590 matches found
PT-2026-5668
An unauthenticated remote attacker can gain full access on the affected devices as they are shipped without a password by default and setting one is not enforced...
CVE-2025-14231
Buffer overflow in print job processing by WSD on Small Office Multifunction Printers and Laser Printers which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. : Satera LBP670C Series/Satera MF750C Series firmware v06.02...
CVE-2022-31793
dorequest in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and...
CVE-2020-10974
An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the administrator password. No authentication is required. Affected devices: Wavlink WN575A3, Wavlink WN579G3, Wavlink WN531A6, Wavlink WN535G3,...
CVE-2020-10971
An issue was discovered on Wavlink Jetstream devices where a crafted POST request can be sent to adm.cgi that will result in the execution of the supplied command if there is an active session at the same time. The POST request itself is not validated to ensure it came from the active session...
CVE-2019-20732
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6220 before 1.0.0.40, D7000v2 before 1.0.0.74, D8500 before 1.0.3.39, DGN2200v4 before 1.0.0.102, DGND2200Bv4 before 1.0.0.102, EX3700 before 1.0.0.70, EX3800 before 1.0.0.70, EX6000 before 1.0.0.30,...
CVE-2022-31765
Affected devices do not properly authorize the change password function of the web interface. This could allow low privileged users to escalate their privileges...
CVE-2017-18763
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects JNR1010v2 before 1.1.0.42, JR6150 before 1.0.1.10, JWNR2010v5 before 1.1.0.42, PR2000 before 1.0.0.18, R6050 before 1.0.1.10, R6120 before 1.0.0.30, R6220 before 1.1.0.50, R6700v2 before 1.2.0.4,...
Malicious code in react-native-kyc (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3d1ae391e8ec2bcc50f5d507ae3566a122058f2d3aa4227b5abf64ecc43990a The package react-native-kyc was found to contain malicious code. Source: ghsa-malware b07a2ced47f073e338b59c9aed3d551f9e8acbbe7c1e02102b7a9c8fb37250...
PT-2026-1528
Name of the Vulnerable Software and Affected Versions versions prior to 2025 Description A memory corruption issue exists when handling buffer mapping operations within the cryptographic driver. The issue involves a flaw in how the driver manages memory, potentially leading to crashes or unexpect...
CVE-2025-59374
"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that...
CVE-2025-59374
The CVE-2025-59374 entry describes a supply-chain compromise in ASUS Live Update, where unauthorized modifications were distributed in several historical builds. Affected versions include ASUS Live Update prior to 3.6.8 and versions 3.6.8–3.6.15, with End-of-Support reached in October 2021. The v...
VulnCheck KEV: CVE-2025-59374
ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. The impacted produc...
CVE-2025-34330
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component F2MAdmin that exposes an unauthenticated prompt upload endpoint at AudioCodesfiles/utils/IVR/diagram/ajaxPromptUploadFile.php. The script accepts an uploaded file and...
EUVD-2025-197984
An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices...
CVE-2025-41734
An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices...
CVE-2025-40815
A vulnerability has been identified in LOGO! 12/24RCE 6ED1052-1MD08-0BA2 All versions V1.84.05, LOGO! 12/24RCEo 6ED1052-2MD08-0BA2 All versions V1.84.05, LOGO! 230RCE 6ED1052-1FB08-0BA2 All versions V1.84.05, LOGO! 230RCEo 6ED1052-2FB08-0BA2 All versions V1.84.05, LOGO! 24CE 6ED1052-1CC08-0BA2 Al...
PT-2025-46557
Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 24.09.03 Description A critical unrestricted file upload issue exists in Apache OFBiz. This allows remote attackers to upload arbitrary files, potentially including malicious scripts, leading to remote command...
PT-2025-46480
Name of the Vulnerable Software and Affected Versions Windows Ancillary Function Driver for WinSock affected versions not specified Description An untrusted pointer dereference in the Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. A...