CVE-2022-1238: Out-of-bounds Write

Out-of-bounds Write in libr/bin/format/ne/ne.c in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow and may be exploitable. For more general description of heap buffer overflow, see CWE...

PT-2022-13738

Name of the Vulnerable Software and Affected Versions radare2 versions prior to 5.6.8 Description The issue is related to an out-of-bounds write in the libr/bin/format/ne/ne.c file, which can cause a heap buffer overflow. This may be exploitable. The heap buffer overflow occurs when more data is...

CVE-2022-1238

Out-of-bounds Write in libr/bin/format/ne/ne.c in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow and may be exploitable. For more general description of heap buffer overflow, see CWE...

CVE-2022-1240: Heap-based Buffer Overflow

Heap buffer overflow in libr/bin/format/mach0/mach0.c in GitHub repository radareorg/radare2 prior to 5.8.6. If address sanitizer is disabled during the compiling, the program should executes into the rstrncpy function. Therefore I think it is very likely to be exploitable. For more general...

PT-2022-2537 · D Link · D-Link Dir-882

Name of the Vulnerable Software and Affected Versions: D-link DIR-882 version A1 FW130B06 Description: A command injection issue was found in the /usr/bin/cli endpoint, related to the handling of symbolic links. This could allow a remote attacker to execute arbitrary commands due to inadequate da...

CVE-2021-43722

D-Link DIR-645 1.03 A1 is vulnerable to Buffer Overflow. The hnapmain function in the cgibin handler uses sprintf to format the soapaction header onto the stack and has no limit on the size...

Tenda M3 Command Injection Vulnerability (CNVD-2022-33114)

Tenda M3 is an access control from Tenda, a Chinese company. Tenda M3 is vulnerable to command injection, which stems from the failure of the component /cgi-bin/uploadWeiXinPic to properly filter the construction of command special characters, commands, etc. An attacker could use this vulnerabili...

CVE-2022-27083

Tenda M3 1.10 V1.0.0.124856 was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadAccessCodePic...

CVE-2022-27083: Improper Neutralization of Special Elements used in a Command

Tenda M3 1.10 V1.0.0.124856 was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadAccessCodePic...

PT-2022-12023 · Razer · Razer Synapse

Name of the Vulnerable Software and Affected Versions: Razer Synapse versions prior to 3.7.0228.022817 Description: The issue allows privilege escalation because Razer Synapse relies on %PROGRAMDATA%RazerSynapse3Servicebin even if %PROGRAMDATA%Razer has been created by any unprivileged user befor...

Tenda M3 命令注入漏洞

Tenda M3 is an access control from Tenda, a Chinese company. Tenda M3 is vulnerable to command injection, which stems from the failure of the component /cgi-bin/uploadWeiXinPic to properly filter the construction of command special characters, commands, etc. An attacker could use this vulnerabili...

CVE-2022-27077: Improper Neutralization of Special Elements used in a Command

Tenda M3 1.10 V1.0.0.124856 was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadWeiXinPic...

CVE-2022-24595

CVE-2022-24595 affects Automotive Grade Linux Kooky Koi versions 11.0.0–11.0.5. The root cause is Incorrect Access Control in /usr/bin/afb-daemon. An attacker can exploit by sending a crafted HTTP (or WebSocket) request to the socket listened by the afb-daemon process, with no credentials or user...

CVE-2022-24595

Automotive Grade Linux Kooky Koi 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, and 11.0.5 is affected by Incorrect Access Control in usr/bin/afb-daemon. To exploit the vulnerability, an attacker should send a well-crafted HTTP or WebSocket request to the socket listened by the afb-daemon process. No...

CVE-2022-24595: Undefined Security Weakness

Automotive Grade Linux Kooky Koi 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, and 11.0.5 is affected by Incorrect Access Control in usr/bin/afb-daemon. To exploit the vulnerability, an attacker should send a well-crafted HTTP or WebSocket request to the socket listened by the afb-daemon process. No...

PT-2022-11499

Name of the Vulnerable Software and Affected Versions Luna Simo PPR1.180610.011/202001031830 Description An issue was discovered that allows local third-party apps to provide a spoofed software update file, which can contain an arbitrary shell script and arbitrary ARM binary. These will be execut...

CVE-2022-24177

A cross-site scripting XSS vulnerability in the component cgi-bin/ej.cgi of Ex libris ALEPH 500 v18.1 and v20 allows attackers to execute arbitrary web scripts or HTML...

PT-2022-16524

Name of the Vulnerable Software and Affected Versions Ex libris ALEPH 500 versions 18.1 through 20 Description A cross-site scripting XSS issue exists in the component cgi-bin/ej.cgi, allowing attackers to execute arbitrary web scripts or HTML. Recommendations For versions 18.1 through 20, consid...

CVE-2022-24177: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the component cgi-bin/ej.cgi of Ex libris ALEPH 500 v18.1 and v20 allows attackers to execute arbitrary web scripts or HTML...

PT-2022-17896

Name of the Vulnerable Software and Affected Versions Veritas InfoScale Operations Manager versions prior to 7.4.2 Patch 600 Veritas InfoScale Operations Manager versions 8.x prior to 8.0.0 Patch 100 Description The web server in Veritas InfoScale Operations Manager fails to sanitize input data f...