16461 matches found
PT-2022-27538 · Unknown · Lazy Mouse Server
Name of the Vulnerable Software and Affected Versions: Lazy Mouse server affected versions not specified Description: The issue allows remote unauthenticated users to easily and quickly brute force the PIN and execute arbitrary commands due to weak password requirements and the lack of rate...
Ubuntu: Security Advisory (USN-5718-2)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2022-36964
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands...
SolarWinds Platform code-related vulnerabilities
SolarWinds Platform is a unified monitoring, observability, and service management platform from U.S.-based SolarWinds, Inc. A security vulnerability exists in SolarWinds Platform that stems from vulnerability to deserialization of untrustworthy data and allows a remote attacker with valid access...
CVE-2022-44037
An access control issue in APsystems ENERGY COMMUNICATION UNIT ECU-C Power Control Software V4.1NA, V3.11.4, W2.1NA, V4.1SAA, C1.2.2 allows attackers to access sensitive data and execute specific commands and functions with full admin rights without authenticating allows him to perform multiple...
Event Registration App CSV Injection Vulnerability
Event Registration App is a JavaScript application for registering event participants by Carlo Montero Personal Developer. A CSV injection vulnerability exists in Carlo Montero Event Registration App v1.0, which stems from improper use of the formula elements of the First Name, Contact, and Remar...
WordPress Plugin Betheme them plugin deserialization vulnerability
WordPress is a blogging platform developed in PHP by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress theme is a theme for WordPress. A deserialization vulnerability exists in WordPress Plugin Betheme them plugin 26.5.1.4 and...
D-Link DIR-3060 Buffer Overflow Vulnerability
D-Link DIR-3060 is a router from China Friendship Communications D-Link Inc. It provides a function to connect to the network.The D-Link DIR-3060 DIR3060A1FW111B04.bin version contains a buffer overflow vulnerability, which stems from a boundary error in FUN0049ac18 when handling untrusted input....
Doufox Arbitrary File Upload (CVE-2022-38621)
An arbitrary file upload vulnerability exists in Doufox. Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the vulnerable system with administrative privileges...
D-Link DIR-816 Command Injection (CVE-2022-37130)
A command injection vulnerability exists in D-Link DIR-816. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...
Cross-site Scripting (XSS)
dokuwiki is vulnerable to cross-site scripting. The vulnerability exists via the function generateFilename which allows an attacker to inject and execute arbitrary javascript...
PT-2022-5603 · Aveva · Aveva Edge
Name of the Vulnerable Software and Affected Versions: AVEVA Edge formerly InduSoft Web Studio versions R2020 and prior Description: An issue was discovered in the ExecuteCommand function that allows unauthenticated arbitrary commands to be executed. This is related to errors in access control...
CVE-2022-39070
There is an access control vulnerability in some ZTE PON OLT products. Due to improper access control settings, remote attackers could use the vulnerability to log in to the device and execute any operation...
CVE-2022-3861 Betheme <= 26.5.1.4 - Authenticated (Subscriber+) PHP Object Injection
The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplied via the import, mfn-items-import-page, and mfn-items-import parameters passed through the mfnbuilderimport, mfnbuilderimportpage,...
CVE-2022-45017
A cross-site scripting XSS vulnerability in the Overview Page settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Post Loop field...
CVE-2022-42904
Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings...
CVE-2022-42904
Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings...
PT-2022-36776 · Git +1 · Fluent-Bit
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-use-after-free error, which occurs when the program attempts to access memory that has already been freed. The crash state...
CVE-2022-43192
An arbitrary file upload vulnerability in the component /dede/filemanagecontrol.php of Dedecms v5.7.101 allows attackers to execute arbitrary code via a crafted PHP file. This vulnerability is related to an incomplete fix for CVE-2022-40886...