VYPR

CVEs

31,785 total · page 348 of 636

AllCriticalHighKEV
  • CVE-2022-22995CriMar 25, 2022
    Westerndigital
    Netatalk
    risk 0.65cvss 10.0epss 0.03

    The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.

  • CVE-2022-22274CriMar 25, 2022
    SonicWall
    Sonicos
    risk 0.68cvss 9.8epss 0.57

    A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution in the firewall.

  • CVE-2022-24783CriMar 25, 2022
    Denoland
    Deno
    risk 0.58cvss 10.0epss 0.01

    Deno is a runtime for JavaScript and TypeScript. The versions of Deno between release 1.18.0 and 1.20.2 (inclusive) are vulnerable to an attack where a malicious actor controlling the code executed in a Deno runtime could bypass all permission checks and execute arbitrary shell…

  • CVE-2022-27919CriMar 25, 2022
    Gradle
    Gradle Enterprise
    risk 0.64cvss 9.8epss 0.02

    Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial configuration file. The configuration allows certain anonymous access to administration and an API.

  • CVE-2021-26622CriMar 25, 2022
    Genian
    NAC
    risk 0.63cvss 9.6epss 0.03

    An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NAC. Remote attackers are able to execute arbitrary malicious code with SYSTEM privileges on all connected nodes in NAC through this…

  • CVE-2021-43636CriMar 25, 2022
    risk 0.64cvss 9.8epss 0.01

    Two Buffer Overflow vulnerabilities exists in T10 V2_Firmware V4.1.8cu.5207_B20210320 in the http_request_parse function when processing host data in the HTTP request process.

  • CVE-2022-25577CriMar 25, 2022
    ALF-BanCO
    ALF-BanCO
    risk 0.59cvss 9.1epss 0.01

    ALF-BanCO v8.2.5 and below was discovered to use a hardcoded password to encrypt the SQLite database containing the user's data. Attackers who are able to gain remote or local access to the system are able to read and modify the data.

  • CVE-2021-43090CriMar 25, 2022
    risk 0.57cvss 9.8epss 0.02

    An XML External Entity (XXE) vulnerability exists in soa-model before 1.6.4 in the WSDLParser function.

  • CVE-2022-1040CriKEVMar 25, 2022
    Sophos
    Sophos Firewall
    risk 0.87cvss 9.8epss 1.00

    An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.

  • CVE-2022-22687CriMar 25, 2022
    Synology
    Diskstation Manager
    risk 0.64cvss 9.8epss 0.02

    Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2022-26301CriMar 24, 2022
    TuziCMS
    TuziCMS
    risk 0.64cvss 9.8epss 0.01

    TuziCMS v2.0.6 was discovered to contain a SQL injection vulnerability via the component App\Manage\Controller\ZhuantiController.class.php.

  • CVE-2022-26279CriMar 24, 2022
    Eyoucms
    Eyoucms
    risk 0.64cvss 9.8epss 0.02

    EyouCMS v1.5.5 was discovered to have no access control in the component /data/sqldata.

  • CVE-2022-26272CriMar 24, 2022
    Ionizecms
    Ionize
    risk 0.65cvss 9.8epss 0.22

    A remote code execution (RCE) vulnerability in Ionize v1.0.8.1 allows attackers to execute arbitrary code via a crafted string written to the file application/config/config.php.

  • CVE-2022-26249CriMar 24, 2022
    SurveyKing
    SurveyKing
    risk 0.64cvss 9.8epss 0.02

    Survey King v0.3.0 does not filter data properly when exporting excel files, allowing attackers to execute arbitrary code or access sensitive information via a CSV injection attack.

  • CVE-2022-22374CriMar 24, 2022
    IBM
    BMC
    risk 0.59cvss 9.1epss 0.01

    The BMC (IBM Power 9 AC922 OP910, OP920, OP930, and OP940) may be subject to a firmware downgrade attack which may affect its ability to operate its host. IBM X-Force ID: 221442.

  • CVE-2021-43084CriMar 24, 2022
    Dreamer CMS
    Dreamer CMS
    risk 0.64cvss 9.8epss 0.01

    An SQL Injection vulnerability exists in Dreamer CMS 4.0.0 via the tableName parameter.

  • CVE-2022-26629CriMar 24, 2022
    SoroushPlus+
    Messenger
    risk 0.59cvss 9.1epss 0.03

    An Access Control vulnerability exists in SoroushPlus+ Messenger 1.0.30 in the Lock Screen Security Feature function due to insufficient permissions and privileges, which allows a malicious attacker bypass the lock screen function.

  • CVE-2021-43700CriMar 24, 2022
    gongwalker
    ApiManager
    risk 0.64cvss 9.8epss 0.01

    An issue was discovered in ApiManager 1.1. there is sql injection vulnerability that can use in /index.php?act=api&tag=8.

  • CVE-2022-27811CriMar 24, 2022
    GNOME Foundation
    OCRFeeder
    risk 0.00cvss 9.8epss 0.03

    GNOME OCRFeeder before 0.8.4 allows OS command injection via shell metacharacters in a PDF or image filename.

  • CVE-2022-27083CriMar 24, 2022
    Tenda
    M3
    risk 0.64cvss 9.8epss 0.03

    Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadAccessCodePic.

  • CVE-2022-27082CriMar 24, 2022
    Tenda
    M3
    risk 0.64cvss 9.8epss 0.03

    Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetInternetLanInfo.

  • CVE-2022-27081CriMar 24, 2022
    Tenda
    M3
    risk 0.64cvss 9.8epss 0.03

    Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetLanInfo.

  • CVE-2022-27080CriMar 24, 2022
    Tenda
    M3
    risk 0.64cvss 9.8epss 0.03

    Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setWorkmode.

  • CVE-2022-27079CriMar 24, 2022
    Tenda
    M3
    risk 0.64cvss 9.8epss 0.03

    Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setPicListItem.

  • CVE-2022-27078CriMar 24, 2022
    Tenda
    M3
    risk 0.64cvss 9.8epss 0.03

    Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setAdInfoDetail.

  • CVE-2022-27077CriMar 24, 2022
    Tenda
    M3
    risk 0.64cvss 9.8epss 0.03

    Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadWeiXinPic.

  • CVE-2022-27076CriMar 24, 2022
    Tenda
    M3
    risk 0.64cvss 9.8epss 0.03

    Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/delAd.

  • CVE-2022-26536CriMar 24, 2022
    Tenda
    M3
    risk 0.64cvss 9.8epss 0.03

    Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setFixTools.

  • CVE-2022-26290CriMar 24, 2022
    Tenda
    M3
    risk 0.64cvss 9.8epss 0.03

    Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/WriteFacMac.

  • CVE-2022-26289CriMar 24, 2022
    Tenda
    M3
    risk 0.64cvss 9.8epss 0.03

    Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/exeCommand.

  • CVE-2021-31326CriMar 24, 2022
    Dlink
    DIR-816
    risk 0.64cvss 9.8epss 0.02

    D-Link DIR-816 A2 1.10 B05 allows unauthenticated attackers to arbitrarily reset the device via a crafted tokenid parameter to /goform/form2Reboot.cgi.

  • CVE-2022-24934CriMar 23, 2022
    Kingsoft
    Wps Office
    risk 0.65cvss 9.8epss 0.20

    wpsupdater.exe in Kingsoft WPS Office through 11.2.0.10382 allows remote code execution by modifying HKEY_CURRENT_USER in the registry.

  • CVE-2022-24768CriMar 23, 2022
    Argoproj
    Argo Cd
    risk 0.57cvss 9.9epss 0.01

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level. Versions starting…

  • CVE-2022-23881CriMar 23, 2022
    Zzcms
    Zzzphp
    risk 0.68cvss 9.8epss 0.57

    ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php.

  • CVE-2022-23880CriMar 23, 2022
    Taogo
    Taocms
    risk 0.64cvss 9.8epss 0.02

    An arbitrary file upload vulnerability in the File Management function module of taoCMS v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file.

  • CVE-2022-25222CriMar 23, 2022
    Money Transfer Management System
    Money Transfer Management System
    risk 0.64cvss 9.8epss 0.02

    Money Transfer Management System Version 1.0 allows an unauthenticated user to inject SQL queries in 'admin/maintenance/manage_branch.php' and 'admin/maintenance/manage_fee.php' via the 'id' parameter.

  • CVE-2022-24293CriMar 23, 2022
    Microfocus
    Print devices
    risk 0.64cvss 9.8epss 0.07

    Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.

  • CVE-2022-24292CriMar 23, 2022
    Microfocus
    Print devices
    risk 0.64cvss 9.8epss 0.07

    Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.

  • CVE-2022-22952CriMar 23, 2022
    VMware
    Carbon Black App Control
    risk 0.59cvss 9.1epss 0.01

    VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains a file upload vulnerability. A malicious actor with administrative access to the VMware App Control administration interface may be able to…

  • CVE-2022-22951CriMar 23, 2022
    VMware
    Carbon Black App Control
    risk 0.61cvss 9.1epss 0.22

    VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains an OS command injection vulnerability. An authenticated, high privileged malicious actor with network access to the VMware App Control…

  • CVE-2022-0888CriMar 23, 2022
    WordPress
    Ninja Forms - File Uploads Extension
    risk 0.67cvss 9.8epss 0.39

    The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthenticated attackers to…

  • CVE-2021-27476CriMar 23, 2022
    Rockwellautomation
    FactoryTalk AssetCentre
    risk 0.65cvss 10.0epss 0.04

    A vulnerability exists in the SaveConfigFile function of the RACompare Service, which may allow for OS command injection. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in Rockwell Automation FactoryTalk AssetCentre v10.00 and…

  • CVE-2021-27474CriMar 23, 2022
    Rockwellautomation
    FactoryTalk AssetCentre
    risk 0.65cvss 10.0epss 0.02

    Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier does not properly restrict all functions relating to IIS remoting services. This vulnerability may allow a remote, unauthenticated attacker to modify sensitive data in FactoryTalk AssetCentre.

  • CVE-2021-27472CriMar 23, 2022
    Rockwellautomation
    FactoryTalk AssetCentre
    risk 0.65cvss 10.0epss 0.05

    A vulnerability exists in the RunSearch function of SearchService service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier, which may allow for the execution of remote unauthenticated arbitrary SQL statements.

  • CVE-2021-27470CriMar 23, 2022
    Rockwellautomation
    FactoryTalk AssetCentre
    risk 0.65cvss 10.0epss 0.04

    A deserialization vulnerability exists in how the LogService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk…

  • CVE-2021-27468CriMar 23, 2022
    Rockwellautomation
    FactoryTalk AssetCentre
    risk 0.65cvss 10.0epss 0.03

    The AosService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier exposes functions lacking proper authentication. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary SQL statements.

  • CVE-2021-27466CriMar 23, 2022
    Rockwellautomation
    FactoryTalk AssetCentre
    risk 0.65cvss 10.0epss 0.04

    A deserialization vulnerability exists in how the ArchiveService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk…

  • CVE-2021-27464CriMar 23, 2022
    Rockwellautomation
    FactoryTalk AssetCentre
    risk 0.65cvss 10.0epss 0.03

    The ArchiveService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier exposes functions lacking proper authentication. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary SQL statements.

  • CVE-2021-27462CriMar 23, 2022
    Rockwellautomation
    FactoryTalk AssetCentre
    risk 0.65cvss 10.0epss 0.04

    A deserialization vulnerability exists in how the AosService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk…

  • CVE-2021-27460CriMar 23, 2022
    Rockwellautomation
    FactoryTalk AssetCentre
    risk 0.65cvss 10.0epss 0.03

    Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier components contain .NET remoting endpoints that deserialize untrusted data without sufficiently verifying that the resulting data will be valid. This vulnerability may allow a remote, unauthenticated attacker to gain…