CVE
Vendors
Products
Updated
CVSS v2
CVSS v3
Various Lexmark products through 2022-04-27 allow an attacker who has already compromised an affected Lexmark device to maintain persistence across reboots.
In music service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.
In Progress OpenEdge before 11.7.14 and 12.x before 12.2.9, certain SUID binaries within the OpenEdge application were susceptible to privilege escalation. If exploited, a local attacker could elevate their privileges and compromise the affected system.
In Progress Ipswitch WhatsUp Gold 17.0.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow them to read sensitive operating-system attributes from a host that is accessible by the WhatsUp Gold system.
In Progress Ipswitch WhatsUp Gold 21.0.0 through 21.1.1, and 22.0.0, it is possible for an unauthenticated attacker to invoke an API transaction that would allow them to relay encrypted WhatsUp Gold user credentials to an arbitrary host.
In Progress Ipswitch WhatsUp Gold 16.1 through 21.1.1, and 22.0.0, it is possible for an unauthenticated attacker to obtain the WhatsUp Gold installation serial number.
In Progress Ipswitch WhatsUp Gold 21.1.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow them to read the contents of a local file.
Sandisk_x600_sd9tb8w-128g_firmware, Sandisk_x600_sd9tb8w-128g, Sandisk_x600_sd9tb8w-256g_firmware, Sandisk_x600_sd9tb8w-256g, Sandisk_x600_sd9tb8w-512g_firmware, Sandisk_x600_sd9tb8w-512g, Sandisk_x600_sd9tb8w-1t00_firmware, Sandisk_x600_sd9tb8w-1t00, Sandisk_x600_sd9tb8w-2t00_firmware, Sandisk_x600_sd9tb8w-2t00
2023-02-01
N/A
9.8 CRITICAL
A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to read and write arbitrary files. This could lead to a full NAS compromise and would give remote execution capabilities to the attacker.
Sandisk_x600_sd9tb8w-128g_firmware, Sandisk_x600_sd9tb8w-128g, Sandisk_x600_sd9tb8w-256g_firmware, Sandisk_x600_sd9tb8w-256g, Sandisk_x600_sd9tb8w-512g_firmware, Sandisk_x600_sd9tb8w-512g, Sandisk_x600_sd9tb8w-1t00_firmware, Sandisk_x600_sd9tb8w-1t00, Sandisk_x600_sd9tb8w-2t00_firmware, Sandisk_x600_sd9tb8w-2t00
2023-02-01
N/A
9.8 CRITICAL
A command injection vulnerability in the DDNS service configuration of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to execute code in the context of the root user.
In jpg driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.