Category
Network devices
11,298 known vulnerabilities.
866 results · Clear filters · Feed
-
Critical 9.4
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted fun…
KEV Sep 19, 2024 -
Critical 9.8
D-Link WiFi router - OS Command Injection
Certain models of D-Link wireless routers do not properly validate user input in the telnet service, allowing unauthenticated remote attackers to use hard-coded credentials to log into telnet and inject arbitrary OS commands, which can then be executed on the…
-
Critical 9.8
D-Link WiFi router - Hidden Functionality
Certain models of D-Link wireless routers have a hidden functionality where the telnet service is enabled when the WAN port is plugged in. Unauthorized remote attackers can log in and execute OS commands using hard-coded credentials.
-
Critical 9.8
D-Link WiFi router - Stack-based Buffer Overflow
The web service of certain models of D-Link wireless routers contains a Stack-based Buffer Overflow vulnerability, which allows unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device.
-
Critical 9.8
D-Link WiFi router - Stack-based Buffer Overflow
The web service of certain models of D-Link wireless routers contains a Stack-based Buffer Overflow vulnerability, which allows unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device.
-
Critical 9.1CVE-2024-34783 EPSS 43%
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated …
-
Critical 9.1CVE-2024-34779 EPSS 24%
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated …
-
Critical 9.1CVE-2024-34785 EPSS 25%
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated …
-
Critical 9.1CVE-2024-32848 EPSS 43%
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated …
-
Critical 9.1
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated …
-
Critical 9.1CVE-2024-32840 EPSS 25%
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated …
-
Critical 9.1
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated …
-
Critical 9.1CVE-2024-32845 EPSS 24%
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated …
-
Critical 9.1
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated …
-
Critical 10.0
Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allow…
-
Critical 9.8
**UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware vers…
-
Critical 9.8
A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an …
KEV Mar 31, 2025 -
Critical 9.8CVE-2024-7261 EPSS 11%
The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmwar…
-
Critical 9.3
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially le…
KEV Sep 9, 2024 -
Critical 9.8
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a rem…
KEV Sep 24, 2024 -
Critical 9.6
An information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows …
-
Critical 9.3
Vulnerability of uncaught exceptions in the Graphics module Impact: Successful exploitation of this vulnerability may a…
-
Critical 9.8
Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisc…
-
Critical 9.8
Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisc…
-
Critical 9.8
An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker …
-
Critical 9.3
Access control vulnerability in the security verification module. Impact: Successful exploitation of this vulnerability…
-
Critical 9.8
D-Link - CWE-294: Authentication Bypass by Capture-replay
D-Link - CWE-294: Authentication Bypass by Capture-replay
-
Critical 9.8
D-Link - CWE-288: Authentication Bypass Using an Alternate Path or Channel
D-Link - CWE-288:Authentication Bypass Using an Alternate Path or Channel
-
Critical 10.0
A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unaut…
-
Critical 9.8
A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an una…
-
Critical 9.3
Expedition: Missing Authentication Leads to Admin Account Takeover
Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichm…
KEV Nov 7, 2024 -
Critical 10.0
Session Smart Router(SSR): On redundant router deployments API authentication can be bypassed
An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router or conductor running with a redundant peer allows a network based attacker to bypass authentication and take full control of the device. Only ro…
-
Critical 9.8CVE-2024-29974 EPSS 23%
** UNSUPPORTED WHEN ASSIGNED ** The remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel N…
-
Critical 9.8
** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmwa…
-
Critical 9.8
** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS32…
-
Critical 9.6CVE-2024-29823 EPSS 100%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated at…
-
Critical 9.6CVE-2024-29827 EPSS 72%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated at…
-
Critical 9.6CVE-2024-29826 EPSS 100%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated at…
-
Critical 9.6CVE-2024-29822 EPSS 64%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated at…
-
Critical 9.6
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated at…
KEV Oct 2, 2024