TOTOLINK A7000R 缓冲区错误漏洞

TOTOLINK A7000R is a wireless router from China's Gion Electronics TOTOLINK. A security vulnerability exists in TOTOLINK A7000R version V9.1.0u.6115B20201022, which stems from a stack overflow in the ip parameter of the setDiagnosisCfg method...

WordPress plugin Web Application Firewall 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

H3C H200 缓冲区错误漏洞

The H3C H200 is a type of full gigabit home smart hub from China's Xinhua San H3C. A security vulnerability exists in the H3C H200 H200V100R004 version that stems from a stack overflow in the UpdateIpv6Params method...

August 25, 2022—KB5016691 (OS Build 22000.918) Preview

None None...

PT-2022-23798 · Totolink · Totolink A7000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A7000R version 9.1.0u.6115 B20201022 Description: A command injection issue was found via the ip parameter at the setDiagnosisCfg function. Recommendations: For version 9.1.0u.6115 B20201022, consider restricting access to the...

CVE-2021-3905

A memory leak was found in Open vSwitch OVS during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments...

CVE-2022-2362

The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTEADDR, which makes it possible to bypass IP-based download blocking restrictions...

PT-2022-8878 · Unknown · Cluster-Ingress-Operator

Name of the Vulnerable Software and Affected Versions: cluster-ingress-operator affected versions not specified Description: A flaw was found in the cluster-ingress-operator, related to how the router-default service allows only certain IP source ranges. This could allow an attacker to access...

GHSA-2FVV-QXRQ-7JQ6 apollo-server-core vulnerable to URL-based XSS attack affecting IE11 on default landing page

Impact The default landing page contained HTML to display a sample curl command which is made visible if the full landing page bundle could not be fetched from Apollo's CDN. The server's URL is directly interpolated into this command inside the browser from window.location.href. On some older...

washingtoninternetdaily.com Cross Site Scripting vulnerability OBB-2847816

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Apache HTTPD: Multiple Vulnerabilities

Background The Apache HTTP server is one of the most popular web servers on the Internet. Description Multiple vulnerabilities have been discovered in Apache HTTPD. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

Internet Bug Bounty: Pause-based desync in Apache HTTPD

Apache was vulnerable to a pause-based desync. This vulnerability is described in detail in my whitepaper here: https://portswigger.net/research/browser-powered-desync-attackspause Impact This enables server-side HTTP Request Smuggling when Apache is deployed as a back-end server, and it also...

smartinternet.com.au Cross Site Scripting vulnerability OBB-2837713

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Meet Tim Vereecke: Technical Solutions Architect

Tim Vereecke, technical solutions architect at Akamai, discusses how he uses a developer-first mindset to find internet performance solutions...

Now it's BlenderBot's turn to make shocking, inappropriate, and untrue remarks

Last Friday, Meta unveiled its new BlenderBot 3 AI chatbot, a conversational AI prototype. The company said its chatbot is designed to learn by having natural conversations with people online. It also improves its skills via human feedback. Meta also asserts with confidence that the more the AI...

Malicious code in magic-internet-money (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3065bd17ca30e939b9bf955fa81882d1780a378815a851b615d44f5c042df38f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4449 Malicious code in magic-internet-money (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3065bd17ca30e939b9bf955fa81882d1780a378815a851b615d44f5c042df38f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress plugin Adminer Login has an unspecified vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin Adminer Login version 1.4.4 contains a security vulnerability that can be exploited by...

PT-2022-6332 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux Kernel affected versions not specified Description: A vulnerability was found in the Linux Kernel, affecting the vsock connect function of the net/vmw vsock/af vsock.c file. This issue is related to incorrect handling of socket block...

Internet Bug Bounty: CVE-2022-35948: CRLF Injection in Nodejs ‘undici’ via Content-Type

undici library should be protects HTTP headers from CRLF injection vulnerabilities. However, CRLF injection exists in the ‘content-type’ header of undici.request api. Impact = [email protected] users are vulnerable to CRLF Injection on headers when using unsanitized input as request headers, more...