PT-2023-10586 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel. Specially crafted commands sent through the PubNub service can cause a stack-based buffer...

PT-2023-10539 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: The issue concerns buffer overflow vulnerabilities in the PubNub message handler for the "cc" channel. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow,...

PT-2023-1414 · Zyxel · Zyxel Gs1915 +4

Name of the Vulnerable Software and Affected Versions: Zyxel GS1920-24v2 firmware versions prior to V4.70ABMH.8C0 Zyxel GS1350, GS1915, GS1920, GS2220 affected versions not specified Description: The issue is related to an improper check for unusual or exceptional conditions in the HTTP request...

CVE-2022-43391

A buffer overflow vulnerability in the parameter of the CGI program in Zyxel NR7101 firmware prior to V1.15ACCC.3C0, which could allow an authenticated attacker to cause denial-of-service DoS conditions by sending a crafted HTTP request...

CVE-2022-43391

CVE-2022-43391 affects Zyxel NR7101 firmware components handling CGI program parameters. The root cause is a buffer overflow in the CGI parameter parsing that can be triggered by a crafted HTTP request, allowing an authenticated attacker to cause denial-of-service (DoS). Impact is limited to avai...

PT-2023-10535 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel. Specially crafted commands sent through the PubNub service can cause a stack-based buffer...

CVE-2022-43390

A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15ACCC.3C0, which could allow an authenticated attacker to execute some OS commands on a vulnerable device by sending a crafted HTTP request...

PT-2023-1559 · Zyxel · Zyxel Nr7101

Name of the Vulnerable Software and Affected Versions: Zyxel NR7101 firmware versions prior to V1.15ACCC.3C0 Description: The issue exists due to the lack of measures to neutralize special elements used in the operating system command. Exploitation of this issue may allow a remote attacker to...

CVE-2022-43393

The CVE-2022-43393 issue affects Zyxel GS1920-24v2 firmware pre‑V4.70(ABMH.8)C0. The root cause is an improper check for unusual or exceptional conditions in the HTTP request processing function, which could allow an unauthenticated attacker to corrupt memory and cause a denial‑of‑service on a vu...

PT-2023-10575 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel. Specially crafted commands sent through the PubNub service can cause a stack-based buffer...

Siemens SINEC INS

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

PT-2023-10141 · Lukehutch · Gribbit

Name of the Vulnerable Software and Affected Versions: lukehutch Gribbit affected versions not specified Description: A problematic issue was found in lukehutch Gribbit, affecting the messageReceived function of the file src/gribbit/request/HttpRequestHandler.java. This issue leads to missing...

Debian: Security Advisory (DSA-5311-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 5311-1] trafficserver security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5311-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 08, 2023 https://www.debian.org/security/faq -...

Command Injection

kylin-server-base is vulnerable to command injection. The vulnerability exists due to the missing parameter validations in the library, which allows an attacker to inject and execute malicious commands through an HTTP request...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a remote attacker due to Node.js (CVE-2022-43548 & CVE-2022-35256)

Summary IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a remote attacker due to Node.js CVE-2022-43548 & CVE-2022-35256. The fix includes Node.js 14.21.1 Vulnerability Details CVEID:CVE-2022-43548 DESCRIPTION: Node.js could allow a remote attacker to execute arbitrary code o...

Several vulnerabilities are addressed by Fortinet across its product range

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Fortinet addressed security vulnerabilities across its products, most notably FortiADC, which has a high-severity command injection bug listed as CVE-2022-39947 due to incorrect input validation i...

Nexxt Router Firmware 42.103.1.5095 Remote Code Execution Exploit

Exploit Title: Nexxt Router Firmware 42.103.1.5095 - Remote Code Execution RCE Authenticated Exploit Author: Yerodin Richards Vendor Homepage: https://www.nexxtsolutions.com/ Version: 42.103.1.5095 Tested on: ARN02304U8 CVE : CVE-2022-44149 import requests import base64 routerhost =...

Security Bulletin: IBM Security SOAR is using a component with known vulnerabilities (CVE-2022-42252)

Summary IBM Security SOAR uses an older version of Apache Tomcat 9.0.63 that may be identified and exploited. An update has been released which addresses these issues. The version of Apache Tomcat included in the latest version of IBM ® Security Soar is 9.0.68. Vulnerability Details...

CVE-2022-39039 aEnrich a+HRD - Server-Side Request Forgery (SSRF)

aEnrich’s a+HRD has inadequate filtering for specific URL parameter. An unauthenticated remote attacker can exploit this vulnerability to send arbitrary HTTPs request to launch Server-Side Request Forgery SSRF attack, to perform arbitrary system command or disrupt service...