Archive
2 July 2024
Vulnerabilities first published on this day (UTC), newest first.
10 results · Clear filters · Feed
-
Critical 9.8
mySCADA myPRO Use of Hard-coded Password
mySCADA myPRO uses a hard-coded password which could allow an attacker to remotely execute code on the affected device.
-
Critical 9.8
Output of "go env" does not sanitize values in cmd/go
Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting ne…
-
Critical 9.8
GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions
GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by us…
-
Critical 9.1
American Dynamics Illustra Essentials Gen 4 - Log Filter Input Validation
Under certain circumstances the web interface will accept characters unrelated to the expected input.
-
Critical 9.8
Download of Code Without Integrity Check in Kiloview P1/P2 devices
A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin and integrity of the code. This vulnerability can allow attackers to modify the firmware before upl…
-
Critical 9.8
Authentication Bypass by Primary Weakness in Kiloview P1/P2 devices
The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in.
-
Critical 9.8
Use of Hard-coded Credentials in Kiloview P1/P2 devices
Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access.
-
Critical 10.0
Missing Authentication for Critical Function in Kiloview P1/P2 devices
A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or even the exe…
-
Critical 10.0
Improper input validation in Kiloview P1/P2 devices allows for remote code execution
Inadequate input validation exposes the system to potential remote code execution (RCE) risks. Attackers can exploit this vulnerability by appending shell commands to the Speed-Measurement feature, enabling unauthorized code execution.
-
Critical 9.8
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribe
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the db parameter in all versions up to, and including, 5.7.25 due to insufficien…