CVE-2022-33313

CVE-2022-33313 affects Robustel R1510 (3.3.0) web_server endpoints. Multiple OS command injection flaws arise from unsafe handling of user-controlled input in several /action/ endpoints (notably /action/import_https_cert_file/, /action/import_cert_file/, and /action/import_sdk_file/). The root ca...

CVE-2022-33312

Multiple command injection vulnerabilities exist in the webserver action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The...

MAL-2022-6558 Malicious code in thisisourgoal1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7bccb974d5583b8e7f44d9f024a4b9dc28841f833b8b766b72cda46fe2802619 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6557 Malicious code in thisisourgoal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 22dade384fcf0c82ff13723cf8070dc513e1d5a97e1e67628ade9904a3a993dc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Advantech iView findCfgDeviceList segment SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetworkServlet endpoint, which listens on TCP port 8080 by default. When parsing the...

Advantech iView findSummaryUpdateDeviceList VALUE SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetworkServlet endpoint, which listens on TCP port 8080 by default. When...

Failed transfer with low level call won't revert

Lines of code Vulnerability details In BaseV1-periphery.sol, the function safeTransferCANTO is as follows: function safeTransferCANTOaddress to, uint value internal bool success, = to.callvalue:valuenew bytes0; requiresuccess, "TransferHelper: ETHTRANSFERFAILED"; This function is utilized in a fe...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli Netcool Impact (CVE-2021-39038)

Summary IBM WebSphere Application Server is shipped with IBM Tivoli Netcool Impact. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details CVEID: CVE-2021-39038 DESCRIPTION: IBM WebSphere Application...

The vulnerability of the JTAG interface implementation in microprogramming software for Intel processors allows a intruder to gain unauthorized access to protected information.

The vulnerability of the JTAG interface implementation in Intel microprogramming systems is related to deficiencies in the system’s controlled boundaries. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information...

CVE-2021-40943

In Bento4 1.6.0-638, there is a null pointer reference in the function AP4DescriptorListInspector::Action function in Ap4Descriptor.h:124 , as demonstrated by GPAC. This can cause a denial of service DOS...

MAL-2022-2519 Malicious code in discorddependency (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6577bf7838937492079199a51de2879d1d859228b7c04d7391bf04f0ef15a73b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-1916

The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store WordPress plugin before 1.0.5 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action available to both unauthenticated and authenticated users, leading to a...

CVE-2022-1953

The Product Configurator for WooCommerce WordPress plugin before 1.2.32 suffers from an arbitrary file deletion vulnerability via an AJAX action, accessible to unauthenticated users, which accepts user input that is being used in a path and passed to unlink without validation first...

CVE-2022-1953

The Product Configurator for WooCommerce WordPress plugin before 1.2.32 suffers from an arbitrary file deletion vulnerability via an AJAX action, accessible to unauthenticated users, which accepts user input that is being used in a path and passed to unlink without validation first...

CVE-2022-1572

The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file...

CVE-2022-1572

The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file...

CVE-2022-1572

The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file...

Authorization

The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover even the administrator due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username...

Cross site scripting

The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store WordPress plugin before 1.0.5 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action available to both unauthenticated and authenticated users, leading to a...

CVE-2022-1953

The CVE-2022-1953 entry concerns the WordPress Product Configurator for WooCommerce plugin prior to version 1.2.32. The vulnerability is an arbitrary file deletion via an unauthenticated AJAX action that accepts user input used in a filesystem path and passed to unlink() without validation. This ...