VYPR

CVEs

31,785 total · page 331 of 636

AllCriticalHighKEV
  • CVE-2022-30909CriJun 8, 2022
    risk 0.64cvss 9.8epss 0.02

    H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the CMD parameter at /goform/aspForm.

  • CVE-2022-1996CriJun 8, 2022
    risk 0.52cvss 9.1epss 0.03

    Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.

  • CVE-2022-1692CriJun 8, 2022
    WordPress
    CP Image Store with Slideshow
    risk 0.65cvss 9.8epss 0.10

    The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embed, allowing unauthenticated users to perform an SQL injection attack

  • CVE-2022-0788CriJun 8, 2022
    WordPress
    WP Fundraising Donation and Crowdfunding Platform
    risk 0.64cvss 9.8epss 0.08

    The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST route, leading to an SQL injection exploitable by unauthenticated users

  • CVE-2022-21122CriJun 8, 2022
    risk 0.52cvss 9.0epss 0.02

    The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.

  • CVE-2022-25361CriJun 7, 2022
    WatchGuard
    Fireware
    risk 0.59cvss 9.1epss 0.01

    WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to delete arbitrary files from a limited set of directories on the system. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.

  • CVE-2022-30927CriJun 6, 2022
    Simple Task Managing System
    Simple Task Managing System
    risk 0.64cvss 9.8epss 0.01

    A SQL injection vulnerability exists in Simple Task Scheduling System 1.0 when MySQL is being used as the application database. An attacker can issue SQL commands to the MySQL database through the vulnerable "id" parameter.

  • CVE-2022-32511CriJun 6, 2022
    risk 0.57cvss 9.8epss 0.02

    jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.

  • CVE-2022-31768CriJun 6, 2022
    IBM
    Infosphere Information Server
    risk 0.64cvss 9.8epss 0.01

    IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.

  • CVE-2022-1680CriJun 6, 2022
    GitLab Inc.
    GitLab
    risk 0.66cvss 9.9epss 0.15

    An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. When group SAML SSO is configured, the SCIM feature (available…

  • CVE-2022-31483CriJun 6, 2022
    HID
    Mercury Intelligent Controllers LP1501
    risk 0.59cvss 9.1epss 0.02

    An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500,…

  • CVE-2022-31481CriJun 6, 2022
    HID Mercury
    LP1501
    risk 0.65cvss 10.0epss 0.01

    An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to…

  • CVE-2022-31479CriJun 6, 2022
    HID Mercury
    Lp4502
    risk 0.63cvss 9.6epss 0.02

    An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection process. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500,…

  • CVE-2022-26134CriKEVJun 3, 2022
    Atlassian
    Confluence
    risk 0.93cvss 9.8epss 1.00

    In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from…

  • CVE-2022-26493CriJun 3, 2022
    Xecuify
    Drupal 7 Miniorange SAML Sp
    risk 0.64cvss 9.8epss 0.01

    Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability. An attacker with access to a HTTP-request intercepting method is able to bypass authentication and authorization by removing the SAML…

  • CVE-2021-42890CriJun 3, 2022
    Totolink
    EX1200T
    risk 0.64cvss 9.8epss 0.02

    TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function NTPSyncWithHost of the file system.so which can control hostTime to attack.

  • CVE-2021-42888CriJun 3, 2022
    Totolink
    EX1200T
    risk 0.64cvss 9.8epss 0.02

    TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setLanguageCfg of the file global.so which can control langType to attack.

  • CVE-2021-42887CriJun 3, 2022
    Totolink
    EX1200T
    risk 0.67cvss 9.8epss 0.43

    In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.

  • CVE-2021-42885CriJun 3, 2022
    Totolink
    EX1200T
    risk 0.64cvss 9.8epss 0.02

    TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceMac of the file global.so which can control deviceName to attack.

  • CVE-2021-42884CriJun 3, 2022
    Totolink
    EX1200T
    risk 0.64cvss 9.8epss 0.02

    TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceName of the file global.so which can control thedeviceName to attack.

  • CVE-2022-32271CriJun 3, 2022
    RealPlayer
    RealPlayer
    risk 0.63cvss 9.6epss 0.03

    In Real Player 20.0.8.310, there is a DCP:// URI Remote Arbitrary Code Execution Vulnerability. This is an internal URL Protocol used by Real Player to reference a file that contains an URL. It is possible to inject script code to arbitrary domains. It is also possible to…

  • CVE-2022-32270CriJun 3, 2022
    RealPlayer
    RealPlayer
    risk 0.64cvss 9.8epss 0.04

    In Real Player 20.0.7.309 and 20.0.8.310, external::Import() allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution. This occurs because it is possible to plant executables in the startup folder (DLL planting could also occur).

  • CVE-2022-32269CriJun 3, 2022
    RealPlayer
    RealPlayer
    risk 0.64cvss 9.8epss 0.03

    In Real Player 20.0.8.310, the G2 Control allows injection of unsafe javascript: URIs in local HTTP error pages (displayed by Internet Explorer core). This leads to arbitrary code execution.

  • CVE-2022-30234CriJun 2, 2022
    Schneider Electric
    Wiser Smart
    risk 0.61cvss 9.4epss 0.01

    A CWE-798: Use of Hard-coded Credentials vulnerability exists that could allow arbitrary code to be executed when root level access is obtained. Affected Products: Wiser Smart, EER21000 & EER21001 (V4.5 and prior)

  • CVE-2022-31462CriJun 2, 2022
    Owl Labs
    Meeting Owl
    risk 0.61cvss 9.3epss 0.01

    Owl Labs Meeting Owl 5.2.0.15 allows attackers to control the device via a backdoor password (derived from the serial number) that can be found in Bluetooth broadcast data.

  • CVE-2022-26869CriJun 2, 2022
    Dell
    Powerstoreos
    risk 0.64cvss 9.8epss 0.02

    Dell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contains an open port vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure and arbitrary code execution.

  • CVE-2021-33473CriJun 2, 2022
    risk 0.52cvss 9.1epss 0.01

    An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url option is disabled. This vulnerability is exploited via a crafted URL.

  • CVE-2021-42875CriJun 2, 2022
    Totolink
    EX1200T
    risk 0.64cvss 9.8epss 0.04

    TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in the function setDiagnosisCfg of the file lib/cste_modules/system.so to control the ipDoamin.

  • CVE-2022-32019CriJun 2, 2022
    Campcodes
    Legal Case Management System
    risk 0.64cvss 9.8epss 0.02

    Car Rental Management System v1.0 is vulnerable to Arbitrary code execution via car-rental-management-system/admin/ajax.php?action=save_car.

  • CVE-2022-29704CriJun 2, 2022
    BrowsBox
    BrowsBox CMS
    risk 0.64cvss 9.8epss 0.01

    BrowsBox CMS v4.0 was discovered to contain a SQL injection vulnerability.

  • CVE-2022-25163CriJun 2, 2022
    Mitsubishielectric
    MELSEC-L Series LJ71E71-100
    risk 0.64cvss 9.8epss 0.02

    Improper Input Validation vulnerability in Mitsubishi Electric MELSEC-Q Series QJ71E71-100 first 5 digits of serial number "24061" or prior, Mitsubishi Electric MELSEC-L series LJ71E71-100 first 5 digits of serial number "24061" or prior and Mitsubishi Electric MELSEC iQ-R…

  • CVE-2021-45983CriJun 2, 2022
    Netscout
    nGeniusONE
    risk 0.64cvss 9.8epss 0.01

    NetScout nGeniusONE 6.3.2 allows Java RMI Code Execution.

  • CVE-2021-45981CriJun 2, 2022
    Netscout
    nGeniusONE
    risk 0.64cvss 9.8epss 0.01

    NetScout nGeniusONE 6.3.2 allows an XML External Entity (XXE) attack.

  • CVE-2022-32020CriJun 2, 2022
    Campcodes
    Legal Case Management System
    risk 0.64cvss 9.8epss 0.02

    Car Rental Management System v1.0 is vulnerable to Arbitrary code execution via ip/car-rental-management-system/admin/ajax.php?action=save_settings.

  • CVE-2022-31993CriJun 2, 2022
    Oretnom23
    Badminton Center Management System
    risk 0.64cvss 9.8epss 0.01

    Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/classes/Master.php?f=delete_service.

  • CVE-2022-31991CriJun 2, 2022
    Badminton Center Management System
    Badminton Center Management System
    risk 0.64cvss 9.8epss 0.01

    Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/classes/Master.php?f=delete_court.

  • CVE-2022-31990CriJun 2, 2022
    Oretnom23
    Badminton Center Management System
    risk 0.64cvss 9.8epss 0.01

    Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/classes/Master.php?f=delete_product.

  • CVE-2022-31989CriJun 2, 2022
    Oretnom23
    Badminton Center Management System
    risk 0.64cvss 9.8epss 0.01

    Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=user/manage_user&id=.

  • CVE-2022-32002CriJun 2, 2022
    Oretnom23
    Badminton Center Management System
    risk 0.64cvss 9.8epss 0.01

    Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/courts/manage_court.php?id=.

  • CVE-2022-31978CriJun 2, 2022
    Oretnom23
    online-fire-reporting-system
    risk 0.64cvss 9.8epss 0.07

    Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=delete_inquiry.

  • CVE-2022-31977CriJun 2, 2022
    Oretnom23
    online-fire-reporting-system
    risk 0.64cvss 9.8epss 0.07

    Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=delete_team.

  • CVE-2022-31976CriJun 2, 2022
    Oretnom23
    online-fire-reporting-system
    risk 0.64cvss 9.8epss 0.07

    Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=delete_request.

  • CVE-2022-31969CriJun 2, 2022
    Oretnom23
    ChatBot App with Suggestion
    risk 0.64cvss 9.8epss 0.01

    ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simple_chat_bot/admin/?page=user/manage_user&id=.

  • CVE-2022-31965CriJun 2, 2022
    Oretnom23
    Rescue Dispatch Management System
    risk 0.64cvss 9.8epss 0.01

    Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/respondent_types/manage_respondent_type.php?id=.

  • CVE-2022-31964CriJun 2, 2022
    Oretnom23
    Rescue Dispatch Management System
    risk 0.64cvss 9.8epss 0.01

    Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via rdms/admin/respondent_types/view_respondent_type.php?id=.

  • CVE-2022-31962CriJun 2, 2022
    Oretnom23
    Rescue Dispatch Management System
    risk 0.64cvss 9.8epss 0.01

    Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incidents/view_incident.php?id=.

  • CVE-2022-31961CriJun 2, 2022
    Oretnom23
    Rescue Dispatch Management System
    risk 0.64cvss 9.8epss 0.01

    Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incidents/manage_incident.php?id=.

  • CVE-2022-31959CriJun 2, 2022
    Oretnom23
    Rescue Dispatch Management System
    risk 0.64cvss 9.8epss 0.01

    Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/teams/manage_team.php?id=.

  • CVE-2022-31957CriJun 2, 2022
    Oretnom23
    Rescue Dispatch Management System
    risk 0.64cvss 9.8epss 0.01

    Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via rdms/admin/teams/view_team.php?id=.

  • CVE-2022-31956CriJun 2, 2022
    Oretnom23
    Rescue Dispatch Management System
    risk 0.64cvss 9.8epss 0.01

    Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incident_reports/manage_report.php?id=.