Archive
January 2022
Vulnerabilities first published in this month (UTC), newest first.
2,026 results · Feed
-
High 8.8
Insufficient Verification of Data Authenticity Remote Code Execution Vulnerability on Western Digital My Cloud devices.
A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an unsecured HTTP call. This was a result insufficient verification of calls to the device. The vulnerabil…
-
High 7.8
Command Injection Remote Code Execution vulnerability on Western Digital My Cloud devices.
A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary system commands on the device. The vulnerability was addressed by escaping individual arguments to she…
-
Critical 9.1CVE-2021-40412 EPSS 27%
An OScommand injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136…
-
Critical 9.1CVE-2021-40410 EPSS 28%
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13…
-
Critical 9.1
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13…
-
Critical 9.1
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13…
-
Critical 9.1
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13…
KEV Dec 18, 2024 -
Critical 9.1
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13…
-
High 7.1
An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RL…
-
High 7.1
An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RL…
-
High 7.1
An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RL…
-
High 7.1
An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RL…
-
Critical 9.1
An out-of-bounds write vulnerability exists in the device TestEmail functionality of reolink RLC-410W v3.0.0.136_201211…
-
High 7.5
A denial of service vulnerability exists in the cgiserver.cgi session creation functionality of reolink RLC-410W v3.0.0…
-
Critical 10.0
A firmware update vulnerability exists in the 'factory' binary of reolink RLC-410W v3.0.0.136_20121102. A specially-cra…
-
Medium 5.3
An authentication bypass vulnerability exists in the cgiserver.cgi Login functionality of reolink RLC-410W v3.0.0.136_2…
-
High 8.3
A firmware update vulnerability exists in the "update" firmware checks functionality of reolink RLC-410W v3.0…
-
High 7.5
An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102. A …
-
High 8.6
A denial of service vulnerability exists in the netserver recv_command functionality of reolink RLC-410W v3.0.0.136_201…
-
Critical 9.3
A memory corruption vulnerability exists in the netserver parse_command_list functionality of reolink RLC-410W v3.0.0.1…
-
High 7.5
A denial of service vulnerability exists in the cgiserver.cgi API command parser functionality of Reolink RLC-410W v3.0…
-
High 8.1
An information disclosure vulnerability exists due to a web server misconfiguration in the Reolink RLC-410W v3.0.0.136_…
-
Unscored —
Potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software.
-
Low 3.7
OWASP Related Vulnerabilities in Hitachi Energy’s LinkOne Product
Information Exposure vulnerability in Hitachi Energy LinkOne application, due to a misconfiguration in the ASP server exposes server and ASP.net information, an attacker that manages to exploit this vulnerability can use the exposed information as a reconnais…
-
Low 3.7
OWASP Related Vulnerabilities in Hitachi Energy’s LinkOne Product
Configuration vulnerability in Hitachi Energy LinkOne application due to the lack of HTTP Headers, allows an attacker that manages to exploit this vulnerability to retrieve sensitive information. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.…
-
Medium 4.8
WordPress Ultimate Reviews plugin <= 3.0.15 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15).
-
Low 3.7
OWASP Related Vulnerabilities in Hitachi Energy’s LinkOne Product
Hitachi Energy LinkOne product, has a vulnerability due to a web server misconfiguration, that enables debug mode and reveals the full path of the filesystem directory when an attacker generates errors during a query operation. This issue affects: Hitachi Ene…
-
Medium 6.8
WordPress Download Monitor plugin <= 4.4.6 - Authenticated Arbitrary File Download vulnerability
Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6). The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the &downl…
-
Medium 6.1
HTML code injection vulnerability in Android Application, Bosch Video Security, version 3.2.3. or earlier, when success…
-
Medium 6.6
SYNEL - eharmony Authenticated Blind & Stored XSS
SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS code into the "comments" field could lead to potential stealing of cookies, loading of HTML tags and JS code onto the system.
-
Low 3.4CVE-2021-23174 EPSS 84%
WordPress Download Monitor plugin <= 4.4.6 - Auth. Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameters: &post_title, &downloadable_file_version[0].
-
Medium 5.6
SYNEL - eharmony Directory Traversal
SYNEL - eharmony Directory Traversal. Directory Traversal - is an attack against a server or a Web application aimed at unauthorized access to the file system. on the "Name" parameter the attacker can return to the root directory and open the host file. The p…
-
High 8.1
Emerson DeltaV Uncontrolled Search Path Element
Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control System Controllers and Workstations (All versions) when some DeltaV services are started.
-
Unscored —
A CWE-200: Information Exposure vulnerability exists which could cause the troubleshooting archive to be accessed. Affe…
-
Medium 6.1
Emerson DeltaV Missing Authentication for Critical Function
A specially crafted script could cause the DeltaV Distributed Control System Controllers (All Versions) to restart and cause a denial-of-service condition.
-
Unscored —
A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists whi…
-
Unscored —
A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists tha…
-
Unscored —
A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists tha…
-
Unscored —
A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists tha…
-
Unscored —
A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists tha…