Archive
22 May 2023
Vulnerabilities first published on this day (UTC), newest first.
84 results · Feed
-
Medium 6.5
CVE-2022-46658
The affected product is vulnerable to a stack-based buffer overflow which could lead to a denial of service or remote code execution.
-
High 7.2
CVE-2022-46738
The affected product exposes multiple sensitive data fields of the affected product. An attacker can use the SNMP command to get device mac address and login as admin.
-
High 8.1
CVE-2022-47320
The iBoot device’s basic discovery protocol assists in initial device configuration. The discovery protocol shows basic information about devices on the network and allows users to perform configuration changes.
-
High 8.5
CVE-2022-47311
A proprietary protocol for iBoot devices is used for control and keepalive commands. The function compares the username and password; it also contains the configuration data for the user specified. If the user does not exist, then it sends a value for usernam…
-
Medium 6.5
CVE-2022-4945
The Dataprobe cloud usernames and passwords are stored in plain text in a specific file. Any user able to read this specific file from the device could compromise other devices connected to the user's cloud.
-
High 8.4
Files present on firmware images could allow an attacker to gain unauthorized access as a root user using hard-coded cr…
-
High 7.7
The affected products have a CSRF vulnerability that could allow an attacker to execute code and upload malicious files.
-
High 8.3
In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new functionality appears that co…
-
High 8.3
Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local networ…
-
High 7.1
Devices using Snap One OvrC cloud are sent to a web address when accessing a web management interface using a HTTP conn…
-
High 8.6
Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly. The device only calculates…
-
High 7.5
Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers. Because the…
-
High 8.6
Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright.
-
Medium 5.3
When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. The MAC …
-
High 8.6
The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. A…
-
Critical 9.8
Apache InLong: Privilege escalation vulnerability for InLong
Improper Privilege Management Vulnerabilities in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. When the attacker has access to a valid (but unprivileged) account, the exploit can be executed using Burp S…
-
High 7.5
Apache InLong: Insecurity direct object references cancelling applications
Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. the user in InLong could cancel an application that doesn't belongs to it. Users are advi…
-
Critical 9.1
Apache InLong: Insufficient Session Expiration in InLong
Insufficient Session Expiration vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. An old session can be used by an attacker even after the user has been deleted or the password has been chan…
-
Critical 9.1
Apache InLong: Insecure direct object references for inlong sources
Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Different users in InLong could delete, edit, stop, and start others' sources! Users are …
-
Critical 9.8
Apache InLong: Weak Password Implementation in InLong
Weak Password Requirements vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.6.0. When users change their password to a simple password (with any character or symbol), attackers can easily guess …
-
Medium 6.5
Apache InLong: Users who joined later can see the data of deleted users
Insecure Default Initialization of Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.6.0. Users registered in InLong who joined later can see deleted users' data. Users are advised to upg…
-
High 8.0
Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injectio…
-
High 7.5
Apache InLong: Attackers can change the immutable name and type of cluster
Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers can change the immutable name and type of cluster of InLong. Users are advised to upgrade to …
-
High 8.0
Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper vali…
-
High 8.8
Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing users to access managed devices’ …
-
High 7.5
Teltonika’s Remote Management System versions prior to 4.10.0 contain a cross-site scripting (XSS) vulnerability in the…
-
Critical 9.0
Teltonika’s Remote Management System versions 4.14.0 is vulnerable to an unauthorized attacker registering previously u…
-
Medium 5.8
Teltonika’s Remote Management System versions prior to 4.10.0 contain a virtual private network (VPN) hub feature for c…
-
High 8.1
Teltonika’s Remote Management System versions prior to 4.10.0 use device serial numbers and MAC addresses to identify d…
-
Medium 5.3
Teltonika’s Remote Management System versions prior to 4.10.0 contain a function that allows users to claim their devic…
-
Medium 5.4
WordPress Archivist – Custom Archive Templates Plugin <= 1.7.4 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin <= 1.7.4 versions.
-
Medium 4.3
WordPress ColorWay Theme <= 4.2.3 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Inkthemescom ColorWay theme <= 4.2.3 versions.
-
High 7.5
Apache InLong: Attackers can change the immutable name and type of nodes
Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers can change the immutable name and type of nodes of InLong. Users are advised to upgrade to Apa…
-
High 7.5
Apache InLong: IDOR make users can delete others' subscription
Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can delete others' subscriptions, even if they are not the owner of the de…
-
High 8.8
A CWE-319: Cleartext transmission of sensitive information vulnerability exists that could cause disclosure of sensitiv…
-
High 7.5
Apache InLong: IDOR make users can bind any cluster
Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can bind any cluster, even if he is not the cluster owner. Users are advi…
-
High 7.5
Apache InLong: JDBC URL bypassing by adding blanks
Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers would bypass the 'autoDeserialize' option filtering by adding blanks. Users are advised to upgrad…
-
Medium 6.1
Dell PowerEdge 14G server BIOS versions prior to 2.18.1 and Dell Precision BIOS versions prior to 2.18.2, contain an Ou…
-
High 7.2
SQL Injection in unilogies/bumsys
SQL Injection in GitHub repository unilogies/bumsys prior to 2.2.0.
-
High 7.5CVE-2023-28709 EPSS 48%
Apache Tomcat: Fix for CVE-2023-24998 is incomplete
The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string p…