ASKEY RTF3505VW-N1 Privilege Escalation

Exploit Title: ASKEY RTF3505VW-N1 - Privilege escalation Date: 07-12-2022 Exploit Author: Leonardo Nicolas Servalli Vendor Homepage: www.askey.com Platform: ASKEY router devices RTF3505VW-N1 Tested on: Firmware BRSVg000R3505VMN1001s327 Vulnerability analysis:...

GHSA-7VCX-V65Q-9WPG XML-RPC for PHP's `Wrapper::buildClientWrapperCode` method allows code injection via malicious `$client` argument

In order for this weakness to be exploited, the following conditions have to apply, at the same time: - method Wrapper::buildClientWrapperCode, or any methods which depend on it, such as Wrapper::wrapXmlrpcServer, Wrapper::wrapXmlrpcMethod or Wrapper::buildWrapMethodSource must be in use. Note th...

PT-2022-6584 · D Link · D-Link Dir-2640

Name of the Vulnerable Software and Affected Versions: D-Link DIR-2640 versions affected versions not specified Description: The issue is related to a stack-based buffer overflow in the prog.cgi web management interface of D-Link DIR-2640 routers. This occurs due to improper validation of...

CVE-2021-4266

A vulnerability classified as problematic has been found in Webdetails cpf up to 9.5.0.0-80. Affected is an unknown function of the file core/src/main/java/pt/webdetails/cpf/packager/DependenciesPackage.java. The manipulation of the argument baseUrl leads to cross site scripting. It is possible t...

Cross site scripting

A vulnerability classified as problematic has been found in Webdetails cpf up to 9.5.0.0-80. Affected is an unknown function of the file core/src/main/java/pt/webdetails/cpf/packager/DependenciesPackage.java. The manipulation of the argument baseUrl leads to cross site scripting. It is possible t...

PT-2022-6581 · D Link · D-Link Dir-2640

Name of the Vulnerable Software and Affected Versions: D-Link DIR-2640 versions affected versions not specified Description: This issue allows network-adjacent attackers to bypass authentication on affected D-Link DIR-2640 routers. The flaw exists within the web management interface, which listen...

TP-Link TL-WR940N httpd Use of Insufficiently Random Values Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of TP-Link TL-WR940N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue...

TP-Link TL-WR940N httpd Incorrect Implementation of Authentication Algorithm Information Disclosure Vulnerability

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR940N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default...

The vulnerability of the Lighttpd microprogramming software library in routers from D-LINK models DIR-867, DIR-878, and DIR-882-US allows a hacker to execute arbitrary code.

The vulnerability of the Lighttpd microprogramming software-based router libraries from D-LINK models DIR-867, DIR-878, and DIR-882-US stems from buffer overflows in the stack. Exploiting this vulnerability allows a malicious actor to execute arbitrary code via a specially crafted HTTP request se...

D-Link Multiple Routers lighttpd Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of multiple D-Link routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the lighttpd service, which listens on TCP port 80 by default. The iss...

D-Link DIR-2150 anweb action_handler Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected D-Link DIR-2150 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the anweb service, which listens on TCP ports 80 and 443 by default. The issue results...

The Low Threshold for Face Recognition in New Delhi

Police in India's capital say they only require an 80 percent accuracy rate for matches, raising new alarm bells for civil liberty advocates...

Siemens EN100 Ethernet Module

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: EN100 Ethernet Module Vulnerability: Improper Restriction of Operations within the Bounds of a Memory Buffer. 2. RISK EVALUATION Successful exploitation of this vulnerability could...

Security Bulletin: This Power System update is being released to address CVE 2021-29847

Summary POWER8: In response to a security issue with BMC's configuration, a new Power System firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE 2019-29847. Vulnerability Details CVEID:CVE-2021-29847 DESCRIPTION: BMC firmware configuration changed to...

Server side request forgery in LiveHelperChat

SSRF filter bypass port 80, 433 in LiveHelperChat prior to v3.67. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191...

PT-2022-13717 · Unknown · Livehelperchat

Name of the Vulnerable Software and Affected Versions: LiveHelperChat versions prior to 3.67 Description: The issue allows an attacker to bypass the SSRF filter on ports 80 and 433, making the application perform arbitrary requests. Recommendations: For versions prior to 3.67, update to version...

Backdoor.Win32.Delf.ps Information Disclosure

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/cf3c08afa6c2d49ba36ed0f895893d71.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Delf.ps Vulnerability: Information Disclosure Description: The malware listens on TCP...

PT-2022-4845 · D Link · D-Link Dir-2150

Name of the Vulnerable Software and Affected Versions: D-Link DIR-2150 version 4.0.1 Description: The issue is related to a stack-based buffer overflow in the anweb service of the D-Link DIR-2150 router. This allows a remote attacker to execute arbitrary code on the affected device. The anweb...

Hades RAT Web Panel Information Disclosure Vulnerability

Original source: https://malvuln.com/advisory/c4cc1317aea42f7dd4a1b786c5278a24B.txt Contact: email protected Media: twitter.com/malvuln Threat: Hades RAT - Web Panel Vulnerability: Information Disclosure Description: The Hades Rat web-panel listens on Port 80. There is no authentication check or...

Hades RAT Web Panel Insecure Credential Storage

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/c4cc1317aea42f7dd4a1b786c5278a24.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Hades RAT - Web Panel Vulnerability: Insecure Credential Storage Family: Hades Type: WebUI MD5:...