CVE-2022-32966

CVE-2022-32966 concerns Realtek RTL8111FP-CG/RTL8168FP-CG devices. The Dash remote management function has missing authorization, enabling an unauthenticated attacker on an adjacent network to connect to the DASH service port and disrupt service. The CVE is documented with a CVSSv3.1 base score o...

CVE-2022-32966 Realtek RTL8111FP-CG - Missing Authorization

RTL8168FP-CG Dash remote management function has missing authorization. An unauthenticated attacker within the adjacent network can connect to DASH service port to disrupt service...

PT-2022-21615 · Realtek · Rtl8111Ep-Cg

Name of the Vulnerable Software and Affected Versions: RTL8111EP-CG/RTL8111FP-CG affected versions not specified Description: The DASH function in RTL8111EP-CG/RTL8111FP-CG has a hard-coded password. An unauthenticated physical attacker can use this default password during system reboot to acquir...

Realtek RTL8111FP-CG 安全漏洞

The Realtek RTL8111FP-CG is an Ethernet controller. An authorization issue vulnerability exists in Realtek RTL8111FP-CG Firmware prior to version 5.0.23, which stems from a lack of authorization for the Dash remote management feature, and can be exploited by an unauthenticated attacker on an...

PT-2022-21614 · Realtek · Rtl8168Fp-Cg

Name of the Vulnerable Software and Affected Versions: RTL8168FP-CG affected versions not specified Description: The issue concerns a missing authorization in the Dash remote management function. An unauthenticated attacker within the adjacent network can connect to the DASH service port,...

PT-2022-27418 · Unknown · Pi-Star Dv Dash

Name of the Vulnerable Software and Affected Versions: Pi-Star DV Dash for Pi-Star DV versions prior to 5aa194d Description: The issue concerns the mishandling of the module parameter. Recommendations: For versions prior to 5aa194d, update to a version that includes the fix for the mishandling of...

CVE-2022-45182

Pi-Star DV Dash (Pi-Star DV) is affected by CVE-2022-45182 in all versions prior to 5aa194d due to mishandling of the module parameter. The CVE metadata indicates a CRITICAL impact (C/H/I/A) with network attack vector and no user interaction required. Public references in the initial and connecte...

OESA-2022-1934 rubygem-bundler security update

Security Fixes: Bundler is a package for managing application dependencies in Ruby. In bundler versions before 2.2.33, when working with untrusted and apparently harmless Gemfile's, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code inside the...

DEBIAN-CVE-2022-36069

Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as git clone. These commands are constructed using user input e.g. the repository URL. When building the commands, Poetry correctly avoid...

AZL-10919 CVE-2022-36069 affecting package poetry 1.0.10-2

Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as git clone. These commands are constructed using user input e.g. the repository URL. When building the commands, Poetry correctly avoid...

PYSEC-2022-266

Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as git clone. These commands are constructed using user input e.g. the repository URL. When building the commands, Poetry correctly avoid...

UBUNTU-CVE-2022-36069

Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as git clone. These commands are constructed using user input e.g. the repository URL. When building the commands, Poetry correctly avoid...

CVE-2022-36064

Shescape is a shell escape package for JavaScript. An Inefficient Regular Expression Complexity vulnerability impacts users that use Shescape to escape arguments for the Unix shells Bash and Dash, or any not-officially-supported Unix shell; and/or using the escape or escapeAll functions with the...

Code injection

Shescape is a shell escape package for JavaScript. An Inefficient Regular Expression Complexity vulnerability impacts users that use Shescape to escape arguments for the Unix shells Bash and Dash, or any not-officially-supported Unix shell; and/or using the escape or escapeAll functions with the...

CVE-2022-36064

CVE-2022-36064 (Shescape) affects the JavaScript package Shescape. The vulnerability is an inefficient Regular Expression Complexity (ReDoS) in two RegExes used when escaping arguments for Unix shells (notably Bash/Dash) or when using escape/escapeAll with interpolation enabled. An attacker can c...

CVE-2022-36064 Shescape Inefficient Regular Expression Complexity vulnerability

Shescape is a shell escape package for JavaScript. An Inefficient Regular Expression Complexity vulnerability impacts users that use Shescape to escape arguments for the Unix shells Bash and Dash, or any not-officially-supported Unix shell; and/or using the escape or escapeAll functions with the...

PT-2022-23152 · Shescape · Shescape

Name of the Vulnerable Software and Affected Versions: Shescape versions prior to 1.5.10 Shescape version 1.5.9 for Bash Description: An Inefficient Regular Expression Complexity issue affects Shescape users who utilize it to escape arguments for Unix shells, including Bash and Dash, particularly...

Inside the Shadow Evacuation of Kabul

In the last two weeks of the war, an ad hoc team armed with group chats, QR codes, and satellite maps launched a mad dash to save imperiled Afghan allies...

chewb-server (>=0.0.1 <=0.0.20), video-dash-uploader (>=0.0.1 <=0.0.4) +1 more potentially affected by CVE-2020-28436 via google-cloudstorage-commands (=0.0.1)

google-cloudstorage-commands NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on google-cloudstorage-commands and may be impacted: - chewb-server =0.0.1, =0.0.1, =0.0.1, =0.0.2 Source cves: CVE-2020-28436 Source advisory:...

PT-2022-20592 · Microsoft +1 · Powershell +2

Name of the Vulnerable Software and Affected Versions: Shescape versions prior to 1.5.8 Description: The issue impacts users of the escape or escapeAll functions with the interpolation option set to true. If an attacker can include whitespace in their input, they can invoke shell-specific behavio...