Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,863

CVE-2025-24426

Adobe Commerce | Improper Access Control (CWE-284)

Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Commerce B2b
CVE-2021-23173

ICSMA-22-006-01 Philips Engage Software

The affected product is vulnerable to an improper access control, which may allow an authenticated user to gain unauthorized access to sensitive data.

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed
Vendors
Philips
Products
Engage
CVE-2021-23236

Fresenius Kabi Agilia Connect Infusion System uncontrolled resource consumption

Requests may be used to interrupt the normal operation of the device. When exploited, Fresenius Kabi Agilia Link+ version 3.0 must be rebooted via a hard reset triggered by pressing a button on the rack system.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Fresenius-kabi
Products
Agilia Connect Agilia Connect Firmware Agilia Partner Maintenance Software and 5 more
CVE-2021-23233

Fresenius Kabi Agilia Connect Infusion System

Sensitive endpoints in Fresenius Kabi Agilia Link+ v3.0 and prior can be accessed without any authentication information such as the session cookie. An attacker can send requests to sensitive endpoints as an unauthenticated user to perform critical actions or modify critical configuration parameters.

CVSS 3.1 · 7.3 High EPSS 1.0% KEV · Not listed
Vendors
Fresenius-kabi
Products
Agilia Connect Agilia Connect Firmware Agilia Partner Maintenance Software and 5 more
CVE-2021-23195

Fresenius Kabi Agilia Connect Infusion System exposure of information through directory listing

Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 has the option for automated indexing (directory listing) activated. When accessing a directory, a web server delivers its entire content in HTML form. If an index file does not exist and directory listing is enabled, all content of the directory will be displayed, allowing an attacker to identify and access files on the server.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Fresenius-kabi
Products
Agilia Connect Agilia Connect Firmware Agilia Partner Maintenance Software and 5 more
CVE-2021-23207

Fresenius Kabi Agilia Connect Infusion System plaintext storage of a password

An attacker with physical access to the host can extract the secrets from the registry and create valid JWT tokens for the Fresenius Kabi Vigilant MasterMed version 2.0.1.3 application and impersonate arbitrary users. An attacker could manipulate RabbitMQ queues and messages by impersonating users.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fresenius-kabi
Products
Agilia Connect Agilia Partner Maintenance Software Link\+ Agilia and 4 more
CVE-2021-31562

Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm

The SSL/TLS configuration of Fresenius Kabi Agilia Link + version 3.0 has serious deficiencies that may allow an attacker to compromise SSL/TLS sessions in different ways. An attacker may be able to eavesdrop on transferred data, manipulate data allegedly secured by SSL/TLS, and impersonate an entity to gain access to sensitive information.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fresenius-kabi
Products
Agilia Connect Agilia Connect Firmware Agilia Link\+ and 5 more
CVE-2021-33843

Fresenius Kabi Agilia Connect Infusion System files or directories accessible to external parties

Fresenius Kabi Agilia SP MC WiFi vD25 and prior has a default configuration page accessible without authentication. An attacker may use this functionality to change the exposed configuration values such as network settings.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Fresenius-kabi
Products
Agilia Sp Mc Wifi Agilia Sp Mc Wifi Firmware
CVE-2021-44464

Fresenius Kabi Agilia Connect Infusion System hard coded credentials

Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 contains service credentials likely to be common across all instances. An attacker in possession of the password may gain privileges on all installations of this software.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Fresenius-kabi
Products
Agilia Connect Agilia Connect Firmware Agilia Partner Maintenance Software and 5 more
CVE-2021-33848

Fresenius Kabi Agilia Connect Infusion System cross site scripting

Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 is vulnerable to reflected cross-site scripting attacks. An attacker could inject JavaScript in a GET parameter of HTTP requests and perform unauthorized actions such as stealing internal information and performing actions in context of an authenticated user.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Fresenius-kabi
Products
Agilia Connect Agilia Connect Firmware Agilia Partner Maintenance Software and 5 more
CVE-2021-41835

Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm

Fresenius Kabi Agilia Link + version 3.0 does not enforce transport layer encryption. Therefore, transmitted data may be sent in cleartext. Transport layer encryption is offered on Port TCP/443, but the affected service does not perform an automated redirect from the unencrypted service on Port TCP/80 to the encrypted service.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Fresenius-kabi
Products
Agilia Connect Agilia Partner Maintenance Software Link\+ Agilia and 4 more
CVE-2021-43355

Fresenius Kabi Agilia Connect Infusion System use of client side authentication

Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 allows user input to be validated on the client side without authentication by the server. The server should not rely on the correctness of the data because users might not support or block JavaScript or intentionally bypass the client-side checks. An attacker with knowledge of the service user could circumvent the client-side control and login with service privileges.

CVSS 3.1 · 7.3 High EPSS 1.0% KEV · Not listed
Vendors
Fresenius-kabi
Products
Agilia Connect Agilia Connect Firmware Agilia Partner Maintenance Software and 5 more
CVE-2022-0365

Ricon Mobile, Inc.

The affected product is vulnerable to an authenticated OS command injection, which may allow an attacker to inject and execute arbitrary shell commands as the Admin (root) user.

CVSS 3.1 · 9.1 Critical EPSS 2.2% KEV · Not listed
Vendors
Riconmobile
Products
S9922l S9922l Firmware S9922xl and 1 more
CVE-2022-22987

Advantech ADAM-3600

The affected product has a hardcoded private key available inside the project folder, which may allow an attacker to achieve Web Server login and perform further actions.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed
Vendors
Advantech
Products
Adam-3600 Adam-3600 Firmware
CVE-2022-21215

Airspan Networks Mimosa Server-Side Request Forgery (SSRF)

This vulnerability could allow an attacker to force the server to create and execute a web request granting access to backend APIs that are only accessible to the Mimosa MMP server, or request pages that could perform some actions themselves. The attacker could force the server into accessing routes on those cloud-hosting platforms, accessing secret keys, changing configurations, etc. Affecting MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1.

CVSS 3.1 · 10 Critical EPSS 1.4% KEV · Not listed
Vendors
Airspan
Products
A5x A5x Firmware C5c and 6 more
CVE-2022-21196

Airspan Networks Mimosa Improper Authorization

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization and authentication checks on multiple API routes. An attacker may gain access to these API routes and achieve remote code execution, create a denial-of-service condition, and obtain sensitive information.

CVSS 3.1 · 10 Critical EPSS 3.7% KEV · Not listed
Vendors
Airspan
Products
A5x A5x Firmware C5c and 6 more
CVE-2022-0138

Airspan Networks Mimosa Deserialization of Untrusted Data

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 has a deserialization function that does not validate or check the data, allowing arbitrary classes to be created.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Airspan
Products
A5x A5x Firmware C5c and 6 more
CVE-2022-21800

Airspan Networks Mimosa Use of a Broken or Risky Cryptographic Algorithm

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 algorithm to hash the passwords before storing them but does not salt the hash. As a result, attackers may be able to crack the hashed passwords.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Airspan
Products
A5x A5x Firmware C5c and 6 more
CVE-2022-21143

Airspan Networks Mimosa OS Command Injection

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not properly sanitize user input on several locations, which may allow an attacker to inject arbitrary commands.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Airspan
Products
A5x A5x Firmware C5c and 6 more