CVE-2022-2487

WAVLINK WN535K2 and WN535K3 routers are affected by OS command injection in /cgi-bin/nightled.cgi due to manipulation of the start_hour parameter. The underlying issue allows remote code execution, with potential full system compromise, data modification/leakage, and control of the device as desc...

CVE-2022-2486

CVE-2022-2486 affects WAVLINK WN535K2 and WN535K3 routers. A vulnerability in an unknown part of the file /cgi-bin/mesh.cgi?page=upgrade allows OS command injection via manipulation of the argument key. Documents describe that an attacker can execute commands, access/modify data, obtain sensitive...

CVE-2022-34538

CVE-2022-34538 affects Digital Watchdog DW MEGApix IP cameras (A7.2.2_20211029). A command-injection vulnerability exists in /admin/vca/bia/addacph.cgi and is exploitable via crafted POST requests. Several connected sources corroborate the issue and its impact, with no publicly documented patch d...

CVE-2022-35405

CVE-2022-35405 affects Zoho ManageEngine PAM360 (before 5.5/5510) and Password Manager Pro (before 12.1/12101), plus Access Manager Plus (before 4.3/4303 with auth). The root cause is a Java deserialization issue in XML-RPC handling that enables unauthenticated RCE for Password Manager Pro and PA...

CVE-2022-33891

Summary: CVE-2022-33891 is a command-injection vulnerability in the Apache Spark UI when ACLs are enabled. A code path in HttpSecurityFilter can impersonate by supplying an arbitrary username, leading to an arbitrary shell command being executed as the Spark process user. Affected versions includ...

CVE-2021-41419

CVE-2021-41419 affects QVIS NVR/DVR firmware prior to 2021-12-13. The vulnerability stems from Java deserialization and permits remote code execution, enabling an attacker to execute arbitrary code with the device’s privileges, potentially leading to full system compromise. The CVSS v3.1 score is...

CVE-2022-31208

Infiray IRAY-A8Z3 1.0.957 webserver is affected by CVE-2022-31208: an endpoint can execute arbitrary commands via the cmd_string URL parameter. Root cause described as improper handling of cmd_string leading to command execution. The vulnerability supports network access with low privileges and n...

CVE-2022-26352

DotCMS ContentResource API (CVE-2022-26352) vulnerable to arbitrary file upload via POST /api/content in 3.0–22.02. An unsanitized filename in multipart form can cause directory traversal, saving files outside the intended storage. If anonymous content creation is enabled, an attacker could uploa...

CVE-2022-31161

CVE-2022-31161 affects Roxy-WI prior to version 6.1.1.0, where the system command can be executed remotely through inputs handled in /app/options.py (notably via the subprocess_execute path). The issue enables unauthenticated remote code execution by abusing input handling (e.g., delcert/ssl_cert...

CVE-2022-34753

CVE-2022-34753 affects Schneider Electric SpaceLogic C-Bus Home Controller (5200WHC2), formerly C-Bus Wiser Home Controller MK2, up to version 1.31.460 (firmware 604). The vulnerability is an authenticated OS command injection vulnerability that allows remote root execution when a crafted command...

CVE-2022-30216

CVE-2022-30216 is a Windows Server Service Tampering vulnerability caused by an off-by-one error in the Windows Server Service, enabling authentication coercion that, per Akamai, could lead to domain controller access. Public writeups describe the issue as affecting Windows Server/Server Service ...

CVE-2022-22049

CVE-2022-22049 is a Windows CSRSS (Client Server Run-time Subsystem) Elevation of Privilege vulnerability. The entry lists a CVSS v2 base score of 7.2 (HIGH) and CVSS v3.1 base score of 7.8 (HIGH), with LOCAL attack vector, LOW attack complexity, and privileges required as LOW; no user interactio...

CVE-2022-22048

Technical details about CVE-2022-22048 are not publicly provided in the supplied documents. No affected products, root cause, impact, or fixes are included here. Monitor for updates.

CVE-2022-22047

CVE-2022-22047 is a Windows CSRSS Elevation of Privilege vulnerability. The CSRSS component may allow a local attacker who can execute code on the target to gain SYSTEM privileges. Public exploitation has been reported; Microsoft’s July 2022 Patch Tuesday addressed this family of issues (CSRSS Eo...

CVE-2022-1952

The CVE-2022-1952 issue affects the WordPress eaSYNC Booking plugin (Hotels/Restaurant/Car Rental) versions prior to 1.1.16. It stems from insufficient input validation of an AJAX action, with an allowlist of valid file extensions defined but not used during validation. This leads to arbitrary fi...

CVE-2022-1057

CVE-2022-1057 affects the WordPress plugin “Pricing Deals for WooCommerce” up to version 2.0.2.02. The vulnerability is an unauthenticated SQL injection caused by improper sanitisation/escaping of a parameter in an AJAX action, allowing arbitrary SQL execution and potential data disclosure or mod...

CVE-2022-31137

CVE-2022-31137 affects Roxy-WI prior to 6.1.1.0. A remote code execution vulnerability exists where system commands can be executed via the subprocess_execute function in /app/options.py without proper input validation, and attackers can exploit it without authentication. The issue is mitigated b...

CVE-2022-31126

CVE-2022-31126 affects Roxy-wi prior to 6.1.1.0. The Nuclei template confirms remote code execution via the vulnerable path, with commands executed through the application logic (ssh_command) in /app/funct.py, enabling an unauthenticated attacker to run arbitrary code on the target. Exploitation ...

CVE-2022-31129

Moment.js (JavaScript date library) contains a vulnerability in string-to-date parsing via RFC2822 parsing, causing quadratic (N^2) complexity and potential (Re)DoS for long inputs (>10k chars). The issue is mitigated by upgrading to Moment.js v2.29.4 or later; if upgrading is not possible, li...

CVE-2022-34151

CVE-2022-34151 affects Omron NJ/NX-series Machine Automation Controllers, Sysmac Studio, and NA-series PTs. Root cause: hard-coded credentials in affected components may let a remote attacker obtain credentials and access the controller. Affected versions: NJ/NX controllers (NJ1/NJ series up to v...