CVEs published by Gridware

CVEs published by Gridware (CVE Numbering Authority). 47 tracked.

• CVE-2025-1131 HIGH 7.8 UPGRADE DOWNGRADE A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolk
• CVE-2025-66263 HIGH 7.5 MITIGATE MITIGATE Unauthenticated Arbitrary File Read via Null Byte Injection in DB Electronica Telecomunicazioni S.p.A
• CVE-2025-12683 MEDIUM 5.8 The service employed by Everything, running as SYSTEM, communicates with the lower privileged Everything GUI v
• CVE-2025-66253 CRITICAL 9.8 MITIGATE MITIGATE Unauthenticated OS Command Injection (start_upgrade.php) in DB Electronica Telecomunicazioni S.p.A
• CVE-2025-66261 CRITICAL 9.8 MITIGATE MITIGATE Unauthenticated OS Command Injection (restore_settings.php) in DB Electronica Telecomunicazioni S.p.A
• CVE-2025-66262 CRITICAL 9.8 MITIGATE MITIGATE Arbitrary File Overwrite via Tar Extraction Path Traversal in DB Electronica Telecomunicazioni S.p.A
• CVE-2025-66259 CRITICAL 9.8 MITIGATE MITIGATE Authenticated Root Remote Code Execution via improrer user input filtering in DB Electronica Telecomunicazioni
• CVE-2025-66250 CRITICAL 9.8 MITIGATE MITIGATE Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A
• CVE-2025-66256 CRITICAL 9.8 MITIGATE MITIGATE Unauthenticated Arbitrary File Upload (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A
• CVE-2025-66251 CRITICAL 9.1 MITIGATE MITIGATE Unauthenticated Path Traversal with Arbitrary File Deletion in DB Electronica Telecomunicazioni S.p.A
• CVE-2025-66255 CRITICAL 9.8 MITIGATE MITIGATE Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A
• CVE-2025-66254 CRITICAL 9.1 MITIGATE MITIGATE Unauthenticated Arbitrary File Deletion (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A
• CVE-2025-66257 CRITICAL 9.1 MITIGATE MITIGATE Unauthenticated Arbitrary File Deletion (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A
• CVE-2025-66252 HIGH 7.5 MITIGATE MITIGATE Infinite Loop Denial of Service via Failed File Deletion in DB Electronica Telecomunicazioni S.p.A
• CVE-2025-66260 MEDIUM 6.5 MITIGATE MITIGATE PostgreSQL SQL Injection (status_sql.php) in DB Electronica Telecomunicazioni S.p.A
• CVE-2025-66266 CRITICAL 9.3 The RupsMon.exe service executable in UPSilon 2000 has insecure permissions, allowing the 'Everyone' group Ful
• CVE-2025-66264 HIGH 7.2 The CMService.exe service runs with SYSTEM privileges and contains an unquoted service path
• CVE-2025-66265 MEDIUM 6.9 CMService.exe creates the C:\\usr directory and subdirectories with insecure permissions, granting write acces
• CVE-2025-66269 HIGH 7.1 The RupsMon and USBMate services in UPSilon 2000 run with SYSTEM privileges and contain unquoted service paths
• CVE-2025-14202 HIGH 8.2 A vulnerability in the file upload at bookmark + asset rendering pipeline allows an attacker to upload a malic
• CVE-2026-29128 CRITICAL 10.0 MITIGATE IDC SFX2100 Satellite Receiver firmware ships with multiple daemon configuration files for routing components
• CVE-2026-29127 HIGH 7.8 MITIGATE The IDC SFX2100 Satellite Receiver sets overly permissive file system permissions on the monitor user's home d
• CVE-2026-29126 HIGH 7.8 MITIGATE Incorrect permission assignment (world-writable file) in /etc/udhcpc/default.script in International Data Cast
• CVE-2026-29125 MEDIUM 4.7 MITIGATE IDC SFX2100 Satalite Recievers set the `/etc/resolv.conf` file to be world-writable by any local user, allowin
• CVE-2026-29124 HIGH 7.8 MITIGATE Multiple SUID root-owned binaries are found in /home/monitor/terminal, /home/monitor/kore-terminal, /home/moni
• CVE-2026-29123 HIGH 7.8 MITIGATE A SUID root-owned binary in /home/xd/terminal/XDTerminal in International Data Casting (IDC) SFX2100 on Linux
• CVE-2026-29122 MEDIUM 5.5 MITIGATE International Data Casting (IDC) SFX2100 satellite receiver comes with the `/bin/date` utility installed with
• CVE-2026-29121 HIGH 7.8 MITIGATE International Data Casting (IDC) SFX2100 satellite receiver comes with the `/sbin/ip` utility installed with t
• CVE-2026-29120 HIGH 7.8 MITIGATE The /root/anaconda-ks.cfg installation configuration file in International Datacasting Corporation (IDC) SFX S
• CVE-2026-29119 CRITICAL 9.8 MITIGATE International Datacasting Corporation (IDC) SFX Series SuperFlex(SFX2100) SatelliteReceiver contains hardcoded
• CVE-2026-28778 CRITICAL 9.8 MITIGATE International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver contains undocumented, har
• CVE-2026-28777 CRITICAL 9.8 MITIGATE International Datacasting Corporation (IDC) SFX2100 Satellite Receiver, trivial password for the `user` (usr
• CVE-2026-28776 CRITICAL 9.8 MITIGATE International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver contains hardcoded credenti
• CVE-2026-28775 CRITICAL 9.8 MITIGATE An unauthenticated Remote Code Execution (RCE) vulnerability exists in the SNMP service of International Datac
• CVE-2026-28774 HIGH 8.8 MITIGATE An OS Command Injection vulnerability exists in the web-based Traceroute diagnostic utility of International D
• CVE-2026-28773 HIGH 8.8 MITIGATE The web-based Ping diagnostic utility (/IDC_Ping/main.cgi) in International Datacasting Corporation (IDC) SFX
• CVE-2026-28772 MEDIUM 6.1 MITIGATE A Reflected Cross-Site Scripting (XSS) vulnerability in the /IDC_Logging/index.cgi endpoint of International D
• CVE-2026-28771 MEDIUM 6.1 MITIGATE A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /index.cgi endpoint of International Dataca
• CVE-2026-28770 HIGH 8.8 MITIGATE Improper neutralization of special elements in the /IDC_Logging/checkifdone.cgi script in International Dataca
• CVE-2026-28769 MEDIUM 6.5 MITIGATE A path traversal vulnerability exists in the /IDC_Logging/checkifdone.cgi script in International Datacasting
• CVE-2026-1953 HIGH 8.2 Nukegraphic CMS v3.1.2 contains a stored cross-site scripting (XSS) vulnerability in the user profile edit fun
• CVE-2025-66258 MEDIUM 5.4 MITIGATE MITIGATE Stored Cross-Site Scripting via XML Injection in DB Electronica Telecomunicazioni S.p.A
• CVE-2025-2271 HIGH 7.7 A vulnerability exists in Issuetrak v17.2.2 and prior that allows a low-privileged user to access audit result
• CVE-2025-1023 CRITICAL 9.8 UPGRADE A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries
• CVE-2025-0981 MEDIUM 6.1 UPGRADE A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to hijack a user's session by exp
• CVE-2024-12123 MEDIUM 5.3 A hidden field manipulation vulnerability was identified in Issuetrak version 17.1 that could be triggered by
• CVE-2024-11479 MEDIUM 5.1 A HTML Injection vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenti

← Back to latest CVEs