V-SOL G/EPON ONU HG323AC-B 安全漏洞

The V-SOL G/EPON ONU HG323AC-B is a dual-band EasyMesh router from China's CoreTech V-SOL. A security vulnerability exists in the V-SOL G/EPON ONU HG323AC-B version V2.0.08-210715. An attacker can exploit the vulnerability to execute arbitrary code and obtain sensitive information via a specially...

The vulnerability of the formSetAutoPing function in the Tenda i21 router microprogramming software allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formSetAutoPing function in Tenda i21 router microprogramming software is related to buffer overflows in the stack when processing the ping1/ping2 parameter. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and...

PuneethReddyHC Event Management 安全漏洞

PuneethReddyHC Event Management is an application by Puneeth Reddy H C Individual Developer. Helps users to register for events organized in university festivals with simple logic and security. A security vulnerability exists in PuneethReddyHC Event Management version 1.0, which stems from the...

Remote Code Execution (RCE)

bentoML is vulnerable to an Remote Code Execution RCE. The vulnerability is due to missing media type checks when handling serialized objects, resulting remote code execution through crafted POST requests containing pickled objects...

FileCatalyst Workflow Web Portal Security Vulnerability

FileCatalyst Workflow Web Portal is a Web-based application from FileCatalyst, Inc. A security vulnerability exists in FileCatalyst Workflow Web Portal prior to 5.1.6 Build 114 that stems from the presence of a path traversal vulnerability. An attacker could use this vulnerability to upload files...

The vulnerability of the syncNtpTime() function in the SystemHandler.class.php script of the software for backup and recovery, Vinchin Backup & Recovery, allows a perpetrator to execute arbitrary commands.

The vulnerability of the syncNtpTime function in the SystemHandler.class.php script of the software for backup and recovery solutions, Vinchin Backup & Recovery, is related to the failure to eliminate special elements used in the operating system’s command processing when handling the ntphost...

USN-6613-1 ceph vulnerability

Lucas Henry discovered that Ceph incorrectly handled specially crafted POST requests. An uprivileged user could use this to bypass Ceph's authorization checks and upload a file to any bucket...

The vulnerability of the microprogrammed software of Advantech EKI-1524, EKI-1522, and EKI-1521 allows a perpetrator to execute arbitrary codes.

The vulnerability of microprogrammed software in Advantech EKI-1524, EKI-1522, and EKI-1521 industrial switches lies in the ability to write code outside the buffer memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending specially crafted POST requests...

The vulnerability of the `show_zysync_server_contents` function in the network storage software Zyxel NAS326 and NAS542 allows a hacker to execute arbitrary code.

The vulnerability of the showzysyncservercontents function in Zyxel NAS326 and NAS542 software exists because measures to neutralize special elements used in operating system commands have not been taken. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending...

The vulnerability of the runscript script of the SCADA/HMI process visualization platform FUXA allows a perpetrator to execute arbitrary code.

The vulnerability of the runscript script of the SCADA/HMI process visualization platform FUXA is related to the failure to take measures for cleaning input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted POST request...

The vulnerability of microprogrammed software in web panels for controlling and monitoring processes in industrial systems from PHOENIX CONTACTs WP 6xxx exists due to the lack of measures taken to neutralize special elements used in the operating system command set. This vulnerability allows a perpetrator to execute arbitrary code.

The vulnerability of microprogrammed software in web panels for controlling and monitoring processes in industrial systems exists due to the lack of measures taken to neutralize special elements used in the operating system command. Exploiting this vulnerability allows a malicious actor to execut...

The vulnerability of the Git repository management system Gitea’s interface allows a attacker to perform a CSRF attack.

The vulnerability of the Git repository management system Gitea relates to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to execute a CSRF attack by sending specially crafted POST requests...

SPIP SQL注入漏洞

SPIP is a freeware program from SPIP for creating Internet sites. A security vulnerability exists in SPIP v4.1.5 and earlier versions, which stems from the presence of a SQL injection vulnerability that can be exploited by an attacker to execute arbitrary code via a crafted POST request...

The vulnerability of the /ptipupgrade.cgi component of the network camera software for video surveillance devices like ISnex HC-IP9100HD and ISnex HC-IP9050HD allows a intruder to gain full access to the device.

The vulnerability of the /ptipupgrade.cgi component of the ISnex HC-IP9100HD and ISnex HC-IP9050HD network camera microprogramming software is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to gain full access to the device through a specially...

CVE-2022-34540

Digital Watchdog DW MEGApix IP cameras A7.2.220211029 was discovered to contain a command injection vulnerability in the component /admin/vca/license/licensetok.cgi. This vulnerability is exploitable via a crafted POST request...

CVE-2022-34592

Wavlink WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability via the function obtw. This vulnerability allows attackers to execute arbitrary commands via a crafted POST request...

CVE-2022-31277

Xiaomi Lamp 1 v2.0.40066 was discovered to be vulnerable to replay attacks. This allows attackers to to bypass the expected access restrictions and gain control of the switch and other functions via a crafted POST request...

Haraj v3.7 跨站脚本漏洞

A cross-site scripting vulnerability exists in Haraj v3.7, a buying and selling platform from Haraj Saudi Arabia. The vulnerability stems from a lack of data validation filtering of user-supplied data and output in some DM components. An attacker could exploit this vulnerability to execute...

GHSA-HXQX-XWVH-44M2 Denial of Service Vulnerability in Rack Multipart Parsing

There is a possible denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30122. Versions Affected: = 1.2 Not affected: 1.2 Fixed Versions: 2.0.9.1, 2.1.4.1, 2.2.3.1 Impact Carefully crafted multipart POST...

The vulnerability of the dotCMS content management system lies in the improper restriction on the path to the restricted catalog, allowing attackers to execute arbitrary code.

The vulnerability of the dotCMS content management system is related to incorrect restrictions on the path to the restricted catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using specially crafted requests to POST files...