423 matches found
PT-2023-16404 · Trendnet · Trendnet Tew-652Brp
Name of the Vulnerable Software and Affected Versions: TRENDnet TEW-652BRP version 3.04B01 Description: A critical issue affects the Web Service component, specifically the file cfg op.ccp, leading to memory corruption through remote attack. The manipulation can be initiated remotely...
Malicious code in yandex-cfg-env (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84d83751dd94336617da93fa09ccd8505ecd47f4cbc9ef2dc4d9ea70068c82dc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-983 Malicious code in yandex-cfg-env (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84d83751dd94336617da93fa09ccd8505ecd47f4cbc9ef2dc4d9ea70068c82dc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview yandex-cfg-env is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package wa...
TOTOLINK A7100RU 操作系统命令注入漏洞
The TOTOLINK A7100RU is a wireless router from China's Gion Electronics TOTOLINK. An operating system command injection vulnerability exists in the TOTOlink A7100RU V7.4cu.2313B20191024 version, which stems from a command injection issue contained in the FileName parameter of the...
ASUS RT-AX82U 缓冲区错误漏洞
The ASUS RT-AX82U is a wireless router from the Chinese company ASUS. A denial of service vulnerability exists in ASUS RT-AX82U version 3.0.0.4.38649674-ge182230, which stems from improper input validation of the cfgserver cmprocessConnDiagPktList opcode of the router configuration service, which...
nieuwestadsboeren.nl Cross Site Scripting vulnerability OBB-3115598
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CLSA-2022-1669390018 grub2: Fix of 7 CVEs
CVE-2021-3981: Fix default privileges of grub.cfg file - CVE-2022-28736: Fix use-after-free bug when grubcmdchainloader is executed more than once before a boot attempt is performed. - CVE-2021-3695: Drop greyscale support to fix heap out-of-bounds write - CVE-2021-3696: Fix out of range...
TOTOLINK LR350 setOpModeCfg function buffer overflow vulnerability
TOTOLINK LR350 is a 4G LTE router from China's Gion Electronics TOTOLINK that supports converting 4G signals to wired signals for home and office scenarios. A buffer overflow vulnerability exists in the TOTOLINK LR350. The vulnerability stems from a buffer overflow after authentication via the...
CVE-2022-41775
SQL Injection in HandlerCFG.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network...
Backdoor.Win32.Aphexdoor.LiteSock MVID-2022-0653 Buffer Overflow
Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/2047ac6183da4dfb61d2562721ba0720.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Aphexdoor.LiteSock Vulnerability: Remote Stack Buffer Overflow SEH...
IP-COM EW9 信息泄露漏洞
The IP-COM EW9 is a wireless router from IP-COM. A security vulnerability exists in the IP-COM EW9 version V15.11.0.149732, which originated from a vulnerability that allows an unauthenticated attacker to access sensitive information via the checkLoginUser, ate, telnet, version, setDebugCfg, and...
PT-2022-26874 · Ip Com · Ip-Com Ew9
Name of the Vulnerable Software and Affected Versions: IP-COM EW9 version 15.11.0.149732 Description: The issue allows unauthenticated attackers to access sensitive information. This is achieved via several interfaces, including "checkLoginUser", "ate", "telnet", "version", "setDebugCfg", and...
CVE-2022-43027
Tenda TX3 USTX3V1.0brV16.03.13.11multiTDE01 was discovered to contain a stack overflow via the firewallEn parameter at /goform/SetFirewallCfg...
CVE-2022-43026
Tenda TX3 USTX3V1.0brV16.03.13.11multiTDE01 was discovered to contain a stack overflow via the endIp parameter at /goform/SetPptpServerCfg...
CVE-2022-41517
TOTOLINK NR1800X V9.1.0u.6279B20210910 was discovered to contain a stack overflow in the lang parameter in the setLanguageCfg function...
PT-2022-25912 · Totolink · Totolink Nr1800X
Name of the Vulnerable Software and Affected Versions: TOTOLINK NR1800X version 9.1.0u.6279 B20210910 Description: A command injection issue was found via the OpModeCfg function at the "/cgi-bin/cstecgi.cgi" API endpoint. This allows for potential command injection attacks. Recommendations: For...
PT-2022-36659 · Git +1 · Haproxy
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 1 crash has been reported. The crash occurs in the parse line function, which is called by readcfgfile in the fuzz cfg parser...
The vulnerability of the cfg_tilde_expand() function in the configuration file parser library libConfuse, which allows a hacker to trigger a service failure.
The vulnerability of the cfgtildeexpand function in the libConfuse configuration file parser library is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures through a specially created file...