VYPR

CVEs

31,788 total · page 234 of 636

AllCriticalHighKEV
  • CVE-2023-45386CriOct 17, 2023
    MyPresta.eu
    extratabspro
    risk 0.64cvss 9.8epss 0.01

    In the module extratabspro before version 2.2.8 from MyPresta.eu for PrestaShop, a guest can perform SQL injection via `extratabspro::searchcategory()`, `extratabspro::searchproduct()` and `extratabspro::searchmanufacturer().'

  • CVE-2023-34207CriOct 17, 2023
    EasyUse
    MailHunter Ultimate
    risk 0.64cvss 9.9epss 0.01

    Unrestricted upload of file with dangerous type vulnerability in create template function in EasyUse MailHunter Ultimate 2023 and earlier allows remote authenticated users to perform arbitrary system commands with ‘NT Authority\SYSTEM‘ privilege via a crafted ZIP archive.

  • CVE-2023-45144CriOct 16, 2023
    Cryptpad
    Identity OAuth
    risk 0.58cvss 10.0epss 0.01

    com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting (XSS) and…

  • CVE-2023-45128CriOct 16, 2023
    Gofiber
    Fiber
    risk 0.58cvss 10.0epss 0.00

    Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulnerability can allow…

  • CVE-2023-40852CriOct 16, 2023
    Phpgurukul
    User Registration \& Login And User Management System
    risk 0.64cvss 9.8epss 0.01

    SQL Injection vulnerability in Phpgurukul User Registration & Login and User Management System With admin panel 3.0 allows attackers to obtain sensitive information via crafted string in the admin user name field on the admin log in page.

  • CVE-2023-4666CriOct 16, 2023
    WordPress
    Form Maker by 10Web
    risk 0.64cvss 9.8epss 0.03

    The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE

  • CVE-2023-43119CriOct 16, 2023
    Extremenetworks
    Switch Engine (EXOS)
    risk 0.64cvss 9.8epss 0.01

    An Access Control issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, also fixed in 22.7, 31.7.2 allows attackers to gain escalated privileges using crafted telnet commands via Redis server.

  • CVE-2023-45984CriOct 16, 2023
    Totolink
    X5000R
    risk 0.64cvss 9.8epss 0.01

    TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the lang parameter in the function setLanguageCfg.

  • CVE-2023-45685CriOct 16, 2023
    South River Technologies
    Titan Mft
    risk 0.59cvss 9.1epss 0.01

    Insufficient path validation when extracting a zip archive in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authenticated attacker to write a file to any location on the filesystem via path traversal

  • CVE-2023-20198CriKEVOct 16, 2023
    Cisco Systems, Inc.
    iOS Xr Software
    risk 0.88cvss 10.0epss 1.00

    Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two…

  • CVE-2023-3991CriOct 16, 2023
    FreshTomato
    FreshTomato
    risk 0.65cvss 10.0epss 0.02

    An OS command injection vulnerability exists in the httpd iperfrun.cgi functionality of FreshTomato 2023.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.

  • CVE-2023-43668CriOct 16, 2023
    Apache
    InLong
    risk 0.57cvss 9.8epss 0.01

    Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0,  some sensitive params checks will be bypassed, like "autoDeserizalize","allowLoadLocalInfile".... .   Users are advised to upgrade…

  • CVE-2023-45158CriOct 16, 2023
    Web2py
    Web2py
    risk 0.00cvss 9.8epss 0.04

    An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.

  • CVE-2023-45580CriOct 16, 2023
    Dlink
    DI-7003GV2
    risk 0.64cvss 9.8epss 0.01

    Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and…

  • CVE-2023-45579CriOct 16, 2023
    Dlink
    DI-7003GV2
    risk 0.64cvss 9.8epss 0.01

    Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and…

  • CVE-2023-45578CriOct 16, 2023
    Dlink
    DI-7003GV2
    risk 0.64cvss 9.8epss 0.01

    Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and…

  • CVE-2023-45577CriOct 16, 2023
    Dlink
    DI-7003GV2
    risk 0.64cvss 9.8epss 0.01

    Stack Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1…

  • CVE-2023-45576CriOct 16, 2023
    Dlink
    DI-7003GV2
    risk 0.64cvss 9.8epss 0.01

    Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and…

  • CVE-2023-21413CriOct 16, 2023
    Axis
    AXIS OS
    risk 0.59cvss 9.1epss 0.01

    GoSecure on behalf of Genetec Inc. has found a flaw that allows for a remote code execution during the installation of ACAP applications on the Axis device. The application handling service in AXIS OS was vulnerable to command injection allowing an attacker to run arbitrary…

  • CVE-2023-45575CriOct 16, 2023
    Dlink
    DI-7003GV2
    risk 0.64cvss 9.8epss 0.01

    Stack Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1…

  • CVE-2023-45574CriOct 16, 2023
    Dlink
    DI-7003GV2
    risk 0.64cvss 9.8epss 0.02

    Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and…

  • CVE-2023-45573CriOct 16, 2023
    Dlink
    DI-7003GV2
    risk 0.64cvss 9.8epss 0.01

    Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and…

  • CVE-2023-45572CriOct 16, 2023
    Dlink
    DI-7003GV2
    risk 0.64cvss 9.8epss 0.01

    Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and…

  • CVE-2023-44809CriOct 16, 2023
    Dlink
    DIR820LA1
    risk 0.64cvss 9.8epss 0.01

    D-Link device DIR-820L 1.05B03 is vulnerable to Insecure Permissions.

  • CVE-2023-44808CriOct 16, 2023
    Dlink
    DIR820LA1
    risk 0.64cvss 9.8epss 0.01

    D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub_4507CC function.

  • CVE-2023-36955CriOct 16, 2023
    Totolink
    CP300
    risk 0.64cvss 9.8epss 0.01

    TOTOLINK CP300+ <=V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule.

  • CVE-2023-36954CriOct 16, 2023
    Totolink
    CP300
    risk 0.64cvss 9.8epss 0.02

    TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection.

  • CVE-2023-36953CriOct 16, 2023
    Totolink
    CP300
    risk 0.64cvss 9.8epss 0.02

    TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection.

  • CVE-2023-36950CriOct 16, 2023
    Totolink
    X5000R
    risk 0.64cvss 9.8epss 0.01

    TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.

  • CVE-2023-36952CriOct 16, 2023
    Totolink
    CP300
    risk 0.64cvss 9.8epss 0.01

    TOTOLINK CP300+ V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the pingIp parameter in the function setDiagnosisCfg.

  • CVE-2023-36947CriOct 16, 2023
    Totolink
    X5000R
    risk 0.64cvss 9.8epss 0.01

    TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule.

  • CVE-2023-36340CriOct 16, 2023
    Totolink
    NR1800X
    risk 0.64cvss 9.8epss 0.01

    TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.

  • CVE-2023-45856CriOct 14, 2023
    Qdpm
    Qdpm
    risk 0.64cvss 9.8epss 0.01

    qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to upload a .php file to the /uploads URI.

  • CVE-2023-30154CriOct 14, 2023
    Prestashop
    aftermailpresta
    risk 0.64cvss 9.8epss 0.01

    Multiple improper neutralization of SQL parameters in module AfterMail (aftermailpresta) for PrestaShop, before version 2.2.1, allows remote attackers to perform SQL injection attacks via `id_customer`, `id_conf`, `id_product` and `token` parameters in `aftermailajax.php via the…

  • CVE-2023-45853CriOct 14, 2023
    risk 0.57cvss 9.8epss 0.03

    MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable…

  • CVE-2023-45852CriOct 14, 2023
    Vitogate
    Vitogate 300
    risk 0.65cvss 9.8epss 0.14

    In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharacters in the ipaddr params JSON data for the put method.

  • CVE-2023-34976CriOct 13, 2023
    Qnap
    Video Station
    risk 0.65cvss 10.0epss 0.01

    A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.0 ( 2023/07/27 )…

  • CVE-2023-45467CriOct 13, 2023
    Netis
    N3Mv2
    risk 0.64cvss 9.8epss 0.02

    Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ntpServIP parameter in the Time Settings.

  • CVE-2023-45466CriOct 13, 2023
    Netis
    N3Mv2
    risk 0.64cvss 9.8epss 0.02

    Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the pin_host parameter in the WPS Settings.

  • CVE-2023-45465CriOct 13, 2023
    Netis
    N3Mv2
    risk 0.64cvss 9.8epss 0.02

    Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ddnsDomainName parameter in the Dynamic DNS settings.

  • CVE-2023-45162CriOct 13, 2023
    risk 0.64cvss 9.9epss 0.01

    Affected 1E Platform versions have a Blind SQL Injection vulnerability that can lead to arbitrary code execution.  Application of the relevant hotfix remediates this issue. for v8.1.2 apply hotfix Q23166 for v8.4.1 apply hotfix Q23164 for v9.0.1 apply hotfix Q23169 SaaS…

  • CVE-2023-5572CriOct 13, 2023
    Vriteio
    Vriteio/vrite
    risk 0.57cvss 9.8epss 0.01

    Server-Side Request Forgery (SSRF) in GitHub repository vriteio/vrite prior to 0.3.0.

  • CVE-2023-4562CriOct 13, 2023
    Mitsubishielectric
    MELSEC-Q Series
    risk 0.59cvss 9.1epss 0.01

    Improper Authentication vulnerability in Mitsubishi Electric Corporation MELSEC-F Series main modules allows a remote unauthenticated attacker to obtain sequence programs from the product or write malicious sequence programs or improper data in the product without authentication…

  • CVE-2023-41262CriOct 12, 2023
    Plixer
    Scrutinizer
    risk 0.64cvss 9.8epss 0.01

    An issue was discovered in /fcgi/scrut_fcgi.fcgi in Plixer Scrutinizer before 19.3.1. The csvExportReport endpoint action generateCSV is vulnerable to SQL injection through the sorting parameter, allowing an unauthenticated user to execute arbitrary SQL statements in the context…

  • CVE-2023-45138CriOct 12, 2023
    Xwiki Contrib
    application-changerequest
    risk 0.64cvss 10.0epss 0.71

    Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly. Starting in version 0.11 and prior to version 1.9.2, it's possible for a user without any specific right to perform script injection and remote code execution…

  • CVE-2023-45133CriOct 12, 2023
    Babel
    Babel
    risk 0.53cvss 9.3epss 0.01

    Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when…

  • CVE-2023-27395CriOct 12, 2023
    Softethervpn
    VPN
    risk 0.59cvss 9.0epss 0.02

    A heap-based buffer overflow vulnerability exists in the vpnserver WpcParsePacket() functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A specially crafted network packet can lead to arbitrary code execution. An attacker can perform a man-in-the-middle attack to…

  • CVE-2023-5046CriOct 12, 2023
    Biltay Technology
    Procost
    risk 0.64cvss 9.8epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Procost allows SQL Injection, Command Line Execution through SQL Injection. This issue affects Procost: before 1390.

  • CVE-2023-5045CriOct 12, 2023
    Biltay Technology
    Kayisi
    risk 0.64cvss 9.8epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Kayisi allows SQL Injection, Command Line Execution through SQL Injection. This issue affects Kayisi: before 1286.

  • CVE-2023-23737CriOct 12, 2023
    WordPress
    MainWP Broken Links Checker Extension
    risk 0.60cvss 9.3epss 0.01

    Unauth. SQL Injection (SQLi) vulnerability in MainWP MainWP Broken Links Checker Extension plugin <= 4.0 versions.