cvss 7.4epss 0.01

    XWiki Platform Wiki UI Main Wiki is a package for managing subwikis. Starting with version 5.3-milestone-2, XWiki Platform Wiki UI Main Wiki contains a possible cross-site scripting vector in the `WikiManager.JoinWiki ` wiki page related to the "requestJoin" field. The issue is…

  • CVE-2022-29251HigMay 25, 2022
    Cryptpad
    Xwiki
    risk 0.41cvss 7.4epss 0.01

    XWiki Platform Flamingo Theme UI is a tool that allows customization and preview of any Flamingo-based skin. Starting with versions 6.2.4 and 6.3-rc-1, a possible cross-site scripting vector is present in the `FlamingoThemesCode.WebHomeSheet` wiki page related to the…

  • CVE-2022-27169HigMay 25, 2022
    Open Automation Software
    Oas Platform
    risk 0.49cvss 7.5epss 0.02

    An information disclosure vulnerability exists in the OAS Engine SecureBrowseFile functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted network request can lead to a disclosure of sensitive information. An attacker can send a network request to…

  • CVE-2022-26303HigMay 25, 2022
    Open Automation Software
    Oas Platform
    risk 0.49cvss 7.5epss 0.01

    An external config control vulnerability exists in the OAS Engine SecureAddUser functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to the creation of an OAS user account. An attacker can send a sequence of…

  • CVE-2022-26077HigMay 25, 2022
    Open Automation Software
    Oas Platform
    risk 0.49cvss 7.5epss 0.01

    A cleartext transmission of sensitive information vulnerability exists in the OAS Engine configuration communications functionality of Open Automation Software OAS Platform V16.00.0112. A targeted network sniffing attack can lead to a disclosure of sensitive information. An…

  • CVE-2022-26043HigMay 25, 2022
    Open Automation Software
    Oas Platform
    risk 0.49cvss 7.5epss 0.01

    An external config control vulnerability exists in the OAS Engine SecureAddSecurity functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to the creation of a custom Security Group. An attacker can send a…

  • CVE-2022-26026HigMay 25, 2022
    Open Automation Software
    Oas Platform
    risk 0.49cvss 7.5epss 0.01

    A denial of service vulnerability exists in the OAS Engine SecureConfigValues functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted network request can lead to loss of communications. An attacker can send a network request to trigger this…

  • CVE-2022-29248HigMay 25, 2022
    Guzzle
    Guzzle
    risk 0.45cvss 8.0epss 0.01

    Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the Set-Cookie header, allowing a…

  • CVE-2022-30428HigMay 25, 2022
    Ginadmin Project
    Ginadmin
    risk 0.42cvss 7.5epss 0.01

    In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading.

  • CVE-2022-30427HigMay 25, 2022
    Ginadmin Project
    Ginadmin
    risk 0.42cvss 7.5epss 0.02

    In ginadmin through 05-10-2022 the incoming path value is not filtered, resulting in directory traversal.

  • CVE-2022-27305HigMay 25, 2022
    Gibbon
    Gibbon
    risk 0.57cvss 8.8epss 0.01

    Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation.

  • CVE-2021-44719HigMay 25, 2022
    Docker
    Desktop
    risk 0.55cvss 8.4epss 0.00

    Docker Desktop 4.3.0 has Incorrect Access Control.

  • CVE-2022-22127HigMay 25, 2022
    Tableausoftware
    Server
    risk 0.47cvss 7.2epss 0.01

    Tableau is aware of a broken access control vulnerability present in Tableau Server affecting Tableau Server customers using Local Identity Store for managing users. The vulnerability allows a malicious site administrator to change passwords for users in different sites hosted…

  • CVE-2021-32997HigMay 25, 2022
    Baker Hughes Bentley Nevada
    3500 System 1
    risk 0.53cvss 8.2epss 0.00

    The affected Baker Hughes Bentley Nevada products (3500 System 1 6.x, Part No. 3060/00 versions 6.98 and prior, 3500 System 1, Part No. 3071/xx & 3072/xx versions 21.1 HF1 and prior, 3500 Rack Configuration, Part No. 129133-01 versions 6.4 and prior, and 3500/22M Firmware, Part…

  • CVE-2022-29651HigMay 25, 2022
    Oretnom23
    Online Food Ordering System
    risk 0.47cvss 7.2epss 0.02

    An arbitrary file upload vulnerability in the Select Image function of Online Food Ordering System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.

  • CVE-2022-1851HigMay 25, 2022
    Vim
    Vim
    risk 0.51cvss 7.8epss 0.02

    Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.

  • CVE-2022-30323HigMay 25, 2022
    Hashicorp
    Go Getter
    risk 0.49cvss 8.6epss 0.01

    go-getter up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files. Fixed in 1.6.1 and 2.1.0.

  • CVE-2022-30322HigMay 25, 2022
    Hashicorp
    Go Getter
    risk 0.49cvss 8.6epss 0.01

    go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses. Fixed in 1.6.1 and 2.1.0.

  • CVE-2022-30321HigMay 25, 2022
    Hashicorp
    Go Getter
    risk 0.49cvss 8.6epss 0.03

    go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0.

  • CVE-2022-1883HigMay 25, 2022
    camptocamp
    terraboard
    risk 0.58cvss 8.8epss 0.07

    SQL Injection in GitHub repository camptocamp/terraboard prior to 2.2.0.