Command Injection

wwbn/avideo is vulnerable to Command Injection. The vulnerability exists because security.php does not escape shell characters, allowing an attacker to inject and execute malicious commands when embedding a video link...

CVE-2022-48107

D-Link DIR878FW1.30B08 was discovered to contain a command injection vulnerability via the component /setnetworksettings/IPAddress. This vulnerability allows attackers to escalate privileges to root via a crafted payload...

PT-2023-36398 · D Link · D-Link Dap-1360 +1

Уязвимость микропрограммного обеспечения беспроводных точек доступа D-Link DAP-2020 и DAP-1360 связана с переполнением буфера на стеке. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код...

CVE-2022-46561

D-Link DIR-882 DIR882A1FW130B06, DIR-878 DIR878FW1.30B08 was discovered to contain a stack overflow via the Password parameter in the SetWanSettings module...

Fedora 36 : drupal7-link (2022-d209710a36)

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-d209710a36 advisory. - https://www.drupal.org/project/link/releases/7.x-1.11 - SA-CONTRIB-2022-034 - https://www.drupal.org/project/link/releases/7.x-1.10 -...

PT-2022-16019 · Sentry · Sentry

Name of the Vulnerable Software and Affected Versions: Sentry versions prior to 22.11.0 Description: Sentry is an error tracking and performance monitoring platform. An attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple account...

Social Base - Moderately critical - Access bypass - SA-CONTRIB-2022-060

The Social Base theme is designed as a base theme for Open Social. This base theme holds has a lot of sensible defaults. It doesn't however contain much styling. We expect developers to want to change this for their own project. When content within the Open Social distribution is placed within a...

EUVD-2022-44065

Data Integrity Failure in 'Backup Config' in D-Link DNR-322L = 2.60B15 allows an authenticated attacker to execute OS level commands on the device...

Design/Logic Flaw

D-Link DIR823G 1.02B05 is vulnerable to Commad Injection...

CVE-2022-36785 D-Link – G integrated Access Device4 Information Disclosure & Authorization Bypass.

D-Link – G integrated Access Device4 Information Disclosure & Authorization Bypass. Information Disclosure – file contains a URL with private IP at line 15 "login.asp" A. The window.location.href = http://192.168.1.1/setupWizard.asp" http://192.168.1.1/setupWizard.asp" ; "admin" – contains defaul...

Command injection

D-link DIR-816 A2v1.10CNB04.img is vulnerable to Command injection via /goform/form2userconfig.cgi...

CVE-2022-37056

D-Link GO-RT-AC750 GORTAC750revAv101b03 and GO-RT-AC750revBFWv200b02 is vulnerable to Command Injection via /cgibin, hnapmain,...

AZL-10723 CVE-2021-35938 affecting package rpm for versions less than 4.18.0-1

A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system...

PT-2022-23444 · D Link · D-Link Go-Rt-Ac750

Name of the Vulnerable Software and Affected Versions: D-Link Go-RT-AC750 versions GORTAC750 revA v101b03 through GO-RT-AC750 revB FWv200b02 Description: The issue concerns command injection via the "/htdocs/upnpinc/gena.php" API endpoint. This allows for potential malicious commands to be...

BookWyrm 输入验证错误漏洞

BookWyrm is a social reading platform. BookWyrm suffers from an input validation error vulnerability that stems from the fact that certain links may be susceptible to tabnabbing attacks...

CVE-2022-26054

Operation restriction bypass vulnerability in Link of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Link...

Cybozu Garoon 输入验证错误漏洞

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. An input validation error vulnerability exists in Cybozu Garoon, which stems from insufficient validation of...

vditor 跨站脚本漏洞

vditor is a browser-based Markdown editor that supports WYSIWYG, instant rendering similar to Typora, and split-screen preview modes. A cross-site scripting vulnerability exists in vditor versions prior to 3.8.13, which stems from the fact that if a user passes a link as a URL value when creating...

MGASA-2022-0060 Updated libarchive packages fix security vulnerability

Processing fixup entries may follow symbolic links. CVE-2021-31566 libarchive 3.4.1 through 3.5.1 has a use-after-free in copystring called from douncompressblock and processblock. CVE-2021-36976...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation. A security vulnerability exists in Mozilla Firefox that stems from an error in the way the product handles tel:link. An attacker could place special characters in a phone number, forcing the victim to make a phone call whe...