GitLab 15.3 < 15.7.8 / 15.8 < 15.8.4 / 15.9 < 15.9.2 (CVE-2022-4289)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab affecting all versions starting from 15.3 before 15.7.8, versions of 15.8 before 15.8.4, and version 15.9 before 15.9.2. Google IAP details in Prometheus...

CVE-2022-3203

On ORing net IAP-420+ with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot...

CVE-2022-3203

On ORing net IAP-420+ with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot...

Hardcoded credentials

On ORing net IAP-420+ with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot...

CVE-2022-3203 ORing net IAP-420(+) Hidden Functionality

On ORing net IAP-420+ with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot...

CVE-2022-3203

The CVE-2022-3203 issue affects ORing Net IAP-420(+) with firmware 2.0m. The root cause is a telnet server that is enabled by default and cannot be permanently disabled, permitting access via LAN/WiFi with hardcoded credentials that reset to defaults on every reboot. This yields an administrative...

CVE-2022-36839

SQL injection vulnerability via IAPService in Samsung Checkout prior to version 5.0.53.1 allows attackers to access IAP information...

CVE-2022-36839

SQL injection vulnerability via IAPService in Samsung Checkout prior to version 5.0.53.1 allows attackers to access IAP information...

PT-2022-23643 · Samsung · Samsung Checkout

Name of the Vulnerable Software and Affected Versions: Samsung Checkout versions prior to 5.0.53.1 Description: The issue allows attackers to access IAP information via SQL injection vulnerability in the IAPService of Samsung Checkout. Recommendations: For versions prior to 5.0.53.1, update to...

SAMSUNG Checkout SQL注入漏洞

SAMSUNG Checkout is a checkout system from Samsung South Korea. A security vulnerability exists in SAMSUNG Checkout versions prior to 5.0.53.1, which stems from an SQL injection vulnerability in IAPService that can be exploited by an attacker to access IAP information...

CVE-2021-37732

A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant IAP versions: Aruba Instant 6.4.x.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x.x: 6.5.4.18 and below; Aruba Instant 8.5.x.x: 8.5.0.11 and below; Aruba Instant 8.6.x.x: 8.6.0.6 and below; Aruba Instant...

CVE-2021-37730

CVE-2021-37730 concerns a remote arbitrary command execution in HPE Aruba Instant (IAP). The vulnerability affects Aruba Instant versions across 6.4.x, 6.5.x, 8.5.x, 8.6.x and 8.7.x (as listed in the NVD entry). The 4.2.x ENISA/ICS/CISA-style documentation describes multiple vectors: a command-in...

CVE-2021-37726

CVE-2021-37726 : A remote buffer overflow vulnerability in HPE Aruba Instant (IAP) affects Aruba Instant 8.7.x.x, specifically 8.7.0.0 through 8.7.1.2. The issue originates from a memory buffer overflow in the product’s components (as described in multiple sources) and allows unauthenticated remo...

CVE-2021-34618

A remote denial of service DoS vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.4.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.4.x: All versions; Aruba...

CVE-2021-34618

CVE-2021-34618 affects Aruba Instant IAP devices. A DoS exists across multiple lines and versions (e.g., Aruba Instant 6.4.x up to 6.4.4.8-4.2.4.18; 6.5.x up to 6.5.4.18; 8.3.x up to 8.3.0.14; 8.4.x all versions; 8.5.x up to 8.5.0.11; 8.6.x up to 8.6.0.7; 8.7.x up to 8.7.1.1). Aruba has released ...

CVE-2021-34617

Aruba Instant IAP products are affected by a remote cross-site scripting (XSS) vulnerability (CVE-2021-34617) in the web management interface. Affected versions include Aruba Instant 6.4.x up to 6.4.4.8-4.2.4.13 and below; 6.5.x up to 6.5.4.13 and below; 8.3.x up to 8.3.0.7; 8.4.x up to 8.4.0.5; ...

CVE-2021-32701

ORY Oathkeeper’s CVE-2021-32701 describes an issue in the oauth2_introspection cache where a second request for a different scope (bar) could be treated as valid even if the new scope wasn’t granted, due to the cache not validating scopes beyond expiration. The root cause is that tokenFromCache i...

CVE-2021-25161

A remote cross-site scripting xss vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below;...

CVE-2021-25157

A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba...

CVE-2021-25160

A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below...