CVE Database and Vulnerability Search
Search CVE and GHSA vulnerability records by identifier, title, vendor, product, package, or CWE. Filter by severity, CISA KEV, ransomware association, linked artifacts, and Nuclei templates; sort by publication date, CVSS, or EPSS.
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2014-8356HIGH | dasanzhone znid_2426a_firmware Authorization Bypass Through User-Controlled KeyThe web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated users to bypass intended access restrictions via a modified server response, related to an insecure direct object reference. CWE-639Nov 21, 2019 | CVSS8.8v3.1 | EPSS5.64% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2014-9118HIGH | dasanzhone znid_2426a_firmware Improper Neutralization of Special Elements used in a Command ('Command Injection')The web administrative portal in Zhone zNID GPON 2426A before S3.0.501 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddr parameter to zhnping.cmd. CWE-77Oct 17, 2017 | CVSS8.8v3.0 | EPSS53.4% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2014-8357HIGH | Zhone zNID GPON 2426A backupsettings.html Vulnerabilitybackupsettings.html in the web administrative portal in Zhone zNID GPON 2426A before S3.0.501 places a session key in a URL, which allows remote attackers to obtain arbitrary user passwords via the sessionKey parameter in a getConfig action to backupsettings.conf. CWE-255Oct 17, 2017 | CVSS8.8v3.0 | EPSS5.44% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |