VYPR

CVEs

414,219 total · page 4837 of 8,285

AllCriticalHighKEV
  • CVE-2021-45408MedFeb 4, 2022
    Seeddms
    Seeddms
    risk 0.40cvss 6.1epss 0.01

    Open Redirect vulnerability exists in SeedDMS 6.0.15 in out.Login.php, which llows remote malicious users to redirect users to malicious sites using the "referuri" parameter.

  • CVE-2021-23507HigFeb 4, 2022
    Skratchdot
    Object Path Set
    risk 0.42cvss 7.5epss 0.02

    The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-OBJECTPATHSET-607…

  • CVE-2021-23497HigFeb 4, 2022
    Set Project
    Set
    risk 0.42cvss 7.5epss 0.04

    This affects the package @strikeentco/set before 1.0.2. It allows an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-STRIKEENTCOSET-1038821

  • CVE-2021-23470HigFeb 4, 2022
    Putil Merge Project
    Putil Merge
    risk 0.46cvss 8.2epss 0.01

    This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete…

  • CVE-2022-24249MedFeb 4, 2022
    Gpac
    Gpac
    risk 0.36cvss 5.5epss 0.01

    A Null Pointer Dereference vulnerability exists in GPAC 1.1.0 via the xtra_box_write function in /box_code_base.c, which causes a Denial of Service. This vulnerability was fixed in commit 71f9871.

  • CVE-2021-45429MedFeb 4, 2022
    Virustotal
    Yara
    risk 0.36cvss 5.5epss 0.01

    A Buffer Overflow vulnerablity exists in VirusTotal YARA git commit: 605b2edf07ed8eb9a2c61ba22eb2e7c362f47ba7 via yr_set_configuration in yara/libyara/libyara.c, which could cause a Denial of Service.

  • CVE-2021-29398MedFeb 4, 2022
    Northstar Technologies Inc
    NorthStar Club Management
    risk 0.35cvss 5.3epss 0.02

    Directory traversal in /northstar/Common/NorthFileManager/fileManagerObjects.jsp Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to browse and list the directories across the entire filesystem of the host of the web application.

  • CVE-2021-29397HigFeb 4, 2022
    Northstar Technologies Inc
    NorthStar Club Management
    risk 0.49cvss 7.5epss 0.01

    Cleartext Transmission of Sensitive Information in /northstar/Admin/login.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote local user to intercept users credentials transmitted in cleartext over HTTP.

  • CVE-2021-29396CriFeb 4, 2022
    Northstar Technologies Inc
    NorthStar Club Management
    risk 0.64cvss 9.8epss 0.02

    Systemic Insecure Permissions in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to use various functionalities without authentication.

  • CVE-2021-29395HigFeb 4, 2022
    Northstar Technologies Inc
    NorthStar Club Management
    risk 0.49cvss 7.5epss 0.02

    Directory travesal in /northstar/filemanager/download.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to download arbitrary files, including JSP source code, across the filesystem of the host of the web application.

  • CVE-2021-29394MedFeb 4, 2022
    Northstar Technologies Inc
    NorthStar Club Management
    risk 0.42cvss 6.5epss 0.01

    Account Hijacking in /northstar/Admin/changePassword.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote authenticated users to change the password of any targeted user accounts via lack of proper authorization in the user-controlled "userID" parameter…

  • CVE-2021-29393CriFeb 4, 2022
    Northstar Technologies Inc
    NorthStar Club Management
    risk 0.64cvss 9.8epss 0.04

    Remote Code Execution in cominput.jsp and comoutput.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to inject and execute arbitrary system commands via the unsanitized user-controlled "command" and "commandvalues" parameters.

  • CVE-2021-43635MedFeb 4, 2022
    Codex
    Codex
    risk 0.40cvss 6.1epss 0.02

    A Cross Site Scripting (XSS) vulnerability exists in Codex before 1.4.0 via Notebook/Page name field, which allows malicious users to execute arbitrary code via a crafted http code in a .json file.

  • CVE-2022-24262HigFeb 4, 2022
    VoIPmonitor
    VoIPmonitor
    risk 0.57cvss 8.8epss 0.02

    The config restore function of Voipmonitor GUI before v24.96 does not properly check files sent as restore archives, allowing remote attackers to execute arbitrary commands via a crafted file in the web root.

  • CVE-2022-24260CriFeb 4, 2022
    VoIPmonitor
    VoIPmonitor
    risk 0.68cvss 9.8epss 0.50

    A SQL injection vulnerability in Voipmonitor GUI before v24.96 allows attackers to escalate privileges to the Administrator level.

  • CVE-2022-24259CriFeb 4, 2022
    VoIPmonitor
    VoIPmonitor
    risk 0.64cvss 9.8epss 0.02

    An incorrect check in the component cdr.php of Voipmonitor GUI before v24.96 allows unauthenticated attackers to escalate privileges via a crafted request.

  • CVE-2021-46398HigFeb 4, 2022
    Filebrowser
    Filebrowser
    risk 0.54cvss 8.8epss 0.07

    A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim. An admin can run commands using the…

  • CVE-2021-44978CriFeb 4, 2022
    ICMS
    iCMS
    risk 0.64cvss 9.8epss 0.02

    iCMS <= 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution.

  • CVE-2021-44977HigFeb 4, 2022
    ICMS
    iCMS
    risk 0.49cvss 7.5epss 0.02

    In iCMS <=8.0.0, a directory traversal vulnerability allows an attacker to read arbitrary files.

  • CVE-2021-44886MedFeb 4, 2022
    Zammad
    Zammad
    risk 0.35cvss 5.3epss 0.01

    In Zammad 5.0.2, agents can configure "out of office" periods and substitute persons. If the substitute persons didn't have the same permissions as the original agent, they could receive ticket notifications for tickets that they have no access to.

  • CVE-2021-43145HigFeb 4, 2022
    Zammad
    Zammad
    risk 0.53cvss 8.1epss 0.01

    With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts.

  • CVE-2021-44983MedFeb 4, 2022
    Taocms
    taocms
    risk 0.32cvss 4.9epss 0.01

    In taocms 3.0.1 after logging in to the background, there is an Arbitrary file download vulnerability at the File Management column.

  • CVE-2022-23316MedFeb 4, 2022
    Taocms
    taocms
    risk 0.32cvss 4.9epss 0.01

    An issue was discovered in taoCMS v3.0.2. There is an arbitrary file read vulnerability that can read any files via admin.php?action=file&ctrl=download&path=../../1.txt.

  • CVE-2021-46320HigFeb 4, 2022
    Openzeppelin
    Openzeppelin
    risk 0.49cvss 7.5epss 0.01

    In OpenZeppelin <=v4.4.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal proxies) may be reentered if they make an untrusted non-view external call. Once an initializer has finished running it can never be…

  • CVE-2021-44903HigFeb 4, 2022
    MSI
    Center Pro
    risk 0.51cvss 7.8epss 0.00

    Micro-Star International (MSI) Center Pro <= 2.0.16.0 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the atidgllk.sys, atillk64.sys, MODAPI.sys, NTIOLib.sys, NTIOLib_X64.sys, WinRing0.sys, WinRing0x64.sys drivers components. All the vulnerabilities…

  • CVE-2021-44901HigFeb 4, 2022
    MSI
    Dragon Center
    risk 0.51cvss 7.8epss 0.00

    Micro-Star International (MSI) Dragon Center <= 2.0.116.0 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the atidgllk.sys, atillk64.sys, MODAPI.sys, NTIOLib.sys, NTIOLib_X64.sys, WinRing0.sys, WinRing0x64.sys drivers components. All the…

  • CVE-2021-44900HigFeb 4, 2022
    MSI
    App Player
    risk 0.51cvss 7.8epss 0.00

    Micro-Star International (MSI) App Player <= 4.280.1.6309 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the NTIOLib_X64.sys and BstkDrv_msi2.sys drivers components. All the vulnerabilities are triggered by sending specific IOCTL requests.

  • CVE-2021-44899HigFeb 4, 2022
    MSI
    Center
    risk 0.51cvss 7.8epss 0.00

    Micro-Star International (MSI) Center <= 1.0.31.0 is vulnerable to multiple Privilege Escalation vulnerabilities in the atidgllk.sys, atillk64.sys, MODAPI.sys, NTIOLib.sys, NTIOLib_X64.sys, WinRing0.sys, WinRing0x64.sys drivers components. All the vulnerabilities are triggered…

  • CVE-2022-24172HigFeb 4, 2022
    Tenda
    G1 and G3
    risk 0.49cvss 7.5epss 0.01

    Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formAddDhcpBindRule. This vulnerability allows attackers to cause a Denial of Service (DoS) via the addDhcpRules parameter.

  • CVE-2022-24171CriFeb 4, 2022
    Tenda
    G3
    risk 0.64cvss 9.8epss 0.03

    Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetPppoeServer. This vulnerability allows attackers to execute arbitrary commands via the pppoeServerIP, pppoeServerStartIP, and pppoeServerEndIP…

  • CVE-2022-24170CriFeb 4, 2022
    Tenda
    G3
    risk 0.64cvss 9.8epss 0.03

    Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetIpSecTunnel. This vulnerability allows attackers to execute arbitrary commands via the IPsecLocalNet and IPsecRemoteNet parameters.

  • CVE-2022-24169HigFeb 4, 2022
    Tenda
    G1 and G3
    risk 0.49cvss 7.5epss 0.01

    Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formIPMacBindAdd. This vulnerability allows attackers to cause a Denial of Service (DoS) via the IPMacBindRule parameter.

  • CVE-2022-24168CriFeb 4, 2022
    Tenda
    G3
    risk 0.64cvss 9.8epss 0.03

    Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetIpGroup. This vulnerability allows attackers to execute arbitrary commands via the IPGroupStartIP and IPGroupEndIP parameters.

  • CVE-2022-24167CriFeb 4, 2022
    Tenda
    G3
    risk 0.64cvss 9.8epss 0.03

    Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetDMZ. This vulnerability allows attackers to execute arbitrary commands via the dmzHost1 parameter.

  • CVE-2022-24166HigFeb 4, 2022
    Tenda
    G3
    risk 0.49cvss 7.5epss 0.01

    Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetSysTime. This vulnerability allows attackers to cause a Denial of Service (DoS) via the manualTime parameter.

  • CVE-2022-24165CriFeb 4, 2022
    Tenda
    G1 and G3
    risk 0.64cvss 9.8epss 0.03

    Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetQvlanList. This vulnerability allows attackers to execute arbitrary commands via the qvlanIP parameter.

  • CVE-2022-24164HigFeb 4, 2022
    Tenda
    G3
    risk 0.49cvss 7.5epss 0.01

    Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetVirtualSer. This vulnerability allows attackers to cause a Denial of Service (DoS) via the DnsHijackRule parameter.

  • CVE-2022-24163HigFeb 4, 2022
    Tenda
    AX3
    risk 0.49cvss 7.5epss 0.01

    Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to cause a Denial of Service (DoS) via the timeZone parameter.

  • CVE-2022-24162HigFeb 4, 2022
    Tenda
    AX3
    risk 0.49cvss 7.5epss 0.01

    Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) via the time parameter.

  • CVE-2022-24161HigFeb 4, 2022
    Tenda
    AX3
    risk 0.49cvss 7.5epss 0.01

    Tenda AX3 v16.03.12.10_CN was discovered to contain a heap overflow in the function GetParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) via the mac parameter.

  • CVE-2022-24160HigFeb 4, 2022
    Tenda
    AX3
    risk 0.49cvss 7.5epss 0.01

    Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetDeviceName. This vulnerability allows attackers to cause a Denial of Service (DoS) via the devName parameter.

  • CVE-2022-24159HigFeb 4, 2022
    Tenda
    AX3
    risk 0.49cvss 7.5epss 0.01

    Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetPPTPServer. This vulnerability allows attackers to cause a Denial of Service (DoS) via the startIp and endIp parameters.

  • CVE-2022-24158HigFeb 4, 2022
    Tenda
    AX3
    risk 0.49cvss 7.5epss 0.01

    Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetIpMacBind. This vulnerability allows attackers to cause a Denial of Service (DoS) via the list parameter.

  • CVE-2022-24157HigFeb 4, 2022
    Tenda
    AX3
    risk 0.49cvss 7.5epss 0.01

    Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetMacFilterCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via the deviceList parameter.

  • CVE-2022-24156HigFeb 4, 2022
    Tenda
    AX3
    risk 0.49cvss 7.5epss 0.01

    Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetVirtualSer. This vulnerability allows attackers to cause a Denial of Service (DoS) via the list parameter.

  • CVE-2022-24155HigFeb 4, 2022
    Tenda
    AX3
    risk 0.49cvss 7.5epss 0.01

    Tenda AX3 v16.03.12.10_CN was discovered to contain a heap overflow in the function setSchedWifi. This vulnerability allows attackers to cause a Denial of Service (DoS) via the schedStartTime and schedEndTime parameters.

  • CVE-2022-24154HigFeb 4, 2022
    Tenda
    AX3
    risk 0.49cvss 7.5epss 0.01

    Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetRebootTimer. This vulnerability allows attackers to cause a Denial of Service (DoS) via the rebootTime parameter.

  • CVE-2022-24153HigFeb 4, 2022
    Tenda
    AX3
    risk 0.49cvss 7.5epss 0.01

    Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formAddMacfilterRule. This vulnerability allows attackers to cause a Denial of Service (DoS) via the devName parameter.

  • CVE-2022-24152HigFeb 4, 2022
    Tenda
    AX3
    risk 0.49cvss 7.5epss 0.01

    Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetRouteStatic. This vulnerability allows attackers to cause a Denial of Service (DoS) via the list parameter.

  • CVE-2022-24151HigFeb 4, 2022
    Tenda
    AX3
    risk 0.49cvss 7.5epss 0.01

    Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetWifiGusetBasic. This vulnerability allows attackers to cause a Denial of Service (DoS) via the shareSpeed parameter.