Linux Distros Unpatched Vulnerability : CVE-2022-33099

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in the component luaGrunerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs. CVE-2022-33099 Note that Nessus...

Linux Distros Unpatched Vulnerability : CVE-2021-44647

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service. CVE-2021-44647...

Linux Distros Unpatched Vulnerability : CVE-2022-24735

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior t...

Linux Distros Unpatched Vulnerability : CVE-2022-28805

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - singlevar in lparser.c in Lua from including 5.4.0 up to excluding 5.4.4 lacks a certain luaKexp2anyregup call, leading to a heap-based buffer over-read that...

Linux Distros Unpatched Vulnerability : CVE-2021-32672

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger'...

Malicious code in bindbc-lua (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c99a42c2ca94208dcdd6dd74e22b5b79b9b211d2afd1854339f31be90d6cd75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2032 Malicious code in bindbc-lua (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c99a42c2ca94208dcdd6dd74e22b5b79b9b211d2afd1854339f31be90d6cd75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the apcli_wps_gen_pincode() function in the mtkwifi.lua script of the TOTOLINK X5000R router’s software allows a hacker to execute arbitrary commands.

The vulnerability of the apcliwpsgenpincode function in the mtkwifi.lua script of the TOTOLINK X5000R router’s software is related to the lack of measures taken to secure input data at the control level. Exploiting this vulnerability could allow an attacker to execute arbitrary commands remotely...

CVE-2025-25605

Totolink X5000R V9.1.0u.6369B20230113 is vulnerable to command injection via the apcliwpsgenpincode function in mtkwifi.lua...

OESA-2025-1157 redis security update

Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets. Security Fixes: Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing i...

PT-2025-7559 · Totolink · Totolink X5000R

Name of the Vulnerable Software and Affected Versions: Totolink X5000R version 9.1.0u.6369 B20230113 Description: The issue concerns a command injection vulnerability via the vif disable function in mtkwifi.lua. Recommendations: For Totolink X5000R version 9.1.0u.6369 B20230113, as a temporary...

Azure Linux 3.0 Security Update: lua / memcached / ntopng (CVE-2021-44647)

The version of lua / memcached / ntopng installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-44647 advisory. - Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function i...

CBL Mariner 2.0 Security Update: lua / memcached / ntopng (CVE-2021-43519)

The version of lua / memcached / ntopng installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-43519 advisory. - Stack overflow in luaresume of ldo.c in Lua Interpreter 5.1.05.4.4 allows attackers to...

Azure Linux 3.0 Security Update: lua / memcached / ntopng (CVE-2021-43519)

The version of lua / memcached / ntopng installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-43519 advisory. - Stack overflow in luaresume of ldo.c in Lua Interpreter 5.1.05.4.4 allows attackers to...

CVE-2025-25605

The TOTOLINK X5000R router, running firmware version V9.1.0u.6369_B20230113 , is vulnerable to a command injection flaw. The vulnerability originates from the apcli_wps_gen_pincode function within the mtkwifi.lua script, caused by a lack of sufficient input data security measures at the control l...

CVE-2025-25605

Totolink X5000R V9.1.0u.6369B20230113 is vulnerable to command injection via the apcliwpsgenpincode function in mtkwifi.lua...

CVE-2024-31714

Buffer Overflow vulnerability in Waxlab wax v.0.9-3 and before allows an attacker to cause a denial of service via the Lua library component...

RockyLinux 8 : redis:6 (RLSA-2025:0595)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:0595 advisory. redis: Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER commands may lead to denial-of-service CVE-2023-22458 redis: Integer overflow in the Redi...

RLSA-2025:0595 Important: redis:6 security update

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, ...

CVE-2025-26361

A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to factory reset the device via crafted HTTP requests...