1611 matches found
PT-2022-16259
Name of the Vulnerable Software and Affected Versions Go versions prior to 1.16.14 Go versions 1.17.x prior to 1.17.7 Description The issue concerns incorrect access control. It occurs when the cmd/go in Go misinterprets branch names that falsely appear to be version tags. This misinterpretation...
CVE-2022-23773: Interpretation Conflict
cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags...
GHSA-4V9W-PVWR-38H3 OS Command Injection in strong-nginx-controller
strong-nginx-controller through 1.0.2 is vulnerable to Command Injection. It allows execution of arbitrary command as part of the 'nginxCmd' function...
go -- multiple vulnerabilities
The Go project reports: crypto/elliptic: fix IsOnCurve for big.Int values that are not valid coordinates Some big.Int values that are not valid field elements negative or overflowing might cause Curve.IsOnCurve to incorrectly return true. Operating on those values may cause a panic or an invalid...
CVE-2021-46354
Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the web server or increas...
CVE-2021-46354
Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the web server or increas...
CVE-2021-46354
Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the web server or increas...
CVE-2021-46354
CVE-2021-46354 affects Thinfinity VirtualUI versions 2.1.28.0, 2.1.32.1, and 2.5.26.2; fixed in 3.0. The vulnerability is an information disclosure caused by the Addr parameter in the cmd site, enabling the vulnerable server to send requests to external systems and potentially reveal the real IP ...
PT-2022-12665
Name of the Vulnerable Software and Affected Versions Thinfinity VirtualUI versions 2.1.28.0 through 2.5.26.2 Description The issue affects the Addr parameter in the cmd site, allowing the vulnerable server to disclose information or increase the attack surface by sending requests to other system...
CVE-2021-46354: Exposure of Resource to Wrong Sphere
Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the web server or increas...
Cybele Software Thinfinity VirtualUI 信息泄露漏洞
Cybele Software Thinfinity VirtualUI is a solution from Cybele Software, Inc. that supports embedding remote Windows applications into standard web applications to allow two-way interaction with Javascript programming. Cybele Software Thinfinity VirtualUI suffers from an information disclosure...
PT-2022-37940
Уязвимость функции asix read cmd модуля drivers/net/usb/asix common.c драйвера поддержки сетевых адаптеров USB ядра операционной системы Linux связана с отсутствием проверки возвращаемого значения. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...
CVE-2021-46233
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function mspinfo.htm. This vulnerability allows attackers to execute arbitrary commands via the cmd parameter...
CVE-2021-46233
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function mspinfo.htm. This vulnerability allows attackers to execute arbitrary commands via the cmd parameter...
CVE-2021-46233
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function mspinfo.htm. This vulnerability allows attackers to execute arbitrary commands via the cmd parameter...
CVE-2021-46233: Improper Neutralization of Special Elements used in a Command
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function mspinfo.htm. This vulnerability allows attackers to execute arbitrary commands via the cmd parameter...
PT-2022-2440
Name of the Vulnerable Software and Affected Versions D-Link DIR-825AC G1 affected versions not specified Description The issue is related to the incorrect handling of the cmd parameter in the cgi-bin/webupg component of the D-Link DIR-825AC G1 router's firmware. This can allow an attacker to...
Null pointer dereference
There is a NULL pointer deference in the Allwinner R818 SoC Android Q SDK V1.0 camera driver /dev/cedardev that could use the ioctl cmd IOCTLGETIOMMUADDR to cause a system crash...
CVE-2021-38785
CVE-2021-38785 describes a NULL pointer dereference in the Allwinner R818 SoC Android Q SDK V1.0 camera driver /dev/cedar_dev. The issue can be triggered by the IOCTL_GET_IOMMU_ADDR ioctl, leading to a system crash. The available documents identify the affected component and the crash impact but ...