CVE-2022-32482: Improper Input Validation

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable...

CVE-2023-22324: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the CONPROSYS HMI System CHS Ver.3.5.0 and earlier allows a remote authenticated attacker to execute an arbitrary SQL command. As a result, information stored in the database may be obtained...

EdgeNexus ADC 操作系统命令注入漏洞

EdgeNexus ADC is a powerful and easy-to-use load balancer from EdgeNexus. An operating system command injection vulnerability exists in EdgeNexus ADC version 4.2.8, which stems from the presence of a command injection vulnerability that allows an authenticated attacker to execute arbitrary comman...

CVE-2022-37718

The management portal component of JetNexus/EdgeNexus ADC 4.2.8 was discovered to contain a command injection vulnerability. This vulnerability allows authenticated attackers to execute arbitrary commands through a specially crafted payload. This vulnerability can also be exploited from an...

CVE-2022-46648: Improper Control of Generation of Code

ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318...

CVE-2022-46372: Improper Input Validation

Alotcer - AR7088H-A firmware version 16.10.3 Command execution Improper validation of unspecified input field may allow Authenticated command execution...

Security Bulletin: Multiple Vulnerabilities in Java and Node.js packages affect IBM Voice Gateway

Summary Security Vulnerabilities in Java and Node.js packages affect IBM Voice Gateway. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2022-25857 DESCRIPTION: Java package org.yaml:snakeyam is vulnerable to a denial of service, caused by missing to nested depth limitatio...

PT-2023-1416 · Zyxel · Zyxel Nr7101

Name of the Vulnerable Software and Affected Versions: Zyxel NR7101 firmware versions prior to V1.15ACCC.3C0 Description: The issue is caused by a buffer overflow vulnerability in the parameter of the CGI program. This could allow an authenticated attacker to cause denial-of-service DoS condition...

CVE-2022-43532

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-site scripting XSS attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script...

PT-2022-27871 · Tp Link · Tp-Link Tl-Wr740N

Name of the Vulnerable Software and Affected Versions: TP-Link TL-WR740N V1 and V2 versions 3.12.4 and earlier Description: The issue allows authenticated attackers to execute arbitrary code or cause a Denial of Service DoS via uploading a crafted firmware image during the firmware update process...

TP-LINK TL-WR740N 安全漏洞

The TP-LINK TL-WR740N is a wireless router from China P&L TP-LINK. A security vulnerability exists in TP-LINK TL-WR740N V1 and V2 firmware v3.12.4 and earlier versions, which originates from the ability of an authenticated attacker to achieve arbitrary code execution or denial of service by...

CVE-2022-46430: Download of Code Without Integrity Check

TP-Link TL-WR740N V1 and V2 v3.12.4 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial of Service DoS via uploading a crafted firmware image during the firmware update process...

CVE-2022-41264: Improper Control of Generation of Code

Due to the unrestricted scope of the RFC function module, SAP BASIS - versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, 791, allows an authenticated non-administrator attacker to access a system class and execute any of its public methods with parameters provided by the attacke...

CVE-2022-46143: Improper Validation of Specified Quantity in Input

Affected devices do not check the TFTP blocksize correctly. This could allow an authenticated attacker to read from an uninitialized buffer that potentially contains previously allocated data...

CVE-2022-43660

The CVE-2022-43660 issue is an SSI (Server-Side Includes) handling vulnerability in Movable Type and related products. A remote authenticated attacker with the privilege “Manage of Content Types” could execute arbitrary Perl scripts or arbitrary OS commands via a crafted web page. Affected are Mo...

CVE-2022-44608: Uncontrolled Resource Consumption

Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.0.0 to 4.0.3 allows a remote authenticated attacker to consume huge storage space, which may result in a denial-of-service DoS condition...

CVE-2021-43258: Unrestricted Upload of File with Dangerous Type

CartView.php in ChurchInfo 1.3.0 allows attackers to achieve remote code execution through insecure uploads. This requires authenticated access tot he ChurchInfo application. Once authenticated, a user can add names to their cart, and compose an email. Uploading an attachment for the email stores...

CVE-2022-39066: Improper Neutralization of Special Elements used in an SQL Command

There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an authenticated attacker could use the vulnerability to execute arbitrary SQL injection...

CVE-2022-43492 WordPress Comments – wpDiscuz plugin 7.4.2 - Auth. Insecure Direct Object References (IDOR) vulnerability

Auth. subscriber+ Insecure Direct Object References IDOR vulnerability in Comments – wpDiscuz plugin 7.4.2 on WordPress...

PT-2022-26841 · Intelbras · Intelbras Sg 2404 Mr

Name of the Vulnerable Software and Affected Versions: INTELBRAS SG 2404 MR version 20180928-rel64938 Description: The issue allows authenticated attackers to create Administrator accounts arbitrarily through crafted user cookies. Recommendations: For version 20180928-rel64938, consider restricti...