Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
103 results · page 1 of 3
Sep 24, 2026Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability.CVE-2026-81473 · Other software · Dell · reported by security_alert@emc.comHigh 8.1
Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
- Product
- Rugged Control Center (RCC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability.CVE-2026-56792 · Other software · Dell · reported by security_alert@emc.comMedium 4.4
Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
- Product
- Rugged Control Center (RCC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct conneCVE-2026-19397 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 7.7
Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent when the host has an active login session. Refer to the ' Security Update for ASUS Control Center Express Agent ' section on the ASUS Security Advisory for more information.
- Product
- Control Center Express Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorizedCVE-2026-75754 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Critical 10
Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to obtain the encryption key via an HTTP request, causing a local service to enable SSH on port 2222. The attacker can then log in with the hardcode credentials to obtain a root shell, enabling direct reading, writing, and deletion of data on ASUS Control Center, as well as remote control of all servers, PCs, and workstations within the company. Refer to the 'Security Update for ASUS Control Center' section on the ASUS Security Advisory for more information.
- Product
- Control Center Enterprise (ACC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026The MBStorage DRAM lighting control module within Gigabyte Control Center (GCC) developed by GIGABYTE Technology has an Improper Access Control vulnerability.CVE-2026-9492 · Other software · GIGABYTE · reported by twcert@cert.org.twHigh 8.5
The MBStorage DRAM lighting control module within Gigabyte Control Center (GCC) developed by GIGABYTE Technology has an Improper Access Control vulnerability. Authenticated local attackers can send specific IOCTL commands through the driver MyPortIO_x64.sys bundled with the module, thereby arbitrarily reading and writing physical memory and obtaining kernel-level privileges.
- Product
- MBStorage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Apr 9, 2026dde-control-center is the control panel of DDE, the Deepin Desktop Environment.CVE-2026-35207 · Computers, phones & browsers · linuxdeepin · reported by GitHubMedium 5.4
dde-control-center is the control panel of DDE, the Deepin Desktop Environment. plugin-deepinid is a plugin in dde-control-center, which provides the deepinid cloud service. Prior to 6.1.80, plugin-deepinid is configured to skip TLS certificate verification when fetching the user's avatar from openapi.deepin.com or other providers. An MITM attacker could intercept the traffic, replace the avatar with a malicious or misleading image, and potentially identify the user by the avatar. This vulnerability is fixed in dde-control-center 6.1.80 and 5.9.9.
- Product
- dde-control-center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026The Performance Library component of Gigabyte Control Center has an Insecure Deserialization vulnerability.CVE-2026-4416 · Other software · GIGABYTE · reported by twcert@cert.org.twHigh 8.5
The Performance Library component of Gigabyte Control Center has an Insecure Deserialization vulnerability. Authenticated local attackers can send a malicious serialized payload to the EasyTune Engine service, resulting in privilege escalation.
- Product
- Performance Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Mar 30, 2026Gigabyte Control Center developed by GIGABYTE has an Arbitrary File Write vulnerability.CVE-2026-4415 · Other software · GIGABYTE · reported by twcert@cert.org.twCritical 9.2
Gigabyte Control Center developed by GIGABYTE has an Arbitrary File Write vulnerability. When the pairing feature is enabled, unauthenticated remote attackers can write arbitrary files to any location on the underlying operating system, leading to arbitrary code execution or privilege escalation.
- Product
- Gigabyte Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Feb 18, 2026Control Center PRO 6.2.9 contains a stack-based buffer overflow vulnerability in the user creation module's username field that allows attackers to overwrite StCVE-2019-25357 · Other software · WEBGATE Inc. · reported by VulnCheckHigh 8.4
Control Center PRO 6.2.9 contains a stack-based buffer overflow vulnerability in the user creation module's username field that allows attackers to overwrite Structured Exception Handler (SEH). Attackers can craft a malicious payload exceeding 664 bytes to inject shellcode and potentially execute arbitrary code on vulnerable Windows systems.
- Product
- Control Center PRO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwebgateinc.comwebgateinc.com
Aug 15, 2025A vulnerability has been found in Mechrevo Control Center GX V2 5.56.51.48.CVE-2025-9016 · Other software · Mechrevo · reported by VulDBMedium 6.4
A vulnerability has been found in Mechrevo Control Center GX V2 5.56.51.48. Affected is an unknown function of the file C:\Program Files\OEM\机械革命控制中心\AiStoneService\MyControlCenter\Command of the component Powershell Script Handler. Such manipulation leads to uncontrolled search path. The attack needs to be performed locally. Attacks of this nature are highly complex. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- Control Center GX V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.proton.mevuldb.com
Aug 14, 2025A vulnerability was detected in Mechrevo Control Center GX V2 5.56.51.48.CVE-2025-9000 · Other software · Mechrevo · reported by VulDBMedium 6.4
A vulnerability was detected in Mechrevo Control Center GX V2 5.56.51.48. Impacted is an unknown function of the component reg File Handler. The manipulation results in uncontrolled search path. The attack needs to be approached locally. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit is now public and may be used.
- Product
- Control Center GX V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.proton.mevuldb.com
Jul 20, 2025A vulnerability classified as problematic was found in Eluktronics Control Center 5.23.51.41.CVE-2025-7884 · Other software · Eluktronics · reported by VulDBLow 1.9
A vulnerability classified as problematic was found in Eluktronics Control Center 5.23.51.41. Affected by this vulnerability is an unknown functionality of the component REG File Handler. The manipulation leads to insufficient verification of data authenticity. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.proton.mevuldb.com
Jul 20, 2025A vulnerability classified as critical has been found in Eluktronics Control Center 5.23.51.41.CVE-2025-7883 · Other software · Eluktronics · reported by VulDBHigh 7.1
A vulnerability classified as critical has been found in Eluktronics Control Center 5.23.51.41. Affected is an unknown function of the file \AiStoneService\MyControlCenter\Command of the component Powershell Script Handler. The manipulation leads to command injection. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.proton.mevuldb.com
Apr 15, 2025In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-serCVE-2023-5616 · Other software · Canonical Ltd. · reported by security@ubuntu.comMedium 4.9
In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-server. This could unknowingly leave the local machine exposed to remote SSH access contrary to expectation of the user.
- Product
- Ubuntu's gnome-control-center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netubuntu.com
Apr 10, 2025IBM Sterling Control Center 6.2.1, 6.3.1, and 6.4.0 allows web pages to be stored locally which can be read by another user on the system.CVE-2023-43035 · Other software · IBM · reported by psirt@us.ibm.comMedium 4
IBM Sterling Control Center 6.2.1, 6.3.1, and 6.4.0 allows web pages to be stored locally which can be read by another user on the system.
- Product
- Sterling Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2025IBM Sterling Control Center 6.2.1, 6.3.1, and 6.4.0 is vulnerable to cross-site scripting.CVE-2023-42007 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Sterling Control Center 6.2.1, 6.3.1, and 6.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
- Product
- Sterling Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2025IBM Control Center 6.2.1 through 6.3.1 is vulnerable to an external service interaction attack, caused by improper validation of user-supplied input.CVE-2023-43052 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Control Center 6.2.1 through 6.3.1 is vulnerable to an external service interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests to arbitrary domain names. By submitting suitable payloads, an attacker can cause the application server to attack other systems that it can interact with.
- Product
- Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2025IBM Control Center 6.2.1 through 6.3.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.CVE-2023-35894 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Control Center 6.2.1 through 6.3.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
- Product
- Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025Ubuntu's configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default.CVE-2022-1736 · Other software · Canonical Ltd. · reported by security@ubuntu.comCritical 9.8
Ubuntu's configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default.
- Product
- Ubuntu's gnome-control-center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netubuntu.com
Jan 25, 2025IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to enumerate usernames due to an observable discrepancy between login attempts.CVE-2024-35114 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to enumerate usernames due to an observable discrepancy between login attempts.
- Product
- Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2025IBM Control Center 6.2.1 and 6.3.1 could allow an authenticated user to obtain sensitive information exposed through a directory listing.CVE-2024-35113 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Control Center 6.2.1 and 6.3.1 could allow an authenticated user to obtain sensitive information exposed through a directory listing.
- Product
- Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2025IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the brCVE-2024-35112 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
- Product
- Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2025IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browCVE-2024-35111 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
- Product
- Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2024An insecure driver vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM) that could allow a locCVE-2024-4763 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.8
An insecure driver vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM) that could allow a local attacker to escalate privileges to kernel.
- Product
- Display Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2024An insecure permissions vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM) that could allow CVE-2024-2175 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.8
An insecure permissions vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM) that could allow a local attacker to escalate privileges.
- Product
- Display Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2024An issue in the component ControlCenter.sys/ControlCenter64.sys of ThundeRobot Control Center v2.0.0.10 allows attackers to access sensitive information, executCVE-2024-39251 · Other software · thunderobot · reported by MITRECritical 10
An issue in the component ControlCenter.sys/ControlCenter64.sys of ThundeRobot Control Center v2.0.0.10 allows attackers to access sensitive information, execute arbitrary code, or escalate privileges via sending crafted IOCTL requests.
- Product
- control_center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2024An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Juniper Networks Paragon Active Assurance Control Center allows a network-adjacenCVE-2024-30381 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 8.4
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Juniper Networks Paragon Active Assurance Control Center allows a network-adjacent attacker with root access to a Test Agent Appliance the ability to access sensitive information about downstream devices. The "netrounds-probe-login" daemon (also called probe_serviced) exposes functions where the Test Agent (TA) Appliance pushes interface state/config, unregister itself, etc. The remote service accidentally exposes an internal database object that can be used for direct database access on the Paragon Active Assurance Control Center. This issue affects Paragon Active Assurance: 4.1.0, 4.2.0.
- Product
- Paragon Active Assurance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportportal.juniper.netfirst.org
Apr 9, 2024Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender GravityZone allows an CVE-2024-2224 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 8.1
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects the following products that include the vulnerable component: Bitdefender Endpoint Security for Linux version 7.0.5.200089 Bitdefender Endpoint Security for Windows version 7.9.9.380 GravityZone Control Center (On Premises) version 6.36.1
- Product
- GravityZone Control Center (On Premises)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.combitdefender.com
Apr 9, 2024An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigureCVE-2024-2223 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 8.1
An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigure the relay. This issue affects the following products that include the vulnerable component: Bitdefender Endpoint Security for Linux version 7.0.5.200089 Bitdefender Endpoint Security for Windows version 7.9.9.380 GravityZone Control Center (On Premises) version 6.36.1
- Product
- GravityZone Control Center (On Premises)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.combitdefender.com
Feb 7, 2024Mail2World v12 Business Control Center was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Usr parameter at resellercenter/loCVE-2024-24130 · Other software · mail2world · reported by MITREMedium 6.1
Mail2World v12 Business Control Center was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Usr parameter at resellercenter/login.asp.
- Product
- mail2world
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2024IBM Sterling Control Center 6.3.0 could allow a remote attacker to traverse directories on the system.CVE-2023-35020 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Sterling Control Center 6.3.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 257874.
- Product
- Sterling Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 11, 2024 An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated network-based attacker to acCVE-2024-21589 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 7.4
An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated network-based attacker to access reports without authenticating, potentially containing sensitive configuration information. A feature was introduced in version 3.1.0 of the Paragon Active Assurance Control Center which allows users to selectively share account data. By exploiting this vulnerability, it is possible to access reports without being logged in, resulting in the opportunity for malicious exfiltration of user data. Note that the Paragon Active Assurance Control Center SaaS offering is not affected by this issue. This issue affects Juniper Networks Paragon Active Assurance versions 3.1.0, 3.2.0, 3.2.2, 3.3.0, 3.3.1, 3.4.0. This issue does not affect Juniper Networks Paragon Active Assurance versions earlier than 3.1.0.
- Product
- Paragon Active Assurance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportportal.juniper.netfirst.org
Dec 2, 2023 Dell Rugged Control Center, version prior to 4.7, contains an Improper Access Control vulnerability.CVE-2023-39257 · Other software · Dell · reported by security_alert@emc.comHigh 7.3
Dell Rugged Control Center, version prior to 4.7, contains an Improper Access Control vulnerability. A local malicious standard user could potentially exploit this vulnerability to modify the content in an unsecured folder when product installation repair is performed, leading to privilege escalation on the system.
- Product
- Rugged Control Center (RCC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2023 Dell Rugged Control Center, version prior to 4.7, contains an improper access control vulnerability.CVE-2023-39256 · Other software · Dell · reported by security_alert@emc.comHigh 7.3
Dell Rugged Control Center, version prior to 4.7, contains an improper access control vulnerability. A local malicious standard user could potentially exploit this vulnerability to modify the content in an unsecured folder during product installation and upgrade, leading to privilege escalation on the system.
- Product
- Rugged Control Center (RCC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023 Dell Rugged Control Center, version prior to 4.7, contains insufficient protection for the Policy folder.CVE-2023-43089 · Other software · Dell · reported by security_alert@emc.comMedium 4.4
Dell Rugged Control Center, version prior to 4.7, contains insufficient protection for the Policy folder. A local malicious standard user could potentially exploit this vulnerability to modify the content of the policy file, leading to unauthorized access to resources.
- Product
- Dell Rugged Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2023Cross Site Scripting (XSS) vulnerability in GBCOM LAC WEB Control Center version lac-1.3.x, allows attackers to create an arbitrary device.CVE-2023-29707 · Other software · Gbcom · reported by MITREMedium 4.8
Cross Site Scripting (XSS) vulnerability in GBCOM LAC WEB Control Center version lac-1.3.x, allows attackers to create an arbitrary device.
- Product
- LAC Web Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comholistic-height-e6d.notion.site
Feb 15, 2023Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution.CVE-2023-22855 · Other software · Kardex · reported by MITRECritical 9.8
Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution. It spawns a web interface listening on port 8088. A user-controllable path is handed to a path-concatenation method (Path.Combine from .NET) without proper sanitisation. This yields the possibility of including local files, as well as remote files on SMB shares. If one provides a file with the extension .t4, it is rendered with the .NET templating engine mono/t4, which can execute code.
- Product
- Kardex Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Feb 1, 2023 Dell Rugged Control Center, versions prior to 4.5, contain an Improper Input Validation in the Service EndPoint.CVE-2022-34443 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell Rugged Control Center, versions prior to 4.5, contain an Improper Input Validation in the Service EndPoint. A Local Low Privilege attacker could potentially exploit this vulnerability, leading to an Escalation of privileges.
- Product
- Rugged Control Center (RCC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2022An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability, a stored XSS (or persistent), in the Control Center ContrCVE-2022-22229 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 8.4
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability, a stored XSS (or persistent), in the Control Center Controller web pages of Juniper Networks Paragon Active Assurance (Formerly Netrounds) allows a high-privilege attacker with 'WRITE' permissions to store one or more malicious scripts that will infect any other authorized user's account when they accidentally trigger the malicious script(s) while managing the device. Triggering these attacks enables the attacker to execute commands with the permissions up to that of the superuser account. This issue affects: Juniper Networks Paragon Active Assurance (Formerly Netrounds) All versions prior to 3.1.1; 3.2 versions prior to 3.2.1.
- Product
- Paragon Active Assurance (Formerly Netrounds)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.juniper.netkb.juniper.net
Aug 18, 2022Improper buffer restrictions for some Intel(R) NUC 9 Extreme Laptop Kit drivers before version 2.2.0.22 may allow an authenticated user to potentially enable esCVE-2022-21229 · Other software · Intel · reported by secure@intel.comHigh 7.8
Improper buffer restrictions for some Intel(R) NUC 9 Extreme Laptop Kit drivers before version 2.2.0.22 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022A vulnerability in the web-based management interface of Cisco IoT Control Center could allow an unauthenticated, remote attacker to conduct a cross-site scriptCVE-2022-20916 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
A vulnerability in the web-based management interface of Cisco IoT Control Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
- Product
- Cisco IoT Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Jun 20, 2022An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04.CVE-2022-31795 · Other software · Fujitsu · reported by MITRECritical 9.8
An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnerability resides in the grel_finfo function in grel.php. An attacker is able to influence the username (user), password (pw), and file-name (file) parameters and inject special characters such as semicolons, backticks, or command-substitution sequences in order to force the application to execute arbitrary commands.
- Product
- Eternus Cs8000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgresearch.nccgroup.com
Jun 20, 2022An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04.CVE-2022-31794 · Other software · Fujitsu · reported by MITRECritical 9.8
An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnerability resides in the requestTempFile function in hw_view.php. An attacker is able to influence the unitName POST parameter and inject special characters such as semicolons, backticks, or command-substitution sequences in order to force the application to execute arbitrary commands.
- Product
- Eternus Cs8000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgresearch.nccgroup.com
Jun 20, 2022ASUS Control Center is vulnerable to SQL injection.CVE-2022-26669 · Network & remote access · ASUS · reported by twcert@cert.org.twHigh 8.8
ASUS Control Center is vulnerable to SQL injection. An authenticated remote attacker with general user privilege can inject SQL command to specific API parameters to acquire database schema or access data.
- Product
- Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jun 20, 2022ASUS Control Center API has a broken access control vulnerability.CVE-2022-26668 · Network & remote access · ASUS · reported by twcert@cert.org.twHigh 7.3
ASUS Control Center API has a broken access control vulnerability. An unauthenticated remote attacker can call privileged API functions to perform partial system operations or cause partial disrupt of service.
- Product
- Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
May 19, 2022Mobotix Control Center (MxCC) through 2.5.4.5 has Insufficiently Protected Credentials, Storing Passwords in a Recoverable Format via the MxCC.ini config file.CVE-2022-30018 · Other software · Mobotix · reported by MITREHigh 8.8
Mobotix Control Center (MxCC) through 2.5.4.5 has Insufficiently Protected Credentials, Storing Passwords in a Recoverable Format via the MxCC.ini config file. The credential storage method in this software enables an attacker/user of the machine to gain admin access to the software and gain access to recordings/recording locations.
- Product
- Mxcontrolcenter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Improper access control for the Intel(R) Killer(TM) Control Center software before version 2.4.3337.0 may allow an authorized user to potentially enable escalatCVE-2021-26258 · Other software · Intel · reported by secure@intel.comHigh 7.8
Improper access control for the Intel(R) Killer(TM) Control Center software before version 2.4.3337.0 may allow an authorized user to potentially enable escalation of privilege via local access.
- Product
- Killer Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022A vulnerability exists where an IBM Robotic Process Automation 21.0.1 regular user is able to obtain view-only access to some admin pages in the Control Center CVE-2022-22415 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
A vulnerability exists where an IBM Robotic Process Automation 21.0.1 regular user is able to obtain view-only access to some admin pages in the Control Center IBM X-Force ID: 223029.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Apr 14, 2022An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated attacker to leverage a crafteCVE-2022-22190 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 7.4
An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated attacker to leverage a crafted URL to generate PDF reports, potentially containing sensitive configuration information. A feature was introduced in version 3.1 of the Paragon Active Assurance Control Center which allows users to selective share account data using a unique identifier. Knowing the proper format of the URL and the identifier of an existing object in an application it is possible to get access to that object without being logged in, even if the object is not shared, resulting in the opportunity for malicious exfiltration of user data. Note that the Paragon Active Assurance Control Center SaaS offering is not affected by this issue. This issue affects Juniper Networks Paragon Active Assurance version 3.1.0.
- Product
- Paragon Active Assurance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.juniper.netkb.juniper.net
Jul 22, 2021Multiple stack-based buffer overflows in WebGate eDVR Manager and Control Center allow remote attackers to execute arbitrary code via unspecified vectors to theCVE-2015-2100 · Other software · Webgate · reported by MITREHigh 8.8
Multiple stack-based buffer overflows in WebGate eDVR Manager and Control Center allow remote attackers to execute arbitrary code via unspecified vectors to the (1) TCPDiscover or (2) TCPDiscover2 function in the WESPDiscovery.WESPDiscoveryCtrl.1 control.
- Product
- Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.