CVE-2022-30272

The ACE1000 RTU (Motorola Solutions) is affected by CVE-2022-30272. Firmware updates performed via ACE1000 Easy Configurator (Web UI) or via SSH for the FEP module lack authentication and rely on insecure checksums for integrity checks, enabling potential manipulation of firmware images. This cou...

CVE-2022-30272: Insufficient Verification of Data Authenticity

The Motorola ACE1000 RTU through 2022-05-02 mishandles firmware integrity. It utilizes either the STS software suite or ACE1000 Easy Configurator for performing firmware updates. In case of the Easy Configurator, firmware updates are performed through access to the Web UI where file system, kerne...

WordPress WooCommerce plugin arbitrary file deletion vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress WooCommerce plugin versions prior to 1.2.32 are vulnerable to arbitrary file deletion, which stems...

ZyXel AP Configurator Incorrect Permission Assignment Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of ZyXel AP Configurator. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the installer...

Motorola Solutions ACE1000 数据伪造问题漏洞

The Motorola Solutions ACE1000 is a remote terminal unit from Motorola Solutions USA. A data forgery vulnerability exists in the Motorola Solutions ACE1000 version that originates from allowing custom applications to be installed via the STS software, the C Toolkit, or the ACE1000 Easy...

CVE-2022-1953

The Product Configurator for WooCommerce WordPress plugin before 1.2.32 suffers from an arbitrary file deletion vulnerability via an AJAX action, accessible to unauthenticated users, which accepts user input that is being used in a path and passed to unlink without validation first...

CVE-2022-1953

The Product Configurator for WooCommerce WordPress plugin before 1.2.32 suffers from an arbitrary file deletion vulnerability via an AJAX action, accessible to unauthenticated users, which accepts user input that is being used in a path and passed to unlink without validation first...

CVE-2022-1953

The CVE-2022-1953 entry concerns the WordPress Product Configurator for WooCommerce plugin prior to version 1.2.32. The vulnerability is an arbitrary file deletion via an unauthenticated AJAX action that accepts user input used in a filesystem path and passed to unlink() without validation. This ...

PT-2022-14213

Name of the Vulnerable Software and Affected Versions Product Configurator for WooCommerce WordPress plugin versions prior to 1.2.32 Description The issue allows unauthenticated users to delete arbitrary files via an AJAX action. This is possible because the AJAX action accepts user input that is...

CVE-2022-1953: Improper Limitation of a Pathname to a Restricted Directory

The Product Configurator for WooCommerce WordPress plugin before 1.2.32 suffers from an arbitrary file deletion vulnerability via an AJAX action, accessible to unauthenticated users, which accepts user input that is being used in a path and passed to unlink without validation first...

CVE-2022-0556

A local privilege escalation vulnerability caused by incorrect permission assignment in some directories of the Zyxel AP Configurator ZAC version 1.1.4, which could allow an attacker to execute arbitrary code as a local administrator...

Privilege escalation

A local privilege escalation vulnerability caused by incorrect permission assignment in some directories of the Zyxel AP Configurator ZAC version 1.1.4, which could allow an attacker to execute arbitrary code as a local administrator...

CVE-2022-0556

CVE-2022-0556 describes a local privilege escalation in Zyxel AP Configurator (ZAC) version 1.1.4 caused by incorrect permission assignment in some directories. This allows an attacker to execute arbitrary code as a local administrator. Connected advisories (e.g., ZDI, PT-2022-13258) indicate a r...

PT-2022-13258 · Zyxel · Zyxel Ap Configurator

Name of the Vulnerable Software and Affected Versions: Zyxel AP Configurator version 1.1.4 Description: A local privilege escalation issue is caused by incorrect permission assignment in some directories of the Zyxel AP Configurator, which could allow an attacker to execute arbitrary code as a...

Zyxel AP Configurator 安全漏洞

The Zyxel AP Configurator ZAC is an AP Configurator from China-based Hopkins Technology Zyxel. It enables resellers to complete the process of configuring multiple APs as well as future maintenance of standalone APs. A security vulnerability exists in Zyxel AP Configurator ZAC version 1.1.4, whic...

CVE-2022-0556: Improper Privilege Management

A local privilege escalation vulnerability caused by incorrect permission assignment in some directories of the Zyxel AP Configurator ZAC version 1.1.4, which could allow an attacker to execute arbitrary code as a local administrator...

The vulnerability of the UI Servlet component of the Oracle Configurator allows a attacker to gain access to read, modify, add, or delete data.

The vulnerability of the UI Servlet component of the Oracle Configurator relates to insufficient validation of input data. Exploiting this vulnerability may allow an attacker to gain access to read, modify, add, or delete data using the HTTP protocol over the network...

Oracle E-Business Suite (Jan 2022 CPU)

The versions of Oracle E-Business Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2022 CPU advisory. - Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite component: Intelligence, RFx Creation. Supported versions that ar...

CVE-2022-21255

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite component: UI Servlet. Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Configurator. Successful...

CVE-2022-21255

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite component: UI Servlet. Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Configurator. Successful...