VYPR

CVEs

414,216 total · page 4838 of 8,285

AllCriticalHighKEV
  • CVE-2022-24147HigFeb 4, 2022
    Tenda
    AX3
    risk 0.49cvss 7.5epss 0.01

    Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromAdvSetMacMtuWan. This vulnerability allows attackers to cause a Denial of Service (DoS) via the wanMTU, wanSpeed, cloneType, mac, and serviceName parameters.

  • CVE-2022-24146HigFeb 4, 2022
    Tenda
    AX3
    risk 0.49cvss 7.5epss 0.01

    Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetQosBand. This vulnerability allows attackers to cause a Denial of Service (DoS) via the list parameter.

  • CVE-2022-24145HigFeb 4, 2022
    Tenda
    AX3
    risk 0.49cvss 7.5epss 0.01

    Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formWifiBasicSet. This vulnerability allows attackers to cause a Denial of Service (DoS) via the security and security_5g parameters.

  • CVE-2022-24144CriFeb 4, 2022
    Tenda
    AX3
    risk 0.65cvss 9.8epss 0.19

    Tenda AX3 v16.03.12.10_CN was discovered to contain a command injection vulnerability in the function WanParameterSetting. This vulnerability allows attackers to execute arbitrary commands via the gateway, dns1, and dns2 parameters.

  • CVE-2022-24143HigFeb 4, 2022
    Tenda
    AX3
    risk 0.49cvss 7.5epss 0.01

    Tenda AX3 v16.03.12.10_CN and AX12 22.03.01.2_CN was discovered to contain a stack overflow in the function form_fast_setting_wifi_set. This vulnerability allows attackers to cause a Denial of Service (DoS) via the timeZone parameter.

  • CVE-2022-24142HigFeb 4, 2022
    Tenda
    AX3
    risk 0.49cvss 7.5epss 0.01

    Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetFirewallCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via the firewallEn parameter.

  • CVE-2021-46457CriFeb 4, 2022
    Dlink
    DIR-823-Pro
    risk 0.64cvss 9.8epss 0.04

    D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function ChgSambaUserSettings. This vulnerability allows attackers to execute arbitrary commands via the samba_name parameter.

  • CVE-2021-46456CriFeb 4, 2022
    Dlink
    DIR-823-Pro
    risk 0.64cvss 9.8epss 0.04

    D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetWLanACLSettings. This vulnerability allows attackers to execute arbitrary commands via the wl(0).(0)_maclist parameter.

  • CVE-2021-46455CriFeb 4, 2022
    Dlink
    DIR-823-Pro
    risk 0.64cvss 9.8epss 0.04

    D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetStationSettings. This vulnerability allows attackers to execute arbitrary commands via the station_access_enable parameter.

  • CVE-2021-46454CriFeb 4, 2022
    Dlink
    DIR-823-Pro
    risk 0.64cvss 9.8epss 0.04

    D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetWLanApcliSettings. This vulnerability allows attackers to execute arbitrary commands via the ApCliKeyStr parameter.

  • CVE-2021-46453CriFeb 4, 2022
    Dlink
    DIR-823-Pro
    risk 0.64cvss 9.8epss 0.04

    D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetStaticRouteSettings. This vulnerability allows attackers to execute arbitrary commands via the staticroute_list parameter.

  • CVE-2021-46452CriFeb 4, 2022
    Dlink
    DIR-823-Pro
    risk 0.64cvss 9.8epss 0.04

    D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetNetworkTomographySettings. This vulnerability allows attackers to execute arbitrary commands via the tomography_ping_address, tomography_ping_number,…

  • CVE-2021-46233CriFeb 4, 2022
    Dlink
    DI-7200GV2.E1
    risk 0.64cvss 9.8epss 0.04

    D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function msp_info.htm. This vulnerability allows attackers to execute arbitrary commands via the cmd parameter.

  • CVE-2021-46232CriFeb 4, 2022
    Dlink
    DI-7200GV2
    risk 0.64cvss 9.8epss 0.04

    D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function version_upgrade.asp. This vulnerability allows attackers to execute arbitrary commands via the path parameter.

  • CVE-2021-46231CriFeb 4, 2022
    Dlink
    DI-7200GV2
    risk 0.64cvss 9.8epss 0.04

    D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function urlrd_opt.asp. This vulnerability allows attackers to execute arbitrary commands via the url_en parameter.

  • CVE-2021-46230CriFeb 4, 2022
    Dlink
    DI-7200GV2
    risk 0.64cvss 9.8epss 0.04

    D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function upgrade_filter. This vulnerability allows attackers to execute arbitrary commands via the path and time parameters.

  • CVE-2021-46229CriFeb 4, 2022
    Dlink
    DI-7200GV2
    risk 0.64cvss 9.8epss 0.04

    D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function usb_paswd.asp. This vulnerability allows attackers to execute arbitrary commands via the name parameter.

  • CVE-2021-46228CriFeb 4, 2022
    Dlink
    DI-7200GV2
    risk 0.64cvss 9.8epss 0.04

    D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function httpd_debug.asp. This vulnerability allows attackers to execute arbitrary commands via the time parameter.

  • CVE-2021-46227CriFeb 4, 2022
    Dlink
    DI-7200GV2
    risk 0.64cvss 9.8epss 0.05

    D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function proxy_client.asp. This vulnerability allows attackers to execute arbitrary commands via the proxy_srv, proxy_srvport, proxy_lanip, proxy_lanport parameters.

  • CVE-2021-46226CriFeb 4, 2022
    Dlink
    DI-7200GV2
    risk 0.64cvss 9.8epss 0.04

    D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function wget_test.asp. This vulnerability allows attackers to execute arbitrary commands via the url parameter.

  • CVE-2021-45998CriFeb 4, 2022
    Dlink
    Dir 882 Firmware
    risk 0.64cvss 9.8epss 0.04

    D-Link device DIR_882 DIR_882_FW1.30B06_Hotfix_02 was discovered to contain a command injection vulnerability in the LocalIPAddress parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP1 POST request.

  • CVE-2021-45997HigFeb 4, 2022
    Tenda
    G3
    risk 0.49cvss 7.5epss 0.01

    Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetPortMapping. This vulnerability allows attackers to cause a Denial of Service (DoS) via the portMappingServer, portMappingProtocol, portMappingWan,…

  • CVE-2021-45996HigFeb 4, 2022
    Tenda
    G3
    risk 0.49cvss 7.5epss 0.01

    Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetPortMapping. This vulnerability allows attackers to cause a Denial of Service (DoS) via the portMappingServer, portMappingProtocol, portMappingWan,…

  • CVE-2021-45995HigFeb 4, 2022
    Tenda
    G3
    risk 0.49cvss 7.5epss 0.01

    Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetStaticRoute. This vulnerability allows attackers to cause a Denial of Service (DoS) via the staticRouteNet, staticRouteMask, and staticRouteGateway parameters.

  • CVE-2021-45994HigFeb 4, 2022
    Tenda
    G3
    risk 0.49cvss 7.5epss 0.01

    Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formDelDhcpRule. This vulnerability allows attackers to cause a Denial of Service (DoS) via the delDhcpIndex parameter.

  • CVE-2021-45993HigFeb 4, 2022
    Tenda
    G1 and G3
    risk 0.49cvss 7.5epss 0.01

    Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formIPMacBindModify. This vulnerability allows attackers to cause a Denial of Service (DoS) via the IPMacBindRuleIP and IPMacBindRuleMac parameters.

  • CVE-2021-45992HigFeb 4, 2022
    Tenda
    G3
    risk 0.49cvss 7.5epss 0.01

    Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetQvlanList. This vulnerability allows attackers to cause a Denial of Service (DoS) via the qvlanName parameter.

  • CVE-2021-45991HigFeb 4, 2022
    Tenda
    G3
    risk 0.49cvss 7.5epss 0.01

    Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formAddVpnUsers. This vulnerability allows attackers to cause a Denial of Service (DoS) via the vpnUsers parameter.

  • CVE-2021-45990CriFeb 4, 2022
    Tenda
    G1 and G3
    risk 0.64cvss 9.8epss 0.02

    Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function uploadPicture. This vulnerability allows attackers to execute arbitrary commands via the pic_name parameter.

  • CVE-2021-45989HigFeb 4, 2022
    Tenda
    G3
    risk 0.49cvss 7.5epss 0.01

    Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function guestWifiRuleRefresh. This vulnerability allows attackers to cause a Denial of Service (DoS) via the qosGuestUpstream and qosGuestDownstream parameters.

  • CVE-2021-45988HigFeb 4, 2022
    Tenda
    G3
    risk 0.49cvss 7.5epss 0.01

    Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formAddDnsForward. This vulnerability allows attackers to cause a Denial of Service (DoS) via the DnsForwardRule parameter.

  • CVE-2021-45987CriFeb 4, 2022
    Tenda
    G3
    risk 0.64cvss 9.8epss 0.02

    Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetNetCheckTools. This vulnerability allows attackers to execute arbitrary commands via the hostName parameter.

  • CVE-2021-45986CriFeb 4, 2022
    Tenda
    G3
    risk 0.64cvss 9.8epss 0.02

    Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetUSBShareInfo. This vulnerability allows attackers to execute arbitrary commands via the usbOrdinaryUserName parameter.

  • CVE-2021-45742CriFeb 4, 2022
    Totolink
    A720R
    risk 0.64cvss 9.8epss 0.03

    TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.

  • CVE-2021-45741HigFeb 4, 2022
    Totolink
    X5000R
    risk 0.49cvss 7.5epss 0.01

    TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a stack overflow in the function setIpv6Cfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via the relay6to4 parameters.

  • CVE-2021-45740CriFeb 4, 2022
    Totolink
    A720R
    risk 0.64cvss 9.8epss 0.01

    TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the setWiFiWpsStart function. This vulnerability allows attackers to cause a Denial of Service (DoS) via the pin parameter.

  • CVE-2021-45739HigFeb 4, 2022
    Totolink
    A720R
    risk 0.49cvss 7.5epss 0.01

    TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the Form_Login function. This vulnerability allows attackers to cause a Denial of Service (DoS) via the flag parameter.

  • CVE-2021-45738CriFeb 4, 2022
    Totolink
    X5000R
    risk 0.64cvss 9.8epss 0.04

    TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function UploadFirmwareFile. This vulnerability allows attackers to execute arbitrary commands via the parameter FileName.

  • CVE-2021-45737HigFeb 4, 2022
    Totolink
    A720R
    risk 0.49cvss 7.5epss 0.01

    TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the Form_Login function. This vulnerability allows attackers to cause a Denial of Service (DoS) via the Host parameter.

  • CVE-2021-45736HigFeb 4, 2022
    Totolink
    X5000R
    risk 0.49cvss 7.5epss 0.01

    TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a stack overflow in the function setL2tpServerCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via the eip, sip, server parameters.

  • CVE-2021-45735HigFeb 4, 2022
    Totolink
    X5000R
    risk 0.49cvss 7.5epss 0.04

    TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to use the HTTP protocol for authentication into the admin interface, allowing attackers to intercept user credentials via packet capture software.

  • CVE-2021-45734HigFeb 4, 2022
    Totolink
    X5000R
    risk 0.49cvss 7.5epss 0.01

    TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a stack overflow in the function setUrlFilterRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via the url parameter.

  • CVE-2021-45733CriFeb 4, 2022
    Totolink
    X5000R
    risk 0.64cvss 9.8epss 0.04

    TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function NTPSyncWithHost. This vulnerability allows attackers to execute arbitrary commands via the parameter host_time.

  • CVE-2021-44882CriFeb 4, 2022
    Dlink
    Dir878 Firmware
    risk 0.64cvss 9.8epss 0.05

    D-Link device DIR_878_FW1.30B08_Hotfix_02 was discovered to contain a command injection vulnerability in the twsystem function. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP1 POST request.

  • CVE-2021-44881CriFeb 4, 2022
    Dlink
    Dir 882 Firmware
    risk 0.64cvss 9.8epss 0.05

    D-Link device DIR_882 DIR_882_FW1.30B06_Hotfix_02 was discovered to contain a command injection vulnerability in the twsystem function. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP1 POST request.

  • CVE-2021-44880CriFeb 4, 2022
    Dlink
    Dir 882 Firmware
    risk 0.64cvss 9.8epss 0.04

    D-Link devices DIR_878 DIR_878_FW1.30B08_Hotfix_02 and DIR_882 DIR_882_FW1.30B06_Hotfix_02 were discovered to contain a command injection vulnerability in the system function. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP1 POST request.

  • CVE-2021-44247CriFeb 4, 2022
    Totolink
    A720R
    risk 0.64cvss 9.8epss 0.03

    Totolink devices A3100R v4.1.2cu.5050_B20200504, A830R v5.9c.4729_B20191112, and A720R v4.1.5cu.470_B20200911 were discovered to contain command injection vulnerability in the function setNoticeCfg. This vulnerability allows attackers to execute arbitrary commands via the IpFrom…

  • CVE-2021-44246HigFeb 4, 2022
    Totolink
    A720R
    risk 0.49cvss 7.5epss 0.01

    Totolink devices A3100R v4.1.2cu.5050_B20200504, A830R v5.9c.4729_B20191112, and A720R v4.1.5cu.470_B20200911 were discovered to contain a stack overflow in the function setNoticeCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via the IpTo parameter.

  • CVE-2021-45268HigFeb 3, 2022
    Backdropcms
    Backdrop
    risk 0.57cvss 8.8epss 0.02

    A Cross Site Request Forgery (CSRF) vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via uploading a maliciously add-on with crafted PHP file. NOTE: the vendor disputes this because the attack…

  • CVE-2022-24307CriFeb 3, 2022
    Mastodon
    Mastodon
    risk 0.64cvss 9.8epss 0.01

    Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect access control because it does not compact incoming signed JSON-LD activities. (JSON-LD signing has been supported since version 1.6.0.)