All Vulnerabilities for g-star.com Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Improper use of cryptographic key in wal-g

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

GHSA-VRMR-F2QH-3HHF Improper use of cryptographic key in wal-g

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

Geutebruck Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Geutebruck Multiple Remote Command Execution', 'Description' = %q This module bypasses the HTTP basic authentication used to access the /uapi-cgi...

PT-2021-5778 · Ntfs-3G +7 · Ntfs-3G +7

Name of the Vulnerable Software and Affected Versions: NTFS-3G versions prior to 2021.8.22 Description: The issue is related to the ntfs attr pwrite function in the NTFS-3G file system driver, which is affected by uncontrolled recursion. This can be exploited by an attacker using a specially...

Information Disclosure

github.com/wal-g/wal-g is vulnerable to information disclosure. The vulnerability exists when user uses libsodium encryption for their backup files which is not available but are silently processed and uploaded as plaintext...

CVE-2021-31698

Quectel EG25-G devices through 202006130814 allow executing arbitrary code remotely by using an AT command to place shell metacharacters in quectelhandlefumocfg input in atfwddaemon...

Code injection

Quectel EG25-G devices through 202006130814 allow executing arbitrary code remotely by using an AT command to place shell metacharacters in quectelhandlefumocfg input in atfwddaemon...

CVE-2021-31698

Quectel EG25-G devices through 202006130814 allow executing arbitrary code remotely by using an AT command to place shell metacharacters in quectelhandlefumocfg input in atfwddaemon...

CVE-2021-31698

CVE-2021-31698 affects Quectel EG25-G devices through 202006130814. The vulnerability allows remote code execution by sending AT commands that place shell metacharacters in quectel_handle_fumo_cfg input processed by atfwd_daemon, potentially executing as root. Multiple sources (NVD entry and vend...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

Code injection

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

CVE-2021-38599

CVE-2021-38599 affects WAL-G prior to version 1.1. In non-libSodium builds, WAL-G silently ignores the libsodium encryption key and uploads backups in plaintext, creating an information disclosure vulnerability. Affected software: WAL-G backup tool (used with PostgreSQL, MySQL/MariaDB, MS SQL Ser...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

Quectel EG25-G 操作系统命令注入漏洞

The Quectel EG25-G is a LTE Cat 4 wireless communication module from China Mobile Telecommunications Quectel designed for M2M and IoT applications. It utilizes 3GPP Rel. 11 LTE technology and supports a maximum downlink rate of 150Mbps and a maximum uplink rate of 50Mbps. An OS command injection...

WAL-G 代码问题漏洞

WAL-G is an archive recovery tool for PostgreSQL, MySQL/MariaDB and MS SQL Server MongoDB and Redis beta. A code issue vulnerability exists in WAL-G prior to 1.1, which stems from a lack of checking for the existence of libsodium keys in non-libsodium builds...

Geutebrück G-Cam E2 和 G-Code 缓冲区错误漏洞

Geutebrück G-Cam E2 is a camera from manualslib.Geutebrück G-Code is an analog video encoder module from Geutebrück, Germany. A buffer error vulnerability exists in the Geutebrück G-Cam E2 and G-Code that stems from a stack-based buffer overflow in the name parameter. This could allow an attacker...

Geutebrück G-Cam E2 和 G-Code 缓冲区错误漏洞

Geutebrück G-Cam E2 is a camera from manualslib.Geutebrück G-Code is an analog video encoder module from Geutebrück, Germany. A buffer error vulnerability exists in the Geutebrück G-Cam E2 and G-Code that stems from a stack-based buffer overflow in the counter parameter. This could allow an...

Geutebrück G-Cam E2 操作系统命令注入漏洞

Geutebrück G-Cam E2 is a camera from manualslib. The Geutebrück G-Cam E2 suffers from an operating system command injection vulnerability that stems from the susceptibility of affected products to command injection attacks. An attacker can exploit this vulnerability to remotely execute arbitrary...