Search
Total
17685 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-13547 | 1 Advantech | 1 Wise-paas\/rmm | 2021-05-13 | 10.0 HIGH | 9.8 CRITICAL |
| Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. There is an unsecured function that allows anyone who can access the IP address to use the function without authentication. | |||||
| CVE-2019-13551 | 1 Advantech | 1 Wise-paas\/rmm | 2021-05-13 | 10.0 HIGH | 9.8 CRITICAL |
| Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Path traversal vulnerabilities are caused by a lack of proper validation of a user-supplied path prior to use in file operations. An attacker can leverage these vulnerabilities to remotely execute code while posing as an administrator. | |||||
| CVE-2019-12725 | 1 Zeroshell | 1 Zeroshell | 2021-05-13 | 10.0 HIGH | 9.8 CRITICAL |
| Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters. | |||||
| CVE-2016-20010 | 1 Ewww | 1 Image Optimizer | 2021-05-13 | 7.5 HIGH | 10.0 CRITICAL |
| EWWW Image Optimizer before 2.8.5 allows remote command execution because it relies on a protection mechanism involving boolval, which is unavailable before PHP 5.5. | |||||
| CVE-2020-11844 | 1 Microfocus | 1 Service Management Automation | 2021-05-12 | 7.5 HIGH | 9.8 CRITICAL |
| Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation. | |||||
| CVE-2020-18890 | 1 Puppycms | 1 Puppycms | 2021-05-12 | 7.5 HIGH | 9.8 CRITICAL |
| Rmote Code Execution (RCE) vulnerability in puppyCMS v5.1 due to insecure permissions, which could let a remote malicious user getshell via /admin/functions.php. | |||||
| CVE-2021-31737 | 1 Emlog | 1 Emlog | 2021-05-12 | 7.5 HIGH | 9.8 CRITICAL |
| emlog v5.3.1 and emlog v6.0.0 have a Remote Code Execution vulnerability due to upload of database backup file in admin/data.php. | |||||
| CVE-2021-27573 | 1 Remotemouse | 1 Emote Remote Mouse | 2021-05-12 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Emote Remote Mouse through 4.0.0.0. Remote unauthenticated users can execute arbitrary code via crafted UDP packets with no prior authorization or authentication. | |||||
| CVE-2020-11285 | 1 Qualcomm | 800 Apq8009, Apq8009 Firmware, Apq8009w and 797 more | 2021-05-12 | 9.4 HIGH | 9.1 CRITICAL |
| Buffer over-read while unpacking the RTCP packet we may read extra byte if wrong length is provided in RTCP packets in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | |||||
| CVE-2021-1910 | 1 Qualcomm | 746 Apq8009, Apq8009 Firmware, Apq8009w and 743 more | 2021-05-12 | 10.0 HIGH | 9.8 CRITICAL |
| Double free in video due to lack of input buffer length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | |||||
| CVE-2020-11279 | 1 Qualcomm | 816 Apq8009, Apq8009 Firmware, Apq8009w and 813 more | 2021-05-12 | 10.0 HIGH | 9.8 CRITICAL |
| Memory corruption while processing crafted SDES packets due to improper length check in sdes packets recieved in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | |||||
| CVE-2020-27654 | 1 Synology | 1 Router Manager | 2021-05-12 | 7.5 HIGH | 9.8 CRITICAL |
| Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port (1) 7786/tcp or (2) 7787/tcp. | |||||
| CVE-2020-27655 | 1 Synology | 1 Router Manager | 2021-05-12 | 7.5 HIGH | 10.0 CRITICAL |
| Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resources via inbound QuickConnect traffic. | |||||
| CVE-2021-32020 | 1 Amazon | 1 Freertos | 2021-05-12 | 7.5 HIGH | 9.8 CRITICAL |
| The kernel in Amazon Web Services FreeRTOS before 10.4.3 has insufficient bounds checking during management of heap memory. | |||||
| CVE-2021-32098 | 1 Artica | 1 Pandora Fms | 2021-05-11 | 7.5 HIGH | 9.8 CRITICAL |
| Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization. | |||||
| CVE-2021-32099 | 1 Artica | 1 Pandora Fms | 2021-05-11 | 7.5 HIGH | 9.8 CRITICAL |
| A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his unprivileged session via the /include/chart_generator.php session_id parameter, leading to a login bypass. | |||||
| CVE-2020-36333 | 1 Themegrill | 1 Themegrill Demo Importer | 2021-05-11 | 6.4 MEDIUM | 9.1 CRITICAL |
| themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a reset_wizard_actions hook. | |||||
| CVE-2021-24236 | 1 Imagements Project | 1 Imagements | 2021-05-11 | 7.5 HIGH | 9.8 CRITICAL |
| The Imagements WordPress plugin through 1.2.5 allows images to be uploaded in comments, however only checks for the Content-Type in the request to forbid dangerous files. This allows unauthenticated attackers to upload arbitrary files by using a valid image Content-Type along with a PHP filename and code, leading to RCE. | |||||
| CVE-2020-23083 | 1 Guojusoft | 1 Jeecg | 2021-05-11 | 7.5 HIGH | 9.8 CRITICAL |
| Unrestricted File Upload in JEECG v4.0 and earlier allows remote attackers to execute arbitrary code or gain privileges by uploading a crafted file to the component "jeecgFormDemoController.do?commonUpload". | |||||
| CVE-2017-5859 | 1 Cambiumnetworks | 3 Cnpilot R200, Cnpilot R200 Series Firmware, Cnpilot R201 | 2021-05-11 | 10.0 HIGH | 9.8 CRITICAL |
| On Cambium Networks cnPilot R200/201 devices before 4.3, there is a vulnerability involving the certificate of the device and its RSA keys, aka RBN-183. | |||||
| CVE-2019-5319 | 1 Arubanetworks | 1 Instant | 2021-05-11 | 10.0 HIGH | 9.8 CRITICAL |
| A remote buffer overflow vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.16 and below; Aruba Instant 8.3.x: 8.3.0.12 and below; Aruba Instant 8.5.x: 8.5.0.6 and below; Aruba Instant 8.6.x: 8.6.0.2 and below. Aruba has released patches for Aruba Instant that address this security vulnerability. | |||||
| CVE-2021-28959 | 1 Zohocorp | 1 Manageengine Eventlog Analyzer | 2021-05-11 | 7.5 HIGH | 9.8 CRITICAL |
| Zoho ManageEngine Eventlog Analyzer through 12147 is vulnerable to unauthenticated directory traversal via an entry in a ZIP archive. This leads to remote code execution. | |||||
| CVE-2020-19113 | 1 Projectworlds | 1 Online Book Store Project In Php | 2021-05-10 | 7.5 HIGH | 9.8 CRITICAL |
| Arbitrary File Upload vulnerability in Online Book Store v1.0 in admin_add.php, which may lead to remote code execution. | |||||
| CVE-2021-21507 | 1 Dell | 22 R1-2210, R1-2210 Firmware, R1-2401 and 19 more | 2021-05-10 | 5.0 MEDIUM | 9.8 CRITICAL |
| Dell EMC Networking X-Series firmware versions prior to 3.0.1.8 and Dell EMC PowerEdge VRTX Switch Module firmware versions prior to 2.0.0.82 contain a Weak Password Encryption Vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable system with privileges of the compromised account. | |||||
| CVE-2020-21452 | 1 Uniview | 2 Isc2500-s, Isc2500-s Firmware | 2021-05-10 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in uniview ISC2500-S. This is an upload vulnerability where an attacker can upload malicious code via /Interface/DevManage/EC.php?cmd=upload | |||||
| CVE-2020-28017 | 1 Exim | 1 Exim | 2021-05-10 | 7.5 HIGH | 9.8 CRITICAL |
| Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail message with fifty million recipients. NOTE: remote exploitation may be difficult because of resource consumption. | |||||
| CVE-2020-28022 | 1 Exim | 1 Exim | 2021-05-10 | 7.5 HIGH | 9.8 CRITICAL |
| Exim 4 before 4.94.2 has Improper Restriction of Write Operations within the Bounds of a Memory Buffer. This occurs when processing name=value pairs within MAIL FROM and RCPT TO commands. | |||||
| CVE-2020-28024 | 1 Exim | 1 Exim | 2021-05-10 | 7.5 HIGH | 9.8 CRITICAL |
| Exim 4 before 4.94.2 allows Buffer Underwrite that may result in unauthenticated remote attackers executing arbitrary commands, because smtp_ungetc was only intended to push back characters, but can actually push back non-character error codes such as EOF. | |||||
| CVE-2021-31755 | 1 Tenda | 2 Ac11, Ac11 Firmware | 2021-05-10 | 10.0 HIGH | 9.8 CRITICAL |
| An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request. | |||||
| CVE-2021-31756 | 1 Tenda | 2 Ac11, Ac11 Firmware | 2021-05-10 | 10.0 HIGH | 9.8 CRITICAL |
| An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /gofrom/setwanType allows attackers to execute arbitrary code on the system via a crafted post request. This occurs when input vector controlled by malicious attack get copied to the stack variable. | |||||
| CVE-2021-31757 | 1 Tenda | 2 Ac11, Ac11 Firmware | 2021-05-10 | 10.0 HIGH | 9.8 CRITICAL |
| An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setVLAN allows attackers to execute arbitrary code on the system via a crafted post request. | |||||
| CVE-2021-31758 | 1 Tenda | 2 Ac11, Ac11 Firmware | 2021-05-10 | 10.0 HIGH | 9.8 CRITICAL |
| An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setportList allows attackers to execute arbitrary code on the system via a crafted post request. | |||||
| CVE-2021-29145 | 1 Arubanetworks | 1 Clearpass | 2021-05-10 | 7.5 HIGH | 9.8 CRITICAL |
| A remote server side request forgery (SSRF) remote code execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has released patches for Aruba ClearPass Policy Manager that address this security vulnerability. | |||||
| CVE-2020-4039 | 1 Fossasia | 1 Susi.ai | 2021-05-10 | 6.4 MEDIUM | 9.1 CRITICAL |
| SUSI.AI is an intelligent Open Source personal assistant. SUSI.AI Server before version d27ed0f has a directory traversal vulnerability due to insufficient input validation. Any admin config and file readable by the app can be retrieved by the attacker. Furthermore, some files can also be moved or deleted. | |||||
| CVE-2020-15153 | 1 Ampache | 1 Ampache | 2021-05-09 | 7.5 HIGH | 9.8 CRITICAL |
| Ampache before version 4.2.2 allows unauthenticated users to perform SQL injection. Refer to the referenced GitHub Security Advisory for details and a workaround. This is fixed in version 4.2.2 and the development branch. | |||||
| CVE-2021-29441 | 1 Alibaba | 1 Nacos | 2021-05-07 | 7.5 HIGH | 9.8 CRITICAL |
| Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any administrative tasks on the Nacos server. | |||||
| CVE-2021-30168 | 1 Meritlilin | 82 P2g1022, P2g1022 Firmware, P2g1022x and 79 more | 2021-05-07 | 7.5 HIGH | 9.8 CRITICAL |
| The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant administrator’s credential and further control the devices. | |||||
| CVE-2021-30167 | 1 Meritlilin | 82 P2g1022, P2g1022 Firmware, P2g1022x and 79 more | 2021-05-07 | 9.0 HIGH | 9.8 CRITICAL |
| The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s information and escalate privileges to control the devices. | |||||
| CVE-2021-25812 | 1 Chinamobile | 2 An Lianbao Wf-1, An Lianbao Wf-1 Firmware | 2021-05-07 | 7.5 HIGH | 9.8 CRITICAL |
| Command injection vulnerability in China Mobile An Lianbao WF-1 1.01 via the 'ip' parameter with a POST request to /api/ZRQos/set_online_client. | |||||
| CVE-2021-20716 | 1 Buffalo | 70 Bhr-4rv, Bhr-4rv Firmware, Fs-g54 and 67 more | 2021-05-07 | 10.0 HIGH | 9.8 CRITICAL |
| Hidden functionality in multiple Buffalo network devices (BHR-4RV firmware Ver.2.55 and prior, FS-G54 firmware Ver.2.04 and prior, WBR2-B11 firmware Ver.2.32 and prior, WBR2-G54 firmware Ver.2.32 and prior, WBR2-G54-KD firmware Ver.2.32 and prior, WBR-B11 firmware Ver.2.23 and prior, WBR-G54 firmware Ver.2.23 and prior, WBR-G54L firmware Ver.2.20 and prior, WHR2-A54G54 firmware Ver.2.25 and prior, WHR2-G54 firmware Ver.2.23 and prior, WHR2-G54V firmware Ver.2.55 and prior, WHR3-AG54 firmware Ver.2.23 and prior, WHR-G54 firmware Ver.2.16 and prior, WHR-G54-NF firmware Ver.2.10 and prior, WLA2-G54 firmware Ver.2.24 and prior, WLA2-G54C firmware Ver.2.24 and prior, WLA-B11 firmware Ver.2.20 and prior, WLA-G54 firmware Ver.2.20 and prior, WLA-G54C firmware Ver.2.20 and prior, WLAH-A54G54 firmware Ver.2.54 and prior, WLAH-AM54G54 firmware Ver.2.54 and prior, WLAH-G54 firmware Ver.2.54 and prior, WLI2-TX1-AG54 firmware Ver.2.53 and prior, WLI2-TX1-AMG54 firmware Ver.2.53 and prior, WLI2-TX1-G54 firmware Ver.2.20 and prior, WLI3-TX1-AMG54 firmware Ver.2.53 and prior, WLI3-TX1-G54 firmware Ver.2.53 and prior, WLI-T1-B11 firmware Ver.2.20 and prior, WLI-TX1-G54 firmware Ver.2.20 and prior, WVR-G54-NF firmware Ver.2.02 and prior, WZR-G108 firmware Ver.2.41 and prior, WZR-G54 firmware Ver.2.41 and prior, WZR-HP-G54 firmware Ver.2.41 and prior, WZR-RS-G54 firmware Ver.2.55 and prior, and WZR-RS-G54HP firmware Ver.2.55 and prior) allows a remote attacker to enable the debug option and to execute arbitrary code or OS commands, change the configuration, and cause a denial of service (DoS) condition. | |||||
| CVE-2021-30502 | 1 Simple Glasgow Haskell Compiler Project | 1 Simple Glasgow Haskell Compiler | 2021-05-07 | 7.5 HIGH | 9.8 CRITICAL |
| The unofficial vscode-ghc-simple (aka Simple Glasgow Haskell Compiler) extension before 0.2.3 for Visual Studio Code allows remote code execution via a crafted workspace configuration with replCommand. | |||||
| CVE-2021-30642 | 1 Symantec | 1 Security Analytics | 2021-05-07 | 10.0 HIGH | 9.8 CRITICAL |
| An input validation flaw in the Symantec Security Analytics web UI 7.2 prior 7.2.7, 8.1, prior to 8.1.3-NSR3, 8.2, prior to 8.2.1-NSR2 or 8.2.2 allows a remote, unauthenticated attacker to execute arbitrary OS commands on the target with elevated privileges. | |||||
| CVE-2021-27480 | 1 Deltaww | 1 Industrial Automation Commgr | 2021-05-07 | 7.5 HIGH | 9.8 CRITICAL |
| Delta Industrial Automation COMMGR Versions 1.12 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to execute remote code. | |||||
| CVE-2020-19107 | 1 Projectworlds | 1 Online Book Store Project In Php | 2021-05-07 | 7.5 HIGH | 9.8 CRITICAL |
| SQL Injection vulnerability in Online Book Store v1.0 via the isbn parameter to edit_book.php, which could let a remote malicious user execute arbitrary code. | |||||
| CVE-2020-19108 | 1 Projectworlds | 1 Online Book Store Project In Php | 2021-05-07 | 7.5 HIGH | 9.8 CRITICAL |
| SQL Injection vulnerability in Online Book Store v1.0 via the pubid parameter to bookPerPub.php, which could let a remote malicious user execute arbitrary code. | |||||
| CVE-2020-19109 | 1 Projectworlds | 1 Online Book Store Project In Php | 2021-05-07 | 7.5 HIGH | 9.8 CRITICAL |
| SQL Injection vulnerability in Online Book Store v1.0 via the bookisbn parameter to admin_edit.php, which could let a remote malicious user execute arbitrary code. | |||||
| CVE-2020-19114 | 1 Projectworlds | 1 Online Book Store Project In Php | 2021-05-07 | 7.5 HIGH | 9.8 CRITICAL |
| SQL Injection vulnerability in Online Book Store v1.0 via the publisher parameter to edit_book.php, which could let a remote malicious user execute arbitrary code. | |||||
| CVE-2020-19112 | 1 Projectworlds | 1 Online Book Store Project In Php | 2021-05-07 | 7.5 HIGH | 9.8 CRITICAL |
| SQL Injection vulnerability in Online Book Store v1.0 via the bookisbn parameter to admin_delete.php, which could let a remote malicious user execute arbitrary code. | |||||
| CVE-2020-19110 | 1 Projectworlds | 1 Online Book Store Project In Php | 2021-05-07 | 7.5 HIGH | 9.8 CRITICAL |
| SQL Injection vulnerability in Online Book Store v1.0 via the bookisbn parameter to book.php parameter, which could let a remote malicious user execute arbitrary code. | |||||
| CVE-2020-24918 | 1 Ambarella | 1 Oryx Rtsp Server | 2021-05-07 | 10.0 HIGH | 9.8 CRITICAL |
| A buffer overflow in the RTSP service of the Ambarella Oryx RTSP Server 2020-01-07 allows an unauthenticated attacker to send a crafted RTSP request, with a long digest authentication header, to execute arbitrary code in parse_authentication_header() in libamprotocol-rtsp.so.1 in rtsp_svc (or cause a crash). This allows remote takeover of a Furbo Dog Camera, for example. | |||||