CRITICAL Severity CVEs

Non-secure region can try modifying RG permissions of IO space xPUs due to improper input validation in Snapdragon Auto,

In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixa

The Solr plugin of Apache OFBiz is configured by default to automatically make a RMI request on localhost, port 1099. In

Apache OFBiz uses the Birt project plugin (https://eclipse.github.io/birt-website/) to create data visualizations and re

Clinic's Patient Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at

Mapper v4.0.0 to v4.2.0 was discovered to contain a SQL injection vulnerability via the ids parameter at the selectByIds

Online Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the component /dishes.php?r

The Eclipse TCF debug interface in JasMiner-X4-Server-20220621-090907 and below is open on port 1534. This issue allows

Dell CloudLink 7.1.3 and all earlier versions contain an Authentication Bypass Using an Alternate Path or Channel Vulner

Dell EMC CloudLink 7.1.2 and all prior versions contain an Authentication Bypass Vulnerability. A remote attacker, with

Dell PowerProtect Cyber Recovery versions before 19.11.0.2 contain an authentication bypass vulnerability. A remote unau

In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause.

Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. This vulnerability

HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated w

In D-Link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img a command injection vulnerability occurs in /goform/Diagn

D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Command injection via /goform/NTPSyncWithHost.

Doctor's Appointment System1.0 is vulnerable to Incorrect Access Control via edoc/patient/settings.php. The settings.php

Doctor’s Appointment System v1.0 is vulnerable to Blind SQLi via settings.php.

In D-Link DIR-816 A2_v1.10CNB04.img the network can be initialized without authentication via /goform/wizard_end.

Rengine v1.3.0 was discovered to contain a command injection vulnerability via the scan engine function.

Honeywell ControlEdge through R151.1 uses Hard-coded Credentials. According to FSCT-2022-0056, there is a Honeywell Cont

Honeywell Experion LX through 2022-05-06 has Missing Authentication for a Critical Function. According to FSCT-2022-0055

Any attempt (good or bad) to log into AutomationDirect Stride Field I/O with a web browser may result in the device resp

It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavio

All versions of iSTAR Ultra prior to version 6.8.9.CU01 are vulnerable to a command injection that could allow an unauth

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes we

Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when us

RPi-Jukebox-RFID v2.3.0 was discovered to contain a command injection vulnerability via the component /htdocs/utils/File

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /admi

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /admi

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the M_Id parameter at /admin/

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /libraria

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /libr

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /libr

Tenda AC6(AC1200) v5.0 Firmware v02.03.01.114 and below contains a vulnerability which allows attackers to remove the Wi

WAVLINK WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability when operating the f

Le-yan Personnel and Salary Management System has hard-coded database account and password within the website source cod

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Section parameter at /sta

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Section parameter at /lib

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/st

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/bo

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/ed

Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain multiple hard-coded passcodes for root. Attackers

Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain a command injection vulnerability via the Ping par

Seiko SkyBridge MB-A100/A110 v4.2.0 and below implements a hard-coded passcode for the root account. Attackers are able

Seiko SkyBridge MB-A100/A110 v4.2.0 and below was discovered to contain an arbitrary file upload vulnerability via the r

Seiko SkyBridge MB-A100/A110 v4.2.0 and below was discovered to contain a command injection vulnerability via the ipAddr

Hytec Inter HWL-2511-SS v1.05 and below implements a SHA512crypt hash for the root account which can be easily cracked v

A command injection vulnerability in the CLI (Command Line Interface) implementation of Hytec Inter HWL-2511-SS v1.05 an

Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /w