Total
210374 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-26607 | 1 Baigo | 1 Baigo Cms | 2022-04-13 | 6.5 MEDIUM | 7.2 HIGH |
| A remote code execution (RCE) vulnerability in baigo CMS v3.0-alpha-2 was discovered to allow attackers to execute arbitrary code via uploading a crafted PHP file. | |||||
| CVE-2022-23900 | 1 Wavlink | 2 Wl-wn531p3, Wl-wn531p3 Firmware | 2022-04-13 | 7.5 HIGH | 9.8 CRITICAL |
| A command injection vulnerability in the API of the Wavlink WL-WN531P3 router, version M31G3.V5030.201204, allows an attacker to achieve unauthorized remote code execution via a malicious POST request through /cgi-bin/adm.cgi. | |||||
| CVE-2021-43205 | 1 Fortinet | 1 Forticlient | 2022-04-13 | 5.0 MEDIUM | 5.3 MEDIUM |
| An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Linux version 7.0.2 and below, 6.4.7 and below and 6.2.9 and below may allow an unauthenticated attacker to access the confighandler webserver via external binaries. | |||||
| CVE-2022-26605 | 1 Dascomsoft | 1 Eziosuite | 2022-04-13 | 6.5 MEDIUM | 8.8 HIGH |
| eZiosuite v2.0.7 contains an authenticated arbitrary file upload via the Avatar upload functionality. | |||||
| CVE-2021-41245 | 1 Combodo | 1 Itop | 2022-04-13 | 5.8 MEDIUM | 8.1 HIGH |
| Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, CSRF tokens generated by `privUITransactionFile` aren't properly checked. Versions 2.7.6 and 3.0.0 contain a patch for this issue. As a workaround, use the session implementation by adding in the iTop config file. | |||||
| CVE-2022-26982 | 1 Simplemachines | 1 Simple Machines Forum | 2022-04-13 | 6.5 MEDIUM | 7.2 HIGH |
| SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php code because the themes can be modified by an administrator. | |||||
| CVE-2021-46417 | 1 Franklinfueling | 2 Colibri, Colibri Firmware | 2022-04-13 | 7.8 HIGH | 7.5 HIGH |
| Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privileges in Franklin Fueling Systems Colibri Controller Module 1.8.19.8580. | |||||
| CVE-2020-19229 | 1 Jeesite | 1 Jeesite | 2022-04-13 | 7.5 HIGH | 9.8 CRITICAL |
| Jeesite 1.2.7 uses the apache shiro version 1.2.3 affected by CVE-2016-4437. Because of this version of the java deserialization vulnerability, an attacker could exploit the vulnerability to execute arbitrary commands via the rememberMe parameter. | |||||
| CVE-2022-25338 | 1 Owncloud | 1 Owncloud | 2022-04-13 | 4.6 MEDIUM | 6.8 MEDIUM |
| ownCloud owncloud/android before 2.20 has Incorrect Access Control for physically proximate attackers. | |||||
| CVE-2021-32593 | 1 Fortinet | 1 Fortiwan | 2022-04-13 | 6.4 MEDIUM | 6.5 MEDIUM |
| A use of a broken or risky cryptographic algorithm vulnerability [CWE-327] in the Dynamic Tunnel Protocol of FortiWAN before 4.5.9 may allow an unauthenticated remote attacker to decrypt and forge protocol communication messages. | |||||
| CVE-2021-26114 | 1 Fortinet | 1 Fortiwan | 2022-04-13 | 7.5 HIGH | 9.8 CRITICAL |
| Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiWAN before 4.5.9 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. | |||||
| CVE-2021-26112 | 1 Fortinet | 1 Fortiwan | 2022-04-13 | 7.5 HIGH | 9.8 CRITICAL |
| Multiple stack-based buffer overflow vulnerabilities [CWE-121] both in network daemons and in the command line interpreter of FortiWAN before 4.5.9 may allow an unauthenticated attacker to potentially corrupt control data in memory and execute arbitrary code via specifically crafted requests. | |||||
| CVE-2021-33207 | 1 Softwareag | 1 Mashzone Nextgen | 2022-04-13 | 7.5 HIGH | 9.8 CRITICAL |
| The HTTP client in MashZone NextGen through 10.7 GA deserializes untrusted data when it gets an HTTP response with a 570 status code. | |||||
| CVE-2021-24009 | 1 Fortinet | 1 Fortiwan | 2022-04-13 | 9.0 HIGH | 8.8 HIGH |
| Multiple improper neutralization of special elements used in an OS command vulnerabilities (CWE-78) in the Web GUI of FortiWAN before 4.5.9 may allow an authenticated attacker to execute arbitrary commands on the underlying system's shell via specifically crafted HTTP requests. | |||||
| CVE-2022-1213 | 1 Livehelperchat | 1 Live Helper Chat | 2022-04-13 | 5.5 MEDIUM | 8.1 HIGH |
| SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191 | |||||
| CVE-2022-28352 | 1 Weechat | 1 Weechat | 2022-04-13 | 4.0 MEDIUM | 4.8 MEDIUM |
| WeeChat (aka Wee Enhanced Environment for Chat) 3.2 to 3.4 before 3.4.1 does not properly verify the TLS certificate of the server, after certain GnuTLS options are changed, which allows man-in-the-middle attackers to spoof a TLS chat server via an arbitrary certificate. NOTE: this only affects situations where weechat.network.gnutls_ca_system or weechat.network.gnutls_ca_user is changed without a WeeChat restart. | |||||
| CVE-2022-27110 | 1 Orangehrm | 1 Orangehrm | 2022-04-13 | 4.9 MEDIUM | 5.4 MEDIUM |
| OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint. | |||||
| CVE-2022-27109 | 1 Orangehrm | 1 Orangehrm | 2022-04-13 | 4.9 MEDIUM | 5.4 MEDIUM |
| OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability. | |||||
| CVE-2021-32978 | 1 Automationdirect | 40 C0-10are-d, C0-10are-d Firmware, C0-10dd1e-d and 37 more | 2022-04-13 | 5.0 MEDIUM | 7.5 HIGH |
| The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful, the attacker can then use the password to unlock Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00. | |||||
| CVE-2021-32982 | 1 Automationdirect | 40 C0-10are-d, C0-10are-d Firmware, C0-10dd1e-d and 37 more | 2022-04-13 | 5.0 MEDIUM | 7.5 HIGH |
| Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 passwords are sent as plaintext during unlocking and project transfers. An attacker who has network visibility can observe the password exchange. | |||||