Archive
25 October 2022
Vulnerabilities first published on this day (UTC), newest first.
123 results · Feed
-
Critical 10.0
Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In…
-
Critical 10.0
An OS command injection vulnerability exists in the XCMD setAlexa functionality of Abode Systems, Inc. iota All-In-One …
-
Critical 9.1
An OS command injection vulnerability exists in the js_package install functionality of Robustel R1510 3.1.16. A specia…
-
Critical 9.0
An integer overflow vulnerability exists in the web interface /action/ipcamRecordPost functionality of Abode Systems, I…
-
Critical 10.0
An OS command injection vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. iota All-In-One S…
-
Critical 9.1
An OS command injection vulnerability exists in the sysupgrade command injection functionality of Robustel R1510 3.1.16…
-
High 8.6
A denial of service vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. iota All-In-One Secur…
-
High 8.0
An OS command injection vulnerability exists in the web interface /action/ipcamRecordPost functionality of Abode System…
-
High 7.5
A double-free vulnerability exists in the web interface /action/ipcamSetParamPost functionality of Abode Systems, Inc. …
-
Critical 10.0
A stack-based buffer overflow vulnerability exists in the XCMD setIPCam functionality of Abode Systems, Inc. iota All-I…
-
Critical 10.0
An OS command injection vulnerability exists in the web interface /action/iperf functionality of Abode Systems, Inc. io…
-
Critical 10.0
An OS command injection vulnerability exists in the XCMD setUPnP functionality of Abode Systems, Inc. iota All-In-One S…
-
Critical 9.8
A hard-coded password vulnerability exists in the telnet functionality of Abode Systems, Inc. iota All-In-One Security …
-
High 8.1
An OS command injection vulnerability exists in the console_main_loop :sys functionality of Abode Systems, Inc. iota Al…
-
High 8.6
An authentication bypass vulnerability exists in the web interface /action/factory* functionality of Abode Systems, Inc…
-
Medium 4.7
An information disclosure vulnerability exists in the XFINDER functionality of Abode Systems, Inc. iota All-In-One Secu…
-
Critical 10.0
An OS command injection vulnerability exists in the web interface util_set_serial_mac functionality of Abode Systems, I…
-
Critical 9.8
An authentication bypass vulnerability exists in the GHOME control functionality of Abode Systems, Inc. iota All-In-One…
-
High 8.0
An os command injection vulnerability exists in the web interface util_set_abode_code functionality of Abode Systems, I…
-
Medium 6.1
BUG-000150540 - Reflected XSS vulnerability in ArcGIS Server
There is as reflected cross site scripting issue in Esri ArcGIS Server versions 10.9.1 and below which may allow a remote unauthorized attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the…
-
Medium 6.5
BUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerability
Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated attacker to overwrite internal ArcGIS Server directory.
-
Medium 6.1
BUG-000148347 Unvalidated redirect issues in ArcGIS Server.
Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker controlled website via a crafted query parameter.
-
Medium 6.1
BUG-000146513 - Reflected XSS vulnerability in ArcGIS Server
There is a reflected cross site scripting issue in the Esri ArcGIS Server services directory versions 10.9.1 and below that may allow a remote, unauthenticated attacker to convince a user to click on a crafted link which could potentially execute arbitrary Ja…
-
Medium 6.1
BUG-000144172 - Remote file download issue in ArcGIS Server
A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated attacker to induce an unsuspecting victim to launch a process in the victim's PATH environment. Current …
-
Medium 6.1
BUG-000142376 - Reflected Cross-Site Scripting (XSS) vulnerability in ArcGIS Server.
A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests can execute arbitrary JavaScript in the context of the victim's browser.
-
Medium 4.1
Server-Side Request Forgery (SSRF) vulnerability in Package Center functionality in Synology DiskStation Manager (DSM) …
-
High 7.4
Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Ma…
-
Medium 6.5
AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS)
AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS) A malicious user injects JavaScript code into a parameter called IntersectudRule on the search/result.html page. The malicious user changes the request from POST to GET and sends the URL to another user…
-
Medium 5.4
Apache Geode stored Cross-Site Scripting (XSS) via data injection vulnerability in Pulse web application
Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse web application to view Region entries.
-
High 8.8
A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, and 7.4.2j could allow a loca…
-
High 7.8
A privilege escalation vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn…
-
High 7.8
Several commands in Brocade Fabric OS before Brocade Fabric OS v.9.0.1e, and v9.1.0 use unsafe string functions to proc…
-
High 7.8
A vulnerability in fab_seg.c.h libraries of all Brocade Fabric OS versions before Brocade Fabric OS v9.1.1, v9.0.1e, v8…
-
Medium 5.5
A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5 could allow a local…
-
Medium 5.5
An information disclosure vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0…
-
High 8.8
A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, 7.4.2.j could allo…
-
High 7.2
A vulnerability in the radius authentication system of Brocade Fabric OS before Brocade Fabric OS 9.0 could allow a rem…
-
High 8.8
Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for…
-
Medium 5.3
PRTG Network Monitor through 22.2.77.2204 does not prevent custom input for a device’s icon, which can be modified to i…
-
Medium 5.9
OpenFGA Authorization Bypass
OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users whose model has a relation defined as a tupleset (the right hand side of a ‘from’ statement) that involves an…