Malicious Package

Overview twilio-bugcrowd-poc-twilio-flex-ui-sample is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only...

The vulnerability of the command-line interface (CLI) of Zyxell USG FLEX, ATP, and VPN network interfaces allows a hacker to execute arbitrary commands with root privileges.

The vulnerability of the command-line interface CLI of Zyxell USG FLEX, ATP, and VPN network interfaces relates to the possibility of rewriting files with arbitrary content. Exploiting this vulnerability allows an attacker to execute arbitrary commands with root privileges...

CVE-2022-2030

A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG FLEX 100W firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 throu...

CVE-2022-30526

A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100W firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50W...

Directory traversal

A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG FLEX 100W firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 throu...

Privilege escalation

A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100W firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50W...

CVE-2022-2030

CVE-2022-2030 describes an authenticated directory traversal in Zyxel firewall/USG/ZyWALL CGI programs. Affected products/versions include Zyxel USG FLEX 100(W) (4.50–5.30), USG FLEX 200 (4.50–5.30), USG FLEX 500 (4.50–5.30), USG FLEX 700 (4.50–5.30), USG FLEX 50(W) (4.16–5.30), USG20(W)-VPN (4.1...

CVE-2022-30526

A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100W firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50W...

CVE-2022-30526

CVE-2022-30526 affects Zyxel USG FLEX/USGZyWALL firewalls (e.g., USG FLEX 100(W), 200, 500, 700; USG FLEX 50(W); USG20(W)-VPN; ATP; VPN series; USG/ZyWALL). The issue is a local privilege escalation via the CLI caused by a SUID binary that allows a low-privileged user to copy files as root and ov...

CVE-2022-30526: Improper Privilege Management

A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100W firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50W...

Zyxel USG FLEX 路径遍历漏洞

Zyxel USG FLEX is a firewall from China-based Hopkins Technology Zyxel. Offering flexible VPN options IPsec, SSL or L2TP, it provides flexible and secure remote access for remote work and management. A security vulnerability exists in Zyxel products that stems from a directory traversal...

PT-2022-3781 · Zyxel · Zyxel Usg/Zywall Series +8

Name of the Vulnerable Software and Affected Versions: Zyxel USG FLEX 100W versions 4.50 through 5.30 Zyxel USG FLEX 200 versions 4.50 through 5.30 Zyxel USG FLEX 500 versions 4.50 through 5.30 Zyxel USG FLEX 700 versions 4.50 through 5.30 Zyxel USG FLEX 50W versions 4.16 through 5.30 Zyxel...

CVE-2022-2030: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG FLEX 100W firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 throu...

The vulnerability of the Common Gateway Interface (CGI) interface of microprogramming software for network devices such as ZyXEL USG, ZyWALL, USG FLEX, ATP, and VPN allows attackers to circumvent security restrictions.

The vulnerability of the Common Gateway Interface CGI interface of ZyXEL USG, ZyWALL, USG FLEX, ATP, and VPN network devices is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions by using IPSec VPN...

The vulnerability of the Flex-Branch component of the Oracle FLEXCUBE Universal Banking banking analytics system, a simulation modeling solution for banking services, allows a perpetrator to gain unauthorized access to protected data.

The vulnerability of the Flex-Branch component in the Oracle FLEXCUBE Universal Banking banking analytics system exists due to insufficient verification of input data. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected data using the HT...

Zyxel Firewall SUID Binary Privilege Escalation

This module exploits CVE-2022-30526, a local privilege escalation vulnerability that allows a low privileged user e.g. nobody escalate to root. The issue stems from a suid binary that allows all users to copy files as root. This module overwrites the firewall's crontab to execute an attacker...

HPESBHF04326 rev.3 - HPE Superdome Flex, Superdome Flex 280, Integrity MC990 X, and SGI UV 300 Servers Using Certain Intel Processors, INTEL-SA-00615, 2022.1 IPU – Intel Processors MMIO Stale Data Advisory, Local Disclosure of Information

Potential Security Impact: Local: Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Integrity MC990 X Server - Prior to 5.2.16 BIOS in product bundle 2022.06 HPE Superdome Flex Server - Prior to 3.55.8 HPE Superdome Flex 280 Server - Prior to 1.35.12 SG...

Exploit for OS Command Injection in Zyxel Usg_Flex_100W_Firmware

CVE-2022-30525 Zyxel Firewall Remote Command Injection A py...

Exploit for OS Command Injection in Zyxel Usg_Flex_100W_Firmware

CVE-2022-30525 A OS Command Injection Vulnerability in the CGI...

HPESBHF04315 rev.1 - HPE Superdome Flex Servers Using Intel Xeon Processors, INTEL-SA-00616, 2022.1 IPU - Intel Xeon Advisory, Multiple Local Vulnerabilities

Potential Security Impact: Local: Denial of Service DoS, Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Superdome Flex Server - Prior to 3.55.8 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2022-21131 |...