CRITICAL Severity CVEs

HGiga OAKlouds file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote a

HGiga PowerStation has a vulnerability of Information Leakage. An unauthenticated remote attacker can exploit this vulne

In Cerebrate 1.13, a blind SQL injection exists in the searchAll API endpoint.

The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git

An issue in the component /network_config/nsg_masq.cgi of DCN (Digital China Networks) DCBI-Netlog-LAB v1.0 allows attac

LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discove

Ruijie Networks RG-EW1200 Wireless Routers EW_3.0(1)B11P204 was discovered to contain a command injetion vulnerability v

Dataease is an open source data visualization and analysis tool. The blacklist for SQL injection protection is missing e

TensorFlow is an open source platform for machine learning. Attackers using Tensorflow prior to 2.12.0 or 2.11.1 can acc

DEK-1705 <=Firmware:34.23.1 device was discovered to have a command execution vulnerability.

ComponentSpace.Saml2 4.4.0 Missing SSL Certificate Validation. NOTE: the vendor does not consider this a vulnerability b

SQL injection vulnerability found in PrestaShop smplredirectionsmanager v.1.1.19 and before allow a remote attacker to g

angular-server-side-configuration helps configure an angular application at runtime on the server or in a docker contain

In lcsm_SendRrAcquiAssist of lcsm_bcm_assist.c, there is a possible out of bounds write due to a missing bounds check. T

In ProfSixDecomTcpSACKoption of RohcPacketCommon, there is a possible out of bounds write due to a missing bounds check.

In SDP_AddAttribute of sdp_db.cc, there is a possible out of bounds write due to an incorrect bounds check. This could l

In gatt_process_prep_write_rsp of gatt_cl.cc, there is a possible out of bounds write due to a missing bounds check. Thi

In sms_SendMmCpErrMsg of sms_MmConManagement.c, there is a possible out of bounds write due to a heap buffer overflow. T

In Pixel cellular firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to re

In parseTrackFragmentRun() of MPEG4Extractor.cpp, there is a possible out of bounds read due to an integer overflow. Thi

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.

Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted

TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the setWebW

Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asyn

PrestaShop jmsblog 2.5.5 was discovered to contain a SQL injection vulnerability.

Incorrect authorization in OMICRON StationGuard 1.10 through 2.20 and StationScout 1.30 through 2.20 allows an attacker

The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not ap

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization

baserCMS is a Content Management system. Prior to version 4.7.5, any file may be uploaded on the management system of ba

baserCMS is a Content Management system. Prior to version 4.7.5, there is a Remote Code Execution (RCE) Vulnerability in

Zoho ManageEngine ADSelfService Plus through 6203 is vulnerable to a brute-force attack that leads to a password reset o

TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 discovered to contain a command injection vulnerability in the setPasswor

The update process in OMICRON StationGuard and OMICRON StationScout before 2.21 can be exploited by providing a modified

TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the mtd_wri

TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the enabled param

A command injection issue was found in TP-Link MR3020 v.1_150921 that allows a remote attacker to execute arbitrary comm

A vulnerability in TOTOLINK CP900 V6.3c.566 allows attackers to start the Telnet service,

TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 contains a command injection vulnerability in the NTPSyncWithHost functio

TOTOLINK Technology CPE with firmware V6.3c.566 ,allows remote attackers to bypass Login.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in As Koc Energy Web

Hard-coded credentials in Web-UI of multiple VARTA Storage products in multiple versions allows an unauthorized attacker

Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name

TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the setUpgr

Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22

LightCMS v1.3.7 was discovered to contain a remote code execution (RCE) vulnerability via the image:make function.

The Lead Generated WordPress Plugin, version <= 1.23, was affected by an unauthenticated insecure deserialization issue.

The Gift Cards (Gift Vouchers and Packages) WordPress Plugin, version <= 4.3.1, is affected by an unauthenticated SQL in

An issue found in NginxProxyManager v.2.9.19 allows an attacker to execute arbitrary code via a lua script to the config

An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP req

An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP req