2022

aEnrich a+HRD has inadequate filtering for special characters in URLs. An unauthenticated remote attacker can bypass aut

Taiwan Secom Dr.ID Access Control system’s login page has a hard-coded credential in the source code. An unauthenticated

D-Link DIR-878 has inadequate filtering for special characters in the webpage input field. An unauthenticated LAN attack

In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and ot

ASUS RT-AC86U’s LPD service has insufficient filtering for special characters in the user request, which allows an unaut

ASUS RT-AC56U’s configuration function has a heap-based buffer overflow vulnerability due to insufficient validation for

ASUS RT-AC86U has improper user request handling, which allows an unauthenticated LAN attacker to cause a denial of serv

Microprogram’s parking lot management system is vulnerable to sensitive information exposure. An unauthorized remote att

ASUS RT-AX56U’s user profile configuration function is vulnerable to stack-based buffer overflow due to insufficient val

ASUS RT-AX56U’s SQL handling function has an SQL injection vulnerability due to insufficient user input validation. An u

ASUS RT-AX56U’s update_PLC/PORT file has a path traversal vulnerability due to insufficient filtering for special charac

ASUS RT-AX56U’s update_json function has a path traversal vulnerability due to insufficient filtering for special charac

A remote, unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulti

A bug in CmpUserMgr component can lead to only partially applied security policies. This can result in enabled, anonymou

An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a v

The SysDrv3S driver in the CODESYS Control runtime system on Microsoft Windows allows any system user to read and write

A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vuln

An authenticated, remote attacker can gain access to a dereferenced pointer contained in a request. The accesses can sub

An authenticated remote attacker can cause a null pointer dereference in the CmpSettings component of the affected CODES

Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97.

Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint

A Cross Site Scripting (XSS) vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in p

An Access Control vulnerability exists in BigAntSoft BigAnt office messenger 5.6 via im_webserver, which could let a mal

A Denial of Service vulnerability exists in CORTX-S3 Server as of 11/7/2021 via the mempool_destroy method due to a fail

A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remot

There is a stack overflow vulnerability in the SetSysTimeCfg() function in the httpd service of Tenda AC9 V15.03.2.21_cn

There is a stack overflow vulnerability in the SetStaticRouteCfg() function in the httpd service of Tenda AC9 15.03.2.21

Online Project Time Management System v1.0 was discovered to contain an arbitrary file write vulnerability which allows

ownCloud owncloud/android 2.20 has Incorrect Access Control for local attackers.

ownCloud owncloud/android before 2.20 has Incorrect Access Control for physically proximate attackers.

An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system fil

An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts.

A command injection vulnerability in the API of the Wavlink WL-WN531P3 router, version M31G3.V5030.201204, allows an att

Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privilege

Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups acce

SWHKD 1.1.5 allows unsafe parsing via the -c option. An information leak might occur but there is a simple denial of ser

SWHKD 1.1.5 unsafely uses the /tmp/swhkd.sock pathname. There can be an information leak or denial of service.

Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Missing Authentication.

Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Transmitting Write Requests and Cha

Dr Trust USA iCheck Connect BP Monitor BP Testing 118 1.2.1 is vulnerable to a Replay Attack to BP Monitoring.

Dr Trust USA iCheck Connect BP Monitor BP Testing 118 1.2.1 is vulnerable to Plain text command over BLE.

Xiongmai Technology Co devices AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2

PHP-CMS v1.0 was discovered to contain a SQL injection vulnerability via the category parameter in categorymenu.php.

A remote code execution (RCE) vulnerability in baigo CMS v3.0-alpha-2 was discovered to allow attackers to execute arbit

eZiosuite v2.0.7 contains an authenticated arbitrary file upload via the Avatar upload functionality.

FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows unauthenticated attackers to access and download arbitrary files via a

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticat

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) c

A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform F

A vulnerability in the login authorization components of Cisco Webex Meetings could allow an authenticated, remote attac