StarWind SAN & NAS 安全漏洞

StarWind SAN & NAS is a standalone hypervisor server or group of servers for StarWind. A security vulnerability exists in StarWind SAN & NAS v0.2 build 1914, which can be exploited by an attacker to cause remote code execution...

CVE-2022-28917

Tenda AX12 v22.03.01.21cn was discovered to contain a stack overflow via the lanIp parameter in /goform/AdvSetLanIp...

USN-5416-1 linux-oem-5.14 vulnerabilities

Qiuhao Li, Gaoning Pan and Yongkang Jia discovered that the KVM implementation in the Linux kernel did not properly perform guest page table updates in some situations. An attacker in a guest vm could possibly use this to crash the host OS. CVE-2022-1158 It was discovered that the implementation ...

CVE-2022-22275

Improper Restriction of TCP Communication Channel in HTTP/S inbound traffic from WAN to DMZ bypassing security policy until TCP handshake potentially resulting in Denial of Service DoS attack if a target host is vulnerable...

CVE-2022-22275

Improper Restriction of TCP Communication Channel in HTTP/S inbound traffic from WAN to DMZ bypassing security policy until TCP handshake potentially resulting in Denial of Service DoS attack if a target host is vulnerable...

The vulnerability of the `mcba_usb_start_xmit` function in Linux kernel allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of mcbausbstartxmit in the Linux kernel’s drivers/net/can/usb/mcbausb.c file is related to a memory reclamation error. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information from a remote location...

The vulnerability of Fortinet FortiWLM, a centralized management system for WLAN access points and LAN switches, arises due to the failure to take measures to eliminate special elements used in the operating system’s command set. This vulnerability allows a perpetrator to execute arbitrary code.

The vulnerability of Fortinet FortiWLM’s WLAN access point and LAN switch management systems exists due to the failure to take measures to neutralize special elements used in the operating system command. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a...

Cisco SD-WAN vManage Software Cross-Site Request Forgery Vulnerability

Cisco SD-WAN vManage Software is a management software for SD-WAN Software Defined Wide Area Network solutions from Cisco, U.S. A cross-site request forgery vulnerability exists in Cisco SD-WAN vManage Software, which can be exploited by attackers to perform arbitrary actions at the affected user...

Zyxel VMG3312-T20A 操作系统命令注入漏洞

The Zyxel VMG3312-T20A is a state-of-the-art VDSL2 gateway from China's Hopkins Technology Zyxel. A security vulnerability exists in the Zyxel VMG3312-T20A version 5.30ABFX.5C0, which originates from a command injection vulnerability in the CGI program. An authenticated attacker could execute...

CVE-2022-23972

ASUS RT-AX56U’s SQL handling function has an SQL injection vulnerability due to insufficient user input validation. An unauthenticated LAN attacker to inject arbitrary SQL code to read, modify and delete database...

CVE-2022-25597

ASUS RT-AC86U’s LPD service has insufficient filtering for special characters in the user request, which allows an unauthenticated LAN attacker to perform command injection attack, execute arbitrary commands and disrupt or terminate service...

CVE-2022-25596

ASUS RT-AC56U’s configuration function has a heap-based buffer overflow vulnerability due to insufficient validation for the decryption parameter length, which allows an unauthenticated LAN attacker to execute arbitrary code, perform arbitrary operations and disrupt service...

CVE-2022-26670

D-Link DIR-878 has inadequate filtering for special characters in the webpage input field. An unauthenticated LAN attacker can perform command injection attack to execute arbitrary system commands to control the system or disrupt service...

CVE-2022-26269

Suzuki Connect v1.0.15 allows attackers to tamper with displayed messages via spoofed CAN messages...

Suzuki Connect 安全漏洞

Suzuki Connect is a web-based solution from Suzuki Japan. It is used to obtain vehicle information such as fuel, ignition status, current position, seat buckle status, and more. A security vulnerability exists in Suzuki Connect v1.0.15 that allows an attacker to tamper with displayed messages by...

WEKA INTEREST Security Scanner 安全漏洞

WEKA INTEREST Security Scanner is a commonly used software for data exploration by the University of Waikato team in New Zealand. A security vulnerability exists in WEKA INTEREST Security Scanner version 1.8 LAN Viewer, which results in a denial of service when unknown input is used in certain...

CVE-2022-27082

Tenda M3 1.10 V1.0.0.124856 was discovered to contain a command injection vulnerability via the component /goform/SetInternetLanInfo...

The vulnerability of the NT Lan Manager Datagram Receiver Driver of the Microsoft Windows operating system allows a hacker to disclose protected information.

The vulnerability of the NT Lan Manager Datagram Receiver Driver of the Microsoft Windows operating system is related to the disclosure of information. Exploiting this vulnerability can allow an attacker to disclose protected information...

CVE-2022-26999

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the static ip settings function via the wanipstat, wanmaskstat, wangwstat, and wandns1stat parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

.A flaw was found in the CAN BCM networking protocol in the Linux kernel where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root.

...