The vulnerability of the FTP service for operating system network storage devices like My Cloud OS allows a hacker to gain full access to the device and execute arbitrary code.

The vulnerability of the FTP service in operating system network storage devices like My Cloud OS is related to incorrect restrictions on the path to the restricted access directory. Exploiting this vulnerability could allow an attacker to gain full access to the device and execute arbitrary code...

PT-2023-3074 · 3S Smart Software Solutions · Codesys Control

Name of the Vulnerable Software and Affected Versions: CODESYS Control versions affected versions not specified Description: The issue is related to an improper restriction of operations within the bounds of a memory buffer, which can be exploited by a remote attacker with user privileges to gain...

Trend Micro Endpoint Encryption 安全漏洞

Trend Micro Endpoint Encryption is Trend Micro's solution for encrypting data on a variety of devices such as PCs and Macs, laptops and desktops, USB drives and other removable media. A security vulnerability exists in Trend Micro Endpoint Encryption Full Disk Encryption version 6.0.0.3204 and...

Design/Logic Flaw

Akuvox E11 cloud login is performed through an unencrypted HTTP connection. An attacker could gain access to the Akuvox cloud and device if the MAC address of a device if known...

CVE-2023-27850

NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a file sharing mechanism that allows users with access to this feature to access arbitrary files on the device...

Target device cannot access VDisk and boot, Event ID 11 seen on Provisioning server

Some or all target devices cannot access the VDisk at boot - the device will get a boot file but be unable to go further. On the PVS servers: Event id 11 from StreamProcess.exe is seen with the error detail:Detected one or more hung threads...

CVE-2023-22805

LS ELECTRIC XBC-DN32U with operating system version 01.80 has improper access control to its read prohibition feature. This could allow a remote attacker to remotely set the feature to lock users out of reading data from the device...

SUSE CVE-2019-18683

An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. It is exploitable for privilege escalation on some Linux distributions where local users have /dev/video0 access, but only if the driver happens to be loaded. There are multiple race conditions during...

PT-2023-1974 · Merten · Merten Knx

Name of the Vulnerable Software and Affected Versions: Merten KNX affected versions not specified Description: A vulnerability exists due to improper authentication, which could allow a device to be compromised when a key of less than seven digits is entered and the attacker has access to the KNX...

Additional Supply Chain Vulnerabilities Uncovered in AMI MegaRAC BMC Software

Two more supply chain security flaws have been disclosed in AMI MegaRAC Baseboard Management Controller BMC software, nearly two months after three security vulnerabilities were brought to light in the same product. Firmware security firm Eclypsium said the two shortcomings were held back until n...

CVE-2022-47732

In Yeastar N412 and N824 Configuration Panel 42.x and 45.x, an unauthenticated attacker can create backup file and download it, revealing admin hash, allowing, once cracked, to login inside the Configuration Panel, otherwise, replacing the hash in the archive and restoring it on the device which...

ASUS RT-AX82U Authentication Error Vulnerability

The ASUS RT-AX82U is a wireless router from the Chinese company ASUS. The ASUS RT-AX82U 3.0.0.4.38649674-ge182230 suffers from an authentication error vulnerability that stems from improper authentication in the getIFTTTtoken.cgi function. An attacker could use this vulnerability to access the...

PT-2022-28119 · Tp Link · Tp-Link Tl-Wr902Ac

Name of the Vulnerable Software and Affected Versions: TP-Link TL-WR902AC devices through V3 0.9.1 Description: The issue allows remote authenticated attackers to execute arbitrary code or cause a Denial of Service DoS by uploading a crafted firmware update because the signature check is...

CVE-2020-12069 CODESYS V3 prone to Inadequate Password Hashing

In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device...

CVE-2022-38757

A vulnerability has been identified in Micro Focus ZENworks 2020 Update 3a and prior versions. This vulnerability allows administrators with rights to perform actions e.g., install a bundle on a set of managed devices, to be able to exercise these rights on managed devices in the ZENworks zone bu...

The vulnerability of the microprogramming software of the AMI MegaRAC Baseboard Management Controller (BMC) allows a intruder to gain full access to the device.

The vulnerability of the microprogramming software of the AMI MegaRAC Baseboard Management Controller BMC relates to the use of rigidly encrypted credentials. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain full access to the device via SSH...

CVE-2022-39914

Exposure of Sensitive Information from an Unauthorized Actor vulnerability in Samsung DisplayManagerService prior to Android T13 allows local attacker to access connected DLNA device information...

The vulnerability of the Windows operating system’s Bind Filter Driver allows a hacker to gain unauthorized access to the device.

The vulnerability of the Windows operating system’s Bind Filter Driver arises due to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to gain unauthorized access to the device...

Code injection

A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13, iOS 16, iOS 15.7 and iPadOS 15.7, watchOS 9, tvOS 16. A user with physical access to a device may be able to access contacts from the lock screen...

CVE-2022-32879

A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13, iOS 16, iOS 15.7 and iPadOS 15.7, watchOS 9, tvOS 16. A user with physical access to a device may be able to access contacts from the lock screen...