Export limit exceeded: 37758 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (37768 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-24689 | 1 Dsk | 1 Dsknet | 2024-11-21 | 5.3 Medium |
| An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. It mishandles access control. This allows a remote attacker to access account information pages (including personal data) without being authenticated. The collected information includes the badge numbers that operate as user login names. They have a PIN code. The PIN code is 4 digits and thus can be guessed in 10000 brute force attempts. | ||||
| CVE-2022-24660 | 1 Goldshell | 1 Goldshell Miner Firmware | 2024-11-21 | 7.5 High |
| The debug interface of Goldshell ASIC Miners v2.2.1 and below was discovered to be exposed publicly on the web interface, allowing attackers to access passwords and other sensitive information in plaintext. | ||||
| CVE-2022-24659 | 1 Goldshell | 1 Goldshell Miner Firmware | 2024-11-21 | 7.5 High |
| Goldshell ASIC Miners v2.2.1 and below was discovered to contain a path traversal vulnerability which allows unauthenticated attackers to retrieve arbitrary files from the device. | ||||
| CVE-2022-24657 | 1 Goldshell | 1 Goldshell Miner Firmware | 2024-11-21 | 9.8 Critical |
| Goldshell ASIC Miners v2.1.x was discovered to contain hardcoded credentials which allow attackers to remotely connect via the SSH protocol (port 22). | ||||
| CVE-2022-24655 | 1 Netgear | 8 Cax80, Cax80 Firmware, Dc112a and 5 more | 2024-11-21 | 7.8 High |
| A stack overflow vulnerability exists in the upnpd service in Netgear EX6100v1 201.0.2.28, CAX80 2.1.2.6, and DC112A 1.0.0.62, which may lead to the execution of arbitrary code without authentication. | ||||
| CVE-2022-24595 | 1 Automotivelinux | 1 Kooky Koi | 2024-11-21 | 9.8 Critical |
| Automotive Grade Linux Kooky Koi 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, and 11.0.5 is affected by Incorrect Access Control in usr/bin/afb-daemon. To exploit the vulnerability, an attacker should send a well-crafted HTTP (or WebSocket) request to the socket listened by the afb-daemon process. No credentials nor user interactions are required. | ||||
| CVE-2022-24578 | 1 Gpac | 1 Gpac | 2024-11-21 | 7.8 High |
| GPAC 1.0.1 is affected by a heap-based buffer overflow in SFS_AddString () at bifs/script_dec.c. | ||||
| CVE-2022-24577 | 1 Gpac | 1 Gpac | 2024-11-21 | 7.8 High |
| GPAC 1.0.1 is affected by a NULL pointer dereference in gf_utf8_wcslen. (gf_utf8_wcslen is a renamed Unicode utf8_wcslen function.) | ||||
| CVE-2022-24576 | 1 Gpac | 1 Gpac | 2024-11-21 | 5.5 Medium |
| GPAC 1.0.1 is affected by Use After Free through MP4Box. | ||||
| CVE-2022-24575 | 1 Gpac | 1 Gpac | 2024-11-21 | 7.8 High |
| GPAC 1.0.1 is affected by a stack-based buffer overflow through MP4Box. | ||||
| CVE-2022-24574 | 1 Gpac | 1 Gpac | 2024-11-21 | 5.5 Medium |
| GPAC 1.0.1 is affected by a NULL pointer dereference in gf_dump_vrml_field.isra (). | ||||
| CVE-2022-24434 | 1 Dicer Project | 1 Dicer | 2024-11-21 | 7.5 High |
| This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes. | ||||
| CVE-2022-24429 | 1 Convert-svg-core Project | 1 Convert-svg-core | 2024-11-21 | 7.5 High |
| The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file. | ||||
| CVE-2022-24428 | 1 Dell | 1 Emc Powerscale Onefs | 2024-11-21 | 6.3 Medium |
| Dell PowerScale OneFS, versions 8.2.x, 9.0.0.x, 9.1.0.x, 9.2.0.x, 9.2.1.x, and 9.3.0.x, contain an improper preservation of privileges. A remote filesystem user with a local account could potentially exploit this vulnerability, leading to an escalation of file privileges and information disclosure. | ||||
| CVE-2022-24394 | 1 Fidelissecurity | 2 Deception, Network | 2024-11-21 | 8.8 High |
| Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “update_checkfile” value for the “filename” parameter. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response via an authenticated session. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability. | ||||
| CVE-2022-24393 | 1 Fidelissecurity | 2 Deception, Network | 2024-11-21 | 8.8 High |
| Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “check_vertica_upgrade” value for the “cpIp” parameter. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response via an authenticated session. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability. | ||||
| CVE-2022-24392 | 1 Fidelissecurity | 2 Deception, Network | 2024-11-21 | 8.8 High |
| Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “feed_comm_test” value for the “feed” parameter. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response via an authenticated session. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability. | ||||
| CVE-2022-24391 | 1 Fidelissecurity | 2 Deception, Network | 2024-11-21 | 8.8 High |
| Vulnerability in Fidelis Network and Deception CommandPost enables SQL injection through the web interface by an attacker with user level access. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability. | ||||
| CVE-2022-24390 | 1 Fidelissecurity | 2 Deception, Network | 2024-11-21 | 8.8 High |
| Vulnerability in rconfig “remote_text_file” enables an attacker with user level access to the CLI to inject user level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability. | ||||
| CVE-2022-24389 | 1 Fidelissecurity | 2 Deception, Network | 2024-11-21 | 8.8 High |
| Vulnerability in rconfig “cert_utils” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability. | ||||