2287 matches found
CVE-2022-48124
TOTOlink A7100RU V7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the FileName parameter in the setting/setOpenVpnCertGenerationCfg function...
PT-2023-15584 · Totolink · Totolink A7100Ru
Name of the Vulnerable Software and Affected Versions: TOTOlink A7100RU version 7.4cu.2313 B20191024 Description: A command injection issue was discovered via the FileName parameter in the setting/setOpenVpnCertGenerationCfg function. This allows for potential exploitation. Recommendations: For...
CVE-2023-0046
CVE-2023-0046 relates to the daloradius project: prior to the master-branch, there is an issue with improper restriction of names for files and other resources due to lack of filename restrictions when saving logging data. An attacker can manipulate the logging filename to point to an existing PH...
httparty has multipart/form-data request tampering vulnerability
Impact I found "multipart/form-data request tampering vulnerability" caused by Content-Disposition "filename" lack of escaping in httparty. httparty/lib/httparty/request body.rb def generatemultipart...
CVE-2022-46594
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the updatefilename parameter in the autoupfw sub420A04 function...
CVE-2022-46594
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the updatefilename parameter in the autoupfw sub420A04 function...
TRENDnet TEW-755AP 缓冲区错误漏洞
The TRENDnet TEW-755AP is a router from TRENDnet. The TRENDnet TEW-755AP suffers from a stack overflow vulnerability that stems from a lack of size checking of input data in the updatefilename parameter of the autoupfw sub420A04 function, which can be exploited by an attacker to execute arbitrary...
PT-2022-7152 · Python Packaging Authority +7 · Wheel +7
Name of the Vulnerable Software and Affected Versions: Python Packaging Authority PyPA Wheel versions 0.37.1 and earlier Description: The issue is related to an uncontrolled resource consumption in the Python Packaging Authority PyPA Wheel, which can be exploited by a remote attacker to cause a...
AlmaLinux 9 : thunderbird (ALSA-2022:9080)
The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2022:9080 advisory. - Mozilla: Quoting from an HTML email with certain tags will trigger network requests and load remote content, regardless of a configuration to block remo...
Debian DSA-5303-1 : thunderbird - security update
The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5303 advisory. Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code or information disclosure. For the stable...
Mozilla: Drag and Dropped Filenames could have been truncated to malicious extensions
The Mozilla Foundation Security Advisory describes this flaw as: A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code...
The vulnerability of the FortiClient.msi installer of the Fortinet FortiClient for Windows security solution allows a malicious individual to escalate their privileges.
The vulnerability of the FortiClient.msi installer of the Fortinet FortiClient for Windows security solution is related to incorrect external management of file names or file paths. Exploiting this vulnerability can allow attackers to increase their privileges...
CVE-2022-45918
ILIAS before 7.16 allows External Control of File Name or Path...
CVE-2022-45918
ILIAS before 7.16 allows External Control of File Name or Path...
PT-2022-27685 · Ilias · Ilias
Name of the Vulnerable Software and Affected Versions: ILIAS versions prior to 7.16 Description: The issue allows for external control of file name or path. Recommendations: For versions prior to 7.16, update to version 7.16 or later to resolve the issue...
CVE-2022-45918
CVE-2022-45918 affects ILIAS eLearning platform prior to 7.16. The vulnerability is External Control of File Name or Path, with upstream advisories and Red Hat corroborating that versions
GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example a victim may use the "ctags *" command (suggested in the ctags documentation) in a situation where the current working directory has contents that depend on untrusted input.
...
TOTOLINK NR1800X setUploadSetting Function Command Injection Vulnerability
TOTOLINK NR1800X is a 5G NR indoor Wi-Fi and SIP CPE broadband access device from China's Gion Electronics TOTOLINK, which is mainly used for the deployment of NR fixed data services in homes and offices to support 5G NR network connectivity. A command injection vulnerability exists in the TOTOLI...
Win32.Ransom.Conti MVID-2022-0662 Cryptography Logic Flaw
Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/99e55ce93392068c970384ab24a0e13d.txt Contact: [email protected] Media: twitter.com/malvuln Backup media: infosec.exchange/@malvuln Threat: Win32.Ransom.Conti Vulnerability: Crypto Logic Fla...