Archive
22 May 2023
Vulnerabilities first published on this day (UTC), newest first.
33 results · Clear filters · Feed
-
High 7.2
CVE-2022-46738
The affected product exposes multiple sensitive data fields of the affected product. An attacker can use the SNMP command to get device mac address and login as admin.
-
High 8.1
CVE-2022-47320
The iBoot device’s basic discovery protocol assists in initial device configuration. The discovery protocol shows basic information about devices on the network and allows users to perform configuration changes.
-
High 8.5
CVE-2022-47311
A proprietary protocol for iBoot devices is used for control and keepalive commands. The function compares the username and password; it also contains the configuration data for the user specified. If the user does not exist, then it sends a value for usernam…
-
High 8.4
Files present on firmware images could allow an attacker to gain unauthorized access as a root user using hard-coded cr…
-
High 7.7
The affected products have a CSRF vulnerability that could allow an attacker to execute code and upload malicious files.
-
High 8.3
In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new functionality appears that co…
-
High 8.3
Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local networ…
-
High 7.1
Devices using Snap One OvrC cloud are sent to a web address when accessing a web management interface using a HTTP conn…
-
High 8.6
Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly. The device only calculates…
-
High 7.5
Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers. Because the…
-
High 8.6
Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright.
-
High 8.6
The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. A…
-
High 7.5
Apache InLong: Insecurity direct object references cancelling applications
Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. the user in InLong could cancel an application that doesn't belongs to it. Users are advi…
-
High 8.0
Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system (OS) command injectio…
-
High 7.5
Apache InLong: Attackers can change the immutable name and type of cluster
Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers can change the immutable name and type of cluster of InLong. Users are advised to upgrade to …
-
High 8.0
Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper vali…
-
High 8.8
Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing users to access managed devices’ …
-
High 7.5
Teltonika’s Remote Management System versions prior to 4.10.0 contain a cross-site scripting (XSS) vulnerability in the…
-
High 8.1
Teltonika’s Remote Management System versions prior to 4.10.0 use device serial numbers and MAC addresses to identify d…
-
High 7.5
Apache InLong: Attackers can change the immutable name and type of nodes
Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers can change the immutable name and type of nodes of InLong. Users are advised to upgrade to Apa…
-
High 7.5
Apache InLong: IDOR make users can delete others' subscription
Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can delete others' subscriptions, even if they are not the owner of the de…
-
High 8.8
A CWE-319: Cleartext transmission of sensitive information vulnerability exists that could cause disclosure of sensitiv…
-
High 7.5
Apache InLong: IDOR make users can bind any cluster
Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can bind any cluster, even if he is not the cluster owner. Users are advi…
-
High 7.5
Apache InLong: JDBC URL bypassing by adding blanks
Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers would bypass the 'autoDeserialize' option filtering by adding blanks. Users are advised to upgrad…
-
High 7.2
SQL Injection in unilogies/bumsys
SQL Injection in GitHub repository unilogies/bumsys prior to 2.2.0.
-
High 7.5CVE-2023-28709 EPSS 48%
Apache Tomcat: Fix for CVE-2023-24998 is incomplete
The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string p…
-
High 7.8
QCS 800xA Vulnerability identified in system log files
Insertion of Sensitive Information into Log File vulnerability in ABB QCS 800xA, ABB QCS AC450, ABB Platform Engineering Tools. An attacker, who already has local access to the QCS nodes, could successfully obtain the password for a system user account. Using…
-
High 7.2
MXsecurity Command Injection Vulnerability
MXsecurity version 1.0 is vulnearble to command injection vulnerability. This vulnerability has been reported in the SSH CLI program, which can be exploited by attackers who have gained authorization privileges. The attackers can break out of the restricted s…
-
High 8.8
IBM InfoSphere Information Server code execution
IBM InfoSphere Information Server 11.7 is affected by a remote code execution vulnerability due to insecure deserialization in an RMI service. IBM X-Force ID: 255285.
-
High 7.5
Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consump…
-
High 7.2CVE-2023-31742 Public exploit
There is a command injection vulnerability in the Linksys WRT54GL router with firmware version 4.30.18.006. If an attac…
-
High 7.5
Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbi…
-
High 7.0
In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache (which is enabled by default in Open…