SSRF in repository migration

Gogs is a self-hosted Git service. The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected. Internal network CIDRs are prohibited to be used as repository migration targets. Users...

GHSA-7V5R-R995-Q2X2 SSRF in repository migration

Gogs is a self-hosted Git service. The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected. Internal network CIDRs are prohibited to be used as repository migration targets. Users...

PT-2022-13488 · Gogs · Gogs

Name of the Vulnerable Software and Affected Versions: gogs versions prior to 0.12.5 Description: The issue is related to Server-Side Request Forgery SSRF in the repository migration functionality of gogs. This allows a malicious user to discover services in the internal network. All installation...

CVE-2020-36517

An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowledge about internal network resources via the hardcoded DNS resolver configuration...

Home Assistant 安全漏洞

Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. A security vulnerability exists in the Home Assistant Operating System and Supervised that allows a DNS operator to gain knowledge about internal network resources...

CVE-2020-36517

An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowledge about internal network resources via the hardcoded DNS resolver configuration...

NSA Releases Network Infrastructure Security Guidance

The National Security Agency NSA has released a new Cybersecurity Technical Report CTR: Network Infrastructure Security Guidance. The report captures best practices based on the depth and breadth of experience in supporting customers and responding to threats. Recommendations include perimeter an...

PT-2022-13242 · Unknown +1 · @Uppy/Companion +1

Name of the Vulnerable Software and Affected Versions: uppy versions prior to 3.3.1 @uppy/companion versions prior to 3.3.1 Description: The issue allows for exposure of sensitive information to an unauthorized actor. It also enables incorrect authorization, where a user with URL upload access...

Alecto DVC-215IP Information Disclosure Vulnerability

Alecto DVC-215IP is a camera from Alecto.Alecto DVC-215IP 63.1.1.173 and earlier versions are vulnerable to an information disclosure vulnerability that stems from the camera's Wi-Fi password phrase being hidden, but by editing to remove the style of the password field, the password becomes visib...

CVE-2022-24610

Settings/network settings/wireless settings on the Alecto DVC-215IP camera version 63.1.1.173 and below shows the Wi-Fi passphrase hidden, but by editing/removing the style of the password field the password becomes visible which grants access to an internal network connected to the camera...

CVE-2022-24610

Settings/network settings/wireless settings on the Alecto DVC-215IP camera version 63.1.1.173 and below shows the Wi-Fi passphrase hidden, but by editing/removing the style of the password field the password becomes visible which grants access to an internal network connected to the camera...

CVE-2022-24610

Settings/network settings/wireless settings on the Alecto DVC-215IP camera version 63.1.1.173 and below shows the Wi-Fi passphrase hidden, but by editing/removing the style of the password field the password becomes visible which grants access to an internal network connected to the camera...

Default credentials

Settings/network settings/wireless settings on the Alecto DVC-215IP camera version 63.1.1.173 and below shows the Wi-Fi passphrase hidden, but by editing/removing the style of the password field the password becomes visible which grants access to an internal network connected to the camera...

Alecto DVC-215IP安全漏洞

Alecto DVC-215IP is a camera from Alecto.Alecto DVC-215IP 63.1.1.173 and earlier versions are vulnerable to an information disclosure vulnerability that stems from the camera's Wi-Fi password phrase being hidden, but by editing to remove the style of the password field, the password becomes visib...

Harbor is vulnerable to a limited Server-Side Request Forgery (SSRF) (CVE-2020-13788)

Impact Matt Hamilton from Soluble has discovered a limited Server-Side Request Forgery SSRF that allowed Harbor project owners to scan the TCP ports of hosts on the Harbor server's internal network. The vulnerability was immediately fixed by the Harbor team. Issue The “Test Endpoint” API, part of...

Exploit for Path Traversal in Mikrotik Routeros

Ladon Scanner For Golang Wiki http://k8gege.org/Ladon/LadonGo.html 简介...

CVE-2021-44746

UNIVERGE DT 820 V3.2.7.0 and prior, UNIVERGE DT 830 V5.2.7.0 and prior, UNIVERGE DT 930 V2.4.0.0 and prior, IP Phone Manager V8.9.1 and prior, Data Maintenance Tool for DT900 Series V5.3.0.0 and prior, Data Maintenance Tool for DT800 Series V4.2.0.0 and prior allows a remote attacker who can acce...

Information disclosure

UNIVERGE DT 820 V3.2.7.0 and prior, UNIVERGE DT 830 V5.2.7.0 and prior, UNIVERGE DT 930 V2.4.0.0 and prior, IP Phone Manager V8.9.1 and prior, Data Maintenance Tool for DT900 Series V5.3.0.0 and prior, Data Maintenance Tool for DT800 Series V4.2.0.0 and prior allows a remote attacker who can acce...

CVE-2021-44746

CVE-2021-44746 affects NEC UNIVERGE IP Phone DT series and related tools: UNIVERGE DT 820 (3.2.7.0 and earlier), DT 830 (5.2.7.0 and earlier), DT 930 (2.4.0.0 and earlier), IP Phone Manager (8.9.1 and earlier), Data Maintenance Tool for DT900 (5.3.0.0 and earlier) and DT800 (4.2.0.0 and earlier)....

CVE-2021-22799

A CWE-331: Insufficient Entropy vulnerability exists that could cause unintended connection from an internal network to an external network when an attacker manages to decrypt the SESU proxy password from the registry. Affected Product: Schneider Electric Software Update, V2.3.0 through V2.5.1...