https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 22:30:22 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-230882 EUVD-2026-230882 https://cve.radiocsirt.org/vuln/euvd-2026-230882 https://cve.radiocsirt.org/vuln/fkie_cve-2022-33944 <p>The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” which accepts arbitrary device IDs.</p> <p>The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” which accepts arbitrary device IDs.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-33944 https://cve.radiocsirt.org/vuln/ghsa-rx38-xpj5-528c <p>The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” which accepts arbitrary device IDs.</p> <p>The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” which accepts arbitrary device IDs.</p> https://cve.radiocsirt.org/vuln/ghsa-rx38-xpj5-528c https://cve.radiocsirt.org/vuln/gsd-2022-33944 gsd-2022-33944 https://cve.radiocsirt.org/vuln/gsd-2022-33944 https://cve.radiocsirt.org/vuln/icsa-22-200-01 <p>The API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner &#39;s mobile number. CVE-2022-2107 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). SMS-based GPS commands can be executed without authentication. CVE-2022-2141 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The main web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a user into making a request. CVE-2022-2199 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). The main web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which accept arbitrary device IDs without further verification. CVE-2022-34150 has been assigned to this vulnerability. A CVSS v3 base score of 7.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). The main web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter Device ID, which accepts arbitrary device IDs. CVE-…</p> <p>The API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner &#39;s mobile number. CVE-2022-2107 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). SMS-based GPS commands can be executed without authentication. CVE-2022-2141 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The main web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a user into making a request. CVE-2022-2199 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). The main web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which accept arbitrary device IDs without further verification. CVE-2022-34150 has been assigned to this vulnerability. A CVSS v3 base score of 7.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). The main web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter Device ID, which accepts arbitrary device IDs. CVE-…</p> https://cve.radiocsirt.org/vuln/icsa-22-200-01