CVE-2022-23227

NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handleimportuser.php authentication. When combined with another flaw CVE-2011-5325, it is possible to overwrite arbitrary files under...

CVE-2021-34978

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6260 1.1.0.781.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the setupwizard.cgi page. A crafted SOAP request can trigg...

CVE-2021-34979

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6260 1.1.0.781.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SOAP requests. When parsing the SOAPAction...

PT-2021-6475 · NetGear · Netgear R6400V2 +6

Name of the Vulnerable Software and Affected Versions: NETGEAR R6700v3 version 1.0.4.120 10.0.91 NETGEAR R6400v2 affected versions not specified NETGEAR R6900P affected versions not specified NETGEAR R7000 affected versions not specified NETGEAR R7000P affected versions not specified NETGEAR RS40...

CVE-2021-3060

An OS command injection vulnerability in the Simple Certificate Enrollment Protocol SCEP feature of PAN-OS software allows an unauthenticated network-based attacker with specific knowledge of the firewall configuration to execute arbitrary code with root user privileges. The attacker must have...

PT-2021-6114 · Tp Link · Tp-Link Ac1750

Name of the Vulnerable Software and Affected Versions: TP-Link AC1750 version 1.1.4 Build 20211022 rel.591035553 Description: The issue is related to a read past the end of an allocated buffer in the NetUSB.ko module, which can be exploited by network-adjacent attackers to execute arbitrary code ...

CVE-2021-37748

Multiple buffer overflows in the limited configuration shell /sbin/gsconfig on Grandstream HT801 devices before 1.0.29 allow remote authenticated users to execute arbitrary code as root via a crafted manageif setting, thus bypassing the intended restrictions of this shell and taking full control ...

NETGEAR R6260 安全漏洞

NETGEAR R6260 is a router device. A security vulnerability exists in NETGEAR R6260 routers, which stems from the device's failure to properly validate the length of user-supplied data before copying it to a fixed-length buffer, which could be exploited by an attacker to execute code in the root...

CVE-2021-34862

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the var:menu parameter provided to the webpr...

CVE-2021-34863

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the var:page parameter provided to the webpr...

Cisco SD-WAN Security Bug Allows Root Code Execution

Cisco SD-WAN implementations are vulnerable to a high-severity privilege-escalation vulnerability in the IOS IE operating system that could lead to arbitrary code execution. Cisco’s SD-WAN portfolio allows businesses of all sizes to connect disparate office locations via the cloud using various...

CVE-2021-33728

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. The affected system allows to upload JSON objects that are deserialized to JAVA objects. Due to insecure deserialization of user-supplied content by the affected software, a privileged attacker could exploit this...

Siemens SINEC NMS 代码问题漏洞

SINEC NMS is a network management system from Siemens for monitoring and managing industrial networks. a code issue vulnerability exists in versions prior to SINEC NMS 1.0 SP2 Update 1. The vulnerability stems from the fact that the affected system allows the upload of JSON objects deserialized t...

Cisco Anyconnect Secure Mobility Client 竞争条件问题漏洞

Cisco Anyconnect Secure Mobility Client is a VPN client software for secure connectivity from Cisco. The Cisco AnyConnect Secure Mobility Client suffers from a Competitive Condition Issue vulnerability that arises from a competitive condition during signature verification of shared library files...

NETGEAR R7800 缓冲区错误漏洞

The NETGEAR R7800 is a wireless router from NETGEAR. The NETGEAR R7800 suffers from a buffer error vulnerability that stems from a lack of proper validation of user-supplied data, which could result in a write beyond the end of the allocated data structure. An attacker could exploit this...

Siemens Desigo CC 操作系统命令注入漏洞

Siemens Desigo CC is an open building management platform from Siemens, Germany.GMA Manager allows the functional combination of different safety and security systems, such as fire detection systems and video surveillance, on a common platform.Operation Scheduler is a tool that enables security...

CVE-2021-39274

In XeroSecurity Sn1per 9.0 free version, insecure directory permissions 0777 are set during installation, allowing an unprivileged user to modify the main application and the application configuration file. This results in arbitrary code execution with root privileges...

XeroSecurity Sn1per 安全漏洞

XeroSecurity Sn1per is a persistent attack surface management ASM platform. A security vulnerability exists in XeroSecurity Sn1per version 9.0 that stems from an application execution with insecure permissions set 0777 that allows an unprivileged user to modify the application, modules and...

Vulnerability fixed in Apple iOS, iPadOS and macOS

A vulnerability has been fixed in iOS, iPadOS and macOS. A malicious party could potentially exploit the vulnerability to execute arbitrary code under root privileges. Apple indicates that this vulnerability may be actively abused being exploited. Apple has released updates to fix the...

Fortinet FortiManager和Fortinet FortiAnalyzer 资源管理错误漏洞

Fortinet FortiManager and Fortinet FortiAnalyzer are both products from Fortinet, Inc. Fortinet FortiManager is a centralized network security management platform. The platform supports centralized management of any number of Fortinet devices, and can be grouped into different management domains...