CVE-2022-36839: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability via IAPService in Samsung Checkout prior to version 5.0.53.1 allows attackers to access IAP information...

PT-2022-23643 · Samsung · Samsung Checkout

Name of the Vulnerable Software and Affected Versions: Samsung Checkout versions prior to 5.0.53.1 Description: The issue allows attackers to access IAP information via SQL injection vulnerability in the IAPService of Samsung Checkout. Recommendations: For versions prior to 5.0.53.1, update to...

SAMSUNG Checkout SQL注入漏洞

SAMSUNG Checkout is a checkout system from Samsung South Korea. A security vulnerability exists in SAMSUNG Checkout versions prior to 5.0.53.1, which stems from an SQL injection vulnerability in IAPService that can be exploited by an attacker to access IAP information...

CVE-2021-37732

A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant IAP versions: Aruba Instant 6.4.x.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x.x: 6.5.4.18 and below; Aruba Instant 8.5.x.x: 8.5.0.11 and below; Aruba Instant 8.6.x.x: 8.6.0.6 and below; Aruba Instant...

CVE-2021-37730

CVE-2021-37730 concerns a remote arbitrary command execution in HPE Aruba Instant (IAP). The vulnerability affects Aruba Instant versions across 6.4.x, 6.5.x, 8.5.x, 8.6.x and 8.7.x (as listed in the NVD entry). The 4.2.x ENISA/ICS/CISA-style documentation describes multiple vectors: a command-in...

CVE-2021-37726

CVE-2021-37726 : A remote buffer overflow vulnerability in HPE Aruba Instant (IAP) affects Aruba Instant 8.7.x.x, specifically 8.7.0.0 through 8.7.1.2. The issue originates from a memory buffer overflow in the product’s components (as described in multiple sources) and allows unauthenticated remo...

CVE-2021-37727: Improper Neutralization of Special Elements used in an OS Command

A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant IAP versions: 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.20 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant 8.7.x.x: 8.7.1.3...

CVE-2021-37726: Buffer Copy without Checking Size of Input

A remote buffer overflow vulnerability was discovered in HPE Aruba Instant IAP versions: Aruba Instant 8.7.x.x: 8.7.0.0 through 8.7.1.2. Aruba has released patches for Aruba Instant IAP that address this security vulnerability...

CVE-2021-34618

A remote denial of service DoS vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.4.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.4.x: All versions; Aruba...

CVE-2021-34618

CVE-2021-34618 affects Aruba Instant IAP devices. A DoS exists across multiple lines and versions (e.g., Aruba Instant 6.4.x up to 6.4.4.8-4.2.4.18; 6.5.x up to 6.5.4.18; 8.3.x up to 8.3.0.14; 8.4.x all versions; 8.5.x up to 8.5.0.11; 8.6.x up to 8.6.0.7; 8.7.x up to 8.7.1.1). Aruba has released ...

CVE-2021-34617

Aruba Instant IAP products are affected by a remote cross-site scripting (XSS) vulnerability (CVE-2021-34617) in the web management interface. Affected versions include Aruba Instant 6.4.x up to 6.4.4.8-4.2.4.13 and below; 6.5.x up to 6.5.4.13 and below; 8.3.x up to 8.3.0.7; 8.4.x up to 8.4.0.5; ...

CVE-2021-34618: Undefined Security Weakness

A remote denial of service DoS vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.4.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.4.x: All versions; Aruba...

CVE-2021-32701

ORY Oathkeeper’s CVE-2021-32701 describes an issue in the oauth2_introspection cache where a second request for a different scope (bar) could be treated as valid even if the new scope wasn’t granted, due to the cache not validating scopes beyond expiration. The root cause is that tokenFromCache i...

CVE-2021-25161

A remote cross-site scripting xss vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below;...

CVE-2021-25160

A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below...

CVE-2021-25157

A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba...

CVE-2021-25159

A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below...

CVE-2021-25157

A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba...

CVE-2021-25161

Aruba Instant IAP CVE-2021-25161 is a remote cross-site scripting vulnerability affecting Aruba Instant IAP web UI. Affected versions include Aruba Instant 6.4.x (6.4.4.8-4.2.4.17 and below), 6.5.x (6.5.4.18 and below), 8.3.x (8.3.0.14 and below), 8.5.x (8.5.0.11 and below), 8.6.x (8.6.0.7 and be...

CVE-2021-25160

CVE-2021-25160 is a remote arbitrary file-write vulnerability in Aruba Instant (IAP) web UI/exposed interfaces. Multiple Aruba Instant versions are affected (e.g., 6.4.x up to 6.4.4.8-4.2.4.17; 6.5.x up to 6.5.4.18; 8.3.x up to 8.3.0.14; 8.5.x up to 8.5.0.11; 8.6.x up to 8.6.0.7; 8.7.x up to 8.7....