CVE-2022-32226

An improper access control vulnerability exists in Rocket.Chat v5, v4.8.2 and v4.7.5 due to input data in the getUsersOfRoom Meteor server method is not type validated, so that MongoDB query operator objects are accepted by the server, so that instead of a matching rid String a$regex query can be...

Tenda AC21 setSmartPowerManagement Function Buffer Overflow Vulnerability

The Tenda AC21 is a wireless router from the Chinese company Tenda. A buffer overflow vulnerability exists in Tenda AC21 version V16.03.08.15, which originates from a lack of length checking of input data in the setSmartPowerManagement function of /bin/httpd, which can be exploited to cause httpd...

Tenda AC21 saveParentControlInfo function buffer overflow vulnerability

The Tenda AC21 is a wireless router from the Chinese company Tenda. A buffer overflow vulnerability exists in Tenda AC21 version V16.03.08.15, which originates from the lack of length checking of input data in the saveParentControlInfo function of /bin/httpd, and can be exploited to cause httpd t...

Tenda AC21 fromSetWifiGusetBasic function buffer overflow vulnerability

The Tenda AC21 is a wireless router from the Chinese company Tenda. A buffer overflow vulnerability exists in Tenda AC21 version V16.03.08.15, which stems from the lack of length checking of input data in the fromSetWifiGusetBasic function of /bin/httpd, which can be exploited to cause httpd to...

The vulnerability of the Mozilla Firefox browser for Windows, related to errors in processing input data, allows a hacker to execute arbitrary code.

The vulnerability of the Mozilla Firefox browser for Windows is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the TCP/IP protocol implementation in Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the TCP/IP protocol implementation in Windows operating systems is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2022-4787 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows versions prior to the fixed version Description: The vulnerability is related to errors in handling input data in the implementation of the TCP/IP protocol in Windows operating systems. This issue allows a remote attacker to execute...

CVE-2022-38400

Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to access a specially crafted URL...

CVE-2022-38400

Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to access a specially crafted URL...

PT-2022-4659

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.18.6 Go versions 1.19.x prior to 1.19.1 Description The issue is related to the net/http package in Go, where an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error, leading to a denial ...

SYNCK GRAPHICA Mailform Pro CGI vulnerable to information disclosure

Overview Mailform Pro CGI provided by SYNCK GRAPHICA contains an information disclosure vulnerability CWE-200. Thanks module of this product saves user input data for a certain period of time. The time is set to 30 seconds by default in configs/thanks.cgi file. To exploit this vulerability, it is...

SYNCK GRAPHICA Mailform Pro CGI 信息泄露漏洞

SYNCK GRAPHICA Mailform Pro CGI is a mail form from SYNCK GRAPHICA Japan. It can be used as a multiple transmission, questionnaire form, and application form. A security vulnerability exists in SYNCK GRAPHICA Mailform Pro CGI prior to version 4.3.1, which stems from the Thanks module saving user...

The vulnerability in the implementation of the Matrix protocol for Thunderbird email clients allows a perpetrator to carry out a DoS attack.

The vulnerability of the Thunderbird email client’s Matrix protocol is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute a DoS attack...

PT-2022-4593 · Weave · Weave Gitops Enterprise

Name of the Vulnerable Software and Affected Versions: Weave GitOps Enterprise versions prior to 0.9.0-rc.5 Description: The issue is related to a lack of input data sanitization, which can be exploited by a remote attacker to conduct a cross-site scripting XSS attack using a specially crafted...

The vulnerability of the Thunderbird email client, related to errors in processing input data, allows a hacker to execute arbitrary JavaScript code.

The vulnerability of the Thunderbird email client is related to errors in processing input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code by sending a specially crafted HTML email with a meta tag set to “refresh”...

The vulnerability of the Ping_addr function in D-Link DIR810LA1FW102B22 microprogrammed router software allows a hacker to execute arbitrary code. [source-iocs-preserved const=DIR810LA1_FW102B22]

The vulnerability of the Pingaddr function in D-Link DIR810LA1FW102B22 microprogrammed router software is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code. source-iocs-preserved const=DIR810LA1FW102B2...

The vulnerability of the mySCADA myPRO system for visualizing and controlling industrial processes, related to the lack of measures for cleaning input data, allows a intruder to execute arbitrary commands.

The vulnerability of the mySCADA myPRO industrial process visualization and control system is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the Office Online Server web server, related to insufficient validation of input data, allows attackers to execute arbitrary code.

The vulnerability of the Office Online Server web server is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to execute arbitrary code on the target system...

Vulnerability of microprogramming software for Siemens STEP 7 programmable logic controllers, systems for manufacturing process control such as Opcenter Execution Discrete, Opcenter Execution Process, Opcenter Execution Foundation, Opcenter Intelligence, Opcenter Quality, SIMATIC IT Production Suite, the system diagnostic tool SIMOCODE ES, the software for parameterizing, diagnosing, and documenting the startup status of SIRIUS Soft Starter ES, technological process management systems like SIMATIC PCS neo, the Opcenter RD&L software platform, and the software for analyzing equipment efficiency and key indicators like SIMATIC IT LMS. These vulnerabilities allow attackers to trigger malfunctions during maintenance operations due to insufficient input data verification.

The vulnerabilities of the microprogramming software for Siemens STEP 7 programmable logic controllers, the systems for managing production processes such as Opcenter Execution Discrete, Opcenter Execution Process, Opcenter Execution Foundation, Opcenter Intelligence, Opcenter Quality, SIMATIC IT...

Microsoft Azure Site Recovery Remote Code Execution Vulnerability (CNVD-2022-84112)

Microsoft Azure Site Recovery is a site recovery DRaaS from Microsoft Corporation for cloud and hybrid cloud architectures. The vulnerability stems from the failure of a network system or product to properly filter special elements of code segments during the construction of external input data. ...