Archive
30 December 2021
Vulnerabilities first published on this day (UTC), newest first.
50 results · Feed
-
Unscored —
Bitmask Riseup VPN 0.21.6 contains a local privilege escalation flaw due to improper access controls. When the software…
-
Unscored —
Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the web interface. By defaul…
-
Unscored —
Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the SOAP interface. By defau…
-
Unscored —
Netgear Nighthawk R6700 version 1.0.4.120 contains a command injection vulnerability in update functionality of the dev…
-
Unscored —
Netgear Nighthawk R6700 version 1.0.4.120 stores sensitive information in plaintext. All usernames and passwords for th…
-
Unscored —
Netgear Nighthawk R6700 version 1.0.4.120 makes use of a hardcoded credential. It does not appear that normal users are…
-
Unscored —
Netgear Nighthawk R6700 version 1.0.4.120 does not have sufficient protections for the UART console. A malicious actor …
-
Unscored —
All known versions of the Netgear Genie Installer for macOS contain a local privilege escalation vulnerability. The ins…
-
Unscored —
Netgear RAX43 version 1.0.3.96 does not utilize secure communications to the web interface. By default, all communicati…
-
Unscored —
Netgear RAX43 version 1.0.3.96 contains a command injection vulnerability. The readycloud cgi application is vulnerable…
-
Unscored —
Netgear RAX43 version 1.0.3.96 does not have sufficient protections to the UART interface. A malicious actor with physi…
-
Unscored —
Netgear RAX43 version 1.0.3.96 contains a buffer overrun vulnerability. The URL parsing functionality in the cgi-bin en…
-
Unscored —
Netgear RAX43 version 1.0.3.96 makes use of hardcoded credentials. It does not appear that normal users are intended to…
-
Unscored —
Netgear RAX43 version 1.0.3.96 stores sensitive information in plaintext. All usernames and passwords for the device's …
-
Unscored —
Trendnet AC2600 TEW-827DRU version 2.08B01 does not properly implement csrf protections. Most pages lack proper usage o…
-
Unscored —
Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses credentials for the smb functionality of the device. Us…
-
Unscored —CVE-2021-20150 EPSS 40%
Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard. Auth…
-
Unscored —
Trendnet AC2600 TEW-827DRU version 2.08B01 contains a flaw in the session management for the device. The router's manag…
-
Unscored —
Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient access controls for the WAN interface. The default …
-
Unscored —
Trendnet AC2600 TEW-827DRU version 2.08B01 leaks information via the ftp web page. Usernames and passwords for all ftp …
-
Unscored —
Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient protections for the UART functionality. A malicious…
-
Unscored —
Trendnet AC2600 TEW-827DRU version 2.08B01 stores credentials in plaintext. Usernames and passwords are stored in plain…
-
Unscored —
Trendnet AC2600 TEW-827DRU version 2.08B01 contains a command injection vulnerability in the smb functionality of the d…
-
Unscored —
Trendnet AC2600 TEW-827DRU version 2.08B01 makes use of hardcoded credentials. It is possible to backup and restore dev…
-
Unscored —
Trendnet AC2600 TEW-827DRU version 2.08B01 contains an security flaw in the web interface. HTTPS is not enabled on the …
-
Unscored —
Trendnet AC2600 TEW-827DRU version 2.08B01 contains a symlink vulnerability in the bittorrent functionality. If enabled…
-
Unscored —
Trendnet AC2600 TEW-827DRU version 2.08B01 lacks proper authentication to the bittorrent functionality. If enabled, any…
-
Unscored —
Trendnet AC2600 TEW-827DRU version 2.08B01 is vulnerable to command injection. The system log functionality of the firm…
-
Unscored —
Trendnet AC2600 TEW-827DRU version 2.08B01 contains an authentication bypass vulnerability. It is possible for an unaut…
-
Unscored —
It is possible for an unauthenticated, malicious user to force the device to reboot due to a hidden administrative comm…
-
Unscored —
Trendnet AC2600 TEW-827DRU version 2.08B01 contains an improper access control configuration that could allow for a mal…
-
Unscored —
Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vul…
-
Unscored —
Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can …
-
Unscored —
Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vul…
-
Unscored —
Glewlwyd 2.0.0, fixed in 2.6.1 is affected by an incorrect access control vulnerability. One user can attempt to log in…
-
Medium 6.1
IBM i 7.2, 7.3, and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaS…
-
Unscored —
iBall WRD12EN 1.0.0 devices allow cross-site request forgery (CSRF) attacks as demonstrated by enabling DNS settings or…
-
Low 3.7
Self XSS on user input
jQuery Terminal Emulator is a plugin for creating command line interpreters in your applications. Versions prior to 2.31.1 contain a low impact and limited cross-site scripting (XSS) vulnerability. The code for XSS payload is always visible, but an attacker c…
-
High 7.2
Incorrect sanitisation function leads to `XSS`
Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. Prior to version 8.13.8, malicious diagrams can run javascript code at diagram readers' machines. Us…
-
Unscored —
Quectel UC20 UMTS/HSPA+ UC20 6.3.14 is affected by a Cross Site Scripting (XSS) vulnerability.