VYPR

CVEs

130,191 total · page 1749 of 2,604

AllCriticalHighKEV
  • CVE-2022-22151HigMar 11, 2022
    Yokogawa
    Exaopc
    risk 0.53cvss 8.1epss 0.01

    CAMS for HIS Log Server contained in the following Yokogawa Electric products fails to properly neutralize log outputs: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, and…

  • CVE-2022-22148HigMar 11, 2022
    Yokogawa
    Exaopc
    risk 0.51cvss 7.8epss 0.00

    'Root Service' service implemented in the following Yokogawa Electric products creates some named pipe with improper ACL configuration. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00…

  • CVE-2022-22145HigMar 11, 2022
    Yokogawa
    Exaopc
    risk 0.53cvss 8.1epss 0.01

    CAMS for HIS Log Server contained in the following Yokogawa Electric products is vulnerable to uncontrolled resource consumption. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, from R6.01.00 to…

  • CVE-2022-22141HigMar 11, 2022
    Yokogawa
    Exaopc
    risk 0.51cvss 7.8epss 0.00

    'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL configuration. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20,…

  • CVE-2022-21808HigMar 11, 2022
    Yokogawa
    Exaopc
    risk 0.57cvss 8.8epss 0.01

    Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc…

  • CVE-2022-21177HigMar 11, 2022
    Yokogawa
    Exaopc
    risk 0.53cvss 8.1epss 0.01

    There is a path traversal vulnerability in CAMS for HIS Log Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, andfrom R6.01.00 to R6.08.00,…

  • CVE-2020-36518HigMar 11, 2022
    NetApp
    Oncommand Insight
    risk 0.42cvss 7.5epss 0.05

    jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

  • CVE-2022-25512HigMar 11, 2022
    Freetakserver UI Project
    Freetakserver UI
    risk 0.49cvss 7.5epss 0.01

    FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys.

  • CVE-2022-25510HigMar 11, 2022
    Freetakserver UI Project
    Freetakserver UI
    risk 0.57cvss 8.8epss 0.01

    FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escalate privileges.

  • CVE-2022-25508HigMar 11, 2022
    Freetakserver UI Project
    Freetakserver UI
    risk 0.49cvss 7.5epss 0.01

    An access control issue in the component /ManageRoute/postRoute of FreeTAKServer v1.9.8 allows unauthenticated attackers to cause a Denial of Service (DoS) via an unusually large amount of created routes, or create unsafe or false routes for legitimate users.

  • CVE-2022-0280HigMar 10, 2022
    McAfee
    McAfee Total Protection
    risk 0.49cvss 7.5epss 0.00

    A race condition vulnerability exists in the QuickClean feature of McAfee Total Protection for Windows prior to 16.0.43 that allows a local user to gain privilege elevation and perform an arbitrary file delete. This could lead to sensitive files being deleted and potentially…

  • CVE-2022-24750HigMar 10, 2022
    Ultravnc
    Ultravnc
    risk 0.57cvss 8.8epss 0.00

    UltraVNC is a free and open source remote pc access software. A vulnerability has been found in versions prior to 1.3.8.0 in which the DSM plugin module, which allows a local authenticated user to achieve local privilege escalation (LPE) on a vulnerable system. The vulnerability…

  • CVE-2022-24726HigMar 10, 2022
    Istio
    Istio
    risk 0.49cvss 7.5epss 0.02

    Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane…

  • CVE-2022-23042HigMar 10, 2022
    Xen
    Xen
    risk 0.46cvss 7.0epss 0.00

    Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access…

  • CVE-2022-23041HigMar 10, 2022
    Xen
    Xen
    risk 0.46cvss 7.0epss 0.00

    Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access…

  • CVE-2022-23040HigMar 10, 2022
    Xen
    Xen
    risk 0.46cvss 7.0epss 0.00

    Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access…

  • CVE-2022-23039HigMar 10, 2022
    Xen
    Xen
    risk 0.46cvss 7.0epss 0.00

    Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access…

  • CVE-2022-23038HigMar 10, 2022
    Xen
    Xen
    risk 0.46cvss 7.0epss 0.00

    Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access…

  • CVE-2022-23037HigMar 10, 2022
    Xen
    Xen
    risk 0.46cvss 7.0epss 0.00

    Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access…

  • CVE-2022-23036HigMar 10, 2022
    Xen
    Xen
    risk 0.46cvss 7.0epss 0.00

    Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access…

  • CVE-2021-39022HigMar 10, 2022
    IBM
    Guardium Data Encryption
    risk 0.57cvss 8.8epss 0.00

    IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by spreadsheet…

  • CVE-2021-44673HigMar 10, 2022
    Croogo
    Croogo
    risk 0.61cvss 8.8epss 0.09

    A Remote Code Execution (RCE) vulnerability exists in Croogo 3.0.2via admin/file-manager/attachments, which lets a malicoius user upload a web shell script.

  • CVE-2022-26846HigMar 10, 2022
    Spip
    Spip
    risk 0.57cvss 8.8epss 0.03

    SPIP before 3.2.14 and 4.x before 4.0.5 allows remote authenticated editors to execute arbitrary code.

  • CVE-2022-26662HigMar 10, 2022
    Tryton
    Proteus
    risk 0.49cvss 7.5epss 0.02

    An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x…

  • CVE-2022-26521HigMar 10, 2022
    AbanteCart
    AbanteCart
    risk 0.51cvss 7.2epss 0.10

    Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Catalog>Media Manager>Images settings can be changed by an administrator (e.g., by configuring .php to be a valid image file type).

  • CVE-2022-26488HigMar 10, 2022
    Python (programming language)
    Python
    risk 0.39cvss 7.0epss 0.01

    In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker to add user-writable directories to the system search path. To exploit, an administrator must have installed Python for…

  • CVE-2022-26311HigMar 10, 2022
    Couchbase
    Operator
    risk 0.49cvss 7.5epss 0.01

    Couchbase Operator 2.2.x before 2.2.3 exposes Sensitive Information to an Unauthorized Actor. Secrets are not redacted in logs collected from Kubernetes environments.

  • CVE-2022-25566HigMar 10, 2022
    Tenda
    AX1806
    risk 0.49cvss 7.5epss 0.01

    Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) via the time parameter.

  • CVE-2022-25561HigMar 10, 2022
    Tenda
    AX12
    risk 0.49cvss 7.5epss 0.01

    Tenda AX12 v22.03.01.21 was discovered to contain a stack overflow in the function sub_42DE00. This vulnerability allows attackers to cause a Denial of Service (DoS) via the list parameter.

  • CVE-2022-25560HigMar 10, 2022
    Tenda
    AX12
    risk 0.49cvss 7.5epss 0.01

    Tenda AX12 v22.03.01.21 was discovered to contain a stack overflow in the function sub_4327CC. This vulnerability allows attackers to cause a Denial of Service (DoS) via the list parameter.

  • CVE-2022-25558HigMar 10, 2022
    Tenda
    AX1806
    risk 0.49cvss 7.5epss 0.01

    Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetProvince. This vulnerability allows attackers to cause a Denial of Service (DoS) via the ProvinceCode parameter.

  • CVE-2022-25557HigMar 10, 2022
    Tenda
    AX1806
    risk 0.49cvss 7.5epss 0.01

    Tenda AX1806 v1.0.0.1 was discovered to contain a heap overflow in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) via the urls parameter.

  • CVE-2022-25556HigMar 10, 2022
    Tenda
    AX12
    risk 0.49cvss 7.5epss 0.01

    Tenda AX12 v22.03.01.21 was discovered to contain a stack overflow in the function sub_42E328. This vulnerability allows attackers to cause a Denial of Service (DoS) via the list parameter.

  • CVE-2022-25555HigMar 10, 2022
    Tenda
    AX1806
    risk 0.49cvss 7.5epss 0.01

    Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to cause a Denial of Service (DoS) via the ntpServer parameter.

  • CVE-2022-25554HigMar 10, 2022
    Tenda
    AX1806
    risk 0.49cvss 7.5epss 0.01

    Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) via the deviceId parameter.

  • CVE-2022-25553HigMar 10, 2022
    Tenda
    AX1806
    risk 0.49cvss 7.5epss 0.01

    Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetSysToolDDNS. This vulnerability allows attackers to cause a Denial of Service (DoS) via the ddnsPwd parameter.

  • CVE-2022-25552HigMar 10, 2022
    Tenda
    AX1806
    risk 0.49cvss 7.5epss 0.01

    Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function form_fast_setting_wifi_set. This vulnerability allows attackers to cause a Denial of Service (DoS) via the ssid parameter.

  • CVE-2022-25551HigMar 10, 2022
    Tenda
    AX1806
    risk 0.49cvss 7.5epss 0.01

    Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetSysToolDDNS. This vulnerability allows attackers to cause a Denial of Service (DoS) via the ddnsDomain parameter.

  • CVE-2022-25550HigMar 10, 2022
    Tenda
    AX1806
    risk 0.49cvss 7.5epss 0.01

    Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) via the deviceName parameter.

  • CVE-2022-25549HigMar 10, 2022
    Tenda
    AX1806
    risk 0.49cvss 7.5epss 0.01

    Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetSysToolDDNS. This vulnerability allows attackers to cause a Denial of Service (DoS) via the ddnsEn parameter.

  • CVE-2022-25548HigMar 10, 2022
    Tenda
    AX1806
    risk 0.49cvss 7.5epss 0.01

    Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to cause a Denial of Service (DoS) via the serverName parameter.

  • CVE-2022-25547HigMar 10, 2022
    Tenda
    AX1806
    risk 0.49cvss 7.5epss 0.09

    Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to cause a Denial of Service (DoS) via the time parameter.

  • CVE-2022-25546HigMar 10, 2022
    Tenda
    AX1806
    risk 0.50cvss 7.5epss 0.12

    Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetSysToolDDNS. This vulnerability allows attackers to cause a Denial of Service (DoS) via the ddnsUser parameter.

  • CVE-2022-25325HigMar 10, 2022
    Omron
    Cx Programmer
    risk 0.51cvss 7.8epss 0.01

    Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. This vulnerability is different…

  • CVE-2022-25294HigMar 10, 2022
    Proofpoint
    Insider Threat Management
    risk 0.51cvss 7.8epss 0.00

    Proofpoint Insider Threat Management Agent for Windows relies on an inherently dangerous function that could enable an unprivileged local Windows user to run arbitrary code with SYSTEM privileges. All versions prior to 7.12.1 are affected. Agents for MacOS and Linux and Cloud…

  • CVE-2022-25234HigMar 10, 2022
    Omron
    Cx Programmer
    risk 0.51cvss 7.8epss 0.01

    Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. This vulnerability is…

  • CVE-2022-25230HigMar 10, 2022
    Omron
    Cx Programmer
    risk 0.51cvss 7.8epss 0.01

    Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. This vulnerability is different…

  • CVE-2022-25225HigMar 10, 2022
    Network Olympus
    Network Olympus
    risk 0.47cvss 7.2epss 0.03

    Network Olympus version 1.8.0 allows an authenticated admin user to inject SQL queries in '/api/eventinstance' via the 'sqlparameter' JSON parameter. It is also possible to achieve remote code execution in the default installation (PostgreSQL) by exploiting this issue.

  • CVE-2022-25219HigMar 10, 2022
    Phicomm
    K2 Firmware
    risk 0.55cvss 8.4epss 0.01

    A null byte interaction error has been discovered in the code that the telnetd_startup daemon uses to construct a pair of ephemeral passwords that allow a user to spawn a telnet service on the router, and to ensure that the telnet service persists upon reboot. By means of a…

  • CVE-2022-25218HigMar 10, 2022
    OpenSSL Project
    OpenSSL
    risk 0.53cvss 8.1epss 0.01

    The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetd_startup, allows an unauthenticated attacker on the local area network to achieve a significant degree of control over the "plaintext" to which an arbitrary blob of ciphertext will be decrypted by…