CVE-2022-38119

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

UPSMON Pro login function has insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and get administrator privilege to access, control system or disrupt service.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Nov 10, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-38126.5A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. Affected by this issue is the function AP4_ContainerAtom::ACVE-2022-381206.5UPSMON PRO’s has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to bypass authCVE-2022-381216.5UPSMON PRO configuration file stores user password in plaintext under public user directory. A remote attacker with general user privilege cCVE-2022-381227.5UPSMON PRO transmits sensitive data in cleartext over HTTP protocol. An unauthenticated remote attacker can exploit this vulnerability to acCVE-2022-381237.2Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code intCVE-2022-381246.5Debug tool in Secomea SiteManager allows logged-in administrator to modify system state in an unintended manner.CVE-2022-381255.5Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Secomea SiteManager (FTP Agent modules) allows ExploitiCVE-2022-381299.8A path traversal vulnerability exists in the com.keysight.tentacle.licensing.LicenseManager.addLicenseFile() method in the Keysight Sensor MCVE-2022-38136.5A vulnerability classified as problematic has been found in Axiomatic Bento4. This affects an unknown part of the component mp4edit. The manCVE-2022-381309.8The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip() method is used to restore the HSQLDB database used in SMS. It takesCVE-2022-381316.1RStudio Connect prior to 2023.01.0 is affected by an Open Redirect issue. The vulnerability could allow an attacker to redirect users to malCVE-2022-381328.8Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacke