Vulnerabilities (CVE)

Filtered by vendor Milesight Subscribe
Filtered by product Milesightvpn
Total 5 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2023-22319 1 Milesight 1 Milesightvpn 2024-02-28 N/A 9.8 CRITICAL
A sql injection vulnerability exists in the requestHandlers.js LoginAuth functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to authentication bypass. An attacker can send a malicious packet to trigger this vulnerability.
CVE-2023-23907 1 Milesight 1 Milesightvpn 2024-02-28 N/A 7.5 HIGH
A directory traversal vulnerability exists in the server.js start functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to arbitrary file read. An attacker can send a network request to trigger this vulnerability.
CVE-2023-22844 1 Milesight 1 Milesightvpn 2024-02-28 N/A 9.8 CRITICAL
An authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to authentication bypass. An attacker can send a network request to trigger this vulnerability.
CVE-2023-22371 1 Milesight 1 Milesightvpn 2024-02-28 N/A 8.1 HIGH
An os command injection vulnerability exists in the liburvpn.so create_private_key functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to command execution. An attacker can send a malicious packet to trigger this vulnerability.
CVE-2023-24496 1 Milesight 1 Milesightvpn 2024-02-28 N/A 4.7 MEDIUM
Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger these vulnerabilities.This XSS is exploited through the name field of the database.