CVE-2018-16230 | CRITICAL | 9.8 | 0.03891 | 40.56 | No | No | 2019-10-03 | 2025-12-03 | euvd | The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_attr_print() (MP_REACH_NLRI).The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_attr_print() (MP_REACH_NLRI). |
CVE-2011-10013 | CRITICAL | 10.0 | 0.01596 | 40.56 | No | No | 2025-08-13 | 2026-07-31 | euvd | Traq versions 2.0 through 2.3 contain a remote code execution vulnerability in the admincp/common.php script. The flawed authorization logic…Traq versions 2.0 through 2.3 contain a remote code execution vulnerability in the admincp/common.php script. The flawed authorization logic fails to halt execution after a failed access check, allowing unauthenticated users to reach admin-only functionality. This can be exploited via plugins.php to inject and execute arbitrary PHP code. |
CVE-2024-3659 | CRITICAL | 10.0 | 0.01612 | 40.56 | No | No | 2024-08-08 | 2025-11-17 | euvd | Firmware in KAON AR2140 routers, prior to versions 3.2.50 and 4.2.16, is vulnerable to a shell command injection via sending a crafted reque…Firmware in KAON AR2140 routers, prior to versions 3.2.50 and 4.2.16, is vulnerable to a shell command injection via sending a crafted request to one of the endpoints.
In order to exploit this vulnerability, one has to have access to the administrative portal of the router. |
CVE-2021-27474 | CRITICAL | 10.0 | 0.01612 | 40.56 | No | No | 2022-03-23 | 2025-04-16 | euvd | Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier does not properly restrict all functions relating to IIS remoting services. T…Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier does not properly restrict all functions relating to IIS remoting services. This vulnerability may allow a remote, unauthenticated attacker to modify sensitive data in FactoryTalk AssetCentre. |
CVE-2022-41875 | CRITICAL | 10.0 | 0.01601 | 40.56 | No | No | 2022-11-23 | 2025-04-23 | euvd | A remote code execution (RCE) vulnerability in Optica allows unauthenticated attackers to execute arbitrary code via specially crafted JSON …A remote code execution (RCE) vulnerability in Optica allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Specially crafted JSON payloads may lead to RCE (remote code execution) on the attacked system running Optica. The vulnerability was patched in v. 0.10.2, where the call to the function `oj.load` was changed to `oj.safe_load`. |
CVE-2021-39168 | CRITICAL | 10.0 | 0.0159 | 40.56 | No | No | 2021-08-26 | 2024-08-04 | euvd | OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with th…OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role from accounts not strictly under the team's control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining. |
CVE-2021-39167 | CRITICAL | 10.0 | 0.0159 | 40.56 | No | No | 2021-08-26 | 2024-08-04 | euvd | OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with th…OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role from accounts not strictly under the team's control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining. |
CVE-2021-21322 | CRITICAL | 10.0 | 0.01614 | 40.56 | No | No | 2021-03-02 | 2024-08-03 | euvd | fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a …fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is `/pub/`, a user expect that accessing `/priv` on the target service would not be possible. In affected versions, it is possible. This is fixed in version 4.3.1. |
CVE-2022-32533 | CRITICAL | 9.8 | 0.03881 | 40.56 | No | No | 2022-07-06 | 2024-08-03 | euvd | Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and S…Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no updates will be provided for this issue |
CVE-2018-14882 | CRITICAL | 9.8 | 0.03891 | 40.56 | No | No | 2019-10-03 | 2025-12-03 | euvd | The ICMPv6 parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp6.c.The ICMPv6 parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp6.c. |
CVE-2024-23614 | CRITICAL | 10.0 | 0.01609 | 40.56 | No | No | 2024-01-25 | 2024-09-05 | euvd | A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 9.5 and before. A remote, anonymous attacker can exploit this …A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 9.5 and before. A remote, anonymous attacker can exploit this vulnerability to achieve remote code execution as root. |
CVE-2026-26216 | CRITICAL | 10.0 | 0.01589 | 40.56 | No | No | 2026-02-12 | 2026-07-14 | euvd | Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a h…Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modules and execute system commands. Successful exploitation allows full server compromise, including arbitrary command execution, file read and write access, sensitive data exfiltration, and lateral movement within internal networks. |
CVE-2024-55877 | CRITICAL | 10.0 | 0.01558 | 40.55 | No | No | 2024-12-12 | 2024-12-13 | euvd | XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any user with an…XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any user with an account can perform arbitrary remote code execution by adding instances of `XWiki.WikiMacroClass` to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been fixed in XWiki 15.10.11, 16.4.1 and 16.5.0. It is possible to manually apply the patch to the page `XWiki.XWikiSyntaxMacrosList` as a workaround. |
CVE-2022-46161 | CRITICAL | 10.0 | 0.01585 | 40.55 | No | No | 2022-12-06 | 2025-04-22 | euvd | pdfmake is an open source client/server side PDF printing in pure JavaScript. In versions up to and including 0.2.5 pdfmake contains an unsa…pdfmake is an open source client/server side PDF printing in pure JavaScript. In versions up to and including 0.2.5 pdfmake contains an unsafe evaluation of user controlled input. Users of pdfmake are thus subject to arbitrary code execution in the context of the process running the pdfmake code. There are no known fixes for this issue. Users are advised to restrict access to trusted user input. |
CVE-2026-48611 | CRITICAL | 9.8 | 0.0386 | 40.55 | No | Yes | 2026-06-12 | 2026-06-12 | euvd, packetstorm | Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to u…Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations. |
CVE-2023-37466 | CRITICAL | 9.8 | 0.03867 | 40.55 | No | No | 2023-07-13 | 2026-01-05 | euvd | vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintena…vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox. Version 3.10.0 contains a patch for the issue. |
CVE-2024-13181 | HIGH | 7.3 | 0.32438 | 40.55 | No | No | 2025-01-14 | 2025-01-16 | euvd | Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. This CVE addresse…Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. This CVE addresses incomplete fixes from CVE-2024-47010. |
CVE-2023-30150 | CRITICAL | 9.8 | 0.03849 | 40.55 | No | No | 2023-06-14 | 2025-01-06 | euvd | PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php. |
CVE-2026-49261 | CRITICAL | 10.0 | 0.01582 | 40.55 | No | Yes | 2026-06-11 | 2026-08-12 | euvd, nvd, packetstorm | MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4…MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`. |
CVE-2022-47190 | CRITICAL | 10.0 | 0.0157 | 40.55 | No | No | 2023-03-31 | 2025-02-11 | euvd | Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a webshell that could allow him to …Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a webshell that could allow him to execute arbitrary code as root. |
CVE-1999-1138 | HIGH | 10.0 | 0.01577 | 40.55 | No | No | 2002-03-09 | 2024-08-01 | euvd, nvd | SCO UNIX System V/386 Release 3.2, and other SCO products, installs the home directories (1) /tmp for the dos user, and (2) /usr/tmp for the…SCO UNIX System V/386 Release 3.2, and other SCO products, installs the home directories (1) /tmp for the dos user, and (2) /usr/tmp for the asg user, which allows other users to gain access to those accounts since /tmp and /usr/tmp are world-writable. |
CVE-2020-7750 | CRITICAL | 9.6 | 0.06148 | 40.55 | No | No | 2020-10-21 | 2024-09-16 | euvd | This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, …This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function. |
CVE-2024-39844 | CRITICAL | 9.8 | 0.03862 | 40.55 | No | No | 2024-07-03 | 2024-08-02 | euvd | In ZNC before 1.9.1, remote code execution can occur in modtcl via a KICK.In ZNC before 1.9.1, remote code execution can occur in modtcl via a KICK. |
CVE-2023-29199 | CRITICAL | 9.8 | 0.03852 | 40.55 | No | No | 2023-04-14 | 2025-02-06 | euvd | There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers …There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass `handleException()` and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context. A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.16` of `vm2`. |
CVE-2026-3518 | HIGH | 8.4 | 0.1985 | 40.55 | No | No | 2026-04-20 | 2026-04-22 | euvd | OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permiss…OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'killsession' command |
CVE-2019-0020 | CRITICAL | 10.0 | 0.01569 | 40.55 | No | No | 2019-01-15 | 2024-09-16 | euvd | Juniper ATP ships with hard coded credentials in the Web Collector instance which gives an attacker the ability to take full control of any …Juniper ATP ships with hard coded credentials in the Web Collector instance which gives an attacker the ability to take full control of any installation of the software. Affected releases are Juniper Networks Juniper ATP: 5.0 versions prior to 5.0.3. |
CVE-2026-8054 | CRITICAL | 10.0 | 0.01584 | 40.55 | No | No | 2026-05-27 | 2026-05-27 | euvd | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishin…Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll) in dotCMS Core 25.11.04-1 through 26.04.28-02 allows remote unauthenticated attackers to read, modify, or destroy arbitrary database content. The endpoints did not enforce authentication and accepted unsanitized input used in dynamically constructed SQL. The fix in dotCMS Core 26.04.28-03 requires an authenticated backend user with the publishing-queue portlet permission. LTS releases are not affected as the vulnerable code path was never backported. |
CVE-2023-24022 | CRITICAL | 10.0 | 0.01557 | 40.54 | No | No | 2023-01-24 | 2025-04-02 | euvd | Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB devices with firmware through RTS/RTD 3.7.11.3 have hardcoded credentials that are …Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB devices with firmware through RTS/RTD 3.7.11.3 have hardcoded credentials that are easily discovered and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmware, encrypted by the crypt function.) |
CVE-2025-55241 | CRITICAL | 10.0 | 0.01554 | 40.54 | No | No | 2025-09-04 | 2026-02-26 | euvd | Azure Entra ID Elevation of Privilege VulnerabilityAzure Entra ID Elevation of Privilege Vulnerability |
CVE-2024-21663 | CRITICAL | 10.0 | 0.01535 | 40.54 | No | No | 2024-01-08 | 2024-09-04 | euvd | Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server. Discord…Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server. Discord-Recon is vulnerable to remote code execution. An attacker is able to execute shell commands in the server without having an admin role. This vulnerability has been fixed in version 0.0.8. |
CVE-2022-4681 | CRITICAL | 9.8 | 0.03824 | 40.54 | No | No | 2023-02-06 | 2025-03-25 | euvd | The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJA…The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. |
CVE-2024-31777 | CRITICAL | 9.8 | 0.03821 | 40.54 | No | No | 2024-06-13 | 2024-09-06 | euvd | File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted file to the certbadge.p…File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted file to the certbadge.php endpoint. |
CVE-2012-6428 | CRITICAL | 10.0 | 0.01533 | 40.54 | No | No | 2012-12-23 | 2025-07-01 | euvd | The Carlo Gavazzi
EOS-Box
stores hard-coded passwords in the PHP file of
the device. By using the hard-coded passwords, attackers can log…The Carlo Gavazzi
EOS-Box
stores hard-coded passwords in the PHP file of
the device. By using the hard-coded passwords, attackers can log into
the device with administrative privileges. This could allow the attacker
to have unauthorized access. |
CVE-2022-25995 | CRITICAL | 9.9 | 0.02676 | 40.54 | No | No | 2022-05-12 | 2025-04-15 | euvd | A command execution vulnerability exists in the console inhand functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted netw…A command execution vulnerability exists in the console inhand functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability. |
CVE-2025-55169 | CRITICAL | 10.0 | 0.01552 | 40.54 | No | No | 2025-08-12 | 2025-08-12 | euvd | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path trav…WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path traversal vulnerability was discovered in the WeGIA application, html/socio/sistema/download_remessa.php endpoint. This vulnerability could allow an attacker to gain unauthorized access to local files in the server and sensitive information stored in config.php. config.php contains information that could allow direct access to the database. This issue has been patched in version 3.4.8. |
CVE-2024-34257 | CRITICAL | 9.8 | 0.03817 | 40.54 | No | No | 2024-05-08 | 2024-08-02 | euvd | TOTOLINK EX1800T V9.1.0cu.2112_B20220316 has a vulnerability in the apcliEncrypType parameter that allows unauthorized execution of arbitrar…TOTOLINK EX1800T V9.1.0cu.2112_B20220316 has a vulnerability in the apcliEncrypType parameter that allows unauthorized execution of arbitrary commands, allowing an attacker to obtain device administrator privileges. |
CVE-2024-52380 | CRITICAL | 10.0 | 0.01535 | 40.54 | No | No | 2024-11-14 | 2026-04-28 | euvd | Unrestricted Upload of File with Dangerous Type vulnerability in softpulseinfotech Picsmize picsmize allows Upload a Web Shell to a Web Serv…Unrestricted Upload of File with Dangerous Type vulnerability in softpulseinfotech Picsmize picsmize allows Upload a Web Shell to a Web Server.This issue affects Picsmize: from n/a through <= 1.0.0. |
CVE-2022-44808 | CRITICAL | 9.8 | 0.03826 | 40.54 | No | No | 2022-11-22 | 2025-04-25 | euvd | A command injection vulnerability has been found on D-Link DIR-823G devices with firmware version 1.02B03 that allows an attacker to execute…A command injection vulnerability has been found on D-Link DIR-823G devices with firmware version 1.02B03 that allows an attacker to execute arbitrary operating system commands through well-designed /HNAP1 requests. Before the HNAP API function can process the request, the system function executes an untrusted command that triggers the vulnerability. |
CVE-2025-5243 | CRITICAL | 10.0 | 0.01548 | 40.54 | No | No | 2025-07-24 | 2026-06-05 | euvd | Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') …Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SMG Software Information Portal allows Code Injection, Upload a Web Shell to a Web Server, Code Inclusion.
This issue affects Information Portal: before 13.06.2025. |
CVE-2022-29130 | CRITICAL | 9.8 | 0.03805 | 40.53 | No | No | 2022-05-10 | 2025-01-02 | euvd | Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityWindows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability |
CVE-2021-2075 | CRITICAL | 9.8 | 0.03804 | 40.53 | No | No | 2021-01-20 | 2024-09-26 | euvd | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples). Supported versions that are affected a…Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). |
CVE-2021-2047 | CRITICAL | 9.8 | 0.03804 | 40.53 | No | No | 2021-01-20 | 2024-09-26 | euvd | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core Components). Supported versions that are af…Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core Components). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). |
CVE-2022-22683 | CRITICAL | 10.0 | 0.01528 | 40.53 | No | No | 2022-07-28 | 2024-09-16 | euvd | Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Media Server before 1.8.1-…Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Media Server before 1.8.1-2876 allows remote attackers to execute arbitrary code via unspecified vectors. |
CVE-2021-27646 | CRITICAL | 9.8 | 0.03786 | 40.53 | No | No | 2021-03-12 | 2024-09-16 | euvd | Use After Free vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers …Use After Free vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests. |
CVE-2022-27624 | CRITICAL | 10.0 | 0.0152 | 40.53 | No | No | 2022-10-20 | 2025-05-07 | euvd | A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption function…A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500. |
CVE-2022-1518 | CRITICAL | 10.0 | 0.01506 | 40.53 | No | No | 2022-06-24 | 2025-04-16 | euvd | LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure.LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure. |
CVE-2019-12650 | HIGH | 7.6 | 0.28948 | 40.53 | No | No | 2019-09-25 | 2024-11-21 | euvd | Multiple vulnerabilities in the web-based user interface (Web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to …Multiple vulnerabilities in the web-based user interface (Web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands with elevated privileges on the affected device. For more information about these vulnerabilities, see the Details section of this advisory. |
CVE-2025-61937 | CRITICAL | 10.0 | 0.01508 | 40.53 | No | No | 2026-01-16 | 2026-01-16 | euvd | The vulnerability, if exploited, could allow an unauthenticated
miscreant to achieve remote code execution under OS system privileges of
“…The vulnerability, if exploited, could allow an unauthenticated
miscreant to achieve remote code execution under OS system privileges of
“taoimr” service, potentially resulting in complete compromise of the model application server. |
CVE-2025-71210 | CRITICAL | 9.8 | 0.03811 | 40.53 | No | No | 2026-05-21 | 2026-05-21 | euvd, nvd | A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands o…A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations.
Please note: although this vulnerability carries a technical critical CVSS rating, this was reported via responsible disclosure via a researcher through the Zero Day Initiative. The SaaS versions of the product have already been mitigated and no customer action required.
For this particular vulnerability, an attacker must have access to the Trend Micro Apex One Management Console, so customers that have their console�s IP address exposed externally should consider mitigating factors such as source restrictions if not already applied. |
CVE-2022-27625 | CRITICAL | 10.0 | 0.0152 | 40.53 | No | No | 2022-10-20 | 2025-05-07 | euvd | A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functio…A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500. |