VYPR

CVEs

31,788 total · page 248 of 636

AllCriticalHighKEV
  • CVE-2023-39532CriAug 8, 2023
    Endojs
    Endo
    risk 0.57cvss 9.8epss 0.01

    SES is a JavaScript environment that allows safe execution of arbitrary programs in Compartments. In version 0.18.0 prior to 0.18.7, 0.17.0 prior to 0.17.1, 0.16.0 prior to 0.16.1, 0.15.0 prior to 0.15.24, 0.14.0 prior to 0.14.5, an 0.13.0 prior to 0.13.5, there is a hole in the…

  • CVE-2023-3522CriAug 8, 2023
    risk 0.64cvss 9.8epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in a2 License Portal System allows SQL Injection. This issue affects License Portal System: before 1.48.

  • CVE-2023-3386CriAug 8, 2023
    A2
    Camera Trap Tracking System
    risk 0.64cvss 9.8epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in a2 Camera Trap Tracking System allows SQL Injection. This issue affects Camera Trap Tracking System: before 3.1905.

  • CVE-2023-3651CriAug 8, 2023
    Digital Ant
    Digital Ant
    risk 0.64cvss 9.8epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digital Ant E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: before 11.

  • CVE-2023-3716CriAug 8, 2023
    Oduyo
    Online Collection
    risk 0.64cvss 9.8epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oduyo Online Collection Software allows SQL Injection. This issue affects Online Collection Software: before 1.0.1.

  • CVE-2023-37682CriAug 8, 2023
    Sourcecodester
    Judging Management System
    risk 0.64cvss 9.8epss 0.01

    Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php-jms/deductScores.php.

  • CVE-2023-4203CriAug 8, 2023
    Advantech
    EKI-1524
    risk 0.59cvss 9.0epss 0.01

    Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stored Cross-Site Scripting vulnerability, which can be triggered by authenticated users in the ping tool of the web-interface.

  • CVE-2023-4202CriAug 8, 2023
    Advantech
    EKI-1524
    risk 0.59cvss 9.0epss 0.01

    Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stored Cross-Site Scripting vulnerability, which can be triggered by authenticated users in the device name field of the web-interface.

  • CVE-2023-3717CriAug 8, 2023
    Farmakom
    Remote Administration Console
    risk 0.64cvss 9.8epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Farmakom Remote Administration Console allows SQL Injection. This issue affects Remote Administration Console: before 1.02.

  • CVE-2023-37372CriAug 8, 2023
    Siemens Foundation
    CROSSBOW
    risk 0.64cvss 9.8epss 0.01

    A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.4). The affected applications is vulnerable to SQL injection. This could allow an unauthenticated remote attackers to execute arbitrary SQL queries on the server database.

  • CVE-2023-28561CriAug 8, 2023
    Qualcomm
    QESL
    risk 0.64cvss 9.8epss 0.00

    Memory corruption in QESL while processing payload from external ESL device to firmware.

  • CVE-2023-24845CriAug 8, 2023
    Siemens Foundation
    RUGGEDCOM
    risk 0.59cvss 9.1epss 0.01

    A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2100NC, RUGGEDCOM M2200, RUGGEDCOM M2200F, RUGGEDCOM…

  • CVE-2023-21651CriAug 8, 2023
    Qualcomm
    TEE
    risk 0.60cvss 9.3epss 0.00

    Memory Corruption in Core due to incorrect type conversion or cast in secure_io_read/write function in TEE.

  • CVE-2023-21643CriAug 8, 2023
    Qualcomm
    Automotive
    risk 0.59cvss 9.1epss 0.00

    Memory corruption due to untrusted pointer dereference in automotive during system call.

  • CVE-2022-40510CriAug 8, 2023
    Qualcomm
    Audio
    risk 0.64cvss 9.8epss 0.00

    Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder.

  • CVE-2023-3898CriAug 8, 2023
    Mayanets
    E Commerce
    risk 0.64cvss 9.8epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mAyaNet E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: before 1.1.

  • CVE-2023-3572CriAug 8, 2023
    Phoenixcontact
    WP 6xxx series web panels
    risk 0.65cvss 10.0epss 0.01

    In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote, unauthenticated attacker may use an attribute of a specific HTTP POST request releated to date/time operations to gain full access to the device.

  • CVE-2023-3526CriAug 8, 2023
    Phoenixcontact
    TC ROUTER
    risk 0.63cvss 9.6epss 0.02

    In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an unauthenticated remote attacker could use a reflective XSS within the license viewer page of the devices in order to execute code in the context…

  • CVE-2023-39976CriAug 8, 2023
    Clusterlabs
    libqb
    risk 0.00cvss 9.8epss 0.01

    log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered.

  • CVE-2023-37483CriAug 8, 2023
    SAP
    Sap Powerdesigner (proxy)
    risk 0.64cvss 9.8epss 0.01

    SAP PowerDesigner - version 16.7, has improper access control which might allow an unauthenticated attacker to run arbitrary queries against the back-end database via Proxy.

  • CVE-2023-39526CriAug 7, 2023
    Prestashop
    Prestashop
    risk 0.52cvss 9.1epss 0.01

    PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no…

  • CVE-2023-38940CriAug 7, 2023
    Tenda
    FH1203
    risk 0.64cvss 9.8epss 0.01

    Tenda F1203 V2.0.1.6, FH1203 V2.0.1.6 and FH1205 V2.0.0.7(775) were discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function.

  • CVE-2023-38939CriAug 7, 2023
    Tenda
    FH1202
    risk 0.64cvss 9.8epss 0.01

    Tenda F1202 V1.2.0.9 and FH1202 V1.2.0.9 were discovered to contain a stack overflow via the mit_ssid parameter in the formWrlsafeset function.

  • CVE-2023-38938CriAug 7, 2023
    Tenda
    FH1202
    risk 0.64cvss 9.8epss 0.01

    Tenda F1202 V1.2.0.9, PA202 V1.1.2.5, PW201A V1.1.2.5 and FH1202 V1.2.0.9 were discovered to contain a stack overflow via the page parameter at /L7Im.

  • CVE-2023-38937CriAug 7, 2023
    Tenda
    AC10
    risk 0.64cvss 9.8epss 0.01

    Tenda AC10 V1.0 V15.03.06.23, AC1206 V15.03.06.23, AC8 v4 V16.03.34.06, AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, AC5 V1.0 V15.03.06.28, AC9 V3.0 V15.03.06.42_multi and AC10 v4.0 V16.03.10.13 were discovered to contain a stack overflow via the list parameter in the…

  • CVE-2023-38936CriAug 7, 2023
    Tenda
    AC6
    risk 0.64cvss 9.8epss 0.01

    Tenda AC10 V1.0 V15.03.06.23, AC1206 V15.03.06.23, AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, AC5 V1.0 V15.03.06.28, FH1203 V2.0.1.6, AC9 V3.0 V15.03.06.42_multi and FH1205 V2.0.0.7(775) were discovered to contain a stack overflow via the speed_dir parameter in the…

  • CVE-2023-38935CriAug 7, 2023
    Tenda
    AC5
    risk 0.64cvss 9.8epss 0.01

    Tenda AC1206 V15.03.06.23, AC8 V4 V16.03.34.06, AC5 V1.0 V15.03.06.28, AC10 v4.0 V16.03.10.13 and AC9 V3.0 V15.03.06.42_multi were discovered to contain a tack overflow via the list parameter in the formSetQosBand function.

  • CVE-2023-38934CriAug 7, 2023
    Tenda
    FH1203
    risk 0.64cvss 9.8epss 0.01

    Tenda F1203 V2.0.1.6, FH1203 V2.0.1.6 and FH1205 V2.0.0.7(775) was discovered to contain a stack overflow via the deviceId parameter in the formSetDeviceName function.

  • CVE-2023-38933CriAug 7, 2023
    Tenda
    AC6
    risk 0.64cvss 9.8epss 0.01

    Tenda AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, F1203 V2.0.1.6, AC5 V1.0 V15.03.06.28, FH1203 V2.0.1.6 and AC9 V3.0 V15.03.06.42_multi, and FH1205 V2.0.0.7(775) were discovered to contain a stack overflow via the deviceId parameter in the formSetClientState function.

  • CVE-2023-38932CriAug 7, 2023
    Tenda
    FH1202
    risk 0.64cvss 9.8epss 0.01

    Tenda F1202 V1.2.0.9, PA202 V1.1.2.5, PW201A V1.1.2.5 and FH1202 V1.2.0.9 were discovered to contain a stack overflow via the page parameter in the SafeEmailFilter function.

  • CVE-2023-38931CriAug 7, 2023
    Tenda
    AC10
    risk 0.64cvss 9.8epss 0.01

    Tenda AC10 V1.0 V15.03.06.23, AC1206 V15.03.06.23, AC8 v4 V16.03.34.06, AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, F1203 V2.0.1.6, AC5 V1.0 V15.03.06.28, AC10 v4.0 V16.03.10.13 and FH1203 V2.0.1.6 were discovered to contain a stack overflow via the list parameter in the…

  • CVE-2023-38930CriAug 7, 2023
    Tenda
    AC9
    risk 0.64cvss 9.8epss 0.01

    Tenda AC7 V1.0,V15.03.06.44, F1203 V2.0.1.6, AC5 V1.0,V15.03.06.28, AC9 V3.0,V15.03.06.42_multi and FH1205 V2.0.0.7(775) were discovered to contain a stack overflow via the deviceId parameter in the addWifiMacFilter function.

  • CVE-2023-38929CriAug 7, 2023
    Tenda
    4G300
    risk 0.64cvss 9.8epss 0.01

    Tenda 4G300 v1.01.42 was discovered to contain a stack overflow via the page parameter at /VirtualSer.

  • CVE-2023-38928CriAug 7, 2023
    Netgear
    R7100LG
    risk 0.64cvss 9.8epss 0.01

    Netgear R7100LG 1.0.0.78 was discovered to contain a command injection vulnerability via the password parameter at usb_remote_invite.cgi.

  • CVE-2023-38044CriAug 7, 2023
    Joomla
    HikaShop
    risk 0.64cvss 9.8epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.

  • CVE-2023-34477CriAug 7, 2023
    Joomla
    Online Virtual Classroom
    risk 0.64cvss 9.8epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.

  • CVE-2023-34476CriAug 7, 2023
    Joomla
    Proforms Basic
    risk 0.64cvss 9.8epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.

  • CVE-2023-23758CriAug 7, 2023
    Joomla
    Creative Gallery
    risk 0.64cvss 9.8epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.

  • CVE-2023-23757CriAug 7, 2023
    Joomla
    BA-Gallery
    risk 0.64cvss 9.8epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.

  • CVE-2023-32090CriAug 7, 2023
    Pega
    Pega Platform
    risk 0.64cvss 9.8epss 0.01

    Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default credentials

  • CVE-2023-4188CriAug 5, 2023
    Instantsoft
    Icms2
    risk 0.00cvss 9.1epss 0.01

    SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

  • CVE-2023-36095CriAug 5, 2023
    risk 0.57cvss 9.8epss 0.01

    An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include from_math_prompt and from_colored_object_prompt.

  • CVE-2023-33367CriAug 5, 2023
    ControlID
    iDSecure
    risk 0.64cvss 9.8epss 0.01

    A SQL injection vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing unauthenticated attackers to write PHP files on the server's root directory, resulting in remote code execution.

  • CVE-2023-39344CriAug 4, 2023
    Fobybus
    Social Media Skeleton
    risk 0.00cvss 10.0epss 0.01

    social-media-skeleton is an uncompleted social media project. A SQL injection vulnerability in the project allows UNION based injections, which indirectly leads to remote code execution. Commit 3cabdd35c3d874608883c9eaf9bf69b2014d25c1 contains a fix for this issue.

  • CVE-2023-39551CriAug 4, 2023
    Phpgurukul
    Online Security Guards Hiring System
    risk 0.64cvss 9.8epss 0.01

    PHPGurukul Online Security Guards Hiring System v.1.0 is vulnerable to SQL Injection via osghs/admin/search.php.

  • CVE-2023-38702CriAug 4, 2023
    Knowagelabs
    Knowage
    risk 0.64cvss 9.9epss 0.01

    Knowage is an open source analytics and business intelligence suite. Starting in the 6.x.x branch and prior to version 8.1.8, the endpoint `/knowage/restful-services/dossier/importTemplateFile` allows authenticated users to upload `template file` on the server, but does not need…

  • CVE-2023-39107CriAug 4, 2023
    Nomachine
    NoMachine Free Edition
    risk 0.59cvss 9.1epss 0.01

    An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for macOS before v8.8.1 allows attackers to overwrite root-owned files by using hardlinks.

  • CVE-2023-38699CriAug 4, 2023
    Mindsdb
    Mindsdb
    risk 0.52cvss 9.1epss 0.00

    MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False` disables SSL certificate checks. This rule enforces always verifying SSL certificates for methods in the Requests…

  • CVE-2023-38692CriAug 4, 2023
    cloudexplorer-dev
    cloudexplorer-lite
    risk 0.64cvss 9.8epss 0.03

    CloudExplorer Lite is an open source, lightweight cloud management platform. Versions prior to 1.3.1 contain a command injection vulnerability in the installation function in module management. The vulnerability has been fixed in v1.3.1. There are no known workarounds aside from…

  • CVE-2023-33379CriAug 4, 2023
    Connected IO
    Connected IO
    risk 0.64cvss 9.8epss 0.01

    Connected IO v2.1.0 and prior has a misconfiguration in their MQTT broker used for management and device communication, which allows devices to connect to the broker and issue commands to other device, impersonating Connected IO management platform and sending commands to all of…