Vulnerabilities

DATE CVE VULNERABILITY TITLE RISK
2024-11-15 CVE-2024-50654 Unspecified vulnerability in Pickmall Lilishop
lilishop <=4.2.4 is vulnerable to Incorrect Access Control, which can allow attackers to obtain coupons beyond the quantity limit by capturing and sending the data packets for coupon collection in high concurrency.
network
low complexity
pickmall
7.5
7.5
2024-11-15 CVE-2024-50655 Cross-site Scripting vulnerability in Emlog
emlog pro <=2.3.18 is vulnerable to Cross Site Scripting (XSS), which allows attackers to write malicious JavaScript code in published articles.
network
low complexity
emlog CWE-79
5.4
5.4
2024-11-15 CVE-2022-20631 A vulnerability in the web-based management interface of Cisco&nbsp;ECE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface of an affected device. The vulnerability exists because the web-based management interface does not properly validate user-supplied input.
network
low complexity
 6.1
6.1
2024-11-15 CVE-2022-20634 A vulnerability in the web-based management interface of Cisco&nbsp;ECE could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. This vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to an affected system.
network
low complexity
CWE-601
4.7
4.7
2024-11-15 CVE-2022-20648 A vulnerability in a debug function for Cisco&nbsp;RCM for Cisco&nbsp;StarOS Software could allow an unauthenticated, remote attacker to perform debug actions that could result in the disclosure of confidential information that should be restricted. This vulnerability exists because of a debug service that incorrectly listens to and accepts incoming connections.
network
low complexity
CWE-200
5.3
5.3
2024-11-15 CVE-2022-20649 A vulnerability in Cisco&nbsp;RCM for Cisco&nbsp;StarOS Software could allow an unauthenticated, remote attacker to perform remote code execution on the application with root-level privileges&nbsp;in the context of the configured container. This vulnerability exists because the debug mode is incorrectly enabled for specific services.
network
high complexity
CWE-489
8.1
8.1
2024-11-15 CVE-2022-20652 A vulnerability in the web-based management interface and in the API subsystem of Cisco&nbsp;Tetration could allow an authenticated, remote attacker to inject arbitrary commands to be executed with root-level privileges on the underlying operating system. This vulnerability is due to insufficient input validation.
network
low complexity
CWE-78
6.5
6.5
2024-11-15 CVE-2022-20654 A vulnerability in the web-based interface of Cisco&nbsp;Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based interface of Cisco&nbsp;Webex Meetings.
network
low complexity
CWE-80
6.1
6.1
2024-11-15 CVE-2022-20655 A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient validation of a process argument on an affected device.
local
low complexity
 8.8
8.8
2024-11-15 CVE-2022-20656 A vulnerability in the web-based management interface of Cisco&nbsp;PI and Cisco&nbsp;EPNM could allow an authenticated, remote attacker to conduct a path traversal attack on an affected device.
network
low complexity
CWE-24
6.5
6.5