Total
210374 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-4303 | 1 Ibm | 10 Control Desk, Maximo Asset Management, Maximo For Aviation and 7 more | 2023-02-03 | 3.5 LOW | 5.4 MEDIUM |
| IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 160949. | |||||
| CVE-2020-36657 | 1 Uptimed Project | 1 Uptimed | 2023-02-03 | N/A | 7.8 HIGH |
| uptimed before 0.4.6-r1 on Gentoo allows local users (with access to the uptimed user account) to gain root privileges by creating a hard link within the /var/spool/uptimed directory, because there is an unsafe chown -R call. | |||||
| CVE-2022-45315 | 1 Mikrotik | 1 Routeros | 2023-02-03 | N/A | 9.8 CRITICAL |
| Mikrotik RouterOs before stable v7.6 was discovered to contain an out-of-bounds read in the snmp process. This vulnerability allows attackers to execute arbitrary code via a crafted packet. | |||||
| CVE-2020-18331 | 1 Chinamobileltd | 2 Gpn2.4p21-c-cn, Gpn2.4p21-c-cn Firmware | 2023-02-03 | N/A | 9.1 CRITICAL |
| Directory traversal vulnerability in ChinaMobile PLC Wireless Router model GPN2.4P21-C-CN running the firmware version W2000EN-01(hardware platform Gpn2.4P21-C_WIFI-V0.05), via the getpage parameter to /cgi-bin/webproc. | |||||
| CVE-2020-18330 | 1 Chinamobileltd | 2 Gpn2.4p21-c-cn, Gpn2.4p21-c-cn Firmware | 2023-02-03 | N/A | 9.1 CRITICAL |
| An issue was discovered in the default configuration of ChinaMobile PLC Wireless Router model GPN2.4P21-C-CN running the firmware version W2000EN-01(hardware platform Gpn2.4P21-C_WIFI-V0.05), allows attackers to gain access to the configuration interface. | |||||
| CVE-2020-18329 | 1 Carel | 3 Pcoweb Card Bios, Pcoweb Card Boot, Pcoweb Card Web | 2023-02-03 | N/A | 7.5 HIGH |
| An issue was discovered in Rehau devices that use a pCOWeb card BIOS v6.27, BOOT v5.00, web version v2.2, allows attackers to gain full unauthenticated access to the configuration and service interface. | |||||
| CVE-2022-42496 | 1 Kujirahand | 1 Nadesiko3 | 2023-02-03 | N/A | 9.8 CRITICAL |
| OS command injection vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to obtain appkey of the product and execute an arbitrary OS command on the product. | |||||
| CVE-2022-41142 | 1 Centreon | 1 Centreon | 2023-02-03 | N/A | 8.8 HIGH |
| This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of requests to configure poller resources. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to the level of an administrator. Was ZDI-CAN-18304. | |||||
| CVE-2022-41777 | 1 Kujirahand | 1 Nadesiko3 | 2023-02-03 | N/A | 7.5 HIGH |
| Improper check or handling of exceptional conditions vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to inject an invalid value to decodeURIComponent of nako3edit, which may lead the server to crash. | |||||
| CVE-2022-41141 | 1 Windscribe | 1 Windscribe | 2023-02-03 | N/A | 7.8 HIGH |
| This vulnerability allows local attackers to escalate privileges on affected installations of Windscribe. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-16859. | |||||
| CVE-2022-40717 | 1 Dlink | 2 Dir-2150, Dir-2150 Firmware | 2023-02-03 | N/A | 8.8 HIGH |
| This vulnerability allows network-adjacent attackers to execute arbitrary code on affected D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the anweb service, which listens on TCP ports 80 and 443 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15727. | |||||
| CVE-2020-10934 | 1 Acyba | 1 Acymailing | 2023-02-03 | 6.5 MEDIUM | 7.2 HIGH |
| Acyba AcyMailing before 6.9.2 mishandles file uploads by admins. | |||||
| CVE-2023-0396 | 1 Zephyrproject | 1 Zephyr | 2023-02-03 | N/A | 6.8 MEDIUM |
| A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses. | |||||
| CVE-2019-20627 | 1 Rbsoft | 1 Autoupdater.net | 2023-02-03 | 7.5 HIGH | 9.8 CRITICAL |
| AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE. | |||||
| CVE-2019-19034 | 1 Zohocorp | 1 Manageengine Assetexplorer | 2023-02-03 | 6.5 MEDIUM | 7.2 HIGH |
| Zoho ManageEngine Asset Explorer 6.5 does not validate the System Center Configuration Manager (SCCM) database username when dynamically generating a command to schedule scans for SCCM. This allows an attacker to execute arbitrary commands on the AssetExplorer Server with NT AUTHORITY/SYSTEM privileges. | |||||
| CVE-2020-10593 | 2 Opensuse, Torproject | 3 Backports Sle, Leap, Tor | 2023-02-03 | 5.0 MEDIUM | 7.5 HIGH |
| Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (memory leak), aka TROVE-2020-004. This occurs in circpad_setup_machine_on_circ because a circuit-padding machine can be negotiated twice on the same circuit. | |||||
| CVE-2020-10808 | 1 Vestacp | 1 Vesta Control Panel | 2023-02-03 | 9.0 HIGH | 8.8 HIGH |
| Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. The attacker must be able to create a crafted filename on the server, as demonstrated by an FTP session that renames .bash_logout to a .bash_logout' substring followed by shell metacharacters. | |||||
| CVE-2020-1879 | 1 Huawei | 12 Hege-560, Hege-560 Firmware, Hege-570 and 9 more | 2023-02-03 | 3.6 LOW | 3.9 LOW |
| There is an improper integrity checking vulnerability on some huawei products. The software of the affected product has an improper integrity check which may allow an attacker with high privilege to make malicious modifications.Affected product versions include:HEGE-560 versions 1.0.1.21(SP3);HEGE-570 versions 1.0.1.22(SP3);OSCA-550 versions 1.0.1.21(SP3);OSCA-550A versions 1.0.1.21(SP3);OSCA-550AX versions 1.0.1.21(SP3);OSCA-550X versions 1.0.1.21(SP3). | |||||
| CVE-2019-15510 | 1 Zohocorp | 1 Manageengine Desktop Central | 2023-02-03 | 4.3 MEDIUM | 6.1 MEDIUM |
| ManageEngine_DesktopCentral.exe in Zoho ManageEngine Desktop Central 10 allows HTML injection on the user administration page via the description of a role. | |||||
| CVE-2022-32629 | 2 Google, Mediatek | 8 Android, Mt6833, Mt6853 and 5 more | 2023-02-03 | N/A | 6.7 MEDIUM |
| In isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07310774; Issue ID: ALPS07310774. | |||||