CVE-2022-28635

A potential local arbitrary code execution and a local denial of service DoS vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 iLO 5 firmware versions: Prior to 2.71. An unprivileged user could locally exploit this vulnerability to potentially execute arbitra...

CVE-2022-28630

A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 iLO 5 firmware versions: Prior to 2.71. An unprivileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality and integrity, and a partial...

CVE-2022-28627

A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 iLO 5 firmware versions: Prior to 2.71. An unprivileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and availability...

CVE-2022-28626

CVE-2022-28626 concerns HPE Integrated Lights-Out 5 (iLO 5) firmware prior to 2.71. A local arbitrary code execution vulnerability exists, exploitable by a highly privileged user with local access, leading to complete compromise of confidentiality, integrity, and availability. The issue is tied t...

CVE-2022-28626

A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 iLO 5 firmware versions: Prior to 2.71. A highly privileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and...

SonicWall SMA1000 CVE-2021-33909 and CVE-2022-0847

This advisory is intended to address Linux Kernel vulnerability CVE-2021-33909 and CVE-2022-0847 in the SonicWall SMA1000 platform.SonicWall has performed a comprehensive analysis of the SMA1000 platform that resulted in no observable attack vectors for CVE-2021-33909 and CVE-2022-0847. To remove...

PT-2022-22886 · Wavlink · Wavlink Wn530H4 +4

Name of the Vulnerable Software and Affected Versions: WAVLINK WN572HP3 WAVLINK WN533A8 WAVLINK WN530H4 WAVLINK WN535G3 WAVLINK WN531P3 Description: The issue concerns a lack of filtering on the del mac and flag parameters in the firewall.cgi, leading to command injection in the /cli black...

PT-2022-22889 · Wavlink · Wavlink Wn533A8 +4

Name of the Vulnerable Software and Affected Versions: WAVLINK WN572HP3 WAVLINK WN533A8 WAVLINK WN530H4 WAVLINK WN535G3 WAVLINK WN531P3 Description: The issue is related to the login.cgi, which has no filtering on the key parameter, leading to command injection in the /login.shtml page...

Intel® PROSet/Wireless WiFi and Killer™ WiFi Advisory

Summary: Potential security vulnerabilities in some Intel® PROSet/Wireless WiFi and Killer™ WiFi products may allow escalation of privilege, information disclosure or denial of service. Intel is releasing firmware and software updates to mitigate these potential vulnerabilities. Vulnerability...

PT-2022-4222 · Intel · Intel Wireless Bluetooth +1

Name of the Vulnerable Software and Affected Versions: IntelR Wireless BluetoothR and KillerTM BluetoothR products versions prior to 22.120 Description: The issue is related to improper buffer restrictions in the firmware of some IntelR Wireless BluetoothR and KillerTM BluetoothR products. This m...

Intel® Wireless Bluetooth® and Killer™ Bluetooth® Advisory

Summary: Potential security vulnerabilities in some Intel® Wireless Bluetooth® and Killer™ Bluetooth® products may allow escalation of privilege, denial of service or information disclosure. Intel is releasing firmware updates to mitigate these potential vulnerabilities. Vulnerability Details:...

Vulnerability fixed in DrayTek Vigor routers

Researchers from security firm Trellix have found a vulnerability found in DrayTek Vigor routers. A unauthenticated malicious person with network access to the management interface could exploit the vulnerability to execute arbitrary code. This allows the malicious party to gain control of the...

muhttpd versions 1.1.5 and earlier are vulnerable to path traversal

Overview Versions 1.1.5 and earlier of the mu HTTP deamon muhttpd are vulnerable to path traversal via crafted HTTP request from an unauthenticated user. This vulnerability can allow unauthenticated users to download arbitrary files and collect private information on the target device. Descriptio...

PT-2022-4946 · Huawei · Cv81-Wdm

Name of the Vulnerable Software and Affected Versions: CV81-WDM FW versions 01.70.49.29.46 Description: The issue is related to insufficient input verification in the software of Huawei multifunctional devices, which can be exploited by a remote attacker to cause a denial of service DoS using a...

CONTEC SolarView Compact vulnerable to insufficient verification in uploading files

Overview SolarView Compact provided by CONTEC CO., LTD. is PV Measurement System. The image file management page of SolarView Compact contains an insufficient verification vulnerability when uploadi webray reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer.ng files...

PT-2022-7030 · D Link · D-Link Dir820La1

Name of the Vulnerable Software and Affected Versions: D-Link DIR820LA1 versions prior to FW106B02 Description: The issue is caused by a buffer overflow on the stack in the ping.ccp component of the D-Link DIR820LA1 router's firmware. This can be exploited by a remote attacker to cause a denial o...

CVE-2022-30316

Honeywell Experion PKS Safety Manager 5.02 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0054, there is a Honeywell Experion PKS Safety Manager unauthenticated firmware update issue. The affected components are characterized as: Firmware update functionality. The...

Hardcoded credentials

Honeywell Experion PKS Safety Manager 5.02 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0054, there is a Honeywell Experion PKS Safety Manager unauthenticated firmware update issue. The affected components are characterized as: Firmware update functionality. The...

CVE-2022-30316

Honeywell Experion PKS Safety Manager 5.02 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0054, there is a Honeywell Experion PKS Safety Manager unauthenticated firmware update issue. The affected components are characterized as: Firmware update functionality. The...

CVE-2022-30316

Honeywell Experion PKS Safety Manager 5.02 is affected by CVE-2022-30316 due to Insufficient Verification of Data Authenticity in the firmware update flow. The flaw stems from unauthenticated firmware images and dependencies on insecure checksums, with firmware images unsigned. A serial interface...