Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas3017▼ 66 respecto a la semana anterior
Críticas / altas1412▲ 56 respecto a la semana anterior
Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)381▼ 129 respecto a la semana anterior
46 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Crítica (9.8) | 3.5% | — | Goabode Iota All-in-one Security KIT Firmware | 25/10/2022 | 17/6/2026 | An OS command injection vulnerability exists in the XCMD setAlexa functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send a malicious XML payload to trigger this vulnerability. | |
| Modificada | Alta (8.8) | 1.5% | — | Goabode Iota All-in-one Security KIT Firmware | 25/10/2022 | 17/6/2026 | An integer overflow vulnerability exists in the web interface /action/ipcamRecordPost functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to memory corruption. An attacker can make an authenticated HTTP request to trigger this vulnerability. | |
| Modificada | Crítica (9.8) | 3.4% | — | Goabode Iota All-in-one Security KIT Firmware | 25/10/2022 | 17/6/2026 | An OS command injection vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send a malicious XML payload to trigger this vulnerability. | |
| Modificada | Alta (7.5) | 0.94% | — | Goabode Iota All-in-one Security KIT Firmware | 25/10/2022 | 17/6/2026 | A denial of service vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to denial of service. An attacker can send a malicious XML payload to trigger this vulnerability. | |
| Modificada | Alta (8.8) | 4.0% | — | Goabode Iota All-in-one Security KIT Firmware | 25/10/2022 | 17/6/2026 | An OS command injection vulnerability exists in the web interface /action/ipcamRecordPost functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this… | |
| Modificada | Media (6.5) | 1.6% | — | Goabode Iota All-in-one Security KIT Firmware | 25/10/2022 | 17/6/2026 | A double-free vulnerability exists in the web interface /action/ipcamSetParamPost functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to memory corruption. An attacker can make an authenticated HTTP request to trigger this vulnerability. | |
| Modificada | Crítica (9.8) | 1.7% | — | Goabode Iota All-in-one Security KIT Firmware | 25/10/2022 | 17/6/2026 | A stack-based buffer overflow vulnerability exists in the XCMD setIPCam functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to remote code execution. An attacker can send a malicious XML payload to trigger this vulnerability. | |
| Modificada | Alta (8.8) | 5.6% | — | Goabode Iota All-in-one Security KIT Firmware | 25/10/2022 | 17/6/2026 | An OS command injection vulnerability exists in the web interface /action/iperf functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. | |
| Modificada | Crítica (9.8) | 3.3% | — | Goabode Iota All-in-one Security KIT Firmware | 25/10/2022 | 17/6/2026 | An OS command injection vulnerability exists in the XCMD setUPnP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send a malicious XML payload to trigger this vulnerability. | |
| Modificada | Crítica (9.8) | 1.2% | — | Goabode Iota All-in-one Security KIT Firmware | 25/10/2022 | 17/6/2026 | A hard-coded password vulnerability exists in the telnet functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. Use of a hard-coded root password can lead to arbitrary command execution. An attacker can authenticate with hard-coded credentials to trigger this vulnerability. | |
| Modificada | Crítica (9.8) | 2.9% | — | Goabode Iota All-in-one Security KIT Firmware | 25/10/2022 | 17/6/2026 | An OS command injection vulnerability exists in the console_main_loop :sys functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send an XML payload to trigger this vulnerability. | |
| Modificada | Crítica (9.8) | 1.3% | — | Goabode Iota All-in-one Security KIT Firmware | 25/10/2022 | 17/6/2026 | An authentication bypass vulnerability exists in the web interface /action/factory* functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP header can lead to authentication bypass. An attacker can send an HTTP request to trigger this vulnerability. | |
| Modificada | Alta (8.1) | 0.60% | — | Goabode Iota All-in-one Security KIT Firmware | 25/10/2022 | 17/6/2026 | An information disclosure vulnerability exists in the XFINDER functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted man-in-the-middle attack can lead to increased privileges. An attacker can perform a man-in-the-middle attack to trigger this vulnerability. | |
| Modificada | Crítica (9.8) | 4.6% | — | Goabode Iota All-in-one Security KIT Firmware | 25/10/2022 | 17/6/2026 | An OS command injection vulnerability exists in the web interface util_set_serial_mac functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability. | |
| Modificada | Crítica (9.8) | 1.4% | — | Goabode Iota All-in-one Security KIT Firmware | 25/10/2022 | 17/6/2026 | An authentication bypass vulnerability exists in the GHOME control functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted network request can lead to arbitrary XCMD execution. An attacker can send a malicious XML payload to trigger this vulnerability. | |
| Modificada | Crítica (9.8) | 3.8% | — | Goabode Iota All-in-one Security KIT Firmware | 25/10/2022 | 17/6/2026 | An os command injection vulnerability exists in the web interface util_set_abode_code functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability. | |
| Modificada | Alta (7.8) | 0.98% | — | Goabode Iota All-in-one Security KIT Firmware | 20/12/2021 | 17/6/2026 | OS Command Injection vulnerability in the wirelessConnect handler of Abode iota All-In-One Security Kit allows an attacker to inject commands and gain root access. This issue affects: Abode iota All-In-One Security Kit versions prior to 1.0.2.23_6.9V_dev_t2_homekit_RF_2.0.19_s2_kvsABODE oz. | |
| Modificada | Alta (7.1) | 2.2% | — | IBM Global Security KITIBM Security Directory ServerIBM Tivoli Directory Server | 27/1/2014 | 17/6/2026 | IBM GSKit 7.x before 7.0.4.48 and 8.x before 8.0.50.16, as used in IBM Security Directory Server (ISDS) and Tivoli Directory Server (TDS), allows remote attackers to cause a denial of service (application crash or hang) via a malformed X.509 certificate chain. | |
| Modificada | Alta (7.8) | 3.2% | — | IBM Content Manager Ondemand FOR MultiplatformsIBM Global Security KITIBM Security Access Manager FOR WEB | 17/12/2013 | 17/6/2026 | IBM Global Security Kit (aka GSKit), as used in Content Manager OnDemand 8.5 and 9.0 and other products, allows remote attackers to cause a denial of service via a crafted handshake during resumption of an SSLv2 session. | |
| Modificada | Alta (7.5) | 1.6% | — | IBM Global Security KITIBM Rational Directory ServerIBM Tivoli Directory Server | 8/8/2012 | 16/6/2026 | IBM Global Security Kit (aka GSKit) before 8.0.14.22, as used in IBM Rational Directory Server, IBM Tivoli Directory Server, and other products, uses the PKCS #12 file format for certificate objects without enforcing file integrity, which makes it easier for remote attackers to spoof SSL servers via vectors involving… | |
| Modificada | Media (5) | 3.9% | — | IBM Global Security KITIBM Rational Directory ServerIBM Tivoli Directory Server | 8/8/2012 | 16/6/2026 | IBM Global Security Kit (aka GSKit) before 8.0.14.22, as used in IBM Rational Directory Server, IBM Tivoli Directory Server, and other products, does not properly validate data during execution of a protection mechanism against the Vaudenay SSL CBC timing attack, which allows remote attackers to cause a denial of… |