CVE-2022-28492

CVE-2022-28492 concerns TOTOLINK CPE devices (e.g., CP900) with firmware V6.3c.566 . The exposure described is a remote login authentication bypass, enabling an attacker to gain unauthorized access without user interaction. Reported metrics show a CRITICAL (3.1, base score 9.8) impact with networ...

CVE-2022-28496

TOTOLink outdoor CPE CP900 V6.3c.566B20171026 discovered to contain a command injection vulnerability in the setPasswordCfg function via the adminuser and adminpassparameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-28491

TOTOLink outdoor CPE CP900 V6.3c.566B20171026 contains a command injection vulnerability in the NTPSyncWithHost function via the hostname parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

RHEL 8 : nss (RHSA-2023:1436)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1436 advisory. Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server...

CVE-2022-28496

CVE-2022-28496 affects TOTOLink outdoor CPE CP900 (version 6.3c.566_B20171026). A command injection vulnerability exists in the setPasswordCfg function exposed via the adminuser and adminpass parameters, allowing an attacker to execute arbitrary commands through a crafted request. The CVE entry n...

CVE-2022-28494

The CVE-2022-28494 entry relates to TOTOLink outdoor CPE CP900 (version 6.3c.566_B20171026). A command injection flaw exists in the setUpgradeFW function reachable via the filename parameter, allowing an attacker to execute arbitrary commands through a crafted request. The NVD metrics indicate a ...

Zyxel Unauthenticated LAN Remote Code Execution Exploit

This Metasploit module exploits a buffer overflow in the zhttpd binary /bin/zhttpd. It is present on more than 40 Zyxel routers and CPE devices. The code execution vulnerability can only be exploited by an attacker if the zhttp webserver is reachable. No authentication is required. After...

Fedora 37 : firefox (2023-24b2b22eca)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-24b2b22eca advisory. - Update to latest upstream 111.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

CBL Mariner 2.0 Security Update: kernel (CVE-2022-3105)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-3105 advisory. - An issue was discovered in the Linux kernel through 5.16-rc6. uapifinalize in...

SUSE SLES12 Security Update : libX11 (SUSE-SU-2023:0667-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0667-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. File data...

WordPress WPCode - Insert Headers and Footers Plugin < 2.0.7 Improper Authorization Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wpcode:wpcode"; ifdescription...

The vulnerability of Zyxel 5G NR/4G LTE CPE router’s micro-programming software arises from the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows a hacker to execute arbitrary commands.

The vulnerability of Zyxel 5G NR/4G LTE CPE routers’ microprogramming software exists due to the lack of measures taken to neutralize the special elements used in the operating system’s commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands using a speciall...

XWiki 7.1-milestone-1 < 14.0 Uncontrolled Resource Consumption Vulnerability (GHSA-92wp-r7hm-42g7)

Xwiki is prone to an uncontrolled resource consumption vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki...

Node.js 14.x < 14.21.3, 16.x < 16.19.1, 18.x < 18.14.1, 19.x < 19.6.1 Multiple Vulnerabilities - Windows

Node.js is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nodejs:node.js"; ifdescription...

Node.js 16.x < 16.19.1, 18.x < 18.14.1, 19.x < 19.6.1 Multiple Vulnerabilities - Mac OS X

Node.js is prone to multiple vulnerabilities. Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

WordPress Popup Maker Plugin < 1.16.11 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:code-atlantic:popupmaker"; ifdescription...

Nextcloud Server < 23.0.12, 24.x < 24.0.8, 25.x < 25.0.2 Path Traversal Vulnerability (GHSA-273v-9h7x-p68v)

Nextcloud Server is prone to a path traversal vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Checkmk 2.0.x < 2.0.0p30, 2.1.x < 2.1.0p14 Information Disclosure Vulnerability

Checkmk is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:checkmk:checkmk"; if...

NewStart CGSL CORE 5.04 / MAIN 5.04 : sos Vulnerability (NS-SA-2023-0002)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has sos packages installed that are affected by a vulnerability: - It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in: sos-4.2-20.el86, ovirt-log-collector-4.4.7-2.el8ev...

Python < 3.7.17, 3.8.x < 3.8.17, 3.9.x < 3.9.17, 3.10.x < 3.10.12, 3.11.x < 3.11.4 RCE Vulnerability - Mac OS X

Python is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python";...