Archive
30 March 2022
Vulnerabilities first published on this day (UTC), newest first.
131 results · Feed
-
Unscored —
totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability via the component c…
-
Unscored —
totolink EX300_v2, ver V4.0.3c.140_B20210429 and A720R ,ver V4.1.5cu.470_B20200911 have an issue which causes uncontrol…
-
Unscored —
totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a reflected cross-site scripting (XSS) vulnerability …
-
Unscored —
totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability via the component p…
-
Unscored —
Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via pa…
-
Unscored —
Online Banking System Protect v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the pages p…
-
Unscored —
In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated. Using this functio…
-
Unscored —
totolink EX300_v2 V4.0.3c.140_B20210429 and EX1200T V4.1.2cu.5230_B20210706 does not contain an authentication mechanis…
-
Unscored —
A remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary…
-
Unscored —
In totolink a3100r V5.9c.4577, the hard-coded telnet password can be discovered from official released firmware. An att…
-
Unscored —CVE-2021-46009 EPSS 13%
In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Additionally, a…
-
Unscored —
totolink a3100r V5.9c.4577 is vulnerable to os command injection. The backend of a page is executing the "ping" command…
-
Unscored —
Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration. The SESSION_ID i…
-
Unscored —
MashZone NextGen through 10.7 GA allows a remote authenticated user, with access to the admin console, to upload a new …
-
Unscored —
The "Register an Ehcache Configuration File" admin feature in MashZone NextGen through 10.7 GA allows XXE attacks via a…
-
Critical 9.1
HTTP Request Smuggling in puma
Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree o…
-
Unscored —
MashZone NextGen through 10.7 GA has an SSRF vulnerability that allows an attacker to interact with arbitrary TCP servi…
-
Unscored —
In RSA Archer 6.x through 6.9 SP3 (6.9.3.0), an authenticated attacker can make a GET request to a REST API endpoint th…
-
Unscored —
Vivoh Webinar Manager before 3.6.3.0 has improper API authentication. When a user logs in to the administration configu…
-
Medium —
Improper Restriction of XML External Entity Reference in wutka jox
An XML External Entity (XXE) vulnerability exists in wuta jox 1.16 in the readObject method in JOXSAXBeanInput.
-
Unscored —
An SQL Injection vulnerability exists in glorylion JFinalOA as of 9/7/2021 in the defkey parameter getHaveDoneTaskDataL…
-
Unscored —
An SQL Injection vulnerability exists in oasys oa_system as of 9/7/2021 in resources/mappers/notice-mapper.xml.
-
High 7.5
Authentication bypass in Wyze Cam Pan v2, Cam v2 and Cam v3
A vulnerability in the authentication logic of Wyze Cam Pan v2, Cam v2, Cam v3 allows an attacker to bypass login and control the devices. This issue affects: Wyze Cam Pan v2 versions prior to 4.49.1.47. Wyze Cam v2 versions prior to 4.9.8.1002. Wyze Cam v3 v…
-
High 7.6
Stack buffer overflow in Wyze Cam Pan v2, Cam v2 and Cam v3
Stack-based Buffer Overflow vulnerability in Wyze Cam Pan v2, Cam v2, Cam v3 allows an attacker to run arbitrary code on the affected device. This issue affects: Wyze Cam Pan v2 versions prior to 4.49.1.47. Wyze Cam v2 versions prior to 4.9.8.1002. Wyze Cam v…
-
High 7.7
Weak Authentication in Login Function of USC+
A vulnerability in MEPSAN's USC+ before version 3.0 has a weakness in login function which lets attackers to generate high privileged accounts passwords.
-
Unscored —
This module provides integration with the CleanTalk spam protection service. The module does not properly filter data i…
-
Unscored —
QingScan 1.3.0 is affected by Cross Site Scripting (XSS) vulnerability in all search functions.
-
Critical 9.1
Tekon KIO devices through 2022-03-30 allow an authenticated admin user to escalate privileges to root by uploading a ma…
-
High 7.8CVE-2022-27772 Public exploit
Temporary Directory Hijacking to Local Privilege Escalation Vulnerability in org.springframework.boot:spring-boot
spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only…
-
Unscored —
phpshe V1.8 is affected by a denial of service (DoS) attack in the registry's verification code, which can paralyze the…
-
High 8.5
TIBCO Managed File Transfer Platform Server Remote Code Execution Vulnerability
The cfsend, cfrecv, and CyberResp components of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for UNIX and TIBCO Managed File Transfer Platform Server for z/Linux contain a difficult to exploit Remote Code Execution (RCE) vulnerability tha…
-
Unscored —
An issue was discovered in Firmware Analysis and Comparison Tool v3.2. Logged in administrators could be targeted by a …
-
Unscored —
An issue was discovered in Firmware Analysis and Comparison Tool v3.2. With administrator privileges, the attacker coul…
-
Unscored —
An integer overflow flaw was found in the Linux kernel’s virtio device driver code in the way a user triggers the vhost…
-
Medium 6.8
Buffer Overflow vulnerability in the recovery image web-based interface
A specially crafted TCP/IP packet may cause the camera recovery image web interface to crash. It may also cause a buffer overflow which could enable remote code execution. The recovery image can only be booted with administrative rights or with physical acces…
-
Medium 6.8
Buffer Overflow vulnerability in the recovery image telnet server
A specially crafted TCP/IP packet may cause a camera recovery image telnet interface to crash. It may also cause a buffer overflow which could enable remote code execution. The recovery image can only be booted with administrative rights or with physical acce…
-
High 7.8
SanDisk Professional G-RAID 4/8 Software Utility, Privilege Escalation
The G-RAID 4/8 Software Utility setups for Windows were affected by a DLL hijacking vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the system user.
-
Unscored —
In ContextImpl, there is a possible way to determine whether an app is installed, without query permissions, due to sid…
-
Unscored —
In incfs, there is a possible way of mounting on arbitrary paths due to a missing permission check. This could lead to …
-
Unscored —
In WallpaperManagerService, there is a possible way to determine whether an app is installed, without query permissions…