by Kastro CVE-2023-23488 · tenable
The archive.
Browse all tracked critical vulnerabilities, including records outside today's brief.
39,271 matching vulnerabilities · Page 588 of 786
tenable
Unknown
CVE-2022-4305 · Unknown Login as User or Customer
Login as User or Customer < 3.3 - Unauthenticated Privilege Escalation to Admin
CVE-2022-0316 · Unknown WeStand
Multiple themes - Unauthenticated Arbitrary File Upload
CVE-2022-4693 · Unknown User Verification
User Verification < 1.0.94 - Authentication Bypass
CVE-2022-4383 · Unknown CBX Petition for WordPress
CBX Petition for WordPress <= 1.0.3 - Unauthenticated SQLi
vmware
snyk
CVE-2022-25860 · snyk
Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRe…
CVE-2022-25908 · snyk
All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-in…
mitre
CVE-2022-48121 · mitre
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the rsabits parameter in the setti…
CVE-2022-48122 · mitre
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the dayvalid parameter in the sett…
CVE-2022-48123 · mitre
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the servername parameter in the se…
CVE-2022-48124 · mitre
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the FileName parameter in the sett…
CVE-2022-48125 · mitre
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the password parameter in the sett…
CVE-2022-48126 · mitre
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the username parameter in the sett…
CVE-2022-40037 · mitre
An issue discovered in Rawchen blog-ssm v1.0 allows remote attacker to escalate privileges and execute arbitrary commands via the compone…
CVE-2022-46998 · mitre
An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery (SSRF).
CVE-2022-47767 · mitre
A backdoor in Solar-Log Gateway products allows remote access via web panel gaining super administration privileges to the attacker.
CVE-2020-18331 · mitre
Directory traversal vulnerability in ChinaMobile PLC Wireless Router model GPN2.4P21-C-CN running the firmware version W2000EN-01(hardwar…
CVE-2022-46999 · mitre
Tuzicms v2.0.6 was discovered to contain a SQL injection vulnerability via the component \App\Manage\Controller\UserController.class.php.
CVE-2022-48120 · mitre
SQL Injection vulnerability in kishan0725 Hospital Management System thru commit 4770d740f2512693ef8fd9aa10a8d17f79fad9bd (on March 13, 2…
CVE-2022-48152 · mitre
SQL Injection vulnerability in RemoteClinic 2.0 allows attackers to execute arbitrary commands and gain sensitive information via the id…
CVE-2023-23331 · mitre
Amano Xoffice parking solutions 7.1.3879 is vulnerable to SQL Injection.
CVE-2020-18330 · mitre
An issue was discovered in the default configuration of ChinaMobile PLC Wireless Router model GPN2.4P21-C-CN running the firmware version…
CVE-2023-23560 · mitre
In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation.
CVE-2021-43445 · mitre
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control.
CVE-2023-22964 · mitre
Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authenticatio…
CVE-2023-24028 · mitre
In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function.
erohtar
GitLab
Mitsubishi Electric Corporation
CVE-2022-40267 · Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-32MT/ES
Authentication Bypass Vulnerability in Web Server Function on MELSEC Series
Apache Software Foundation
CVE-2023-22884 · Apache Software Foundation Apache Airflow
Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow
Campbell Scientific
Western Digital
CVE-2022-29844 · Western Digital My Cloud
Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp
CVE-2022-29843 · Western Digital My Cloud
Western Digital My Cloud OS 5 devices Command Injection Vulnerability
ThimPress
CVE-2022-45808 · ThimPress LearnPress – WordPress LMS Plugin
WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL Injection
CVE-2022-47615 · ThimPress LearnPress – WordPress LMS Plugin
WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to Local File Inclusion
CVE-2022-45820 · ThimPress LearnPress – WordPress LMS Plugin
WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL Injection
Baicells
CVE-2023-24022 · Baicells Nova 227
Hard Coded Credential Crypt Vulnerability
CVE-2023-24508 · Baicells Nova 227
Remote Code Execution in Baicells RTS Platform
Jenkins Project
CVE-2023-24429 · Jenkins Project Jenkins Semantic Versioning Plugin
Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements…
CVE-2023-24430 · Jenkins Project Jenkins Semantic Versioning Plugin
Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-24427 · Jenkins Project Jenkins Bitbucket OAuth Plugin
Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login.
CVE-2023-24441 · Jenkins Project Jenkins MSTest Plugin
Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-24443 · Jenkins Project Jenkins TestComplete support Plugin
Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-24444 · Jenkins Project Jenkins OpenID Plugin
Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.
CVE-2023-24456 · Jenkins Project Jenkins Keycloak Authentication Plugin
Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login.
SAUTER Controls
CVE-2023-0052 · SAUTER Controls Nova 220 (EYK220F001) DDC with BACnet connection