by Kastro CVE-2022-26258 · D-Link DIR-820L
The archive.
Browse all tracked critical vulnerabilities, including records outside today's brief.
39,277 matching vulnerabilities · Page 664 of 786
D-Link
Sophos
GitLab
mitre
CVE-2021-26599 · mitre
ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.
CVE-2022-26245 · mitre
Falcon-plus v0.3 was discovered to contain a SQL injection vulnerability via the parameter grpName in /config/service/host.go.
CVE-2022-26272 · mitre
A remote code execution (RCE) vulnerability in Ionize v1.0.8.1 allows attackers to execute arbitrary code via a crafted string written to…
CVE-2021-26600 · mitre
ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass (!= instead of !==).
CVE-2021-44127 · mitre
In DLink DAP-1360 F1 firmware version <=v6.10 in the "webupg" binary, an attacker can use the "file" parameter to execute arbitrary syste…
CVE-2022-23884 · mitre
Mojang Bedrock Dedicated Server 1.18.2 is affected by an integer overflow leading to a bound check bypass caused by PurchaseReceiptPacket…
CVE-2022-27811 · mitre
GNOME OCRFeeder before 0.8.4 allows OS command injection via shell metacharacters in a PDF or image filename.
CVE-2021-43090 · mitre
An XML External Entity (XXE) vulnerability exists in soa-model before 1.6.4 in the WSDLParser function.
CVE-2021-44617 · mitre
A SQL Injection vulnerability exits in the Ramo plugin for GLPI 9.4.6 via the idu parameter in plugins/ramo/ramoapirest.php/getOutdated.
CVE-2022-26205 · mitre
Marky commit 3686565726c65756e was discovered to contain a remote code execution (RCE) vulnerability via the Display text fields.
CVE-2022-24303 · mitre
Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
CVE-2022-26198 · mitre
Notable v1.8.4 does not filter text editing, allowing attackers to execute arbitrary code via a crafted payload injected into the Title t…
CVE-2022-26249 · mitre
Survey King v0.3.0 does not filter data properly when exporting excel files, allowing attackers to execute arbitrary code or access sensi…
CVE-2022-26255 · mitre
Clash for Windows v0.19.8 was discovered to allow arbitrary code execution via a crafted payload injected into the Proxies name column.
CVE-2022-26279 · mitre
EyouCMS v1.5.5 was discovered to have no access control in the component /data/sqldata.
CVE-2022-26629 · mitre
An Access Control vulnerability exists in SoroushPlus+ Messenger 1.0.30 in the Lock Screen Security Feature function due to insufficient…
CVE-2022-27919 · mitre
Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial configuration file.
CVE-2021-43636 · mitre
Two Buffer Overflow vulnerabilities exists in T10 V2_Firmware V4.1.8cu.5207_B20210320 in the http_request_parse function when processing…
CVE-2021-43700 · mitre
An issue was discovered in ApiManager 1.1.
CVE-2021-46433 · mitre
In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCode()to bypass sandbox to execute arbitra…
CVE-2022-23882 · mitre
TuziCMS 2.0.6 is affected by SQL injection in \App\Manage\Controller\BannerController.class.php.
CVE-2022-26273 · mitre
EyouCMS v1.5.4 was discovered to lack parameter filtering in \user\controller\shop.php, leading to payment logic vulnerabilities.
CVE-2022-26301 · mitre
TuziCMS v2.0.6 was discovered to contain a SQL injection vulnerability via the component App\Manage\Controller\ZhuantiController.class.php.
CVE-2021-43084 · mitre
An SQL Injection vulnerability exists in Dreamer CMS 4.0.0 via the tableName parameter.
CVE-2022-26268 · mitre
Xiaohuanxiong v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /app/controller/Books.php.
CVE-2021-45490 · mitre
The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for Android through 2022-03-17 lack SSL certifica…
CVE-2022-25577 · mitre
ALF-BanCO v8.2.5 and below was discovered to use a hardcoded password to encrypt the SQLite database containing the user's data.
SonicWall
Unknown
CVE-2022-0479 · Unknown Popup Builder – Create highly converting, mobile friendly marketing popups.
Popup Builder < 4.1.1 - SQL Injection to Reflected Cross-Site Scripting
CVE-2022-0679 · Unknown Narnoo Distributor
Narnoo Distributor <= 2.5.1 - Unauthenticated LFI to Arbitrary File Read / RCE
CVE-2022-0784 · Unknown Title Experiments Free
Title Experiments Free < 9.0.1 - Unauthenticated SQLi
CVE-2022-0846 · Unknown SpeakOut! Email Petitions
SpeakOut! Email Petitions < 2.14.15.1 - Unauthenticated SQLi
CVE-2022-0787 · Unknown Limit Login Attempts (Spam Protection)
Limit Login Attempts (Spam Protection) < 5.1 - Unauthenticated SQLi
CVE-2021-25070 · Unknown Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
WP Block and Stop Bad Bots < 6.88 - Unauthenticated SQLi
Zyxel
Genians Co., Ltd
CVE-2021-26622 · Genians Co., Ltd Genian NAC Suite V4.0
Genian NAC remote code execution vulnerability
Schneider Electric
CVE-2021-22795 · Schneider Electric StruxureWare Data Center Expert
A CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause…
CVE-2021-22794 · Schneider Electric StruxureWare Data Center Expert
A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code…
Western Digital
Apache Software Foundation
CVE-2022-25757 · Apache Software Foundation Apache APISIX
Apache APISIX: the body_schema check in request-validation plugin can be bypassed
Synology
denoland
forkcms
CVE-2022-0153 · forkcms forkcms/forkcms
SQL Injection in forkcms/forkcms
CVE-2022-1064 · forkcms forkcms/forkcms