PT-2021-10716 · Unknown · Homeautomation

Name of the Vulnerable Software and Affected Versions: HomeAutomation version 3.3.2 Description: The issue allows for an authentication bypass when the X-Forwarded-For header is spoofed with the local IP address, enabling remote control of the smart home solution. Recommendations: For...

Subreddit Home Automation 跨站脚本漏洞

Subreddit Home Automation is an automation device for the Subreddit community. An automated electric light. Subreddit Home Automation 3.3.2 suffers from a cross-site scripting vulnerability that stems from an XSS vulnerability when input passed to multiple scripts via multiple parameters is not...

Subreddit Home Automation 操作系统命令注入漏洞

Subreddit Home Automation is an automation device for the Subreddit community. An automated electric light. A security vulnerability exists in Subreddit Home Automation 3.3.2, which stems from authenticated OS command execution in the custom command v0.1 plugin...

Updated python-cryptography package fixes a security vulnerability

In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow CVE-2020-36242...

Endian Firewall Community Operating System Command Injection Vulnerability

Endian Firewall Community is a firewall for the Endian community in the UK. It provides network protection. An operating system command injection vulnerability exists in Endian Firewall Community 3.3.2, which allows remote authenticated users to execute arbitrary operating system commands...

GHSA-RHM9-P9W5-FWM7 PyCA Cryptography symmetrically encrypting large values can lead to integer overflow

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. When certain sequences of update calls with large values multiple GBs for symetric encryption or decryption occur, it's possible for an integer overflow to happen, leading to mishandling of...

CVE-2020-4000

The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 allows for executing files through directory traversal. An authenticated SD-WAN Orchestrator user is able to traversal directories which may lead to code execution of files...

Helm Cross-Site Scripting Vulnerability

helm is a Kubernetes package manager. A security vulnerability exists in Helm versions prior to 2.16.11 and 3.3.2, which can be exploited by an attacker to launch a local attack...

PT-2020-14257 · Helm +2 · Helm +2

Name of the Vulnerable Software and Affected Versions: Helm versions prior to 2.16.11 Helm versions prior to 3.3.2 Description: The issue arises from improper sanitization of plugin names, allowing a malicious plugin author to use characters that could result in unexpected behavior. This could...

PT-2020-14255 · Helm +2 · Helm +2

Name of the Vulnerable Software and Affected Versions: Helm versions prior to 2.16.11 Helm versions prior to 3.3.2 Description: The issue is related to the alias field on a Chart.yaml not being properly sanitized, which could lead to the injection of unwanted information into a chart. This was...

Chartkick Injection Vulnerability

Chartkick is a package for creating JavaScript icons. An injection vulnerability exists in Chartkick gem 3.3.2 and earlier versions Ruby. The vulnerability stems from a lack of proper validation of user input data by a networked system or product that does not filter, or does not correctly filter...

VulnCheck KEV: CVE-2020-36875

AccessAlly WordPress plugin versions prior to 3.3.2 contain an unauthenticated arbitrary PHP code execution vulnerability in the Login Widget. The plugin processes the loginerror parameter as PHP code, allowing an attacker to supply and execute arbitrary PHP in the context of the WordPress web...

WordPress AccessAlly plugin <= 3.3.1 - Arbitrary PHP Execution vulnerability

Arbitrary PHP Execution vulnerability found by Brad Patton in WordPress AccessAlly plugin versions = 3.3.1. Solution Update the WordPress AccessAlly plugin to the latest available version at least 3.3.2...

HomeAutomation 3.3.2 - Cross-Site Request Forgery (Add Admin) Vulnerability

Exploit for php platform in category web applications Exploit: HomeAutomation 3.3.2 - Cross-Site Request Forgery Add Admin Author: LiquidWorm Vendor: Tom Rosenback and Daniel Malmgren Product web page: http://karpero.mine.nu/ha/ Affected version: 3.3.2 Tested on: Apache/2.4.41 centos...

CVE-2019-5152

An exploitable information disclosure vulnerability exists in the network packet handling functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream Cipher, a specially crafted set of network packets can cause an outbound connection from the server, resulting in information disclosure. An...

Shadowsocks-libev Access Control Error Vulnerability

Shadowsocks-libev is a lightweight secure SOCKS5 agent for embedded devices. An Access Control Error vulnerability exists in the UDPRelay feature in Shadowsocks-libev version 3.3.2. The vulnerability stems from a network system or product not properly restricting access to resources from...

UBUNTU-CVE-2019-5164

An exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev 3.3.2. Specially crafted network packets sent to ss-manager can cause an arbitrary binary to run, resulting in code execution and privilege escalation. An attacker can send network packets to trigger...

Shadowsocks-libev Access Control Error Vulnerability (CNVD-2020-00259)

Shadowsocks-libev is a lightweight secure SOCKS5 agent for embedded devices. An access control error vulnerability exists in the ss-manager binary in Shadowsocks-libev version 3.3.2, which can be exploited by an attacker to elevate privileges and execute arbitrary code...

Shadowsocks-libev Information Disclosure Vulnerability

Shadowsocks-libev is a lightweight secure SOCKS5 agent for embedded devices. An information disclosure vulnerability exists in the network packet handling feature in Shadowsocks-libev version 3.3.2, which can be exploited by an attacker to disclose information with the help of specially crafted...

libarchive security and bug fix update

3.3.2-7 - fix use-after-free in delayed newc link processing 1602575 - fix a few obvious resource leaks and strcpy misuses 1602575 3.3.2-6 - fixed use after free in RAR decoder 1700752 - fixed double free in RAR decoder 1700753 3.3.2-5 - release bump due to gating 1680768 3.3.2-4 - fix...