Archive
18 March 2025
Vulnerabilities first published on this day (UTC), newest first.
71 results · Feed
-
High 8.1CVE-2024-44313 Public exploit
TastyIgniter Has an Incorrect Access Control Vulnerability via `invoice()` Function
TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice() function within Orders.php which allows unauthorized users to access and generate invoices due to missing permission checks.
-
Medium 6.5
TastyIgniter Has an Incorrect Access Control Vulnerability
TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthorized users to update order statuses. The issue occurs in the index_onUpdateStatus() function within Orders.php, which fails to verify if th…
-
Critical 9.8
An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Default Credentials Cannot Be Changed. It us…
-
Critical 9.8
An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Hardcoded Credentials exist in the APK for P…
-
High 7.3
An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Managing Settings and Obtaining Sensitive Da…
-
Critical 9.8
An issue was discovered on ROADCAM X3 devices. The mobile app APK (Viidure) contains hardcoded FTP credentials for the …
-
Critical 9.8
An issue was discovered on ROADCAM X3 devices. It has a uniform default credential set that cannot be modified by users…
-
Critical 9.8
An issue was discovered in the G-Net GNET APK 2.6.2. Hardcoded credentials exist in in APK for ports 9091 and 9092. The…
-
High 7.5
An issue was discovered on G-Net Dashcam BB GONX devices. One can Remotely Dump Video Footage and the Live Video Stream…
-
Critical 9.1
An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Bypassing of Device Pairing can occur. The p…
-
High 7.5
An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Remotely Dumping of Video Footage and the Li…
-
High 7.5
On IROAD v9 devices, one can Remotely Dump Video Footage and the Live Video Stream. The dashcam exposes endpoints that …
-
Critical 9.8
An issue was discovered on G-Net Dashcam BB GONX devices. Default credentials for SSID cannot be changed. It broadcasts…
-
Medium 6.5
In the IROAD APK 5.2.5, there are Hardcoded Credentials in the APK for ports 9091 and 9092. The mobile application for …
-
High 7.5
On IROAD V9 devices, Managing Settings and Obtaining Sensitive Data and Sabotaging the Car Battery can be performed by …
-
High 8.1
An issue was discovered on G-Net Dashcam BB GONX devices. Bypassing of Device Pairing can occur. It uses MAC address ve…
-
Medium 4.6
An issue was discovered on G-Net Dashcam BB GONX devices. Managing Settings and Obtaining Sensitive Data and Sabotaging…
-
High 8.8
On IROAD v9 devices, the dashcam has hardcoded default credentials ("qwertyuiop") that cannot be changed by the user. T…
-
High 7.5
An issue was discovered on G-Net Dashcam BB GONX devices. A Public Domain name is Used for the Internal Domain Name. It…
-
Critical 9.1
An issue was discovered on IROAD Dashcam V devices. It uses an unregistered public domain name as an internal domain, c…
-
Medium 6.5
On IROAD X5 devices, a Bypass of Device Pairing can occur via MAC Address Spoofing. The dashcam's pairing mechanism rel…
-
Medium 6.1
yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the selectNoticeList() method at …
-
Medium 4.2
yimioa before v2024.07.04 was discovered to contain an information disclosure vulnerability via the component /resource…
-
High 7.3
Incorrect access control in the component /config/WebSecurityConfig.java of yimioa before v2024.07.04 allows unauthoriz…
-
High 7.5
CosmWasm Allows Bypass of Capability Restrictions in Blockchains
An issue in CosmWasm prior to v2.2.0 allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime capability validation. This allows attackers to deploy a contract without capability enforcement, and execute unauthorized a…
-
High 8.1
An XML external entity (XXE) injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.…
-
Medium 6.1
yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the listNameBySql() method at /xm…
-
Medium 6.1
yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the component /mapper/xml/Address…
-
Critical 9.8
A lack of rate limiting in the login page of Safe App version a3.0.9 allows attackers to bypass authentication via a br…
-
High 7.5
Systemic Risk Value <=2.8.0 is vulnerable to Local File Inclusion via /GetFile.aspx?ReportUrl=. An unauthenticated atta…
-
Medium 6.5
Systemic Risk Value <=2.8.0 is vulnerable to improper access control in /RiskValue/GroupingEntities/Controls/GetFile.as…