CVE-2022-22054

ASUS RT-AX56U’s login function contains a path traversal vulnerability due to its inadequate filtering for special characters in URL parameters, which allows an unauthenticated local area network attacker to access restricted system paths and download arbitrary files...

CVE-2021-4183

A heap-buffer-overflow vulnerability was found in Wireshark. This flaw allows an attacker with local network access to pass specially crafted capture files, causing an application to halt or crash...

CVE-2021-4190

An infinite-loop flaw was found in Wireshark. This flaw allows an attacker with local network access to pass specially crafted capture files, causing an application to halt, crash, or go into an infinite loop...

CVE-2021-4182

A parser infinite-loop flaw was found in wireshark. An attacker with local network access could pass specially crafted capture files causing an application to halt, crash, or infinite loop...

CVE-2021-4186

A segmentation issue was found in Wireshark. This flaw allows an attacker with local network access to pass specially crafted capture files, causing an application to halt or crash...

CVE-2021-4184

An infinite-loop flaw was found in Wireshark's DHT dissector module. This flaw allows an attacker with local network access to pass specially crafted capture files, causing an application to halt, crash or go into an infinite loop...

CVE-2021-4185

An infinite-loop flaw was found in Wireshark RTMPT. This flaw allows an attacker with local network access to pass specially crafted capture files, causing an application to halt, crash, or go into an infinite loop...

CVE-2021-4181

A denial of service via packet injection flaw was found in wireshark. An attacker with local network access could pass specially crafted capture files causing an application to halt or crash, leading to a denial of service...

CVE-2021-46141

An Invalid pointer operations flaw was found in uriparser. An attacker with local network access could pass a specially crafted unknown input causing that application to crash...

CVE-2021-46142

An invalid pointer operations flaw was found in uriparser's uriNormalizeSyntax function. An attacker with local network access could pass a specially crafted unknown input causing that application to crash...

Input validation

The programming function of Shockwall system has an improper input validation vulnerability. An authenticated attacker within the local area network can send malicious response to the server to disrupt the service partially...

CVE-2021-45916 SUN & MOON RISE CO., LTD. Shockwall - Improper Input Validation

The programming function of Shockwall system has an improper input validation vulnerability. An authenticated attacker within the local area network can send malicious response to the server to disrupt the service partially...

CVE-2021-45257

An infinite loop flaw was found in nasm's preproc.c via pastetokens function. An attacker with local network access could pass a specially crafted unknown input causing an application to halt or crash leading to a denial of service...

mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete

A flaw was found in the mysql-connector-java package. A complicated attack against the mysql Connector/J allows attackers on the local network to interfere with a user's connection and insert unauthorized SQL commands...

mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete

A flaw was found in the mysql-connector-java package. A complicated attack against the mysql Connector/J allows attackers on the local network to interfere with a user's connection and insert unauthorized SQL commands in MySQL Connectors and other products...

Vulnerability fixed in Huawei CloudEngine

Huawei has fixed a vulnerability in their CloudEngine series of switches. An unauthenticated malicious person on the same network can exploit the vulnerability to cause a denial-of-service cause. Huawei has released updates to fix the vulnerability in CloudEngine. For more information, see:...

elecom lan 授权问题漏洞

elecom lan routers is a router from Elecom Japan. An access control error vulnerability exists in elecom lan routers, which can be exploited by an attacker to bypass access restrictions and gain access to the product's administration screens via an unspecified vector...

elecom lan 跨站脚本漏洞

elecom lan routers is a router from Elecom Japan. A cross-site scripting vulnerability exists in elecom lan routers, which can be exploited by an attacker to inject arbitrary script via an unspecified vector...

Server-Side Request Forgery (SSRF)

concrete5/concrete5 is vulnerable to server-side request forgery. The vulnerability exists through the local IP importing in 'file.php' which allows an attacker to read the files from private local LAN servers and exploit the local network apps...

GHSA-GQPW-9Q54-9X28 Server-Side Request Forgery in Concrete CMS

Concrete CMS formerly concrete5 versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable to SSRF attacks on the private LAN to servers by reading files from the local LAN. An attacker can pivot in the private LAN and exploit local network appsandb...