PowerCMS XMLRPC API vulnerable to command injection

Overview PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability CWE-74. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. According to the...

PT-2022-23527 · Unknown · Pkuvcl Davs2

Name of the Vulnerable Software and Affected Versions: PKUVCL davs2 version 1.6.205 Description: A global buffer overflow was discovered in the parse sequence header function at source/common/header.cc:269. This issue affects the specified version of PKUVCL davs2. Recommendations: For PKUVCL davs...

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium such as a flash disk could use this flaw to force a user into permanently disabling the encryption layer of that medium.

...

PT-2022-23861 · Unknown · Garage Management System

Name of the Vulnerable Software and Affected Versions: Garage Management System version 1.0 Description: The application manage website.php is vulnerable to Shell File Upload. An already authenticated malicious user can upload a dangerous Remote Code Execution RCE or Local Code Execution LCE...

Grafana Image Renderer leaking files

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser Chromium/Chrome. An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized fil...

PT-2022-14032 · WordPress · Stop Comment Spam

Name of the Vulnerable Software and Affected Versions: Stop Spam Comments WordPress plugin versions 0.2.1.2 and earlier Description: The issue arises from the improper generation of the Javascript access token, which is intended to prevent abuse of the comment section. This allows threat authors ...

PT-2022-17431 · Npm · @Pendo324/Get-Process-By-Name

Name of the Vulnerable Software and Affected Versions: @pendo324/get-process-by-name versions all Description: The issue is related to Arbitrary Code Execution due to improper sanitization of the getProcessByName function. This allows for potential code execution without proper validation...

PT-2022-24452 · Linksys · Linksys E1200

Name of the Vulnerable Software and Affected Versions: Linksys E1200 version 1.0.04 Description: The issue is related to a buffer overflow vulnerability. It can be triggered via the ej get web page name function. Recommendations: For Linksys E1200 version 1.0.04, as a temporary workaround, consid...

PT-2022-24456 · Tenda · Tenda M3

Name of the Vulnerable Software and Affected Versions: Tenda M3 version 1.0.0.124856 Description: A heap buffer overflow issue was found in the formSetFixTools function, allowing attackers to cause a Denial of Service DoS by exploiting the lan parameter. Recommendations: For Tenda M3 version...

PT-2022-24457 · Tenda · Tenda M3

Name of the Vulnerable Software and Affected Versions: Tenda M3 version 1.0.0.124856 Description: A heap buffer overflow issue was found in the function formSetFixTools, allowing attackers to cause a Denial of Service DoS via the MACAddr parameter. Recommendations: For Tenda M3 version...

PT-2022-24464 · Tenda · Tenda M3

Name of the Vulnerable Software and Affected Versions: Tenda M3 version 1.0.0.124856 Description: A buffer overflow was discovered in the function formSetGuideListItem. Recommendations: For Tenda M3 version 1.0.0.124856, consider disabling the formSetGuideListItem function until a patch is...

PT-2022-23443 · Mikrotik · Routeros +1

Name of the Vulnerable Software and Affected Versions: Mikrotik RouterOs versions through 6.48.3 Description: The issue is related to an assertion failure in the component /advanced-tools/nova/bin/netwatch, allowing attackers to cause a Denial of Service DoS via a crafted packet. Recommendations:...

PT-2022-23413 · H3C · H3C Magic Nx18 Plus

Name of the Vulnerable Software and Affected Versions: H3C Magic NX18 Plus version NX18PV100R003 Description: A stack overflow issue was discovered via the function UpdateIpv6Params. Recommendations: For version NX18PV100R003, consider disabling the UpdateIpv6Params function as a temporary...

PT-2022-24084 · Tenda · Tenda Ac1206

Name of the Vulnerable Software and Affected Versions: Tenda AC1206 version 15.03.06.23 Description: A stack overflow issue was discovered via the page parameter in the fromDhcpListClient function. Recommendations: For Tenda AC1206 version 15.03.06.23, consider disabling the fromDhcpListClient...

PT-2022-23417 · H3C · H3C Magic Nx18 Plus

Name of the Vulnerable Software and Affected Versions: H3C Magic NX18 Plus version NX18PV100R003 Description: A stack overflow issue was discovered via the function addactionlist. Recommendations: For H3C Magic NX18 Plus version NX18PV100R003, consider disabling the addactionlist function until a...

PT-2022-23416 · H3C · H3C Magic Nx18 Plus

Name of the Vulnerable Software and Affected Versions: H3C Magic NX18 Plus version NX18PV100R003 Description: A stack overflow issue was discovered via the function edditactionlist. Recommendations: For H3C Magic NX18 Plus version NX18PV100R003, as a temporary workaround, consider disabling the...

PT-2022-23406 · Totolink · Totolink N350Rt

Name of the Vulnerable Software and Affected Versions: TOTOLINK N350RT version 9.3.5u.6139 B20201216 Description: A stack overflow issue was discovered in the setDiagnosisCfg function, which can be exploited. Recommendations: For TOTOLINK N350RT version 9.3.5u.6139 B20201216, as a temporary...

PT-2022-23808 · H3C · H3C H200

Name of the Vulnerable Software and Affected Versions: H3C H200 version H200V100R004 Description: A stack overflow issue was discovered via the function SetAPWifiorLedInfoById. Recommendations: For H3C H200 version H200V100R004, consider disabling the SetAPWifiorLedInfoById function as a temporar...

PT-2022-23781 · H3C · H3C Gr-1200W

Name of the Vulnerable Software and Affected Versions: H3C GR-1200W MiniGRW1A0V100R006 Description: A stack overflow issue was discovered in the function UpdateWanParamsMulti. Recommendations: For H3C GR-1200W MiniGRW1A0V100R006, as a temporary workaround, consider disabling the...

PT-2022-23438 · H3C · H3C Gr-1200W

Name of the Vulnerable Software and Affected Versions: H3C GR-1200W MiniGRW1A0V100R006 Description: A stack overflow issue was discovered in the H3C GR-1200W MiniGRW1A0V100R006 via the function debug wlan advance. Recommendations: For H3C GR-1200W MiniGRW1A0V100R006, consider disabling the debug...