CVE-2022-43626

CVE-2022-43626 affects the D-Link DIR-1935 (version 1.03). The flaw is in the web management SetIPv4FirewallSettings handling of IPv4FirewallRule elements, where a user-supplied string isn’t properly validated before it’s used in a system call, enabling arbitrary code execution in the root contex...

CVE-2022-43623

CVE-2022-43623 affects D-Link DIR-1935 1.03. The vulnerability is a command-injection flaw in the web management portal’s handling of the SetWebFilterSetting request, specifically when parsing the WebFilterURLs element. A user-supplied string is not properly validated before being used to execute...

D-Link DIR-1935 操作系统命令注入漏洞

The D-Link DIR-1935 is a wireless router from China's AUO D-Link. The D-Link DIR-1935 suffers from an operating system command injection vulnerability that originates when parsing sub-elements within a VirtualServerInfo element, where the process does not properly validate before executing a syst...

CVE-2022-3210

This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the xupnpd service, which listens on TCP port 4044 by defaul...

CVE-2022-42433

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR841N TL-WR841NUSV14220121 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

CVE-2022-43632

CVE-2022-43632 affects D-Link DIR-1935 firmware 1.03. The flaw is in SetQoSSettings QoSInfo parsing: unvalidated user-supplied data is used in a system call, allowing network-adjacent attackers to achieve code execution as root. Exploitation details are documented by ZDI (ZDI-22-1504) and other f...

CVE-2022-43623

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

D-Link DIR-1935 操作系统命令注入漏洞

The D-Link DIR-1935 is a wireless router from China-based AUO D-Link. The D-Link DIR-1935 suffers from an operating system command injection vulnerability that stems from a process not properly validating before executing a system call with a user-supplied string when parsing sub-elements within ...

D-Link DIR-825 操作系统命令注入漏洞

The D-Link DIR-825 is a router from China-based AUO D-Link. The D-Link DIR-825 suffers from an operating system command injection vulnerability that originates from failure to properly validate a user-supplied string before executing a system call using it...

CVE-2022-43646

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Vimeo plugin for the xupnpd service, which listens on TCP...

D-Link DIR-825 操作系统命令注入漏洞

The D-Link DIR-825 is a router from China-based AUO D-Link. The D-Link DIR-825 suffers from an operating system command injection vulnerability that originates from failure to properly validate a user-supplied string before executing a system call using it...

D-Link DIR-825 操作系统命令注入漏洞

The D-Link DIR-825 is a router from China-based AUO D-Link. The D-Link DIR-825 suffers from an operating system command injection vulnerability that originates from failure to properly validate a user-supplied string before executing a system call using it...

D-Link DIR-825 操作系统命令注入漏洞

The D-Link DIR-825 is a router from China-based AUO D-Link. The D-Link DIR-825 suffers from an operating system command injection vulnerability that originates from failure to properly validate a user-supplied string before executing a system call using it...

CVE-2022-43623

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2023-1562

Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/users API call, allowing an attacker to learn the full name of a board owner...

Buffer overflow

Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/users API call, allowing an attacker to learn the full name of a board owner...

CVE-2023-1562 Full name revealed via /plugins/focalboard/api/v2/users

Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/users API call, allowing an attacker to learn the full name of a board owner...

CVE-2023-1562 Full name revealed via /plugins/focalboard/api/v2/users

Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/users API call, allowing an attacker to learn the full name of a board owner...

The vulnerability relates to the runtime of procedure calls in Windows operating systems, allowing an attacker to execute arbitrary code.

The vulnerability of remote procedure call runtime in Windows operating systems exists due to insufficient checking of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability relates to the runtime of procedure calls in Windows operating systems, allowing an attacker to execute arbitrary code.

The vulnerability of remote procedure call runtime in Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...