PT-2023-16751 · Baicells · Baicells Eg7035-M11

Name of the Vulnerable Software and Affected Versions: Baicells EG7035-M11 devices with firmware through BCE-ODU-1.0.8 Description: The issue concerns improper code exploitation via HTTP GET command injections. Commands are executed using pre-login execution and are executed with root permissions...

PT-2023-2070 · Fortinet · Fortiweb

Name of the Vulnerable Software and Affected Versions: FortiWeb versions 7.0.1 and below FortiWeb version 6.4 and all versions FortiWeb version 6.3.19 and below Description: The issue is related to improper neutralization of special elements used in an OS Command, which may allow an authenticated...

CVE-2022-48299

The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentiality...

CVE-2022-34459

Dell Command | Update, Dell Update, and Alienware Update versions prior to 4.7 contain a improper verification of cryptographic signature in get applicable driver component. A local malicious user could potentially exploit this vulnerability leading to malicious payload execution...

Mozilla: libusrsctp library out of date

The Mozilla Foundation Security Advisory describes this flaw as: An out of date library libusrsctp contained vulnerabilities that could potentially be exploited...

The vulnerability of the Netlogon service in Windows operating systems allows a hacker to trigger a service failure.

The vulnerability of the Netlogon service in Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

CVE-2020-22659

In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 SCG200 before 3.6.2.0.795, SmartZone 100 SZ-100 before 3.6.2.0.795, SmartZone 300 SZ300 before 3.6.2.0.795, Virtua...

CVE-2023-22496 Netdata vulnerable to command injection

Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. An attacker with the ability to establish a streaming connection can execute arbitrary commands on the targeted Netdata agent. When an alert is triggered, the function healthalarmexecute is called. This...

PT-2023-15115 · Unknown · Dynamic Transaction Queuing System

Name of the Vulnerable Software and Affected Versions: Dynamic Transaction Queuing System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/admin/ajax.php?action=delete transaction" API endpoint...

PT-2023-14245 · Aruba · Clearpass Onguard Linux Agent +1

Name of the Vulnerable Software and Affected Versions: Aruba ClearPass Policy Manager versions 6.10.x: 6.10.7 and below Aruba ClearPass Policy Manager versions 6.9.x: 6.9.12 and below Description: A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance...

PT-2022-28127 · Unknown · Usememos/Memos

Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.1 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs in the GitHub repository usememos/memos. This type of attack allows an attacker to inject malicious scripts into a...

CVE-2022-46315

The ProfileSDK has defects introduced in the design process. Successful exploitation of this vulnerability may affect system availability...

PT-2022-17905 · Undefined · Undefined

ParsedReport 19-12-2022 Veeam Fixes Critical Vulnerabilities in Backup & Replication Software CVE-2022-26500 & CVE-2022-26501 https://socradar.io/veeam-fixes-critical-vulnerabilities-in-backup-replication-software-cve-2022-26500-cve-2022-26501 Threats: Monti Yanluowang Empire loader CVEs:...

CVE-2022-20525

In enforceVisualVoicemailPackage of PhoneInterfaceManager.java, there is a possible leak of visual voicemail package name due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

PT-2022-27194 · Tenda · Tenda I21

Name of the Vulnerable Software and Affected Versions: Tenda i21 version 1.0.0.144656 Description: The issue is related to a Buffer Overflow that can be triggered via the "/goform/AddSysLogRule" API endpoint. This allows for potential exploitation. Recommendations: For Tenda i21 version...

PUB-A-235601770

In getSmsRoleHolder of RoleService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not...

CVE-2022-37430

Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link issue 2 of 2...

CVE-2022-44552

The lock screen module has defects introduced in the design process. Successful exploitation of this vulnerability may affect system availability...

CVE-2021-46852

The memory management module has the logic bypass vulnerability. Successful exploitation of this vulnerability may affect data confidentiality...

CVE-2022-44553

The HiView module has a vulnerability of not filtering third-party apps out when the HiView module traverses to invoke the system provider. Successful exploitation of this vulnerability may cause third-party apps to start periodically...