Archive
18 July 2022
Vulnerabilities first published on this day (UTC), newest first.
100 results · Feed
-
Medium 5.9
Chcnav - P5E GNSS Authentication bypass
The server checks the user's cookie in a non-standard way, and a value is entered in the cookie value name of the status and its value is set to true to bypass the identification with the system using a username and password.
-
Medium 5.7
Chcnav - P5E GNSS Directory listing
Directory listing is a web server function that displays the directory contents when there is no index file in a specific website directory. A directory listing provides an attacker with the complete index of all the resources located inside of the directory.…
-
Medium 6.3
Chcnav - P5E GNSS API not secure
Browsing the path: http://ip/wifi_ap_pata_get.cmd, will show in the name of the existing access point on the component, and a password in clear text.
-
Medium 6.8
Chcnav - P5E GNSS Authentication bypass admin password reset
Browsing the admin.html page allows the user to reset the admin password. Also appears in the JS code for the password.
-
Medium 5.7
Chcnav - P5E GNSS Information disclosure hard coded credentials.
This vulnerability affects all of the company's products that also include the FW versions: update_i90_cv2.021_b20210104, update_i50_v1.0.55_b20200509, update_x6_v2.1.2_b202001127, update_b5_v2.0.9_b20200706. This vulnerability makes it possible to extract fr…
-
High 7.6
Cellinx NVT – IP PTZ Camera local file inclusion
Allows a remote user to read files on the camera's OS "GetFileContent.cgi". Reading arbitrary files on the camera's OS as root user.
-
High 8.2
Cellinx NVT – IP PTZ Camera Privilege Escalation
On Cellinx Camera with guest enabled, attacker with web access can elevate privileges to administrative: "1" to "0" privileges by changing the following cookie values from "is_admin", "showConfig". Administrative Privileges which allows changing various confi…
-
Unscored —
An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The new menu option within the general Parameters page…
-
Unscored —
An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A SQL Injection vulnerability allows authenticated use…
-
Unscored —
An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A PresAbs.php SQL Injection vulnerability allows unaut…
-
Unscored —
An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. It mishandles access control. This allows a remote att…
-
Unscored —
An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The Touch settings allow unrestricted file upload (and…
-
Unscored —
ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file an…
-
Unscored —
AnyDesk 7.0.9 allows a local user to gain SYSTEM privileges via a symbolic link because the user can write to their own…
-
High 7.5
Service unavailability impact in NodeJS agent(version <= 0.5.0)
A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable if the OAP is unhealthy and NodeJS agent can't establish the connection.
-
Medium 6.3
FileZilla Client Installer uninstall.exe unquoted search path
A vulnerability has been found in FileZilla Client 3.17.0.0 and classified as problematic. This vulnerability affects unknown code of the file C:\Program Files\FileZilla FTP Client\uninstall.exe of the component Installer. The manipulation leads to unquoted s…
-
High 8.8
Apache Spark shell command injection vulnerability via Spark UI
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in H…
KEV Mar 7, 2023 -
High 7.2
Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload
The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level pe…
-
Medium 5.3
External Control of File Name or Path in dompdf/dompdf
External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.
-
High 8.8
An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8…