CRITICAL Severity CVEs

The pyesasky for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The curre

A vulnerability exists in Online Student Rate System v1.0 that allows any user to register as an administrator without n

IBM CICS TX Standard and Advanced 11.1 could allow a remote attacker to execute arbitrary commands on the system by send

A vulnerability in the packaging of Cisco Adaptive Security Device Manager (ASDM) images and the validation of those ima

IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allow a remote attacker to upload arbitrary files, caused by impro

Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload whic

Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication, inclu

The www-data (Apache web server) account is configured to run sudo with no password for many commands (including /bin/sh

An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read sensitive

Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the init

A remote authentication bypass vulnerability was discovered in HPE Cray Legacy Shasta System Solutions; HPE Slingshot; a

Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from tho

Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the open TCP por

LRM does not implement authentication or authorization by default. A malicious actor can inject, replay, modify, and/or

LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any

LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directo

LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operati

In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by defau

In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared

Jenkins xUnit Plugin 3.0.8 and earlier implements an agent-to-controller message that creates a user-specified directory

The function that calls the diff tool in Diffy 3.4.1 does not properly handle double quotes in a filename when run in a

Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x

IdeaTMS 2022 is vulnerable to SQL Injection via the PATH_INFO

Docebo Community Edition v4.0.5 and below was discovered to contain a SQL injection vulnerability. NOTE: This vulnerabil

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query meth

Laiketui 3.5.0 is affected by an arbitrary file upload vulnerability that can allow an attacker to execute arbitrary cod

The Quectel RG502Q-EA modem before 2022-02-23 allow OS Command Injection.

iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL.

iSpy v7.2.2.0 is vulnerable to remote command execution via path traversal.

A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All ver

An arbitrary file upload vulnerability /images/background/1.php in of SolarView Compact 6.0 allows attackers to execute

An unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order

An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to

Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.4.

IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authen

IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authen

An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnera

An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnera

A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers

The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in

Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4.

An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050. There is Remote Code Execution due to a har

ASUS RT-N53 3.0.0.4.376.3754 has a command injection vulnerability in the SystemCmd parameter of the apply.cgi interface

Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via \rdms\admin?page=user\manage_user&id=.

A stack-based buffer overflow vulnerability exists in the BlynkConsole.h runCommand functionality of Blynk -Library v1.0

A use-after-free vulnerability exists in the mips_collector appsrv_server functionality of Anker Eufy Homebase 2 2.1.8.5

Proietti Tech srl Planet Time Enterprise 4.2.0.1,4.2.0.0,4.1.0.0,4.0.0.0,3.3.1.0,3.3.0.0 is vulnerable to Remote code ex

In some cases, an unsuccessful attempt to log into IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14.000 d

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/inventory/inde

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/store/index.ph