CVE-2022-23773

cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags...

CVE-2022-23773

CVE-2022-23773 affects the Go toolchain component cmd/go. Impact: branch names may be misinterpreted as version tags, potentially granting inappropriate access to create branches but not tags. Affected: Go before 1.16.14 and 1.17.x before 1.17.7. Mitigation: upgrade to fixed releases (Go 1.16.14+...

CVE-2022-23773

cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags...

CVE-2022-23773

cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags...

CVE-2022-23773

cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags...

GHSA-4V9W-PVWR-38H3 OS Command Injection in strong-nginx-controller

strong-nginx-controller through 1.0.2 is vulnerable to Command Injection. It allows execution of arbitrary command as part of the 'nginxCmd' function...

go -- multiple vulnerabilities

The Go project reports: crypto/elliptic: fix IsOnCurve for big.Int values that are not valid coordinates Some big.Int values that are not valid field elements negative or overflowing might cause Curve.IsOnCurve to incorrectly return true. Operating on those values may cause a panic or an invalid...

CVE-2021-46354

Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the web server or increas...

CVE-2021-46354

Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the web server or increas...

CVE-2021-46354

Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the web server or increas...

CVE-2021-46354

CVE-2021-46354 affects Thinfinity VirtualUI versions 2.1.28.0, 2.1.32.1, and 2.5.26.2; fixed in 3.0. The vulnerability is an information disclosure caused by the Addr parameter in the cmd site, enabling the vulnerable server to send requests to external systems and potentially reveal the real IP ...

Cybele Software Thinfinity VirtualUI 信息泄露漏洞

Cybele Software Thinfinity VirtualUI is a solution from Cybele Software, Inc. that supports embedding remote Windows applications into standard web applications to allow two-way interaction with Javascript programming. Cybele Software Thinfinity VirtualUI suffers from an information disclosure...

CVE-2021-46233

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function mspinfo.htm. This vulnerability allows attackers to execute arbitrary commands via the cmd parameter...

CVE-2021-46233

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function mspinfo.htm. This vulnerability allows attackers to execute arbitrary commands via the cmd parameter...

CVE-2021-46233

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function mspinfo.htm. This vulnerability allows attackers to execute arbitrary commands via the cmd parameter...

Null pointer dereference

There is a NULL pointer deference in the Allwinner R818 SoC Android Q SDK V1.0 camera driver /dev/cedardev that could use the ioctl cmd IOCTLGETIOMMUADDR to cause a system crash...

CVE-2021-38785

There is a NULL pointer deference in the Allwinner R818 SoC Android Q SDK V1.0 camera driver /dev/cedardev that could use the ioctl cmd IOCTLGETIOMMUADDR to cause a system crash...

CVE-2021-38785

CVE-2021-38785 describes a NULL pointer dereference in the Allwinner R818 SoC Android Q SDK V1.0 camera driver /dev/cedar_dev. The issue can be triggered by the IOCTL_GET_IOMMU_ADDR ioctl, leading to a system crash. The available documents identify the affected component and the crash impact but ...

CVE-2021-38783

CVE-2021-38783 affects the Allwinner R818 SoC Android Q SDK V1.0 camera driver, exposing /dev/cedar_dev to iotcl IOCTL_SET_PROC_INFO and IOCTL_COPY_PROC_INFO. The root cause is an out-of-bounds write in the driver, which can cause a system crash or privilege escalation. Provided documents do not ...

The vulnerability of the WEB_CmdFileList() function implementation in D-Link DAP-2020 wireless access points allows a intruder to execute arbitrary code.

The vulnerability of the WEBCmdFileList function implementation in D-Link DAP-2020 wireless access points relates to the lack of measures taken to neutralize special elements used in operating system commands when processing CGI scripts. Exploiting this vulnerability can allow an attacker to...