Command injection

Multiple command injection vulnerabilities exist in the webserver ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The /ajax/remove/ API...

Command injection

Multiple command injection vulnerabilities exist in the webserver action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The...

CVE-2022-33327

Multiple command injection vulnerabilities exist in the webserver ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The...

CVE-2022-33326

The CVE-2022-33326 family affects Robustel R1510 (3.3.0) Web UI endpoints. The root cause is unsafe command execution via system()-style calls in multiple /ajax/* endpoints (eg /ajax/config_rollback/, /ajax/clear_tools_log/, /ajax/remove_sniffer_raw_log/, /ajax/remove/, /ajax/set_sys_time/) where...

CVE-2022-33314

CVE-2022-33314 concerns Robustel R1510 web server command injection vulnerabilities. Talos/Cisco reports describe multiple unsanitized user inputs reaching endpoints under /action/ that allow OS command execution via unsafe formatting and system() usage. Root cause involves unsafe handling in cod...

CVE-2022-32585

A command execution vulnerability exists in the clish art2 functionality of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability...

WordPress Easy SVG Support plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. cross-site scripting vulnerability exists in versions prior to WordPress Easy SVG Support plugin 3.3....

Robustel R1510 web_server /action/remove/ API data removal vulnerability

Summary A data removal vulnerability exists in the webserver /action/remove/ API functionality of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary file deletion. An attacker can send a sequence of requests to trigger this vulnerability. Tested Versions Robustel R151...

CVE-2022-1964

The Easy SVG Support WordPress plugin before 3.3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

WordPress plugin Easy SVG Support 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. cross-site scripting vulnerability exists in versions prior to WordPress Easy SVG Support plugin 3.3....

Pure Storage FlashArray 和 FlashBlade 安全漏洞

Pure Storage FlashArray and Pure Storage FlashBlade are both products of Pure Storage, Inc. the Pure Storage FlashArray is an all QLC flash storage array. the Pure Storage FlashBlade is a consolidated storage platform for file and object Pure Storage FlashBlade is a consolidated storage platform...

ai.starlake:starlake-spark2_2.11 (>=0.2.7 <=0.2.8), ai.starlake:starlake-spark3_2.12 (>=0.2.7 <=0.2.10) +83 more potentially affected by CVE-2021-33036 via org.apache.hadoop:hadoop-yarn-server-common (>=3.3.0 <=3.3.1)

org.apache.hadoop:hadoop-yarn-server-common MAVEN version =3.3.0, =0.2.7, =0.2.7, =0.1.30, =0.1.30, =0.1.28, =0.9.0, =2.8.2, =2.8.2, =304, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.3.1 and more Source cves: CVE-2021-33036 Source advisory: OSV:GHSA-58JX-F5RF-QGQF...

ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6 <=1.2.10), ai.catboost:catboost-spark_3.2_2.13 (>=1.0.6 <=1.2.10) +590 more potentially affected by CVE-2021-37404 via org.apache.hadoop:hadoop-common (>=3.3.0 <=3.3.1)

org.apache.hadoop:hadoop-common MAVEN version =3.3.0, =1.0.6, =1.0.6, =0.13.0, =0.2.7, =0.2.7, =0.6.1.2, =1.0.0, =1.0.0, =0.2.2, =1.0.0, =1.0.0, =0.2.2, =0.8.0, =0.8.0, =0.8.5 and more Source cves: CVE-2021-37404 Source advisory: OSV:GHSA-RMPJ-7C96-MRG8...

CVE-2022-30425

Tenda Technology Co.,Ltd HG6 3.3.0-210926 was discovered to contain a command injection vulnerability via the pingAddr and traceAddr parameters. This vulnerability is exploited via a crafted POST request...

CVE-2022-30425

Affected product : Tenda HG6 router (firmware/software version 3.3.0-210926, HG6). Vulnerability : OS command injection via HTTP POST parameters in the formPing/formPing6 and formTracert/formTracert6, exploiting unfiltered input in the pingAddr and traceAddr fields. Root cause : failure to proper...

UBUNTU-CVE-2022-29021

A buffer overflow vulnerability exists in the razerkbd driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Service DoS and possibly escalate their privileges via a crafted buffer sent to the matrixcustomframe device...

PT-2022-19371 · Openrazer +1 · Openrazer +1

Name of the Vulnerable Software and Affected Versions: OpenRazer versions prior to v3.3.0 Description: A buffer overflow issue exists in the razermouse driver, allowing attackers to cause a Denial of Service DoS and possibly escalate their privileges via a crafted buffer sent to the matrix custom...

OpenRazer安全漏洞

OpenRazer is an open source driver and userspace daemon. It is used to control Razer lighting and other features on GNU/Linux. A security vulnerability exists in OpenRazer version 3.3.0 and prior versions, which originates from a buffer overflow in the razermouse driver. An attacker could exploit...

PT-2022-19369 · Openrazer +1 · Openrazer +1

Name of the Vulnerable Software and Affected Versions: OpenRazer versions up to v3.3.0 Description: A buffer overflow issue exists in the razerkbd driver, allowing attackers to cause a Denial of Service DoS and possibly escalate their privileges via a crafted buffer sent to the "matrix custom...

SQL Injection

Overview web-tp3/wecmap is a WEC Google Maps. Affected versions of this package are vulnerable to SQL Injection through unspecified vectors. An attacker can execute arbitrary SQL commands by injecting malicious SQL code. Remediation Upgrade web-tp3/wecmap to version 3.3.0 or higher. References -...