Stack overflow

The LAN-side Web-Configuration Interface has Stack-based Buffer Overflow vulnerability in the D-Link Wi-Fi router firmware DIR-890L DIR890LA1FW107b09.bin and previous versions. The function created at 0x17958 of /htdocs/cgibin will call sprintf without checking the length of strings in parameters...

PT-2022-3311 · D Link · D-Link Dir-890L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-890L versions prior to DIR890LA1 FW107b09.bin Description: The issue is related to a stack-based buffer overflow vulnerability in the LAN-side Web-Configuration Interface of the D-Link Wi-Fi router firmware. This vulnerability is...

CVE-2022-22309

The POWER systems FSP is vulnerable to unauthenticated logins through the serial port/TTY interface. This vulnerability can be more critical if the serial port is connected to a serial-over-lan device. IBM X-Force ID: 217095...

Design/Logic Flaw

The POWER systems FSP is vulnerable to unauthenticated logins through the serial port/TTY interface. This vulnerability can be more critical if the serial port is connected to a serial-over-lan device. IBM X-Force ID: 217095...

CVE-2022-22309

Summary: CVE-2022-22309 affects IBM POWER systems, where the firmware service processor (FSP) is vulnerable to unauthenticated logins via the physical serial port/TTY interface. Root cause/impact: Unauthenticated access could allow login through the serial interface, with CVSS v3.1/3.0 vectors in...

CVE-2022-22309

The POWER systems FSP is vulnerable to unauthenticated logins through the serial port/TTY interface. This vulnerability can be more critical if the serial port is connected to a serial-over-lan device. IBM X-Force ID: 217095...

VulnCheck KEV: CVE-2022-26925

Microsoft Windows Local Security Authority LSA contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM...

CANs Reinvent LANs for an All-Local World

In an article I wrote over a year ago called “Securing the New Normal of Network Access,” I presented four access scenarios that modern organizations needed to enable users to stay securely connected and protected in the new normal of a work-from-anywhere world. Of course, “new” is a relative ter...

PT-2022-3135 · Microsoft · File Server Shadow Copy Agent Service +1

Name of the Vulnerable Software and Affected Versions: Microsoft File Server Shadow Copy Agent Service RVSS affected versions not specified Description: The issue is related to insufficient access restrictions in the Microsoft File Server Shadow Copy Agent Service RVSS, which can be exploited by ...

UBUNTU-CVE-2022-24882

FreeRDP is a free implementation of the Remote Desktop Protocol RDP. In versions prior to 2.7.0, NT LAN Manager NTLM authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. Th...

CVE-2022-21742

Realtek USB driver has a buffer overflow vulnerability due to insufficient parameter length verification in the API function. An unauthenticated LAN attacker can exploit this vulnerability to disrupt services...

FreeRDP 安全漏洞

FreeRDP is an open source implementation of the Remote Desktop Protocol RDP from the FreeRDP team. A security vulnerability exists in FreeRDP that stems from the fact that in versions prior to 2.7.0, NT LAN Manager NTLM authentication does not abort correctly when someone provides and empty...

Cisco Wireless LAN Controller Authentication Bypass (cisco-sa-wlc-auth-bypass-JRNhV4fF)

An authentication bypass vulnerability exists in the authentication functionality of Cisco Wireless LAN Controller WLC due to the improper implementation of the password validation algorithm. An unauthenticated, remote attacker can exploit this by logging in to an affected device with crafted...

ZOHO ManageEngine ADSelfService Plus 安全漏洞

An information disclosure exists in Zoho ManageEngine ADSelfService Plus, ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. A vulnerability exists in Zoho ManageEngine ADSelfService Plus, which stems from the disclosure of...

CVE-2022-20695

A vulnerability in the authentication functionality of Cisco Wireless LAN Controller WLC Software could allow an unauthenticated, remote attacker to bypass authentication controls and log in to the device through the management interface This vulnerability is due to the improper implementation of...

CVE-2022-20695

CVE-2022-20695 affects Cisco Wireless LAN Controller (WLC) software. The issue is an authentication bypass caused by improper password validation, allowing an unauthenticated, remote attacker to log in via the management interface and gain administrator privileges. The vulnerability requires a no...

CVE-2022-20695 Cisco Wireless LAN Controller Management Interface Authentication Bypass Vulnerability

A vulnerability in the authentication functionality of Cisco Wireless LAN Controller WLC Software could allow an unauthenticated, remote attacker to bypass authentication controls and log in to the device through the management interface This vulnerability is due to the improper implementation of...

CVE-2022-20695 Cisco Wireless LAN Controller Management Interface Authentication Bypass Vulnerability

A vulnerability in the authentication functionality of Cisco Wireless LAN Controller WLC Software could allow an unauthenticated, remote attacker to bypass authentication controls and log in to the device through the management interface This vulnerability is due to the improper implementation of...

Critical Auth Bypass Bug Reported in Cisco Wireless LAN Controller Software

Cisco has released patches to contain a critical security vulnerability affecting the Wireless LAN Controller WLC that could be abused by an unauthenticated, remote attacker to take control of an affected system. Tracked as CVE-2022-20695, the issue has been rated 10 out of 10 for severity and...

PT-2022-19521 · Notable +1 · Notable +1

Name of the Vulnerable Software and Affected Versions: Notable versions prior to 1.9.0-beta.8 Description: The issue arises from improper validation of the file URI scheme, allowing the opening of executable files when clicking on a link. This could lead to the execution of an arbitrary program o...