CVE-2021-33316: Improper Input Validation

The TRENDnet TI-PG1284i switchhw v2.0R prior to version 2.0.2.S0 suffers from an integer underflow vulnerability. This vulnerability exists in its lldp related component. Due to lack of proper validation on length field of ChassisID TLV, by sending a crafted lldp packet to the device, integer...

CVE-2021-33315: Improper Input Validation

The TRENDnet TI-PG1284i switchhw v2.0R prior to version 2.0.2.S0 suffers from an integer underflow vulnerability. This vulnerability exists in its lldp related component. Due to lack of proper validation on length field of PortID TLV, by sending a crafted lldp packet to the device, integer...

PT-2022-10227

Name of the Vulnerable Software and Affected Versions TRENDnet TI-PG1284i switch hw v2.0R versions prior to 2.0.2.S0 Description The issue exists in the lldp related component of the switch due to a lack of proper validation on the length field of ChassisID TLV. By sending a crafted lldp packet t...

PT-2022-38065

Уязвимость функции wl1251 event wait модуля drivers/net/wireless/ti/wl1251/event.c драйвера поддержки адаптеров беспроводной связи Texas Instruments ядра операционной системы Linux связана с неправильным отключением или освобождением ресурса. Эксплуатация уязвимости может позволить нарушителю...

GSD-2022-1001882 media: ti-vpe: cal: Fix a NULL pointer dereference in cal_ctx_v4l2_init_formats()

media: ti-vpe: cal: Fix a NULL pointer dereference in calctxv4l2initformats This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.33 by commit...

GSD-2022-1001574 media: ti-vpe: cal: Fix a NULL pointer dereference in cal_ctx_v4l2_init_formats()

media: ti-vpe: cal: Fix a NULL pointer dereference in calctxv4l2initformats This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.19 by commit...

GSD-2022-1001266 media: ti-vpe: cal: Fix a NULL pointer dereference in cal_ctx_v4l2_init_formats()

media: ti-vpe: cal: Fix a NULL pointer dereference in calctxv4l2initformats This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.2 by commit...

PT-2022-37935

Уязвимость функции cpsw ethtool op begin модуля drivers/net/ethernet/ti/cpsw ethtool.c драйвера поддержки сетевых адаптеров Ethernet Texas Instruments ядра операционной системы Linux связана с раскрытием конфиденциальной информации. Эксплуатация уязвимости может позволить нарушителю вызвать отказ...

ALPINE-CVE-2022-0865

Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 5e180045...

WordPress TI WooCommerce Wishlist plugin SQL injection vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers.A SQL injection vulnerability exists in versions of the WordPress TI WooCommerce Wishlist plugin prior to 1.40.1, which stem...

CVE-2022-0412

The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro WordPress plugins (versions before 1.40.1 ) are vulnerable to an unauthenticated Blind SQL injection attack. The root cause is the failure to sanitize and escape the item_id parameter when used in a SQL statement via the wishlist/remove_...

CVE-2022-0412: Improper Neutralization of Special Elements used in an SQL Command

The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the itemid parameter before using it in a SQL statement via the wishlist/removeproduct REST endpoint, allowing unauthenticated attackers to perform SQL...

Sealevel Systems, Inc. SeaConnect 370W Web Server information disclosure vulnerability

Summary An information disclosure vulnerability exists in the Web Server functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger...

Sealevel Systems, Inc. SeaConnect 370W OTA update task out-of-bounds write vulnerability

Summary An out-of-bounds write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to denial of service. An attacker can perform a man-in-the-middle attack to trigger this vulnerability. Tested...

Sealevel Systems, Inc. SeaConnect 370W MQTTS Certificate Validation vulnerability

Summary A misconfiguration exists in the MQTTS functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. This misconfiguration significantly simplifies a man-in-the-middle attack, which directly leads to control of device functionality. Tested Versions Sealevel Systems, Inc. SeaConnect 370...

Sealevel Systems, Inc. SeaConnect 370W Modbus/SeaMAX Remote Configuration denial of service vulnerabilities

Summary Two denial of service vulnerabilities exist in the Modbus/SeaMAX Remote Configuration functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. Specially-crafted network packets can lead to denial of service. An attacker can send a malicious packet to trigger these vulnerabilities...

Sealevel Systems, Inc. SeaConnect 370W LLMNR/NBNS stack-based buffer overflow vulnerabilities

Summary A stack-based buffer overflow vulnerability exists in both the LLMNR and NBNS functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted network packet can lead to remote code execution. An attacker can send a malicious packet to trigger either of the...

TI WooCommerce Wishlist < 1.40.1 - Unauthenticated Blind SQL Injection

The plugins do not sanitise and escape the itemid parameter before using it in a SQL statement via the wishlist/removeproduct REST endpoint, allowing unauthenticated attackers to perform SQL injection attacks time wget...

GSD-2021-1002272 usb: typec: tipd: Remove WARN_ON in tps6598x_block_read

usb: typec: tipd: Remove WARNON in tps6598xblockread This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.162 by commit...

CVE-2020-16630

The CVE-2020-16630 entry concerns TI’s BLE stack, where the Long-Term Key (LTK) property is cached and reused for bonded devices. A LTK can be unauthenticated (Just Works) or authenticated (Passkey Entry, Numeric Comparison, or OOB). If a victim mobile securely paired with a TI BLE device generat...